536cb72a72
Phase 1 of Item #9 (Tower-stamped Secrets → ESO + OpenBao migration). Replaces Tower's imperative kubectl-stamp of gitea-archive-pull with a declarative ExternalSecret synced from OpenBao at v3/platform/gitea- archive-pull. Other 4 Tower-stamped Secrets (cloudflare, s3-backup, longhorn-s3, docker-mirror-pull) remain on legacy path. Tower must pass externalSecrets.openbao.mountPath as a per-cluster helm parameter (kubernetes-<server-name>) for ESO to activate; chart guards against unset mountPath via {{ if }} in both new templates.
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
{{- if .Values.externalSecrets.enabled }}
|
|
{{- if .Values.externalSecrets.openbao.mountPath }}
|
|
# ClusterSecretStore — single store per cluster, namespace-spanning so a
|
|
# tenants-namespace ExternalSecret can also reference it (current Phase 1
|
|
# scope only writes to odoosky-system, but downstream phases will fan to
|
|
# tenants ns for s3-backup-creds).
|
|
#
|
|
# auth.kubernetes.mountPath is per-cluster (Tower passes
|
|
# `kubernetes-<cluster-name>` as a helm parameter). Each cluster
|
|
# authenticates against its own OpenBao auth mount, with the
|
|
# `eso-platform-read` policy bound to the role. ServiceAccount
|
|
# `external-secrets` is created by the ESO subchart in odoosky-system.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao-platform
|
|
labels:
|
|
app.kubernetes.io/managed-by: cluster-platform-v3
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: {{ .Values.externalSecrets.openbao.server | quote }}
|
|
path: "v3"
|
|
version: "v2"
|
|
auth:
|
|
kubernetes:
|
|
mountPath: {{ .Values.externalSecrets.openbao.mountPath | quote }}
|
|
role: {{ .Values.externalSecrets.openbao.role | default "eso" | quote }}
|
|
serviceAccountRef:
|
|
name: external-secrets
|
|
namespace: odoosky-system
|
|
{{- end }}
|
|
{{- end }}
|