panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
44 lines
2.0 KiB
YAML
44 lines
2.0 KiB
YAML
# The one store every namespace reads from.
|
|
#
|
|
# Cluster-scoped on purpose: authelia, gitea and cloudflared all consume it, and a
|
|
# per-namespace SecretStore would mean duplicating the OpenBao connection details
|
|
# three times.
|
|
#
|
|
# AUTH: no credential is stored anywhere. ESO presents its own ServiceAccount JWT,
|
|
# OpenBao validates it against the cluster's TokenReview API, and hands back a
|
|
# short-lived token scoped by the `external-secrets` role. The reviewer JWT that
|
|
# makes that possible lives on the bao host, configured by
|
|
# ../../infrastructure/openbao/ansible/roles/openbao_bootstrap/tasks/auth_kubernetes.yml — it is key
|
|
# material, which is why Ansible owns it and Terraform does not.
|
|
#
|
|
# TLS: bao presents a Let's Encrypt cert for bao.ad.ddupan.top, so no caBundle or
|
|
# caProvider is needed — verified from inside a pod (HTTP 200, ssl_verify_result 0).
|
|
# ⚠ Address it by HOSTNAME, never 192.168.10.8: the cert carries a DNS SAN only,
|
|
# so connecting by IP fails verification. Same trap as dc1's LDAPS cert.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: openbao
|
|
spec:
|
|
provider:
|
|
vault:
|
|
# OpenBao is Vault-API compatible; ESO's vault provider drives it unchanged.
|
|
server: 'https://bao.ad.ddupan.top:8200'
|
|
# Mount path of the KV engine, from ../../infrastructure/openbao/terraform/mounts.tf.
|
|
path: 'kv'
|
|
version: 'v2'
|
|
auth:
|
|
kubernetes:
|
|
mountPath: 'kubernetes'
|
|
role: 'external-secrets'
|
|
serviceAccountRef:
|
|
name: 'external-secrets'
|
|
# namespace is MANDATORY on a ClusterSecretStore (it has no namespace
|
|
# of its own to resolve the reference against).
|
|
namespace: 'external-secrets'
|
|
# NOTE: Vault 1.21+ requires an `audiences: ['vault']` entry here, and
|
|
# the bao role must declare a matching audience. OpenBao 2.6.1 does not,
|
|
# so it is omitted — if auth ever starts failing with an audience
|
|
# mismatch after an upgrade, this is the first thing to add.
|