Initial commit

infrastructure/crowdsec/manifests/external-secret.yaml

@@ -0,0 +1,41 @@
+# CrowdSec secrets from Vault
+# - CAPI enrollment key (user registers at app.crowdsec.net)
+# - Bouncer API key (generated by postsync hook via cscli)
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: crowdsec-capi
+  namespace: crowdsec
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: crowdsec-capi-key
+    creationPolicy: Owner
+  data:
+    - secretKey: enrollment-key
+      remoteRef:
+        key: crowdsec-capi
+        property: enrollment-key
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: crowdsec-bouncer
+  namespace: crowdsec
+spec:
+  refreshInterval: "0"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: crowdsec-bouncer-key
+    creationPolicy: Owner
+  data:
+    - secretKey: api-key
+      remoteRef:
+        key: crowdsec-bouncer
+        property: api-key