Stéphane Tailland
d68d20c6f4
Every environment value is a ${VAR} for the caller to substitute: hostname,
images, storage, ingress class, TLS issuer, Vault server and path, timezone,
retention. Nothing in k8s/ names a host, a realm, an agent or an estate.
Removed: the Flux plumbing under dev/, which described one deployment, and the
ExternalSecret pulling a specific agent's Keycloak client secret. Both belong to
whoever deploys this. The lab CA ConfigMap goes with them — the mount stays,
parameterised and marked optional, because 'trust a private CA' is a property of
an environment and not of n8n.
The README is now the template's: how to consume it, what every variable means,
and the three things it deliberately does not do.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
# Reads this deployment's secrets from Vault. Scope the AppRole's policy to the
|
|
# path this store reads and nothing more, so a workload here cannot reach
|
|
# another estate's secrets.
|
|
#
|
|
# The Vault side is created once, outside this repo:
|
|
#
|
|
# vault policy write <policy> - <<'HCL'
|
|
# path "<mount>/data/<path>/*" { capabilities = ["read"] }
|
|
# path "<mount>/metadata/<path>/*" { capabilities = ["list", "read"] }
|
|
# HCL
|
|
# vault write auth/approle/role/<role> token_policies=<policy> \
|
|
# token_ttl=1h token_max_ttl=4h
|
|
# kubectl -n external-secrets create secret generic ${VAULT_APPROLE_SECRET} \
|
|
# --from-literal=roleId=$(vault read -field=role_id auth/approle/role/<role>/role-id) \
|
|
# --from-literal=secretId=$(vault write -f -field=secret_id auth/approle/role/<role>/secret-id)
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: ${VAULT_STORE_NAME}
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: ${VAULT_SERVER}
|
|
path: ${VAULT_MOUNT}
|
|
version: v2
|
|
auth:
|
|
appRole:
|
|
path: approle
|
|
roleRef:
|
|
name: ${VAULT_APPROLE_SECRET}
|
|
namespace: external-secrets
|
|
key: roleId
|
|
secretRef:
|
|
name: ${VAULT_APPROLE_SECRET}
|
|
namespace: external-secrets
|
|
key: secretId
|