rblundonandClaude Sonnet 5.5
ebe4681438
- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1), values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services for fantasmic/wishes, namespace - gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate, ReferenceGrant for litellm namespace - cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones - external-dns: add wdw-labs.cloud zone (Technitium RFC2136) - onepassword-connect: add wdw-labs vault to ClusterSecretStore Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# ClusterSecretStore — 1Password Connect
|
|
#
|
|
# This is the bridge between ESO and 1Password Connect. Once this exists,
|
|
# any ExternalSecret in any namespace can reference:
|
|
# secretStoreRef:
|
|
# kind: ClusterSecretStore
|
|
# name: onepassword-connect
|
|
#
|
|
# The connect-token secret must exist in the onepassword-connect namespace.
|
|
# Generate a token in 1Password: Developer Tools > Connect Servers > <your server>
|
|
# Then apply once:
|
|
# kubectl create secret generic connect-token \
|
|
# --from-literal=token=<your-token> \
|
|
# -n onepassword-connect
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: onepassword-connect
|
|
spec:
|
|
provider:
|
|
onepassword:
|
|
connectHost: http://onepassword-connect.onepassword-connect.svc.cluster.local:8080
|
|
vaults:
|
|
mk-labs: 1 # vault name in 1Password : priority
|
|
wdw-labs: 2 # WDW Labs hosts/agents (LiteLLM, host api-keys); Connect token needs read access
|
|
auth:
|
|
secretRef:
|
|
connectTokenSecretRef:
|
|
name: connect-token
|
|
key: token
|
|
namespace: onepassword-connect
|