mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
7acb7eaa8c
ESO 0.16.2 is the one release that serves both v1beta1 and v1. 0.17 stops serving v1beta1, so manifests still on v1beta1 would fail to sync from the next hop on. For these resources the schemas are name-identical (conversion strategy None); only the apiVersion changes.
73 lines
2.3 KiB
YAML
73 lines
2.3 KiB
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: vault-oidc-config
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: vault-oidc-config
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client_secret
|
|
remoteRef:
|
|
key: kv/vault-oidc
|
|
property: client_secret
|
|
- secretKey: admin_token
|
|
remoteRef:
|
|
key: kv/vault-oidc
|
|
property: admin_token
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: vault-configure-oidc
|
|
annotations:
|
|
argocd.argoproj.io/hook: PostSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: configure
|
|
image: hashicorp/vault:1.15
|
|
env:
|
|
- name: VAULT_ADDR
|
|
value: "http://vault-active.vault.svc:8200"
|
|
- name: VAULT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: vault-oidc-config
|
|
key: admin_token
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: vault-oidc-config
|
|
key: client_secret
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
vault auth enable oidc 2>/dev/null || true
|
|
vault auth tune -listing_visibility=unauth oidc/
|
|
vault policy write admin - <<'POLICY'
|
|
path "*" {
|
|
capabilities = ["create", "read", "update", "delete", "list", "sudo"]
|
|
}
|
|
POLICY
|
|
vault write auth/oidc/config \
|
|
oidc_discovery_url="https://authentik.rubenhensen.nl/application/o/vault/" \
|
|
oidc_client_id="vault" \
|
|
oidc_client_secret="$OIDC_CLIENT_SECRET" \
|
|
default_role="default"
|
|
vault write auth/oidc/role/default \
|
|
allowed_redirect_uris="https://vault.rubenhensen.nl/ui/vault/auth/oidc/oidc/callback" \
|
|
allowed_redirect_uris="http://localhost:8250/oidc/callback" \
|
|
user_claim="preferred_username" \
|
|
oidc_scopes="openid,profile,email" \
|
|
groups_claim="groups" \
|
|
policies="default,admin"
|
|
restartPolicy: OnFailure
|