31 lines
1.2 KiB
YAML
31 lines
1.2 KiB
YAML
# Points External Secrets Operator at your Vault as a secrets backend.
|
|
# Auth is via the Kubernetes auth method (see the vault CLI commands run
|
|
# to set this up: `vault auth enable kubernetes`, the "external-secrets"
|
|
# role bound to the external-secrets ServiceAccount) — no long-lived Vault
|
|
# token stored anywhere; ESO authenticates dynamically using its own
|
|
# ServiceAccount's projected token each time it needs to read a secret.
|
|
#
|
|
# server uses Vault's internal cluster-DNS Service name, not the ingress
|
|
# host — this is pod-to-pod traffic, same reasoning as claude.md's
|
|
# "Pending" note about Jenkins pushing to Harbor via
|
|
# harbor-core.harbor.svc.cluster.local instead of going through Contour.
|
|
# tls_disable is set in Vault's own listener config (lab only), so this is
|
|
# http://, not https://.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ClusterSecretStore
|
|
metadata:
|
|
name: vault-backend
|
|
spec:
|
|
provider:
|
|
vault:
|
|
server: "http://vault.vault.svc.cluster.local:8200"
|
|
path: "secret"
|
|
version: "v2"
|
|
auth:
|
|
kubernetes:
|
|
mountPath: "kubernetes"
|
|
role: "external-secrets"
|
|
serviceAccountRef:
|
|
name: "external-secrets"
|
|
namespace: "external-secrets"
|