unkin-agent
4f79141638
Wire the bearer-protected /api/admin/ route so OpenBao on the VMs can machine-mint arrproxy tokens through the ingress. - Add arrproxy-admin-token VaultStaticSecret (default VaultAuth, k8s-auth default-SA) syncing kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token - Set ARRPROXY_ADMIN_TOKEN on arrproxy-api from that Secret; add it to the Reloader reload annotation so the pod rolls on rotation - Skip-auth /api/admin/ in oauth2-proxy (route stays bearer-protected by arrproxy's own token); /api/tokens and /api/me stay oauth-gated - Bump arrproxy-api and arrproxy-ui images to v0.2.0
77 lines
2.5 KiB
YAML
77 lines
2.5 KiB
YAML
---
|
|
# Per-deployment token-hash pepper. Seeded (openssl rand) at
|
|
# kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key: pepper); the
|
|
# default k8s role's templated policy already grants read on
|
|
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
|
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
|
# syncs it into the arrproxy-pepper Secret consumed by arrproxy-api as
|
|
# ARRPROXY_PEPPER.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: arrproxy-pepper
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: arrproxy-pepper
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/arrstack/default/arrproxy-pepper
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Machine-mint admin bearer token. Seeded (openssl rand) at
|
|
# kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token (key: token) and
|
|
# shared as the source of truth with the future Vault engine. The default k8s
|
|
# role's templated policy already grants read on
|
|
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
|
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
|
# syncs it into the arrproxy-admin-token Secret consumed by arrproxy-api as
|
|
# ARRPROXY_ADMIN_TOKEN to gate the bearer-protected /api/admin/ route.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: arrproxy-admin-token
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: arrproxy-admin-token
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/arrstack/default/arrproxy-admin-token
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Authentik OIDC client for the arrstack front door (client_id, client_secret,
|
|
# cookie_secret), created by terraform-authentik at
|
|
# kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into
|
|
# the oauth-credentials Secret consumed by the oauth2-proxy Deployment.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: oauth-credentials
|
|
namespace: arrstack
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/arrstack/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|