Aleksandr Bogomiakov
7db427f332
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 20s
Move the Vaultwarden bridge and the ClusterSecretStores out of external-secrets into secret-stores (wave 4, after vaultwarden). A store key may be an item UUID or an item name used as a path (k8s/<namespace>/<what>), matched exactly.
48 lines
2.3 KiB
YAML
48 lines
2.3 KiB
YAML
# ClusterSecretStores in front of the Vaultwarden vault that belongs to the bot
|
|
# account (the vault holds server secrets only, nothing personal).
|
|
#
|
|
# `key` may be either
|
|
# - the item UUID (old style, changes whenever items are imported again), or
|
|
# - the item path: the item NAME, which by convention is the full path
|
|
# k8s/<namespace>/<what> e.g. k8s/cert-manager/cloudflare-api-token
|
|
# Names are looked up by exact match (a name that is a substring of another
|
|
# item name, login or URL is fine). Do not use double quotes in names.
|
|
#
|
|
# vaultwarden-login: `property` is a path inside the item: login.username,
|
|
# login.password, notes, fields[0].value, ...
|
|
# vaultwarden-fields: `property` is the NAME of a custom field of the item.
|
|
#
|
|
# data:
|
|
# - secretKey: password
|
|
# sourceRef:
|
|
# storeRef: {name: vaultwarden-login, kind: ClusterSecretStore}
|
|
# remoteRef:
|
|
# key: k8s/cert-manager/cloudflare-api-token
|
|
# property: login.password
|
|
#
|
|
# The bridge syncs the vault every couple of minutes, so a new item becomes
|
|
# visible to ESO after that.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vaultwarden-login
|
|
spec:
|
|
provider:
|
|
webhook:
|
|
url: 'http://bitwarden-cli.external-secrets.svc:8087/{{ if regexMatch "^[0-9a-fA-F-]{36}$" .remoteRef.key }}object/item/{{ .remoteRef.key }}{{ else }}list/object/items?search={{ .remoteRef.key }}{{ end }}'
|
|
headers:
|
|
Content-Type: application/json
|
|
result:
|
|
jsonPath: '{{ if regexMatch "^[0-9a-fA-F-]{36}$" .remoteRef.key }}$.data.{{ .remoteRef.property }}{{ else }}$.data.data[?@.name=="{{ .remoteRef.key }}"].{{ .remoteRef.property }}{{ end }}'
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vaultwarden-fields
|
|
spec:
|
|
provider:
|
|
webhook:
|
|
url: 'http://bitwarden-cli.external-secrets.svc:8087/{{ if regexMatch "^[0-9a-fA-F-]{36}$" .remoteRef.key }}object/item/{{ .remoteRef.key }}{{ else }}list/object/items?search={{ .remoteRef.key }}{{ end }}'
|
|
result:
|
|
jsonPath: '{{ if regexMatch "^[0-9a-fA-F-]{36}$" .remoteRef.key }}$.data.fields[?@.name=="{{ .remoteRef.property }}"].value{{ else }}$.data.data[?@.name=="{{ .remoteRef.key }}"].fields[?@.name=="{{ .remoteRef.property }}"].value{{ end }}'
|