mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
ca94282552
PushSecret (home) + ExternalSecret (VPS) pairs for the four chart-generated secrets whose values must match before Phase 1c's Postgres replication goes live: gitlab-rails-secret (secret_key_base/ db_key_base/otp_key_base/openid_connect_signing_key, all in one secrets.yml key - confirmed live, not four separate keys as first assumed), gitlab-gitlab-shell-secret, gitlab-gitaly-secret, gitlab-praefect-secret (the latter two also needed for Phase 2's cross-site gRPC auth). Same pattern as infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
88 lines
2.3 KiB
YAML
88 lines
2.3 KiB
YAML
# GitLab cross-site replication Phase 1b - VPS's half of the Vault
|
|
# pipeline (apps/gitlab/manifests/ha-gitlab-secrets-pushsecret.yaml has
|
|
# home's half, which pushes the authoritative values into Vault at
|
|
# secret/vps/gitlab-{rails,gitlab-shell,gitaly,praefect}-secret). Pulls
|
|
# them back down here, BEFORE Phase 1c's Postgres replication goes live.
|
|
#
|
|
# creationPolicy: Owner (not Merge) - each of these secrets has exactly
|
|
# one key with nothing else to preserve, unlike pg-authentik-app which
|
|
# has CNPG-local host/dbname/username fields alongside the shared
|
|
# password. The chart's shared-secrets job skips creating a key that
|
|
# already exists, so having ESO own these outright is sufficient to stop
|
|
# the VPS from ever generating its own divergent values.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-rails-secret
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitlab-rails-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: secrets.yml
|
|
remoteRef:
|
|
key: vps/gitlab-rails-secret
|
|
property: secrets.yml
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-gitlab-shell-secret
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitlab-gitlab-shell-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: secret
|
|
remoteRef:
|
|
key: vps/gitlab-gitlab-shell-secret
|
|
property: secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-gitaly-secret
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitlab-gitaly-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: token
|
|
remoteRef:
|
|
key: vps/gitlab-gitaly-secret
|
|
property: token
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitlab-praefect-secret
|
|
namespace: gitlab
|
|
spec:
|
|
refreshInterval: 5m
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitlab-praefect-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: token
|
|
remoteRef:
|
|
key: vps/gitlab-praefect-secret
|
|
property: token
|