benvin
477c65cb4e
Replace the out-of-band cephrgw-credentials Secret with a VSO-managed one so the operator's Ceph dashboard credentials come from Vault. - Add apps/base/cephrgw-system/vaultauth.yaml: VaultAuth (k8s/au/syd1 mount, role cephrgw-operator, SA cephrgw-operator, connection vso-system/default). - Add apps/base/cephrgw-system/vaultstaticsecret.yaml: renders the KV path service/cephrgw/dashboard-credentials into the cephrgw-credentials Secret (keys copied verbatim, consumed by the Deployment via envFrom). - Reference both from the base kustomization. Requires the Vault role/policy from terraform-vault #95 and the KV values to be seeded (see the operator's docs/ceph-setup.md).
19 lines
386 B
YAML
19 lines
386 B
YAML
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultAuth
|
|
metadata:
|
|
name: default
|
|
namespace: cephrgw-system
|
|
spec:
|
|
method: kubernetes
|
|
mount: k8s/au/syd1
|
|
vaultConnectionRef: vso-system/default
|
|
allowedNamespaces:
|
|
- cephrgw-system
|
|
kubernetes:
|
|
role: cephrgw-operator
|
|
serviceAccount: cephrgw-operator
|
|
audiences:
|
|
- vault
|
|
tokenExpirationSeconds: 600
|