Mukul Sharma
84f5e27238
One Vault path (secret/toolshed/postgres) into two namespaces: the server needs the credential to initialise, api needs it to connect. Kept in one file because it is one credential with two consumers — split, they drift, and drift surfaces as an authentication error that looks nothing like a config mistake. The api-side Secret also carries a composed libpq URL, so host, port and database name live in one place instead of across several environment variables that can disagree. Postgres gets its own namespace rather than living inside toolshed, so it is addressed over cluster DNS like any other platform component and outlives whatever consumes it.
83 lines
2.8 KiB
YAML
83 lines
2.8 KiB
YAML
# PostgreSQL credentials for toolshed, from one Vault path into two
|
|
# namespaces: the server needs them to initialise the database, and
|
|
# toolshed's api needs them to connect. Kept in one file because they are one
|
|
# credential with two consumers — splitting them invites the two drifting
|
|
# apart, which fails as an authentication error that looks nothing like a
|
|
# config mistake.
|
|
#
|
|
# Put the credential in Vault BEFORE syncing either of these. External
|
|
# Secrets cannot create a Secret for a path that does not exist, and the
|
|
# PostgreSQL pod will sit in CreateContainerConfigError until it can:
|
|
#
|
|
# kubectl -n vault exec -i vault-0 -- sh -lc '
|
|
# vault login <root-token> >/dev/null &&
|
|
# vault kv put secret/toolshed/postgres \
|
|
# username=toolshed \
|
|
# password=<a long alphanumeric password>'
|
|
#
|
|
# Use an alphanumeric password. It is interpolated into a libpq connection
|
|
# URL below, where @ : / ? # would need percent-encoding, and a password that
|
|
# silently truncates the URL is a genuinely unpleasant thing to debug.
|
|
#
|
|
# Remember that `kubectl exec` into Vault is unauthenticated by default —
|
|
# without the `vault login` the commands fail with a "preflight capability
|
|
# check" error that reads like a permissions bug rather than a missing login.
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: postgresql-credentials
|
|
namespace: postgres
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: postgresql-credentials
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: toolshed/postgres
|
|
property: username
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: toolshed/postgres
|
|
property: password
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: toolshed-db
|
|
namespace: toolshed
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: toolshed-db
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
username: "{{ .username }}"
|
|
password: "{{ .password }}"
|
|
# Composed here rather than assembled in application code, so the
|
|
# host, port and database name live in one place instead of being
|
|
# spread across environment variables that can disagree.
|
|
#
|
|
# sslmode=disable is consistent with this cluster running plain HTTP
|
|
# throughout; traffic stays on the pod network. It is the first thing
|
|
# to change if this ever leaves the homelab.
|
|
url: "postgres://{{ .username }}:{{ .password }}@postgresql.postgres.svc.cluster.local:5432/toolshed?sslmode=disable"
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: toolshed/postgres
|
|
property: username
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: toolshed/postgres
|
|
property: password
|