Initial commit

apps/guacamole/manifests/external-secret.yaml

@@ -0,0 +1,29 @@
+# kubernetes/apps/guacamole/external-secret.yaml
+# ExternalSecrets for Guacamole - pulls credentials from Vault
+
+# Note: Database password is managed by CNPG cluster (pg-guacamole-app secret)
+# We reference it directly in the guacamole values.yaml
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: guacamole-oauth
+  namespace: guacamole
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: guacamole-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: guacamole-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: guacamole-oauth
+        property: client-secret