48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
---
|
|
# ExternalSecret pulls credentials from 1Password Connect
|
|
# and creates a standard Kubernetes Secret that Glance reads
|
|
# as environment variables injected into the container.
|
|
#
|
|
# Prerequisites: ESO + 1Password Connect installed in fastpass
|
|
# 1Password vault item: "the-hub" with fields matching below
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: the-hub-secrets
|
|
namespace: the-hub
|
|
labels:
|
|
app.kubernetes.io/name: the-hub
|
|
app.kubernetes.io/part-of: mk-labs
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: onepassword-connect # ClusterSecretStore name from your ESO bootstrap
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: the-hub-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
# Proxmox API token (read-only, created in Datacenter > API Tokens)
|
|
- secretKey: PROXMOX_TOKEN
|
|
remoteRef:
|
|
key: the-hub
|
|
property: proxmox_token
|
|
|
|
# Proxmox Backup Server API token
|
|
- secretKey: PBS_TOKEN
|
|
remoteRef:
|
|
key: the-hub
|
|
property: pbs_token
|
|
|
|
# Grafana service account token (read-only)
|
|
- secretKey: GRAFANA_TOKEN
|
|
remoteRef:
|
|
key: the-hub
|
|
property: grafana_token
|
|
|
|
# Gitea personal access token (read-only)
|
|
- secretKey: GITEA_TOKEN
|
|
remoteRef:
|
|
key: the-hub
|
|
property: gitea_token
|