External Secrets Store

kong-platform/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - gatewayclass.yaml
   - dataplane-template-defaults.yaml
+  - vault-clustersecretstore.yaml

kong-platform/vault-clustersecretstore.yaml

@@ -0,0 +1,32 @@
+# Shared by every kong-v2 domain — one Vault connection, not duplicated per
+# domain. Auth is AppRole (not Kubernetes auth): Vault at vault.sttlab.eu
+# can't reach back into this cluster's API server to validate SA tokens
+# (local cluster's API is https://127.0.0.1:26443, not internet-reachable) —
+# Kubernetes auth was the first choice but isn't viable here.
+#
+# Both roleId and secretId come from vault-approle-kong-v2 (ns
+# external-secrets) — created directly via `vault write` + `kubectl create
+# secret`, never written to a file. Scoped read-only to secrets/kong-v2/*
+# via Vault policy kong-v2-readonly (see Vault directly for policy/role
+# definitions — not tracked in this repo, no Terraform-for-Vault yet).
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-kong-v2
+spec:
+  provider:
+    vault:
+      server: https://vault.sttlab.eu
+      path: secrets
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: vault-approle-kong-v2
+            namespace: external-secrets
+            key: roleId
+          secretRef:
+            name: vault-approle-kong-v2
+            namespace: external-secrets
+            key: secretId