Aleksandr Bogomiakov
8e4201621d
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Failing after 1m6s
132 lines
4.1 KiB
YAML
132 lines
4.1 KiB
YAML
# Bridge between External Secrets and Vaultwarden: `bw serve` logged in as the
|
|
# bot account. Needs the Secret bitwarden-cli (created by hand; the bot logs in
|
|
# with email + password, so keep password login enabled for it, i.e. no
|
|
# SSO_ONLY, or switch the image to API-key login):
|
|
# kubectl -n external-secrets create secret generic bitwarden-cli \
|
|
# --from-literal=BW_HOST=https://vw.hexor.cy \
|
|
# --from-literal=BW_USERNAME=<bot email> --from-literal=BW_PASSWORD=<password>
|
|
# Image source: Dockerfile-bitwarden-cli in this directory.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-cli
|
|
labels:
|
|
reloader.stakater.com/auto: "true"
|
|
app.kubernetes.io/instance: bitwarden-cli
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: RollingUpdate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
app.kubernetes.io/instance: bitwarden-cli
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
app.kubernetes.io/instance: bitwarden-cli
|
|
spec:
|
|
nodeSelector:
|
|
homelab.hexor.cy/pool: core
|
|
homelab.hexor.cy/exposure: external
|
|
kubernetes.io/arch: amd64
|
|
containers:
|
|
- name: bitwarden-cli
|
|
image: ultradesu/bitwarden-client:2025.12.1
|
|
imagePullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "300m"
|
|
limits:
|
|
memory: "512Mi"
|
|
# `bw sync` is bursty and was reaching the 1-core CFS quota.
|
|
# Keep the scheduler reservation modest, but allow short sync bursts.
|
|
cpu: "2"
|
|
env:
|
|
- name: BW_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-cli
|
|
key: BW_HOST
|
|
- name: BW_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-cli
|
|
key: BW_USERNAME
|
|
- name: BW_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-cli
|
|
key: BW_PASSWORD
|
|
ports:
|
|
- name: http
|
|
containerPort: 8087
|
|
protocol: TCP
|
|
livenessProbe:
|
|
# Syncs the vault and requires the bridge to be logged in: `bw serve` can
|
|
# lose its login (status "unauthenticated") while /sync still answers, and
|
|
# every lookup then fails with 500. Failing the probe restarts the pod.
|
|
exec:
|
|
command:
|
|
- sh
|
|
- -c
|
|
- >-
|
|
wget -q -O /dev/null --post-data='' http://127.0.0.1:8087/sync &&
|
|
wget -q -O - http://127.0.0.1:8087/status | grep -q '"status":"unlocked"'
|
|
initialDelaySeconds: 20
|
|
failureThreshold: 3
|
|
timeoutSeconds: 10
|
|
periodSeconds: 120
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 8087
|
|
initialDelaySeconds: 20
|
|
failureThreshold: 3
|
|
timeoutSeconds: 1
|
|
periodSeconds: 10
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 8087
|
|
initialDelaySeconds: 10
|
|
failureThreshold: 30
|
|
timeoutSeconds: 1
|
|
periodSeconds: 5
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-cli
|
|
labels:
|
|
app.kubernetes.io/instance: bitwarden-cli
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 8087
|
|
targetPort: http
|
|
protocol: TCP
|
|
name: http
|
|
selector:
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
app.kubernetes.io/instance: bitwarden-cli
|
|
---
|
|
# Only the External Secrets controller may talk to the bridge: it serves the whole vault.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: external-secret-2-bw-cli
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: bitwarden-cli
|
|
app.kubernetes.io/name: bitwarden-cli
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: external-secrets
|
|
app.kubernetes.io/name: external-secrets
|