Stéphane Tailland
6d020572e0
k8s/secret.yaml held the Grafana admin credentials and, since the MCP server landed, its service account token — gitignored, so deploying this stack required the right file to exist on the right laptop. It now comes from Vault through External Secrets, and nothing sensitive has to exist locally. A dedicated store rather than reusing vault-kong-v2: that one's AppRole carries kong-v2-readonly, scoped to secrets/data/kong-v2/*, so it cannot see this path — confirmed with a probe ExternalSecret that failed with "could not get secret data from provider". Widening that policy would have handed the Kong reader observability's secrets for no reason. So observability-readonly and observability-eso were created in Vault, mirroring the existing pattern exactly. The AppRole credentials stay out of git; the ClusterSecretStore comments carry the commands that mint them. dataFrom.extract pulls the whole path instead of naming each key, so a new key in Vault reaches the cluster with no edit here. The target keeps the name every consumer already uses, so neither the Grafana Deployment nor mcp-grafana changed — verified, neither pod restarted and the token in the cluster matches Vault byte for byte. secret.example.yaml no longer describes a file to create; it documents where the keys live and how the Grafana token is minted. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
36 lines
1.4 KiB
YAML
36 lines
1.4 KiB
YAML
# Reads secrets/observability/* from Vault. Deliberately not reusing the
|
|
# vault-kong-v2 store: its AppRole carries the kong-v2-readonly policy, scoped
|
|
# to secrets/data/kong-v2/*, so it simply cannot see this path — verified, a
|
|
# probe ExternalSecret against it failed with "could not get secret data from
|
|
# provider". Widening that policy would have given the Kong reader access to
|
|
# observability's secrets for no reason.
|
|
#
|
|
# The AppRole credentials are NOT in git. Created once against Vault:
|
|
# vault policy write observability-readonly (read on secrets/{data,metadata}/observability/*)
|
|
# vault write auth/approle/role/observability-eso token_policies=observability-readonly
|
|
# vault read auth/approle/role/observability-eso/role-id
|
|
# vault write -f auth/approle/role/observability-eso/secret-id
|
|
# kubectl -n external-secrets create secret generic vault-approle-observability \
|
|
# --from-literal=roleId=<...> --from-literal=secretId=<...>
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vault-observability
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: https://vault.sttlab.eu
|
|
path: secrets
|
|
version: v2
|
|
auth:
|
|
appRole:
|
|
path: approle
|
|
roleRef:
|
|
name: vault-approle-observability
|
|
namespace: external-secrets
|
|
key: roleId
|
|
secretRef:
|
|
name: vault-approle-observability
|
|
namespace: external-secrets
|
|
key: secretId
|