From 477c65cb4e3370ece3aaf4654d5370cedc92ebcf Mon Sep 17 00:00:00 2001
From: benvin <neotheo@gmail.com>
Date: Sat, 18 Jul 2026 16:13:55 +1000
Subject: [PATCH] cephrgw-system: source cephrgw-credentials from Vault via VSO

Replace the out-of-band cephrgw-credentials Secret with a VSO-managed one so
the operator's Ceph dashboard credentials come from Vault.

- Add apps/base/cephrgw-system/vaultauth.yaml: VaultAuth (k8s/au/syd1 mount,
  role cephrgw-operator, SA cephrgw-operator, connection vso-system/default).
- Add apps/base/cephrgw-system/vaultstaticsecret.yaml: renders the KV path
  service/cephrgw/dashboard-credentials into the cephrgw-credentials Secret
  (keys copied verbatim, consumed by the Deployment via envFrom).
- Reference both from the base kustomization.

Requires the Vault role/policy from terraform-vault #95 and the KV values to
be seeded (see the operator's docs/ceph-setup.md).
---
 apps/base/cephrgw-system/kustomization.yaml   |  2 ++
 apps/base/cephrgw-system/vaultauth.yaml       | 18 ++++++++++++++++
 .../cephrgw-system/vaultstaticsecret.yaml     | 21 +++++++++++++++++++
 3 files changed, 41 insertions(+)
 create mode 100644 apps/base/cephrgw-system/vaultauth.yaml
 create mode 100644 apps/base/cephrgw-system/vaultstaticsecret.yaml

diff --git a/apps/base/cephrgw-system/kustomization.yaml b/apps/base/cephrgw-system/kustomization.yaml
index c3558d4..8087c3e 100644
--- a/apps/base/cephrgw-system/kustomization.yaml
+++ b/apps/base/cephrgw-system/kustomization.yaml
@@ -9,3 +9,5 @@ resources:
   - https://git.unkin.net/unkin/cephrgw-operator/raw/tag/v0.1.0/config/crd/install.yaml
   - rbac.yaml
   - deployment.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
diff --git a/apps/base/cephrgw-system/vaultauth.yaml b/apps/base/cephrgw-system/vaultauth.yaml
new file mode 100644
index 0000000..fe747e6
--- /dev/null
+++ b/apps/base/cephrgw-system/vaultauth.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: cephrgw-system
+spec:
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
+  allowedNamespaces:
+    - cephrgw-system
+  kubernetes:
+    role: cephrgw-operator
+    serviceAccount: cephrgw-operator
+    audiences:
+      - vault
+    tokenExpirationSeconds: 600
diff --git a/apps/base/cephrgw-system/vaultstaticsecret.yaml b/apps/base/cephrgw-system/vaultstaticsecret.yaml
new file mode 100644
index 0000000..6de026a
--- /dev/null
+++ b/apps/base/cephrgw-system/vaultstaticsecret.yaml
@@ -0,0 +1,21 @@
+---
+# Renders the Ceph dashboard credentials from Vault into the cephrgw-credentials
+# Secret the operator Deployment consumes via envFrom. The KV secret's keys
+# (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are
+# copied verbatim, so they land as the matching env vars.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: cephrgw-credentials
+  namespace: cephrgw-system
+spec:
+  vaultAuthRef: default
+  mount: kv
+  type: kv-v2
+  path: service/cephrgw/dashboard-credentials
+  refreshAfter: 5m
+  hmacSecretData: true
+  destination:
+    name: cephrgw-credentials
+    create: true
+    overwrite: true