c26ee5b3c6
Phase 2 of Item #9. Adds ExternalSecret manifests for: - docker-mirror-pull (×2 namespaces, dockerconfigjson template) - cloudflare-api-token-<slug> (per-tenant, gated on tenant.id+slug) - s3-backup-creds (per-tenant, in tenants ns) - longhorn-s3-creds (per-tenant, gated on tenant.s3Endpoint) New helm values: tenant.id, tenant.slug, tenant.s3Endpoint. Tower must pass these per-cluster (next ship). All manifests gated on externalSecrets.enabled + mountPath set + tenant.id set, so old apps without the new params remain on the legacy Tower-stamped path until the operator opts them in.
44 lines
1.3 KiB
YAML
44 lines
1.3 KiB
YAML
{{- if .Values.externalSecrets.enabled }}
|
|
{{- if .Values.externalSecrets.openbao.mountPath }}
|
|
{{- if .Values.tenant.id }}
|
|
# s3-backup-creds — per-tenant S3 backup credentials consumed by the
|
|
# instance-template-v3 backup-cronjob (env: AWS_ACCESS_KEY_ID +
|
|
# AWS_SECRET_ACCESS_KEY). Source: v3/tenants/<id>/s3-credentials in
|
|
# OpenBao with fields access_key + secret_key. Lives in the `tenants`
|
|
# namespace where the per-instance backup CronJobs run.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: s3-backup-creds
|
|
namespace: tenants
|
|
labels:
|
|
app.kubernetes.io/managed-by: cluster-platform-v3
|
|
odoosky.io/tenant: {{ .Values.tenant.id | quote }}
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
name: openbao-platform
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: s3-backup-creds
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
template:
|
|
type: Opaque
|
|
engineVersion: v2
|
|
data:
|
|
AWS_ACCESS_KEY_ID: "{{ `{{ .access_key }}` }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ `{{ .secret_key }}` }}"
|
|
data:
|
|
- secretKey: access_key
|
|
remoteRef:
|
|
key: tenants/{{ .Values.tenant.id }}/s3-credentials
|
|
property: access_key
|
|
- secretKey: secret_key
|
|
remoteRef:
|
|
key: tenants/{{ .Values.tenant.id }}/s3-credentials
|
|
property: secret_key
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|