viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migrate consuming stacks to ESO + remove k8s-dashboard static token

Browse source 
Phase 9: ExternalSecret migration across 26 stacks:

Fully migrated (vault data source removed, ESO delivers secrets):
- speedtest, shadowsocks, wealthfolio, plotting-book, f1-stream, tandoor
- n8n, dawarich, diun, netbox, onlyoffice, tuya-bridge
- hackmd (ESO template for DB URL), health (ESO template for DB URL)
- trading-bot (ESO template for DATABASE_URL + 7 secret env vars)
- forgejo (removed unused vault data source)

Partially migrated (vault kept for plan-time, ESO added for runtime):
- immich, linkwarden, nextcloud, paperless-ngx (jsondecode for homepage)
- claude-memory, rybbit, url, webhook_handler (plan-time in locals/jobs)
- woodpecker, openclaw, resume (plan-time in helm values/jobs/modules)

17 stacks unchanged (all plan-time: homepage annotations, configmaps,
module inputs) — vault data source works with OIDC auth.

Phase 17a: Remove k8s-dashboard static admin token secret.
Users now get tokens via: vault write kubernetes/creds/dashboard-admin
This commit is contained in:
Viktor Barzin 2026-03-15 19:05:04 +00:00
parent cfc30b62e8
commit 1acf8cc4e8
41 changed files with 1278 additions and 265 deletions
Download patch file Download diff file Expand all files Collapse all files

83
stacks/webhook_handler/main.tf
View file

@ -77,7 +77,7 @@ resource "kubernetes_deployment" "webhook_handler" {
tier = local.tiers.aux
}
annotations = {
"reloader.stakater.com/search" = "true"
"reloader.stakater.com/auto" = "true"
}
}
spec {
@ -126,32 +126,62 @@ resource "kubernetes_deployment" "webhook_handler" {
sub_path = "id_rsa"
}
env {
name = "WEBHOOKSECRET"
value = data.vault_kv_secret_v2.secrets.data["secret"]
name = "WEBHOOKSECRET"
value_from {
secret_key_ref {
name = "webhook-handler-secrets"
key = "secret"
}
}
}
env {
name = "FB_APP_SECRET"
value = data.vault_kv_secret_v2.secrets.data["fb_app_secret"]
name = "FB_APP_SECRET"
value_from {
secret_key_ref {
name = "webhook-handler-secrets"
key = "fb_app_secret"
}
}
}
env {
name = "FB_VERIFY_TOKEN"
value = data.vault_kv_secret_v2.secrets.data["fb_verify_token"]
name = "FB_VERIFY_TOKEN"
value_from {
secret_key_ref {
name = "webhook-handler-secrets"
key = "fb_verify_token"
}
}
}
env {
name = "FB_PAGE_TOKEN"
value = data.vault_kv_secret_v2.secrets.data["fb_page_token"]
name = "FB_PAGE_TOKEN"
value_from {
secret_key_ref {
name = "webhook-handler-secrets"
key = "fb_page_token"
}
}
}
env {
name = "CONFIG"
value = "./chatbot/config/viktorwebservices.yaml"
}
env {
name = "GIT_USER"
value = data.vault_kv_secret_v2.secrets.data["git_user"]
name = "GIT_USER"
value_from {
secret_key_ref {
name = "webhook-handler-secrets"
key = "git_user"
}
}
}
env {
name = "GIT_TOKEN"
value = data.vault_kv_secret_v2.secrets.data["git_token"]
name = "GIT_TOKEN"
value_from {
secret_key_ref {
name = "webhook-handler-secrets"
key = "git_token"
}
}
}
env {
name = "SSH_KEY"
@ -205,3 +235,30 @@ module "ingress" {
"gethomepage.dev/pod-selector" = ""
}
}
resource "kubernetes_manifest" "external_secret" {
manifest = {
apiVersion = "external-secrets.io/v1beta1"
kind = "ExternalSecret"
metadata = {
name = "webhook-handler-secrets"
namespace = "webhook-handler"
}
spec = {
refreshInterval = "15m"
secretStoreRef = {
name = "vault-kv"
kind = "ClusterSecretStore"
}
target = {
name = "webhook-handler-secrets"
}
dataFrom = [{
extract = {
key = "webhook-handler"
}
}]
}
}
depends_on = [kubernetes_namespace.webhook-handler]
}