unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

certificates: restore the validly-signed intermediate in vault-ca-cert #305

Merged
benvin merged 1 commits from benvin/vault-ca-cert-refresh into main 2026-07-28 23:14:15 +10:00
Conversation 0 Commits 1 Files Changed 2
+8 -1
2 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/certificates/vault-ca-cert.yaml
+3 -1
View File
@@ -1,4 +1,6 @@
--- ---
# pre-commit: allow-plain-secret -- public CA bundle; this secret bootstraps
# trust in Vault itself and therefore cannot be Vault-sourced.
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
@@ -28,7 +30,7 @@ stringData:
mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV aHR0cHM6Ly92YXVsdC5zZXJ2dWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5 aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03 muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
ci/validate-no-secrets.sh
+5
View File
@@ -10,6 +10,11 @@ while IFS= read -r -d '' file; do
# Check if the file contains a plain Kubernetes Secret # Check if the file contains a plain Kubernetes Secret
if grep -q "^kind: Secret" "$file"; then if grep -q "^kind: Secret" "$file"; then
# Explicit opt-out for public-data bootstrap secrets (e.g. the CA bundle
# that establishes Vault trust and therefore cannot be Vault-sourced).
if grep -q "^# pre-commit: allow-plain-secret" "$file"; then
continue
fi
# Allow secure secret types # Allow secure secret types
if ! grep -q -E "^kind: (SealedSecret|ExternalSecret|VaultStaticSecret|VaultDynamicSecret)" "$file"; then if ! grep -q -E "^kind: (SealedSecret|ExternalSecret|VaultStaticSecret|VaultDynamicSecret)" "$file"; then
echo "BLOCKED: $file contains a plain Kubernetes Secret" >&2 echo "BLOCKED: $file contains a plain Kubernetes Secret" >&2