Skip to content

Commit 963de21

Browse files
akhil27051999akhil27051999
committed
Added external-secrets helm files
1 parent 39e89b6 commit 963de21

9 files changed

Lines changed: 130 additions & 0 deletions

File tree

‎helm/external-secrets/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: external-secrets
3+
description: Helm chart for External Secrets Operator with Vault
4+
type: application
5+
version: 0.1.0
6+
appVersion: v0.9.9

‎helm/external-secrets/templates/clusterrole.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: external-secrets-cluster-role
5+
rules:
6+
- apiGroups: [""]
7+
resources: ["secrets", "namespaces"]
8+
verbs: ["get", "list", "watch", "create", "update", "patch"]
9+
- apiGroups: ["external-secrets.io"]
10+
resources: ["secretstores", "clustersecretstores", "externalsecrets", "clusterexternalsecrets"]
11+
verbs: ["get", "list", "watch", "create", "update", "patch"]

‎helm/external-secrets/templates/clusterrolebinding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: external-secrets-cluster-role-binding
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: ClusterRole
8+
name: external-secrets-cluster-role
9+
subjects:
10+
- kind: ServiceAccount
11+
name: {{ .Values.serviceAccount.name }}
12+
namespace: {{ .Values.namespaces.eso }}

‎helm/external-secrets/templates/clustersecretstore.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ClusterSecretStore
3+
metadata:
4+
name: vault-secretstore
5+
spec:
6+
provider:
7+
vault:
8+
server: {{ .Values.vault.server | quote }}
9+
path: {{ .Values.vault.path | quote }}
10+
version: {{ .Values.vault.version | quote }}
11+
auth:
12+
tokenSecretRef:
13+
name: {{ .Values.vault.secretName }}
14+
key: token
15+
namespace: {{ .Values.namespaces.eso }}

‎helm/external-secrets/templates/deployment.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: external-secrets-operator
5+
namespace: {{ .Values.namespaces.eso }}
6+
spec:
7+
replicas: {{ .Values.replicaCount }}
8+
selector:
9+
matchLabels:
10+
app: external-secrets
11+
template:
12+
metadata:
13+
labels:
14+
app: external-secrets
15+
spec:
16+
serviceAccountName: {{ .Values.serviceAccount.name }}
17+
nodeSelector:
18+
type: {{ .Values.nodeSelector.type }}
19+
containers:
20+
- name: external-secrets-operator
21+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
22+
imagePullPolicy: {{ .Values.image.pullPolicy }}

‎helm/external-secrets/templates/externalsecret.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: external-secrets.io/v1beta1
2+
kind: ExternalSecret
3+
metadata:
4+
name: {{ .Values.database.secretName }}
5+
namespace: {{ .Values.namespaces.app }}
6+
spec:
7+
refreshInterval: 1m
8+
secretStoreRef:
9+
name: vault-secretstore
10+
kind: ClusterSecretStore
11+
target:
12+
name: {{ .Values.database.secretName }}
13+
creationPolicy: Owner
14+
data:
15+
- secretKey: {{ .Values.database.usernameKey }}
16+
remoteRef:
17+
key: {{ .Values.database.vaultKey }}
18+
property: {{ .Values.database.usernameKey }}
19+
- secretKey: {{ .Values.database.passwordKey }}
20+
remoteRef:
21+
key: {{ .Values.database.vaultKey }}
22+
property: {{ .Values.database.passwordKey }}

‎helm/external-secrets/templates/secret-vault-token.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ .Values.vault.secretName }}
5+
namespace: {{ .Values.namespaces.eso }}
6+
type: Opaque
7+
stringData:
8+
token: {{ .Values.vault.token | quote }}

‎helm/external-secrets/templates/serviceaccount.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: {{ .Values.serviceAccount.name }}
5+
namespace: {{ .Values.namespaces.eso }}

‎helm/external-secrets/values.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
namespaces:
2+
eso: external-secrets
3+
app: student-api
4+
5+
replicaCount: 1
6+
7+
image:
8+
repository: ghcr.io/external-secrets/external-secrets
9+
tag: v0.9.9
10+
pullPolicy: IfNotPresent
11+
12+
serviceAccount:
13+
name: external-secrets
14+
15+
vault:
16+
secretName: vault-token
17+
token: "root"
18+
server: "http://vault.vault.svc.cluster.local:8200"
19+
path: "secret"
20+
version: "v2"
21+
22+
database:
23+
secretName: postgres-secret
24+
vaultKey: studentdb
25+
usernameKey: POSTGRES_USER
26+
passwordKey: POSTGRES_PASSWORD
27+
28+
nodeSelector:
29+
type: dependent_services

0 commit comments

Comments
 (0)