Stéphane Tailland
58325b470a
catalogue-agent and approvisionnement-agent named a Deployment, a Service, an Ingress and a Certificate in French, in an estate where nothing else is. The peer URLs move with them, set through the existing per-environment override so the rename takes effect without rebuilding an image; the defaults in the code carry the same values for the next build. The Keycloak client ids, the image names and the repository names are still French. They are a separate, heavier move. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
877 B
YAML
25 lines
877 B
YAML
# The agent's Keycloak client secret, and nothing else. It comes from the same
|
|
# Vault entry the realm import reads, so there is exactly one copy of this
|
|
# secret in the estate and rotating it in Vault rotates it everywhere.
|
|
#
|
|
# vault-keycloak rather than a store of the agents' own: this value is a
|
|
# Keycloak client secret, owned by the realm, and inventing a second AppRole to
|
|
# read the same path would add a credential without adding a boundary.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: catalog-agent-secrets
|
|
namespace: agents
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: catalog-agent-secrets
|
|
data:
|
|
- secretKey: CATALOGUE_CLIENT_SECRET
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_CLASSIC_MODELS_AGENT_CATALOGUE
|