Sienna Meridian Satterwhite
424db43ccf
Meet: add backend/frontend/celery deployments and services, meet-config ConfigMap, nginx SPA config, VSO secrets (meet-db-credentials VDS, meet-django-secret and meet-livekit VSS). Wire oidc-meet OAuth2Client. La Suite overlay discipline: move people/docs frontend nginx ConfigMaps and patches from overlays/local to base so both environments share them. Remove values-ory.yaml (folded into base). Add docs-frontend nginx config with sub_filter theming. Add local gitea mkcert CA patch. Pingora: add [ssh] TCP passthrough block (port 22 → Gitea SSH pod) and split meet route into frontend default + backend paths for /api/, /admin/, /oidc/, /static/, /__. Remove now-unused values-pingora.yaml from production overlay (host ports moved to patch-pingora-hostport.yaml). Update both overlay kustomizations to reference all new resources and add meet-backend/meet-frontend image entries.
278 lines
6.4 KiB
YAML
278 lines
6.4 KiB
YAML
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultAuth
|
|
metadata:
|
|
name: vso-auth
|
|
namespace: lasuite
|
|
spec:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
kubernetes:
|
|
role: vso
|
|
serviceAccount: default
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: seaweedfs-s3-credentials
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: seaweedfs
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: seaweedfs-s3-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
S3_ACCESS_KEY:
|
|
text: "{{ index .Secrets \"access-key\" }}"
|
|
S3_SECRET_KEY:
|
|
text: "{{ index .Secrets \"secret-key\" }}"
|
|
---
|
|
# Hive DB credentials from OpenBao database secrets engine (static role, 24h rotation).
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: hive-db-url
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: database
|
|
path: static-creds/hive
|
|
allowStaticCreds: true
|
|
refreshAfter: 5m
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: hive
|
|
destination:
|
|
name: hive-db-url
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
url:
|
|
text: "postgresql://{{ index .Secrets \"username\" }}:{{ index .Secrets \"password\" }}@postgres-rw.data.svc.cluster.local:5432/hive_db"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: hive-oidc
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: hive
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: hive-oidc
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
"client-id":
|
|
text: "{{ index .Secrets \"oidc-client-id\" }}"
|
|
"client-secret":
|
|
text: "{{ index .Secrets \"oidc-client-secret\" }}"
|
|
---
|
|
# People DB credentials from OpenBao database secrets engine (static role, 24h rotation).
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: people-db-credentials
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: database
|
|
path: static-creds/people
|
|
allowStaticCreds: true
|
|
refreshAfter: 5m
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: people-backend
|
|
- kind: Deployment
|
|
name: people-celery-worker
|
|
- kind: Deployment
|
|
name: people-celery-beat
|
|
destination:
|
|
name: people-db-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
password:
|
|
text: "{{ index .Secrets \"password\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: people-django-secret
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: people
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: people-django-secret
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
DJANGO_SECRET_KEY:
|
|
text: "{{ index .Secrets \"django-secret-key\" }}"
|
|
---
|
|
# Docs DB credentials from OpenBao database secrets engine (static role, 24h rotation).
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: docs-db-credentials
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: database
|
|
path: static-creds/docs
|
|
allowStaticCreds: true
|
|
refreshAfter: 5m
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: docs-backend
|
|
- kind: Deployment
|
|
name: docs-celery-worker
|
|
- kind: Deployment
|
|
name: docs-y-provider
|
|
destination:
|
|
name: docs-db-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
password:
|
|
text: "{{ index .Secrets \"password\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: docs-django-secret
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: docs
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: docs-django-secret
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
DJANGO_SECRET_KEY:
|
|
text: "{{ index .Secrets \"django-secret-key\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: docs-collaboration-secret
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: docs
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: docs-collaboration-secret
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
secret:
|
|
text: "{{ index .Secrets \"collaboration-secret\" }}"
|
|
---
|
|
# Meet DB credentials from OpenBao database secrets engine (static role, 24h rotation).
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: meet-db-credentials
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: database
|
|
path: static-creds/meet
|
|
allowStaticCreds: true
|
|
refreshAfter: 5m
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: meet-backend
|
|
- kind: Deployment
|
|
name: meet-celery-worker
|
|
destination:
|
|
name: meet-db-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
password:
|
|
text: "{{ index .Secrets \"password\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: meet-django-secret
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: meet
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: meet-django-secret
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
DJANGO_SECRET_KEY:
|
|
text: "{{ index .Secrets \"django-secret-key\" }}"
|
|
APPLICATION_JWT_SECRET_KEY:
|
|
text: "{{ index .Secrets \"application-jwt-secret-key\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: meet-livekit
|
|
namespace: lasuite
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: livekit
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: meet-livekit
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
LIVEKIT_API_KEY:
|
|
text: "{{ index .Secrets \"api-key\" }}"
|
|
LIVEKIT_API_SECRET:
|
|
text: "{{ index .Secrets \"api-secret\" }}"
|