From 34521e65270b48f2f0d51c4a23d7dd8192420259 Mon Sep 17 00:00:00 2001 From: Edward Cheng Date: Mon, 15 Jul 2024 22:37:46 +1000 Subject: [PATCH] add sealed-secrets --- .../env/k3s-cluster/kustomization.yaml | 4 -- projects/k3s-cluster-secrets.yaml | 52 ------------------- .../sealed-secrets/base/kustomization.yaml | 8 +++ .../env/k3s-cluster/config.json | 6 +-- .../env/k3s-cluster/kustomization.yaml | 0 .../env/k3s-cluster/values.yaml | 3 ++ secrets/env/k3s-cluster/Chart.yaml | 23 -------- .../env/k3s-cluster/templates/secrets.yaml | 10 ---- .../templates/secrets/postgresql.yaml | 32 ------------ 9 files changed, 14 insertions(+), 124 deletions(-) delete mode 100644 infrastructures/postgresql/env/k3s-cluster/kustomization.yaml delete mode 100644 projects/k3s-cluster-secrets.yaml create mode 100644 resources/sealed-secrets/base/kustomization.yaml rename {secrets => resources/sealed-secrets}/env/k3s-cluster/config.json (63%) rename resources/{secrets => sealed-secrets}/env/k3s-cluster/kustomization.yaml (100%) create mode 100644 resources/sealed-secrets/env/k3s-cluster/values.yaml delete mode 100644 secrets/env/k3s-cluster/Chart.yaml delete mode 100644 secrets/env/k3s-cluster/templates/secrets.yaml delete mode 100644 secrets/env/k3s-cluster/templates/secrets/postgresql.yaml diff --git a/infrastructures/postgresql/env/k3s-cluster/kustomization.yaml b/infrastructures/postgresql/env/k3s-cluster/kustomization.yaml deleted file mode 100644 index 2aa8841..0000000 --- a/infrastructures/postgresql/env/k3s-cluster/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -#apiVersion: kustomize.config.k8s.io/v1beta1 -#kind: Kustomization -#resources: -# - ../../base \ No newline at end of file diff --git a/projects/k3s-cluster-secrets.yaml b/projects/k3s-cluster-secrets.yaml deleted file mode 100644 index 82a9d8f..0000000 --- a/projects/k3s-cluster-secrets.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: ApplicationSet -metadata: - annotations: - argocd.argoproj.io/sync-wave: "2" - creationTimestamp: null - name: app-secrets - namespace: argocd -spec: - generators: - - git: - files: - - path: secrets/env/k3s-cluster/config.json - repoURL: https://github.com/3dwardch3ng/home-cluster-ops.git - requeueAfterSeconds: 20 - revision: "" - template: - metadata: {} - spec: - destination: {} - project: "" - source: - repoURL: "" - syncPolicy: { } - template: - metadata: - metadata: - labels: - app.kubernetes.io/managed-by: argocd - app.kubernetes.io/name: '{{ appName }}' - name: '{{ userGivenName }}' - namespace: argocd - spec: - destination: - namespace: '{{ destNamespace }}' - server: '{{ destServer }}' - ignoreDifferences: - - group: argoproj.io - jsonPointers: - - /status - kind: Application - project: k3s-cluster - source: - helm: - valueFiles: - - secrets://{{ srcPath }}/postgresql.yaml - syncPolicy: - automated: - allowEmpty: true - prune: true - selfHeal: true -status: {} \ No newline at end of file diff --git a/resources/sealed-secrets/base/kustomization.yaml b/resources/sealed-secrets/base/kustomization.yaml new file mode 100644 index 0000000..db6356b --- /dev/null +++ b/resources/sealed-secrets/base/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +helmCharts: + - name: sealed-secrets + repo: https://bitnami-labs.github.io/sealed-secrets + version: 2.16.0 + releaseName: sealed-secrets + valuesFile: values.yaml \ No newline at end of file diff --git a/secrets/env/k3s-cluster/config.json b/resources/sealed-secrets/env/k3s-cluster/config.json similarity index 63% rename from secrets/env/k3s-cluster/config.json rename to resources/sealed-secrets/env/k3s-cluster/config.json index 23b2c14..a689d07 100644 --- a/secrets/env/k3s-cluster/config.json +++ b/resources/sealed-secrets/env/k3s-cluster/config.json @@ -1,9 +1,9 @@ { - "appName": "app-secrets", - "userGivenName": "app-secrets", + "appName": "sealed-secrets", + "userGivenName": "sealed-secrets", "destNamespace": "argocd", "destServer": "https://kubernetes.default.svc", - "srcPath": "secrets/env/k3s-cluster/templates/secrets", + "srcPath": "resources/sealed-secrets/env/k3s-cluster", "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git", "srcTargetRevision": "", "labels": null, diff --git a/resources/secrets/env/k3s-cluster/kustomization.yaml b/resources/sealed-secrets/env/k3s-cluster/kustomization.yaml similarity index 100% rename from resources/secrets/env/k3s-cluster/kustomization.yaml rename to resources/sealed-secrets/env/k3s-cluster/kustomization.yaml diff --git a/resources/sealed-secrets/env/k3s-cluster/values.yaml b/resources/sealed-secrets/env/k3s-cluster/values.yaml new file mode 100644 index 0000000..5284b86 --- /dev/null +++ b/resources/sealed-secrets/env/k3s-cluster/values.yaml @@ -0,0 +1,3 @@ +service: + type: NodePort + nodePort: 31008 \ No newline at end of file diff --git a/secrets/env/k3s-cluster/Chart.yaml b/secrets/env/k3s-cluster/Chart.yaml deleted file mode 100644 index 62d4ae3..0000000 --- a/secrets/env/k3s-cluster/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v2 -name: app-secrets -description: Applications - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. -type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.0 - -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -appVersion: "1.0" diff --git a/secrets/env/k3s-cluster/templates/secrets.yaml b/secrets/env/k3s-cluster/templates/secrets.yaml deleted file mode 100644 index 1cf0d5b..0000000 --- a/secrets/env/k3s-cluster/templates/secrets.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: app-secrets - namespace: argocd -spec: - source: - helm: - valueFiles: - - secrets://secrets/postgresql.yaml \ No newline at end of file diff --git a/secrets/env/k3s-cluster/templates/secrets/postgresql.yaml b/secrets/env/k3s-cluster/templates/secrets/postgresql.yaml deleted file mode 100644 index 0685a98..0000000 --- a/secrets/env/k3s-cluster/templates/secrets/postgresql.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: postgresql-secrets - namespace: flux-system -type: Opaque -stringData: - postgres_password: ENC[AES256_GCM,data:zue+FIUT+6iVqetulQIPegJKuJg=,iv:YEIaGAFPK73+qXZ3lx95kEbVCELSvMCwdeiryZXK+kQ=,tag:VHbpcCVTpHuMGR2Sh+5Zjg==,type:str] - username: ENC[AES256_GCM,data:OiDwHKxM,iv:rWmb9BV1qZ7I5bg/MZjSyHroz1esi4xNl6hrfEm/53o=,tag:vPcZAHDqCYk2JsFwgqwE7A==,type:str] - password: ENC[AES256_GCM,data:UjKHr0IGhiK7vlwg0URqpxUXONM=,iv:B5AYc4HCxcaImlYxKYNNeRcpznGXlkFqA0ybxf8duLY=,tag:mpLmMvTzahTp0iIiBtYGrw==,type:str] - database: ENC[AES256_GCM,data:TxW5MxlS6DY=,iv:bOoQvdNz7mul5ibqDjiJ/C1UoHS37OxjK/seXHn1UCc=,tag:O5OSrqSf0ziNGnxVZP6+Zg==,type:str] - replication_password: ENC[AES256_GCM,data:NbeXfZuVCbyeAdMA7l7mX6jJyTQ=,iv:P0l1LOr7GyVoE+lYchU0w1KUgoqEbxR6Fy5OYFhjW8E=,tag:3+uKwk3a71nQNIaCKVCV9Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1d47q8mlty404pxx378q49hr93aqexca4mkeqtdm00w4gjd09xd0qhxcdcz - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUlc3dUF6bnp2L0J5UXpx - NU5XWlZhdDhHWGJDVTljYUtxd2xWOUozSXdVCnN2UnZIRWt1d2xoWXpYYmI1Z2pC - ZE5MTy9LdTgza2VPUmYvSHplU2JiTEEKLS0tIGhTVjU3M3dDd3Jpb21aM2J0QmlF - ZHFxd3dFZTJxcG9QTFA5dFRZK1JicTgKRM29yMy9JVrXe/9LZ/XnsNyVXUEJ1qBS - 0mhGIkv/zukXzmJ0VAJ+pAgJMcgcOYNPg9Mjhny3zYvdONGlcGj2HA== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-06-18T03:05:29Z" - mac: ENC[AES256_GCM,data:hwEwWTOy164Cnu2xRkP4GiyJhgUuIvHwRb970OMYPLM2cYGN0DudIjkB2qbjtR8DSgaVT2h+sJrkWdgp4sjlROLeEbeZDMrZZ/RxNjeb364guJpmpAZts6DaYWCc9VukCpGnFTRzARoyEiYin8fw4KhfdwuzuOQq2fkQOued0mw=,iv:Os10YeN0KM1a676aUbuSDxmgc+FfqzP0FEJ5417okfw=,tag:2fJbvY9V9Ixm6Mn6JfOJEQ==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.8.1