fix(monitoring): add the ExternalSecret PR #NNN missed

gitops/workloads/monitoring/alertmanager-externalsecret.yaml

@@ -0,0 +1,49 @@
+---
+# Alertmanager notification endpoints, pulled from Vault.
+#
+# WHY THESE ARE SECRETS
+#
+# ntfy has no accounts — the topic name IS the password. Anyone who knows the
+# topic can both read every alert this lab emits and publish fake ones. Same for
+# the healthchecks.io ping URL: its UUID is the only credential. Neither may be
+# committed, so both live in Vault and are mounted into the Alertmanager pod.
+#
+# Storing the FULL URL (not just the topic) also means the query string —
+# including ntfy's message-template parameters, priority and tags — can be tuned
+# without a commit and an Argo sync. Alertmanager reads these files at
+# /etc/alertmanager/secrets/alertmanager-endpoints/ via `url_file`.
+#
+# SEED VAULT BEFORE ARGO SYNCS THIS:
+#
+#   # Pick an unguessable topic — this is the password.
+#   TOPIC="lab-$(openssl rand -hex 16)"
+#
+#   vault kv patch secret/lab/alertmanager \
+#     ntfy-url="https://ntfy.sh/${TOPIC}?priority=5&tags=rotating_light" \
+#     watchdog-url="https://hc-ping.com/<uuid-of-the-alertmanager-watchdog-check>"
+#
+# Then subscribe to ${TOPIC} in the ntfy app, and create a healthchecks.io check
+# named `alertmanager-watchdog` with Period 15m / Grace 10m — see the Watchdog
+# receiver in gitops/apps/monitoring.yaml for why that cadence.
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: alertmanager-endpoints
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: alertmanager-endpoints
+    creationPolicy: Owner
+  data:
+    - secretKey: ntfy-url
+      remoteRef:
+        key: secret/lab/alertmanager
+        property: ntfy-url
+    - secretKey: watchdog-url
+      remoteRef:
+        key: secret/lab/alertmanager
+        property: watchdog-url