7d297dc6b1
Phase 3 of the ESO 0.12->2.6 migration (the last k8s-1.35 compat-gate blocker).
Climbed external-secrets 0.16.2 -> 0.17.0 -> ... -> 2.6.0 one minor at a time,
each hop applied + verified (ES sync held at 109 Ready every hop; atomic=true
rollback safety net). Crossed the 0.17 cutoff (v1beta1 serving removed) only
after Phase 2 put all 104 ExternalSecrets + 2 ClusterSecretStores on
external-secrets.io/v1. Result: compat-gate now returns "OK: cluster is safe to
upgrade to 1.35.6" (EXIT 0) — the autonomous version-check chain will take k8s
1.34 -> 1.35 on its next nightly run.
Also fixes the repo-wide stale-lock issue that broke CI pipeline 332: the
terragrunt-generated providers.tf declares gavinbunney/kubectl + telmate/proxmox,
but ~28-39 stacks' committed .terraform.lock.hcl predated that ("Inconsistent
dependency lock file: no version selected"). Reconciled via `tg init -upgrade`
and committed so `terragrunt apply`/CI work cleanly again.
Docs: .claude/CLAUDE.md ESO line corrected (104 ESs, v1, chart 2.6.0); plan doc
marked COMPLETE.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
92 lines
2.6 KiB
HCL
92 lines
2.6 KiB
HCL
resource "kubernetes_namespace" "external_secrets" {
|
|
metadata {
|
|
name = "external-secrets"
|
|
labels = {
|
|
tier = local.tiers.cluster
|
|
"keel.sh/enrolled" = "true"
|
|
}
|
|
}
|
|
lifecycle {
|
|
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
|
|
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "external_secrets" {
|
|
name = "external-secrets"
|
|
namespace = kubernetes_namespace.external_secrets.metadata[0].name
|
|
repository = "https://charts.external-secrets.io"
|
|
chart = "external-secrets"
|
|
# ESO 0.12->2.6 migration (2026-06-21, docs/plans/2026-06-21-eso-0.12-to-2.x-migration-design.md).
|
|
# Stepped one minor at a time on k8s 1.34; rewrite all 104 CRs v1beta1->v1 at 0.16.2 before 0.17.
|
|
version = "2.6.0"
|
|
|
|
# Added for the migration: auto-rollback a failed hop's helm upgrade (ESO had no
|
|
# rollback safety net) and wait for the controller Deployment to be Ready first.
|
|
atomic = true
|
|
timeout = 600
|
|
|
|
values = [yamlencode({
|
|
installCRDs = true
|
|
})]
|
|
}
|
|
|
|
# --- ClusterSecretStore for Vault KV v2 ---
|
|
|
|
resource "kubernetes_manifest" "css_vault_kv" {
|
|
manifest = {
|
|
apiVersion = "external-secrets.io/v1"
|
|
kind = "ClusterSecretStore"
|
|
metadata = { name = "vault-kv" }
|
|
spec = {
|
|
provider = {
|
|
vault = {
|
|
server = "http://vault-active.vault.svc.cluster.local:8200"
|
|
path = "secret"
|
|
version = "v2"
|
|
auth = {
|
|
kubernetes = {
|
|
mountPath = "kubernetes"
|
|
role = "eso"
|
|
serviceAccountRef = {
|
|
name = "external-secrets"
|
|
namespace = "external-secrets"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
depends_on = [helm_release.external_secrets]
|
|
}
|
|
|
|
# --- ClusterSecretStore for Vault Database Engine ---
|
|
|
|
resource "kubernetes_manifest" "css_vault_db" {
|
|
manifest = {
|
|
apiVersion = "external-secrets.io/v1"
|
|
kind = "ClusterSecretStore"
|
|
metadata = { name = "vault-database" }
|
|
spec = {
|
|
provider = {
|
|
vault = {
|
|
server = "http://vault-active.vault.svc.cluster.local:8200"
|
|
path = "database"
|
|
version = "v1"
|
|
auth = {
|
|
kubernetes = {
|
|
mountPath = "kubernetes"
|
|
role = "eso"
|
|
serviceAccountRef = {
|
|
name = "external-secrets"
|
|
namespace = "external-secrets"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
depends_on = [helm_release.external_secrets]
|
|
}
|