Aleksandr Bogomiakov
99e1818572
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 24s
79 lines
1.8 KiB
YAML
79 lines
1.8 KiB
YAML
# Read-only access to the vaultwarden-db Secret in the psql namespace
|
|
# (see postgresql/databases/vaultwarden.yaml for the other half).
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: db-credentials-reader
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: SecretStore
|
|
metadata:
|
|
name: psql-credentials
|
|
spec:
|
|
provider:
|
|
kubernetes:
|
|
remoteNamespace: psql
|
|
server:
|
|
caProvider:
|
|
type: ConfigMap
|
|
name: kube-root-ca.crt
|
|
key: ca.crt
|
|
auth:
|
|
serviceAccount:
|
|
name: db-credentials-reader
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: vaultwarden-db-url
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: SecretStore
|
|
name: psql-credentials
|
|
target:
|
|
name: vaultwarden-db-url
|
|
template:
|
|
data:
|
|
DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/vaultwarden"
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: vaultwarden-db
|
|
property: username
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: vaultwarden-db
|
|
property: password
|
|
---
|
|
# Admin panel token (/admin). Generated once; read it with:
|
|
# kubectl -n vaultwarden get secret admin-token -o jsonpath='{.data.ADMIN_TOKEN}' | base64 -d
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
metadata:
|
|
name: admin-token
|
|
spec:
|
|
length: 48
|
|
digits: 10
|
|
symbols: 0
|
|
noUpper: false
|
|
allowRepeat: true
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: admin-token
|
|
spec:
|
|
refreshPolicy: CreatedOnce
|
|
target:
|
|
name: admin-token
|
|
template:
|
|
data:
|
|
ADMIN_TOKEN: "{{ .password }}"
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: Password
|
|
name: admin-token
|