Initial commit

apps/nessus/manifests/cnpg-secrets.yaml

@@ -0,0 +1,44 @@
+# External Secrets Operator configuration for Nessus PostgreSQL password rotation
+# This auto-generates and rotates the database password in Vault
+---
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: nessus-db-password
+  namespace: nessus
+spec:
+  length: 32
+  digits: 10
+  symbols: 0  # No special chars to avoid escaping issues
+  symbolCharacters: ""
+  noUpper: false
+  allowRepeat: true
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nessus-cnpg-secret
+  namespace: nessus
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: nessus-db-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        password: "{{ .password }}"
+        username: "nessus"
+        host: "pg-nessus-rw"
+        port: "5432"
+        database: "nessus"
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: nessus-db-password