cluster

commit 7c5db76bcbcee3ae56225cd84bb43cdb6a2a7c3d
parent a743e2bed6cc3f7f668e001e8d62a1f9dca31d9e
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sun, 19 Mar 2023 15:39:53 +0100

Fix missing secret

Diffstat:
M
apps/production/kustomization.yaml
 | 
1
-
A
apps/production/secrets/kustomization.yaml
 | 
4
++++
A
apps/production/secrets/vaultwarden-secret.yaml
 | 
64
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
D
apps/production/vaultwarden-secret.yaml
 | 
63
---------------------------------------------------------------
M
clusters/production/apps.yaml
 | 
22
++++++++++++++++++++++

5 files changed, 90 insertions(+), 64 deletions(-)
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -1,7 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - vaultwarden-secret.yaml
   - ../base/vaultwarden
 patchesStrategicMerge:
   - vaultwarden-values.yaml
diff --git a/apps/production/secrets/kustomization.yaml b/apps/production/secrets/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - vaultwarden-secret.yaml
diff --git a/apps/production/secrets/vaultwarden-secret.yaml b/apps/production/secrets/vaultwarden-secret.yaml
@@ -0,0 +1,64 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vaultwarden-postgresql
+  namespace: k8s-at-home
+type: Opaque
+data:
+  postgresql-password: ENC[AES256_GCM,data:h3gXx8ZUR6mtyU++eOK0+lsNTKZGdJrmQx7TKxeySHpw2zcRElKq9maHtPOCKVXG5Tf0t9mLCL1Jf99ruyUoJVMg6ufyVO3pyZUGWGa+4BTIxQP3Fe2NzA==,iv:4XUj7NWmr5ogFHPJCkaktXjAmm0C04ZLFb4xz9e+UEQ=,tag:iyX7n7L5ZpERxiJXGFp+IA==,type:str]
+  postgresql-postgres-password: ENC[AES256_GCM,data:OG+tLnZrJ+R9FbXx2NOREw==,iv:JGvpSvk25JQYCxIxygInRusj2FGtmkCLzAX+ZbCTmok=,tag:RLsF+KO6nPqX/F0M6R4zow==,type:str]
+  password: ENC[AES256_GCM,data:cIvw4gC4s94bECR5V5vFZsyyQlk86kg+JmIcQr4fLb75/T2AcTAm9JOAtOa4yvCk789tOc7Tncw1vufcVoKQSuDS0oi2oEvQGCPdMeg01fHIJnQ5/xISMA==,iv:dItSer1bPtVb9mNoG4GTerRV2NN9AeLh+fiLBylayd4=,tag:YHgKtuQQNsIiTuuXzPqh6w==,type:str]
+  postgres-password: ENC[AES256_GCM,data:08Mh7/ogJjOu2E+m9Ln+4A==,iv:siHg00e+9xE/A8HvIqL8+YUkvqTYY77eI8aC0iSYOwQ=,tag:QTdMVCDBx6hVeO633gS+1Q==,type:str]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYjlJWndmOVNDWjc0dU9r
+        eG14bmd3dVZqZmxTRUkvZk5tbm95RzNFK1F3ClpoOTBpWlJMUXhaM0kxaUE5OUdw
+        c1NVZG9yOFZEOUxUSnVKclpBczVuVlEKLS0tIDNBUnJUaHhPZ3R5TzNqZXl1QjJ4
+        SkE1L2tkQXphSlNmU2lVNldrNjU5Qk0KnUm93N3G7ZYU4UKWerKkJBCkpYh7oAmk
+        RNxWx6IGruh1XibBQnOzYvu8RrhqIg6QEgj9WSO4fUalPd0sHByofw==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2023-03-19T13:48:40Z"
+  mac: ENC[AES256_GCM,data:ypOqCj9iYS5rrP0mq2TLArE64INur8hTnU973JHK5BOL1Zedpd0NMT2m9gyx/EjyeEzL51gK7tWHVNMgIm7ZkQOGTV3QulTA3bzN3hr6jNeVajJlL3KiUCk7SWbAoK7NsAOh+dIvBCHy/iFDZiyUcgBYM5oPO4mas8iDyWJhywE=,iv:70UFCZpbCECccUzPQ4AvwPAzZ7/AcCSdcORAkMxHv/M=,tag:Ma2Q0fSmyoyydyCcQ/9Cpg==,type:str]
+  pgp: []
+  encrypted_regex: ^(data|stringData)$
+  version: 3.7.3
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: vaultwarden-envs
+  namespace: k8s-at-home
+type: Opaque
+stringData:
+  admin-token: ENC[AES256_GCM,data:EPL9v8s2yd7LwNymfGFE6wIKCTbZ/NMTgwH7ndRE6DwoYuj0+r6uQZZnbjSd2U+HX707eTxGh4pV0ntAA2IgQA==,iv:kjvn5CLjOW1/R9UmbepR/OFyPD1fKQvLiHQFvuDAuRA=,tag:1H7b67XZXyS1912C7Md8jA==,type:str]
+  smtp-user: ENC[AES256_GCM,data:C+ZLN9yZLX5UjkExmxfgkGEDoqU=,iv:gXFmGlXMoCwVyZ2JUUnkmFLHsPBRn7/hFyJQWvn+9Kc=,tag:VDnd2XGCyTvIbeE1Pz857A==,type:str]
+  smtp-password: ENC[AES256_GCM,data:N9su+bHa5VRu,iv:rPTS1hqPxvb3v8RW9gTu8bIoxipKKL7ytpkPd07zcVE=,tag:bj71sBrsxNHf0SUAe0PJ1w==,type:str]
+  database-url: ENC[AES256_GCM,data:voI0418K5y9cwL6hx233wQoQQsHokL9AnhXhOc1Iq/vw2D3USw3IomoccS5hQrySKZAPTzmCtSVen/W6SnqQ/BmUet1hDRgmerluwOqp9tgXzyuZduASkLrU9u90zeh/mVTAFTUbC74XCBdV/F2s5Z50uWcgizUvibud7LJh57k6Hh/T6HS9JloEyC95rqa8wDSQwhb2M5BgcQ==,iv:8TjB//F6HAli/EfvALxYZC5Rcf+5OTrwkM2aA3tnbSI=,tag:5rx8OKVGJzYZZ25wmlXNCA==,type:str]
+sops:
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age:
+    - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYjlJWndmOVNDWjc0dU9r
+        eG14bmd3dVZqZmxTRUkvZk5tbm95RzNFK1F3ClpoOTBpWlJMUXhaM0kxaUE5OUdw
+        c1NVZG9yOFZEOUxUSnVKclpBczVuVlEKLS0tIDNBUnJUaHhPZ3R5TzNqZXl1QjJ4
+        SkE1L2tkQXphSlNmU2lVNldrNjU5Qk0KnUm93N3G7ZYU4UKWerKkJBCkpYh7oAmk
+        RNxWx6IGruh1XibBQnOzYvu8RrhqIg6QEgj9WSO4fUalPd0sHByofw==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2023-03-19T13:48:40Z"
+  mac: ENC[AES256_GCM,data:ypOqCj9iYS5rrP0mq2TLArE64INur8hTnU973JHK5BOL1Zedpd0NMT2m9gyx/EjyeEzL51gK7tWHVNMgIm7ZkQOGTV3QulTA3bzN3hr6jNeVajJlL3KiUCk7SWbAoK7NsAOh+dIvBCHy/iFDZiyUcgBYM5oPO4mas8iDyWJhywE=,iv:70UFCZpbCECccUzPQ4AvwPAzZ7/AcCSdcORAkMxHv/M=,tag:Ma2Q0fSmyoyydyCcQ/9Cpg==,type:str]
+  pgp: []
+  encrypted_regex: ^(data|stringData)$
+  version: 3.7.3
diff --git a/apps/production/vaultwarden-secret.yaml b/apps/production/vaultwarden-secret.yaml
@@ -1,63 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: vaultwarden-postgresql
-    namespace: k8s-at-home
-type: Opaque
-data:
-    postgresql-password: ENC[AES256_GCM,data:h3gXx8ZUR6mtyU++eOK0+lsNTKZGdJrmQx7TKxeySHpw2zcRElKq9maHtPOCKVXG5Tf0t9mLCL1Jf99ruyUoJVMg6ufyVO3pyZUGWGa+4BTIxQP3Fe2NzA==,iv:4XUj7NWmr5ogFHPJCkaktXjAmm0C04ZLFb4xz9e+UEQ=,tag:iyX7n7L5ZpERxiJXGFp+IA==,type:str]
-    postgresql-postgres-password: ENC[AES256_GCM,data:OG+tLnZrJ+R9FbXx2NOREw==,iv:JGvpSvk25JQYCxIxygInRusj2FGtmkCLzAX+ZbCTmok=,tag:RLsF+KO6nPqX/F0M6R4zow==,type:str]
-    password: ENC[AES256_GCM,data:cIvw4gC4s94bECR5V5vFZsyyQlk86kg+JmIcQr4fLb75/T2AcTAm9JOAtOa4yvCk789tOc7Tncw1vufcVoKQSuDS0oi2oEvQGCPdMeg01fHIJnQ5/xISMA==,iv:dItSer1bPtVb9mNoG4GTerRV2NN9AeLh+fiLBylayd4=,tag:YHgKtuQQNsIiTuuXzPqh6w==,type:str]
-    postgres-password: ENC[AES256_GCM,data:08Mh7/ogJjOu2E+m9Ln+4A==,iv:siHg00e+9xE/A8HvIqL8+YUkvqTYY77eI8aC0iSYOwQ=,tag:QTdMVCDBx6hVeO633gS+1Q==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYjlJWndmOVNDWjc0dU9r
-            eG14bmd3dVZqZmxTRUkvZk5tbm95RzNFK1F3ClpoOTBpWlJMUXhaM0kxaUE5OUdw
-            c1NVZG9yOFZEOUxUSnVKclpBczVuVlEKLS0tIDNBUnJUaHhPZ3R5TzNqZXl1QjJ4
-            SkE1L2tkQXphSlNmU2lVNldrNjU5Qk0KnUm93N3G7ZYU4UKWerKkJBCkpYh7oAmk
-            RNxWx6IGruh1XibBQnOzYvu8RrhqIg6QEgj9WSO4fUalPd0sHByofw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-19T13:48:40Z"
-    mac: ENC[AES256_GCM,data:ypOqCj9iYS5rrP0mq2TLArE64INur8hTnU973JHK5BOL1Zedpd0NMT2m9gyx/EjyeEzL51gK7tWHVNMgIm7ZkQOGTV3QulTA3bzN3hr6jNeVajJlL3KiUCk7SWbAoK7NsAOh+dIvBCHy/iFDZiyUcgBYM5oPO4mas8iDyWJhywE=,iv:70UFCZpbCECccUzPQ4AvwPAzZ7/AcCSdcORAkMxHv/M=,tag:Ma2Q0fSmyoyydyCcQ/9Cpg==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
----
-apiVersion: v1
-kind: Secret
-metadata:
-    name: vaultwarden-envs
-    namespace: k8s-at-home
-type: Opaque
-stringData:
-    admin-token: ENC[AES256_GCM,data:EPL9v8s2yd7LwNymfGFE6wIKCTbZ/NMTgwH7ndRE6DwoYuj0+r6uQZZnbjSd2U+HX707eTxGh4pV0ntAA2IgQA==,iv:kjvn5CLjOW1/R9UmbepR/OFyPD1fKQvLiHQFvuDAuRA=,tag:1H7b67XZXyS1912C7Md8jA==,type:str]
-    smtp-user: ENC[AES256_GCM,data:C+ZLN9yZLX5UjkExmxfgkGEDoqU=,iv:gXFmGlXMoCwVyZ2JUUnkmFLHsPBRn7/hFyJQWvn+9Kc=,tag:VDnd2XGCyTvIbeE1Pz857A==,type:str]
-    smtp-password: ENC[AES256_GCM,data:N9su+bHa5VRu,iv:rPTS1hqPxvb3v8RW9gTu8bIoxipKKL7ytpkPd07zcVE=,tag:bj71sBrsxNHf0SUAe0PJ1w==,type:str]
-    database-url: ENC[AES256_GCM,data:voI0418K5y9cwL6hx233wQoQQsHokL9AnhXhOc1Iq/vw2D3USw3IomoccS5hQrySKZAPTzmCtSVen/W6SnqQ/BmUet1hDRgmerluwOqp9tgXzyuZduASkLrU9u90zeh/mVTAFTUbC74XCBdV/F2s5Z50uWcgizUvibud7LJh57k6Hh/T6HS9JloEyC95rqa8wDSQwhb2M5BgcQ==,iv:8TjB//F6HAli/EfvALxYZC5Rcf+5OTrwkM2aA3tnbSI=,tag:5rx8OKVGJzYZZ25wmlXNCA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxYjlJWndmOVNDWjc0dU9r
-            eG14bmd3dVZqZmxTRUkvZk5tbm95RzNFK1F3ClpoOTBpWlJMUXhaM0kxaUE5OUdw
-            c1NVZG9yOFZEOUxUSnVKclpBczVuVlEKLS0tIDNBUnJUaHhPZ3R5TzNqZXl1QjJ4
-            SkE1L2tkQXphSlNmU2lVNldrNjU5Qk0KnUm93N3G7ZYU4UKWerKkJBCkpYh7oAmk
-            RNxWx6IGruh1XibBQnOzYvu8RrhqIg6QEgj9WSO4fUalPd0sHByofw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-19T13:48:40Z"
-    mac: ENC[AES256_GCM,data:ypOqCj9iYS5rrP0mq2TLArE64INur8hTnU973JHK5BOL1Zedpd0NMT2m9gyx/EjyeEzL51gK7tWHVNMgIm7ZkQOGTV3QulTA3bzN3hr6jNeVajJlL3KiUCk7SWbAoK7NsAOh+dIvBCHy/iFDZiyUcgBYM5oPO4mas8iDyWJhywE=,iv:70UFCZpbCECccUzPQ4AvwPAzZ7/AcCSdcORAkMxHv/M=,tag:Ma2Q0fSmyoyydyCcQ/9Cpg==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
diff --git a/clusters/production/apps.yaml b/clusters/production/apps.yaml
@@ -2,12 +2,34 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
+  name: apps-secrets
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  dependsOn:
+    - name: infra-configs
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./apps/production/secrets
+  prune: false
+  wait: true
+  timeout: 5m0s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
   name: apps
   namespace: flux-system
 spec:
   interval: 10m0s
   dependsOn:
     - name: infra-configs
+    - name: apps-secrets
   sourceRef:
     kind: GitRepository
     name: flux-system