mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
48b0873ca3
The Scouting MBG photos (immich) will log in through this authentik, which later passes on Scouts Online. The provider issues immich_role and immich_quota: admins and the members of "MBG kader" may upload (-1), everyone else gets a quota of 0, which makes immich refuse uploads. "MBG leden" and "MBG kader" are filled by the Scouts Online source in a next step; until then only authentik Admins can use the app. The scouting blueprints and their secrets are mounted as directories rather than with subPath, and the blueprint reads the client secret with !File instead of !Env, so later changes reach authentik without a restart.
175 lines
3.8 KiB
YAML
175 lines
3.8 KiB
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-secrets
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: authentik-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: secret_key
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: secret_key
|
|
- secretKey: bootstrap_password
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: bootstrap_password
|
|
- secretKey: bootstrap_token
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: bootstrap_token
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: authentik-postgres-credentials
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: authentik-postgres-credentials
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: postgres_user
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: kv/authentik
|
|
property: postgres_password
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: vault-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: vault-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/vault-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: stalwart-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: stalwart-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/stalwart-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: argocd-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: argocd-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/argocd-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: freshrss-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: freshrss-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/freshrss-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: actualbudget-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: actualbudget-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/actualbudget-oidc
|
|
property: client_secret
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: longhorn-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: longhorn-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/longhorn-oidc
|
|
property: client_secret
|
|
---
|
|
# Mounted as a file for blueprint-scouting.yaml, not as an env variable.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: immich-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: immich-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/immich-oidc
|
|
property: client_secret
|