panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
44 lines
1.6 KiB
YAML
44 lines
1.6 KiB
YAML
# External Secrets Operator — pulls secret material from OpenBao into Kubernetes
|
|
# Secrets, so the Secrets themselves become declarative instead of hand-created.
|
|
#
|
|
# Install:
|
|
# helm upgrade --install external-secrets external-secrets/external-secrets \
|
|
# -n external-secrets --create-namespace -f values.yaml
|
|
#
|
|
# WHY this and not SOPS: OpenBao is already the secrets store and the internal CA
|
|
# here, and its Kubernetes auth backend is already bootstrapped
|
|
# (../../infrastructure/openbao/ansible/roles/openbao_bootstrap/tasks/auth_kubernetes.yml), so a pod
|
|
# authenticates with its own ServiceAccount JWT and NOTHING long-lived is stored
|
|
# in the cluster. SOPS would mean managing an age key and committing ciphertext.
|
|
#
|
|
# Single node, so one replica of each component. The webhook and cert-controller
|
|
# are not optional — the CRDs use conversion/validating webhooks.
|
|
replicaCount: 1
|
|
|
|
webhook:
|
|
replicaCount: 1
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {memory: 128Mi}
|
|
|
|
certController:
|
|
replicaCount: 1
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {memory: 128Mi}
|
|
|
|
resources:
|
|
requests: {cpu: 10m, memory: 64Mi}
|
|
limits: {memory: 256Mi}
|
|
|
|
# The controller's own ServiceAccount is what the ClusterSecretStore presents to
|
|
# OpenBao, so its name is part of the contract with the bao Kubernetes auth role
|
|
# (bound_service_account_names). Pinned rather than left to the chart's default.
|
|
serviceAccount:
|
|
create: true
|
|
name: external-secrets
|
|
|
|
# ClusterSecretStore is cluster-scoped; leaving this on lets one store serve every
|
|
# namespace, which is the point here (authelia, gitea and cloudflared all consume it).
|
|
installCRDs: true
|