viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migrate consuming stacks to ESO + remove k8s-dashboard static token

Browse source 
Phase 9: ExternalSecret migration across 26 stacks:

Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)

Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)

17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.

Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin
This commit is contained in:
Viktor Barzin 2026-03-15 19:05:04 +00:00
parent cfc30b62e8
commit 1acf8cc4e8
41 changed files with 1278 additions and 265 deletions
Download patch file Download diff file Expand all files Collapse all files

67
stacks/immich/main.tf
View file

@ -103,6 +103,33 @@ resource "kubernetes_namespace" "immich" {
}
}
resource "kubernetes_manifest" "external_secret" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
kind = "ExternalSecret"
metadata = {
name = "immich-secrets"
namespace = "immich"
}
spec = {
refreshInterval = "15m"
secretStoreRef = {
name = "vault-kv"
kind = "ClusterSecretStore"
}
target = {
name = "immich-secrets"
}
dataFrom = [{
extract = {
key = "immich"
}
}]
}
}
depends_on = [kubernetes_namespace.immich]
}
resource "kubernetes_deployment" "immich_server" {
metadata {
name = "immich-server"
@ -112,6 +139,9 @@ resource "kubernetes_deployment" "immich_server" {
app = "immich-server"
tier = local.tiers.gpu
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
lifecycle {
@ -140,8 +170,9 @@ resource "kubernetes_deployment" "immich_server" {
app = "immich-server"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"reloader.stakater.com/auto" = "true"
}
}
@ -169,8 +200,13 @@ resource "kubernetes_deployment" "immich_server" {
value = "immich"
}
env {
name = "DB_PASSWORD"
value = data.vault_kv_secret_v2.secrets.data["db_password"]
name = "DB_PASSWORD"
value_from {
secret_key_ref {
name = "immich-secrets"
key = "db_password"
}
}
}
env {
name = "IMMICH_MACHINE_LEARNING_URL"
@ -331,6 +367,9 @@ resource "kubernetes_deployment" "immich-postgres" {
labels = {
tier = local.tiers.gpu
}
annotations = {
"reloader.stakater.com/search" = "true"
}
}
lifecycle {
@ -365,8 +404,13 @@ resource "kubernetes_deployment" "immich-postgres" {
name = "postgresql"
}
env {
name = "POSTGRES_PASSWORD"
value = data.vault_kv_secret_v2.secrets.data["db_password"]
name = "POSTGRES_PASSWORD"
value_from {
secret_key_ref {
name = "immich-secrets"
key = "db_password"
}
}
}
env {
name = "POSTGRES_USER"
@ -641,13 +685,22 @@ resource "kubernetes_cron_job_v1" "postgresql-backup" {
image = "postgres:16.4-bullseye"
command = ["/bin/sh", "-c", <<-EOT
export now=$(date +"%Y_%m_%d_%H_%M")
PGPASSWORD=${data.vault_kv_secret_v2.secrets.data["db_password"]} pg_dumpall -h immich-postgresql -U immich > /backup/dump_$now.sql
pg_dumpall -h immich-postgresql -U immich > /backup/dump_$now.sql
# Rotate - delete last log file
cd /backup
find . -name "dump_*.sql" -type f -mtime +14 -delete # 14 day retention of backups
EOT
]
env {
name = "PGPASSWORD"
value_from {
secret_key_ref {
name = "immich-secrets"
key = "db_password"
}
}
}
volume_mount {
name = "postgresql-backup"
mount_path = "/backup"