From 8a90756af02757474b4c3ea77f746b91c0008203 Mon Sep 17 00:00:00 2001
From: Ultradesu <ultradesu@hexor.cy>
Date: Sun, 18 Oct 2026 11:23:14 +0100
Subject: [PATCH] Restore authenticated secret reader in current cluster

---
 k8s-ng/core-state/values.yaml             |  6 +++++
 k8s/apps/k8s-secrets/app.yaml             | 21 ---------------
 k8s/apps/k8s-secrets/deployment.yaml      |  6 ++---
 k8s/apps/k8s-secrets/external-secret.yaml | 32 +++++++----------------
 k8s/apps/k8s-secrets/ingress.yaml         |  8 ++----
 k8s/apps/k8s-secrets/kustomization.yaml   |  9 +++++++
 k8s/apps/k8s-secrets/rbac.yaml            |  3 ++-
 7 files changed, 32 insertions(+), 53 deletions(-)
 delete mode 100644 k8s/apps/k8s-secrets/app.yaml
 create mode 100644 k8s/apps/k8s-secrets/kustomization.yaml

diff --git a/k8s-ng/core-state/values.yaml b/k8s-ng/core-state/values.yaml
index a79b19a..b42e696 100644
--- a/k8s-ng/core-state/values.yaml
+++ b/k8s-ng/core-state/values.yaml
@@ -75,6 +75,12 @@ apps:
     namespace: web-petting
     wave: 5
     skipDryRunOnMissingResource: true
+  - name: k8s-secrets
+    project: apps
+    path: k8s/apps/k8s-secrets
+    namespace: k8s-secret
+    wave: 6 # after secret-stores and auth-proxy
+    skipDryRunOnMissingResource: true
   - name: llamacpp
     project: apps
     path: k8s-ng/apps/llamacpp
diff --git a/k8s/apps/k8s-secrets/app.yaml b/k8s/apps/k8s-secrets/app.yaml
deleted file mode 100644
index 67d13ba..0000000
--- a/k8s/apps/k8s-secrets/app.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: k8s-secrets
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: k8s-secret
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/k8s-secrets
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-
diff --git a/k8s/apps/k8s-secrets/deployment.yaml b/k8s/apps/k8s-secrets/deployment.yaml
index 05f894d..99b06f5 100644
--- a/k8s/apps/k8s-secrets/deployment.yaml
+++ b/k8s/apps/k8s-secrets/deployment.yaml
@@ -16,11 +16,12 @@ spec:
     spec:
       serviceAccountName: secret-reader
       nodeSelector:
-        kubernetes.io/os: linux
+        homelab.hexor.cy/pool: core
+        homelab.hexor.cy/exposure: external
       containers:
       - name: secret-reader
         image: ultradesu/k8s-secrets:0.2.1
-        imagePullPolicy: Always
+        imagePullPolicy: IfNotPresent
         args:
           - "--secrets"
           - "openai-creds"
@@ -28,7 +29,6 @@ spec:
           - "k8s-secret"
           - "--port"
           - "3000"
-          - "--webhook"
         ports:
         - containerPort: 3000
           name: http
diff --git a/k8s/apps/k8s-secrets/external-secret.yaml b/k8s/apps/k8s-secrets/external-secret.yaml
index b138869..987be04 100644
--- a/k8s/apps/k8s-secrets/external-secret.yaml
+++ b/k8s/apps/k8s-secrets/external-secret.yaml
@@ -1,44 +1,32 @@
----
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: openai-creds
 spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vaultwarden-login
   target:
     name: openai-creds
     deletionPolicy: Delete
     template:
       type: Opaque
       data:
-        USER: |-
-          {{ .user }}
-        PASS: |-
-          {{ .pass }}
-        TOTP: |-
-          {{ .totp }}
+        USER: "{{ .user }}"
+        PASS: "{{ .pass }}"
+        TOTP: "{{ .totp }}"
   data:
     - secretKey: user
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
       remoteRef:
-        key: a485f323-fd47-40ee-a5cf-40891b1f963c
+        key: k8s/openai/creds
         property: login.username
     - secretKey: pass
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
       remoteRef:
-        key: a485f323-fd47-40ee-a5cf-40891b1f963c
+        key: k8s/openai/creds
         property: login.password
     - secretKey: totp
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
       remoteRef:
-        key: a485f323-fd47-40ee-a5cf-40891b1f963c
+        key: k8s/openai/creds
         property: login.totp
 
diff --git a/k8s/apps/k8s-secrets/ingress.yaml b/k8s/apps/k8s-secrets/ingress.yaml
index 759e65b..799641d 100644
--- a/k8s/apps/k8s-secrets/ingress.yaml
+++ b/k8s/apps/k8s-secrets/ingress.yaml
@@ -5,12 +5,8 @@ metadata:
   name: auth-proxy
 spec:
   forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
+    address: http://auth-proxy.keycloak.svc:80/auth
+    trustForwardHeader: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
diff --git a/k8s/apps/k8s-secrets/kustomization.yaml b/k8s/apps/k8s-secrets/kustomization.yaml
new file mode 100644
index 0000000..db361ed
--- /dev/null
+++ b/k8s/apps/k8s-secrets/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service-account.yaml
+  - rbac.yaml
+  - external-secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
diff --git a/k8s/apps/k8s-secrets/rbac.yaml b/k8s/apps/k8s-secrets/rbac.yaml
index c65d158..4744aaf 100644
--- a/k8s/apps/k8s-secrets/rbac.yaml
+++ b/k8s/apps/k8s-secrets/rbac.yaml
@@ -5,7 +5,8 @@ metadata:
 rules:
 - apiGroups: [""]
   resources: ["secrets"]
-  verbs: ["get", "list"]
+  resourceNames: ["openai-creds"]
+  verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding