Initial commit

infrastructure/unpoller/manifests/unpoller-secret.yaml

@@ -0,0 +1,45 @@
+---
+# ExternalSecret for Unpoller Unifi credentials
+# Syncs credentials from Vault to Kubernetes Secret
+#
+# BOOTSTRAP SETUP:
+# ================
+# After first deployment, store your Unifi credentials in Vault:
+#
+#   kubectl exec -n vault vault-0 -- vault kv put secret/unpoller \
+#     unifi-user="your-unifi-username" \
+#     unifi-pass="your-unifi-password"
+#
+# Or use the API key approach (recommended):
+#   kubectl exec -n vault vault-0 -- vault kv put secret/unpoller \
+#     unifi-user="your-api-key" \
+#     unifi-pass="your-api-key"
+#
+# The ExternalSecret will automatically sync these to a Kubernetes secret
+# and Reloader will restart Unpoller when they change.
+#
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: unpoller-secret
+  namespace: unpoller
+  annotations:
+    meta.helm.sh/release-name: unpoller
+    meta.helm.sh/release-namespace: unpoller
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: unpoller-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: unifi-user
+      remoteRef:
+        key: secret/unpoller
+        property: unifi-user
+    - secretKey: unifi-pass
+      remoteRef:
+        key: secret/unpoller
+        property: unifi-pass