ce7cb702218693d08ea6d83464d2457c9250027c

services/stalwart/k8s/base/vault/identity.yaml

@@ -0,0 +1,65 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-alert
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/alert-identity
+  refreshAfter: 1h
+  destination:
+    name: stalwart-alert
+    create: true
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: mail-web
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/oidc/zitadel
+  refreshAfter: 1h
+  destination:
+    name: mail-web
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        config.json:
+          text: '{{ dict "issuer" (get .Secrets "issuer_url") "clientId" (get .Secrets "account_client_id") "scope" (printf "openid profile urn:zitadel:iam:org:project:id:%s:aud" (get .Secrets "audience")) | toJson }}'
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-test-client
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/test-client
+  refreshAfter: 1h
+  destination:
+    name: stalwart-test-client
+    create: true
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: stalwart-oidc
+  namespace: stalwart
+spec:
+  type: kv-v2
+  mount: secret
+  path: stalwart/oidc/zitadel
+  refreshAfter: 1h
+  destination:
+    name: stalwart-oidc
+    create: true
+  vaultAuthRef: default