agent-company
43f5d5ef60
Add flux/external-secrets/ directory containing: - namespace.yaml: external-secrets namespace - helmrepository.yaml: charts.external-secrets.io HelmRepository - helmrelease.yaml: ESO HelmRelease (external-secrets/external-secrets >=0.9.0 <1.0.0) - clustersecretstore.yaml: ClusterSecretStore using Kubernetes provider (ServiceAccount + ClusterRole + ClusterRoleBinding + ClusterSecretStore) - kustomization.yaml: wires all above resources Uncomment and complete ExternalSecret manifests in each API namespace: - flux/zip-enrichment/externalsecret.yaml - flux/holidays/externalsecret.yaml - flux/air-quality/externalsecret.yaml All three ExternalSecrets reference the kubernetes-provider ClusterSecretStore and will auto-sync rapidapi-proxy-secret once ESO is running. Add external-secrets to flux/kustomization.yaml. kustomize build flux/ = PASS Closes leeworks-agents/api-company#61
51 lines
1.3 KiB
YAML
51 lines
1.3 KiB
YAML
# ClusterSecretStore using the Kubernetes provider.
|
|
# Reads secrets from the cluster itself — no external vault required.
|
|
# The service account below must have get/list access to secrets in
|
|
# the namespaces where ExternalSecrets are created.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: eso-kubernetes-provider
|
|
namespace: external-secrets
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: eso-kubernetes-provider-reader
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: eso-kubernetes-provider-reader
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: eso-kubernetes-provider-reader
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: eso-kubernetes-provider
|
|
namespace: external-secrets
|
|
---
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: kubernetes-provider
|
|
spec:
|
|
provider:
|
|
kubernetes:
|
|
remoteNamespace: external-secrets
|
|
server:
|
|
caProvider:
|
|
type: ConfigMap
|
|
name: kube-root-ca.crt
|
|
namespace: external-secrets
|
|
key: ca.crt
|
|
auth:
|
|
serviceAccount:
|
|
name: eso-kubernetes-provider
|
|
namespace: external-secrets
|