added glance dashboard

cluster/applications/the-hub/externalsecret.yaml

@@ -0,0 +1,47 @@
+---
+# ExternalSecret pulls credentials from 1Password Connect
+# and creates a standard Kubernetes Secret that Glance reads
+# as environment variables injected into the container.
+#
+# Prerequisites: ESO + 1Password Connect installed in fastpass
+# 1Password vault item: "the-hub" with fields matching below
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: the-hub-secrets
+  namespace: the-hub
+  labels:
+    app.kubernetes.io/name: the-hub
+    app.kubernetes.io/part-of: mk-labs
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-connect       # ClusterSecretStore name from your ESO bootstrap
+    kind: ClusterSecretStore
+  target:
+    name: the-hub-secrets
+    creationPolicy: Owner
+  data:
+    # Proxmox API token (read-only, created in Datacenter > API Tokens)
+    - secretKey: PROXMOX_TOKEN
+      remoteRef:
+        key: the-hub
+        property: proxmox_token
+
+    # Proxmox Backup Server API token
+    - secretKey: PBS_TOKEN
+      remoteRef:
+        key: the-hub
+        property: pbs_token
+
+    # Grafana service account token (read-only)
+    - secretKey: GRAFANA_TOKEN
+      remoteRef:
+        key: the-hub
+        property: grafana_token
+
+    # Gitea personal access token (read-only)
+    - secretKey: GITEA_TOKEN
+      remoteRef:
+        key: the-hub
+        property: gitea_token