52a157f187
Chart 0.6.1's fullnameOverride attempted to give ESO resources stable
names (just 'external-secrets' instead of '<release>-external-secrets')
but ArgoCD couldn't fully drain the prefixed resources from 0.6.0,
leaving sync stuck. Reverting: keep the subchart's default release-
prefixed naming, template the SA reference in ClusterSecretStore via
{{ .Release.Name }}-external-secrets so it resolves correctly per
cluster.
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
{{- if .Values.externalSecrets.enabled }}
|
|
{{- if .Values.externalSecrets.openbao.mountPath }}
|
|
# ClusterSecretStore — single store per cluster, namespace-spanning so a
|
|
# tenants-namespace ExternalSecret can also reference it (current Phase 1
|
|
# scope only writes to odoosky-system, but downstream phases will fan to
|
|
# tenants ns for s3-backup-creds).
|
|
#
|
|
# auth.kubernetes.mountPath is per-cluster (Tower passes
|
|
# `kubernetes-<cluster-name>` as a helm parameter). Each cluster
|
|
# authenticates against its own OpenBao auth mount, with the
|
|
# `eso-platform-read` policy bound to the role. ServiceAccount
|
|
# `external-secrets` is created by the ESO subchart in odoosky-system.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-platform
|
|
labels:
|
|
app.kubernetes.io/managed-by: cluster-platform-v3
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: {{ .Values.externalSecrets.openbao.server | quote }}
|
|
path: "v3"
|
|
version: "v2"
|
|
auth:
|
|
kubernetes:
|
|
mountPath: {{ .Values.externalSecrets.openbao.mountPath | quote }}
|
|
role: {{ .Values.externalSecrets.openbao.role | default "eso" | quote }}
|
|
serviceAccountRef:
|
|
# ESO subchart names its SA `<release>-external-secrets`
|
|
# (no fullnameOverride — see values.yaml). The OpenBao
|
|
# role's bound_service_account_names must match this
|
|
# exact name (e.g. `qsoft-platform-external-secrets`).
|
|
name: "{{ .Release.Name }}-external-secrets"
|
|
namespace: odoosky-system
|
|
{{- end }}
|
|
{{- end }}
|