Initial commit

infrastructure/vault/manifests/clustersecretstore.yaml

@@ -0,0 +1,19 @@
+# manifests/clustersecretstore-vault.yaml
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-backend
+spec:
+  provider:
+    vault:
+      server: http://vault.vault.svc:8200
+      path: secret          # KV v2 mount
+      version: v2
+      auth:
+        kubernetes:
+          # MUST be just the mount name; Vault shows this as "kubernetes/" in `vault auth list`
+          mountPath: kubernetes
+          role: eso-writer               # role we create in Vault
+          serviceAccountRef:
+            name: external-secrets       # SA created by the ESO chart
+            namespace: external-secrets