Initial commit

infrastructure/vault/manifests/eso-bootstrap-job.yaml

@@ -0,0 +1,48 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: vault-eso-bootstrap
+  namespace: vault
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  backoffLimit: 5
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      containers:
+        - name: eso-bootstrap
+          image: bitnami/kubectl:1.31
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Vault ESO Bootstrap ==="
+
+              # Wait for ESO to be ready
+              echo "Waiting for External Secrets Operator..."
+              for i in $(seq 1 60); do
+                if kubectl -n external-secrets get deploy/external-secrets >/dev/null 2>&1; then
+                  kubectl -n external-secrets rollout status deploy/external-secrets --timeout=180s && break
+                fi
+                echo "  waiting for ESO deployment... (attempt $i/60)"
+                sleep 5
+              done
+
+              # Wait for ClusterSecretStore to be ready
+              echo "Checking ClusterSecretStore vault-backend..."
+              for i in $(seq 1 30); do
+                STATUS=$(kubectl get clustersecretstore vault-backend -o jsonpath='{.status.conditions[0].status}' 2>/dev/null || echo "")
+                if [ "$STATUS" = "True" ]; then
+                  echo "  ClusterSecretStore vault-backend is ready"
+                  break
+                fi
+                echo "  waiting for ClusterSecretStore... (attempt $i/30)"
+                sleep 5
+              done
+
+              echo "=== Vault ESO Bootstrap Complete ==="
+      restartPolicy: Never