111 lines
2.2 KiB
YAML
111 lines
2.2 KiB
YAML
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: api
|
|
namespace: short
|
|
spec:
|
|
vaultAuthRef: short
|
|
type: kv-v2
|
|
mount: secret
|
|
path: short/api
|
|
refreshAfter: 1m
|
|
destination:
|
|
create: true
|
|
overwrite: true
|
|
name: api
|
|
transformation:
|
|
excludeRaw: true
|
|
excludes:
|
|
- .*
|
|
templates:
|
|
private_key:
|
|
text: '{{ get .Secrets "private_key" }}'
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: controller
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: cloud
|
|
namespace: short
|
|
spec:
|
|
vaultAuthRef: short
|
|
type: kv-v2
|
|
mount: secret
|
|
path: short/cloud
|
|
refreshAfter: 1m
|
|
destination:
|
|
create: true
|
|
overwrite: true
|
|
name: cloud
|
|
transformation:
|
|
excludeRaw: true
|
|
excludes:
|
|
- .*
|
|
templates:
|
|
config:
|
|
text: '{{ get .Secrets "config" }}'
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: controller
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: opnsense
|
|
namespace: short
|
|
spec:
|
|
vaultAuthRef: short
|
|
type: kv-v2
|
|
mount: secret
|
|
path: opnsense/interface-watcher
|
|
refreshAfter: 1h
|
|
destination:
|
|
create: true
|
|
overwrite: true
|
|
name: opnsense
|
|
transformation:
|
|
excludeRaw: true
|
|
excludes:
|
|
- .*
|
|
templates:
|
|
key:
|
|
text: '{{ get .Secrets "key" }}'
|
|
secret:
|
|
text: '{{ get .Secrets "secret" }}'
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: controller
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: opnsense-ca
|
|
namespace: short
|
|
spec:
|
|
vaultAuthRef: short
|
|
type: kv-v2
|
|
mount: secret
|
|
path: ca/opnsense
|
|
hmacSecretData: true
|
|
refreshAfter: 1h
|
|
destination:
|
|
create: true
|
|
overwrite: true
|
|
name: ca-opnsense
|
|
transformation:
|
|
excludeRaw: true
|
|
excludes:
|
|
- .*
|
|
templates:
|
|
ca.crt:
|
|
text: >-
|
|
{{- $ca := get .Secrets "certificate" -}}
|
|
{{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
|
|
{{- fail "CA publication is pending" -}}
|
|
{{- end -}}
|
|
{{- $ca -}}
|
|
rolloutRestartTargets:
|
|
- kind: Deployment
|
|
name: controller
|