Aleksandr Bogomiakov
ac8e5e127c
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 17s
147 lines
3.6 KiB
YAML
147 lines
3.6 KiB
YAML
# Read-only access to the Grafana database credentials in the psql namespace.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: db-credentials-reader
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-3"
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: SecretStore
|
|
metadata:
|
|
name: psql-credentials
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-2"
|
|
spec:
|
|
provider:
|
|
kubernetes:
|
|
remoteNamespace: psql
|
|
server:
|
|
caProvider:
|
|
type: ConfigMap
|
|
name: kube-root-ca.crt
|
|
key: ca.crt
|
|
auth:
|
|
serviceAccount:
|
|
name: db-credentials-reader
|
|
---
|
|
# A local break-glass account. OIDC remains the normal login path.
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
metadata:
|
|
name: grafana-admin
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-2"
|
|
spec:
|
|
length: 40
|
|
digits: 10
|
|
symbols: 0
|
|
noUpper: false
|
|
allowRepeat: true
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: grafana-admin
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
spec:
|
|
refreshPolicy: CreatedOnce
|
|
target:
|
|
name: grafana-admin
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
admin-user: admin
|
|
admin-password: "{{ .password }}"
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
name: grafana-admin
|
|
---
|
|
# Grafana's database credentials come from CNPG. OIDC credentials are read by
|
|
# stable Vaultwarden item and custom-field names, so imports and field ordering
|
|
# do not invalidate the references.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: grafana-env
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
spec:
|
|
refreshInterval: 1h
|
|
target:
|
|
name: grafana-env
|
|
deletionPolicy: Delete
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
GF_DATABASE_USER: "{{ .db_username }}"
|
|
GF_DATABASE_PASSWORD: "{{ .db_password }}"
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ .client_id }}"
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .client_secret }}"
|
|
data:
|
|
- secretKey: db_username
|
|
remoteRef:
|
|
key: grafana-db
|
|
property: username
|
|
- secretKey: db_password
|
|
remoteRef:
|
|
key: grafana-db
|
|
property: password
|
|
- secretKey: client_id
|
|
sourceRef:
|
|
storeRef:
|
|
name: vaultwarden-fields
|
|
kind: ClusterSecretStore
|
|
remoteRef:
|
|
key: k8s/prometheus/grafana-secrets
|
|
property: IDM Client ID
|
|
- secretKey: client_secret
|
|
sourceRef:
|
|
storeRef:
|
|
name: vaultwarden-fields
|
|
kind: ClusterSecretStore
|
|
remoteRef:
|
|
key: k8s/prometheus/grafana-secrets
|
|
property: IDM Client Secret
|
|
secretStoreRef:
|
|
kind: SecretStore
|
|
name: psql-credentials
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: alertmanager-telegram
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
spec:
|
|
refreshInterval: 1h
|
|
target:
|
|
name: alertmanager-telegram
|
|
deletionPolicy: Delete
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
bot-token: "{{ .bot_token }}"
|
|
chat-id: "{{ .chat_id }}"
|
|
data:
|
|
- secretKey: bot_token
|
|
sourceRef:
|
|
storeRef:
|
|
name: vaultwarden-fields
|
|
kind: ClusterSecretStore
|
|
remoteRef:
|
|
key: k8s/prometheus/grafana-secrets
|
|
property: TG Token
|
|
- secretKey: chat_id
|
|
sourceRef:
|
|
storeRef:
|
|
name: vaultwarden-fields
|
|
kind: ClusterSecretStore
|
|
remoteRef:
|
|
key: k8s/prometheus/grafana-secrets
|
|
property: TG ID
|