Sienna Meridian Satterwhite
8cb705fecc
- gitea-db-credentials is now a VaultDynamicSecret reading from database/static-creds/gitea (OpenBao static role, 24h password rotation). Replaces the previous KV-based Secret that used a hardcoded localdev password. - gitea-admin-credentials and gitea-s3-credentials remain VaultStaticSecrets synced from secret/gitea and secret/seaweedfs respectively. - gitea-values.yaml adds gitea.admin.existingSecret so the chart reads the admin username/password from the VSO-managed Secret instead of values.
83 lines
1.8 KiB
YAML
83 lines
1.8 KiB
YAML
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultAuth
|
|
metadata:
|
|
name: vso-auth
|
|
namespace: devtools
|
|
spec:
|
|
method: kubernetes
|
|
mount: kubernetes
|
|
kubernetes:
|
|
role: vso
|
|
serviceAccount: default
|
|
---
|
|
# Gitea DB credentials from OpenBao database secrets engine (static role, 24h rotation).
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultDynamicSecret
|
|
metadata:
|
|
name: gitea-db-credentials
|
|
namespace: devtools
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: database
|
|
path: static-creds/gitea
|
|
refreshAfter: 1h
|
|
rolloutRestartTargets:
|
|
- kind: StatefulSet
|
|
name: gitea
|
|
destination:
|
|
name: gitea-db-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
password:
|
|
text: "{{ index .Secrets \"password\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: gitea-s3-credentials
|
|
namespace: devtools
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: seaweedfs
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: gitea-s3-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
"access-key":
|
|
text: "{{ index .Secrets \"access-key\" }}"
|
|
"secret-key":
|
|
text: "{{ index .Secrets \"secret-key\" }}"
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: gitea-admin-credentials
|
|
namespace: devtools
|
|
spec:
|
|
vaultAuthRef: vso-auth
|
|
mount: secret
|
|
type: kv-v2
|
|
path: gitea
|
|
refreshAfter: 30s
|
|
destination:
|
|
name: gitea-admin-credentials
|
|
create: true
|
|
overwrite: true
|
|
transformation:
|
|
excludeRaw: true
|
|
templates:
|
|
username:
|
|
text: "{{ index .Secrets \"admin-username\" }}"
|
|
password:
|
|
text: "{{ index .Secrets \"admin-password\" }}"
|