gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-23 12:56:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

GitLab cross-site replication Phase 1b: secret material sync

Browse Source 
PushSecret (home) + ExternalSecret (VPS) pairs for the four
chart-generated secrets whose values must match before Phase 1c's
Postgres replication goes live: gitlab-rails-secret (secret_key_base/
db_key_base/otp_key_base/openid_connect_signing_key, all in one
secrets.yml key - confirmed live, not four separate keys as first
assumed), gitlab-gitlab-shell-secret, gitlab-gitaly-secret,
gitlab-praefect-secret (the latter two also needed for Phase 2's
cross-site gRPC auth). Same pattern as
infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-08-22 13:08:22 -05:00
co-authored by Claude Sonnet 5
parent 04fa80ece3
commit ca94282552
2 changed files with 186 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infrastructure/vps-standby/gitlab/manifests/ha-gitlab-secrets-externalsecret.yaml
+87
View File
@@ -0,0 +1,87 @@
# GitLab cross-site replication Phase 1b - VPS's half of the Vault
# pipeline (apps/gitlab/manifests/ha-gitlab-secrets-pushsecret.yaml has
# home's half, which pushes the authoritative values into Vault at
# secret/vps/gitlab-{rails,gitlab-shell,gitaly,praefect}-secret). Pulls
# them back down here, BEFORE Phase 1c's Postgres replication goes live.
#
# creationPolicy: Owner (not Merge) - each of these secrets has exactly
# one key with nothing else to preserve, unlike pg-authentik-app which
# has CNPG-local host/dbname/username fields alongside the shared
# password. The chart's shared-secrets job skips creating a key that
# already exists, so having ESO own these outright is sufficient to stop
# the VPS from ever generating its own divergent values.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitlab-rails-secret
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: gitlab-rails-secret
creationPolicy: Owner
data:
- secretKey: secrets.yml
remoteRef:
key: vps/gitlab-rails-secret
property: secrets.yml
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitlab-gitlab-shell-secret
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: gitlab-gitlab-shell-secret
creationPolicy: Owner
data:
- secretKey: secret
remoteRef:
key: vps/gitlab-gitlab-shell-secret
property: secret
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitlab-gitaly-secret
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: gitlab-gitaly-secret
creationPolicy: Owner
data:
- secretKey: token
remoteRef:
key: vps/gitlab-gitaly-secret
property: token
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitlab-praefect-secret
namespace: gitlab
spec:
refreshInterval: 5m
secretStoreRef:
name: vault-backend
kind: ClusterSecretStore
target:
name: gitlab-praefect-secret
creationPolicy: Owner
data:
- secretKey: token
remoteRef:
key: vps/gitlab-praefect-secret
property: token