rock
667bca0f44
- ExternalSecret syncs age key from Vault to pod - CRD defines rotation schedule for each secret - Controller watches CRD, rotates on schedule: * Call provider API (Authentik/Forgejo/MinIO) for new secret * Update k8s Secret * Update .enc.yaml via sops (uses age key from Vault) * Git commit and push - Vault is source of truth for age key (never on disk) - Examples: minio-oidc (90d), portfolio-agent (90d), forgejo-token (90d), minio-root (180d)
16 lines
307 B
YAML
16 lines
307 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: secret-rotation
|
|
|
|
resources:
|
|
- rbac.yaml
|
|
- crd.yaml
|
|
- external-secret.yaml
|
|
- deployment.yaml
|
|
|
|
commonLabels:
|
|
app.kubernetes.io/name: secret-rotation-controller
|
|
app.kubernetes.io/component: automation
|
|
managed-by: argocd
|