c26ee5b3c6
Phase 2 of Item #9. Adds ExternalSecret manifests for: - docker-mirror-pull (×2 namespaces, dockerconfigjson template) - cloudflare-api-token-<slug> (per-tenant, gated on tenant.id+slug) - s3-backup-creds (per-tenant, in tenants ns) - longhorn-s3-creds (per-tenant, gated on tenant.s3Endpoint) New helm values: tenant.id, tenant.slug, tenant.s3Endpoint. Tower must pass these per-cluster (next ship). All manifests gated on externalSecrets.enabled + mountPath set + tenant.id set, so old apps without the new params remain on the legacy Tower-stamped path until the operator opts them in.
47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
{{- if .Values.externalSecrets.enabled }}
|
|
{{- if .Values.externalSecrets.openbao.mountPath }}
|
|
# docker-mirror-pull — platform-wide registry credential. Two ExternalSecrets
|
|
# (one per namespace the chart consumes the Secret in) sourced from the same
|
|
# OpenBao path. Type kubernetes.io/dockerconfigjson rendered via ESO template
|
|
# from the registry/username/password fields stored in OpenBao.
|
|
{{- range $ns := list "odoosky-system" "tenants" }}
|
|
---
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: docker-mirror-pull
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
app.kubernetes.io/managed-by: cluster-platform-v3
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
name: openbao-platform
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: docker-mirror-pull
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
engineVersion: v2
|
|
data:
|
|
.dockerconfigjson: |
|
|
{{ `{"auths":{"{{ .registry }}":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}` }}
|
|
data:
|
|
- secretKey: registry
|
|
remoteRef:
|
|
key: platform/docker-mirror-pull
|
|
property: registry
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: platform/docker-mirror-pull
|
|
property: username
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: platform/docker-mirror-pull
|
|
property: password
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|