4b1e8a7cac
- Rename application/namespace: the-seas -> harbor - Move directory: cluster/platform/the-seas -> cluster/platform/harbor - Update all resource references (ExternalSecret, HTTPRoutes, Certificates) - Switch to letsencrypt-staging issuer (avoid ACME rate limits during testing) - Thematic name 'the-seas' remains in DNS hostnames and comments
53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# ExternalSecret — Harbor Credentials
|
|
# Pulled from 1Password via Connect Server, materialized as a K8s secret
|
|
# in the-seas namespace for use by Harbor components.
|
|
#
|
|
# In 1Password, these are stored in the "the-seas" item in the "mk-labs" vault
|
|
# with fields: harbor-admin-password, database-password, redis-password,
|
|
# core-secret, jobservice-secret, registry-password
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: harbor-credentials
|
|
namespace: harbor
|
|
spec:
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
refreshInterval: "1h"
|
|
target:
|
|
name: harbor-credentials
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: HARBOR_ADMIN_PASSWORD
|
|
remoteRef:
|
|
key: the-seas
|
|
property: harbor-admin-password
|
|
|
|
- secretKey: DATABASE_PASSWORD
|
|
remoteRef:
|
|
key: the-seas
|
|
property: database-password
|
|
|
|
- secretKey: REDIS_PASSWORD
|
|
remoteRef:
|
|
key: the-seas
|
|
property: redis-password
|
|
|
|
- secretKey: CORE_SECRET
|
|
remoteRef:
|
|
key: the-seas
|
|
property: core-secret
|
|
|
|
- secretKey: JOBSERVICE_SECRET
|
|
remoteRef:
|
|
key: the-seas
|
|
property: jobservice-secret
|
|
|
|
- secretKey: REGISTRY_PASSWD
|
|
remoteRef:
|
|
key: the-seas
|
|
property: registry-password
|