mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
054117ad6d
The store went through https://vault.rubenhensen.nl, so via Hetzner and the home internet connection. When home internet dropped, the store validation failed and External Secrets backed off long enough that it needed a controller restart after the connection came back. vault-active.vault.svc talks to the active Vault pod directly. It's plain HTTP, same as the ingress → Vault hop already is.
21 lines
714 B
YAML
21 lines
714 B
YAML
apiVersion: external-secrets.io/v1beta1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vault-backend
|
|
spec:
|
|
provider:
|
|
vault:
|
|
# In-cluster, so syncing secrets doesn't depend on Hetzner or the home
|
|
# internet connection. Plain HTTP, like the ingress → Vault hop.
|
|
server: "http://vault-active.vault.svc:8200"
|
|
path: "kv"
|
|
# Version is the Vault KV secret engine version.
|
|
# This can be either "v1" or "v2", defaults to "v2"
|
|
version: "v2"
|
|
auth:
|
|
# points to a secret that contains a vault token
|
|
# https://www.vaultproject.io/docs/auth/token
|
|
tokenSecretRef:
|
|
name: "vault-token"
|
|
namespace: external-secrets
|
|
key: "token" |