ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/control/vault.yaml

@@ -0,0 +1,111 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: api
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: short/api
+  refreshAfter: 1m
+  destination:
+    create: true
+    overwrite: true
+    name: api
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        private_key:
+          text: '{{ get .Secrets "private_key" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: cloud
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: short/cloud
+  refreshAfter: 1m
+  destination:
+    create: true
+    overwrite: true
+    name: cloud
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        config:
+          text: '{{ get .Secrets "config" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: opnsense/interface-watcher
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: opnsense
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        key:
+          text: '{{ get .Secrets "key" }}'
+        secret:
+          text: '{{ get .Secrets "secret" }}'
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: opnsense-ca
+  namespace: short
+spec:
+  vaultAuthRef: short
+  type: kv-v2
+  mount: secret
+  path: ca/opnsense
+  hmacSecretData: true
+  refreshAfter: 1h
+  destination:
+    create: true
+    overwrite: true
+    name: ca-opnsense
+    transformation:
+      excludeRaw: true
+      excludes:
+      - .*
+      templates:
+        ca.crt:
+          text: >-
+            {{- $ca := get .Secrets "certificate" -}}
+            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
+            {{- fail "CA publication is pending" -}}
+            {{- end -}}
+            {{- $ca -}}
+  rolloutRestartTargets:
+  - kind: Deployment
+    name: controller