unkin-agent
5faaff8d19
Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.
- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.
45 lines
1.2 KiB
YAML
45 lines
1.2 KiB
YAML
---
|
|
# GitHub App credentials (app_id, client_id, client_secret, private_key). Ben
|
|
# populates kv/kubernetes/namespace/ghp/default/github-app via the runbook; the
|
|
# default k8s role's templated policy already grants read here, so no
|
|
# terraform-vault change is needed. VSO syncs it into the ghp-github-app Secret.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: ghp-github-app
|
|
namespace: ghp
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: ghp-github-app
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/ghp/default/github-app
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Application encryption key (encryption_key) from
|
|
# kv/kubernetes/namespace/ghp/default/app.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: ghp-app
|
|
namespace: ghp
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0"
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: ghp-app
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/ghp/default/app
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|