Stéphane Tailland
33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
# Shared by every kong-v2 domain — one Vault connection, not duplicated per
|
|
# domain. Auth is AppRole (not Kubernetes auth): Vault at vault.sttlab.eu
|
|
# can't reach back into this cluster's API server to validate SA tokens
|
|
# (local cluster's API is https://127.0.0.1:26443, not internet-reachable) —
|
|
# Kubernetes auth was the first choice but isn't viable here.
|
|
#
|
|
# Both roleId and secretId come from vault-approle-kong-v2 (ns
|
|
# external-secrets) — created directly via `vault write` + `kubectl create
|
|
# secret`, never written to a file. Scoped read-only to secrets/kong-v2/*
|
|
# via Vault policy kong-v2-readonly (see Vault directly for policy/role
|
|
# definitions — not tracked in this repo, no Terraform-for-Vault yet).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vault-kong-v2
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: https://vault.sttlab.eu
|
|
path: secrets
|
|
version: v2
|
|
auth:
|
|
appRole:
|
|
path: approle
|
|
roleRef:
|
|
name: vault-approle-kong-v2
|
|
namespace: external-secrets
|
|
key: roleId
|
|
secretRef:
|
|
name: vault-approle-kong-v2
|
|
namespace: external-secrets
|
|
key: secretId
|