diff --git a/helm-overrides/k8s-admin-prd-ase1/external-secrets/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/external-secrets/custom-values.yaml index 2e983a9..b4b4d39 100644 --- a/helm-overrides/k8s-admin-prd-ase1/external-secrets/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/external-secrets/custom-values.yaml @@ -1,56 +1,37 @@ external-secrets: - replicaCount: 1 + # Fresh install — nothing runs this today, so no adoption gotchas here + # (unlike gitea/vault/contour). Replaces the Vault Agent Injector as the + # path for getting secrets into pods (see the injector.enabled: false + # note in ../vault/custom-values.yaml) — nothing is wired to a + # SecretStore/ClusterSecretStore backend yet, that's a separate step + # once this controller itself is up and healthy. + # + # installCRDs defaults to true — leaving it, this is a fresh cluster + # with no existing SecretStore/ExternalSecret CRs whose schema this + # could clobber. + # + # All three components (controller, webhook, cert-controller) default + # to unbounded resources — every other app in this repo gets trimmed + # requests/limits for the same reason, staying consistent here. + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + memory: 128Mi - # -- If set, install and upgrade CRDs through helm chart. - installCRDs: true - - crds: - # -- If true, create CRDs for Cluster External Secret. - createClusterExternalSecret: true - # -- If true, create CRDs for Cluster Secret Store. - createClusterSecretStore: true - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Annotations to add to Pod - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "8080" - prometheus.io/path: "/metrics" - - tolerations: - - effect: NoSchedule - key: dedicated - operator: Equal - value: devops - nodeSelector: - dedicated: devops - certController: - tolerations: - - effect: NoSchedule - key: dedicated - operator: Equal - value: devops - nodeSelector: - dedicated: devops - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "8080" - prometheus.io/path: "/metrics" webhook: - tolerations: - - effect: NoSchedule - key: dedicated - operator: Equal - value: devops - nodeSelector: - dedicated: devops - podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "8080" - prometheus.io/path: "/metrics" + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + memory: 64Mi + + certController: + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + memory: 64Mi diff --git a/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml b/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml index d7afce0..f147415 100644 --- a/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml +++ b/helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml @@ -1,22 +1,24 @@ vault: - # This is your live `helm get values vault -n vault` output, verbatim — - # not a rewrite. Production mode (file storage, not dev), standalone - # (no HA/raft). Init/unseal are still NEVER in Git or scripted: run by - # hand and keep the unseal keys / root token in a password manager, same - # as claude.md says. This adoption only manages Vault's own Deployment - # config, not its data or seal state. + # This started as your live `helm get values vault -n vault` output, + # verbatim. One deliberate deviation from that since: injector.enabled + # is now false, not true. Secret delivery into pods is going through + # External Secrets Operator instead of Vault Agent Injector sidecars — + # nothing currently depends on the injector (claude.md's "Pending / not + # yet built" list has "Vault Agent Injector annotations for pulling + # secrets at pod start" — never actually wired up to any workload), so + # this removes an unused webhook rather than breaking anything live. + # + # Production mode (file storage, not dev), standalone (no HA/raft). + # Init/unseal are still NEVER in Git or scripted: run by hand and keep + # the unseal keys / root token in a password manager, same as claude.md + # says. This adoption only manages Vault's own Deployment config, not + # its data or seal state. # # `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH # required — this is claude.md issue #10 (Vault UI 404'd until both were # set; the chart has two separate toggles for the same thing). injector: - enabled: true - resources: - limits: - memory: 128Mi - requests: - cpu: 50m - memory: 64Mi + enabled: false server: dataStorage: diff --git a/helm-templates/external-secrets-2.6.0/Chart.yaml b/helm-templates/external-secrets-2.6.0/Chart.yaml deleted file mode 100644 index e51d045..0000000 --- a/helm-templates/external-secrets-2.6.0/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: external-secrets -version: 1.0.0 -dependencies: - - name: external-secrets - version: 2.6.0 - repository: https://charts.external-secrets.io diff --git a/helm-templates/external-secrets/Chart.lock b/helm-templates/external-secrets/Chart.lock new file mode 100644 index 0000000..a08b585 --- /dev/null +++ b/helm-templates/external-secrets/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 2.6.0 +digest: sha256:18576e23abafb5305e77f03826b4f6d7f7b48adaf18934416511ea7f8d757b26 +generated: "2026-08-31T07:51:26.802283+05:30" diff --git a/helm-templates/external-secrets/Chart.yaml b/helm-templates/external-secrets/Chart.yaml index 2b61903..9c43654 100644 --- a/helm-templates/external-secrets/Chart.yaml +++ b/helm-templates/external-secrets/Chart.yaml @@ -3,5 +3,10 @@ name: external-secrets version: 1.0.0 dependencies: - name: external-secrets - version: 0.5.9 + # Was 0.5.9 (very old pre-1.0 stream). Using the version the fleet's + # own external-secrets-2.6.0 versioned sibling already targeted as its + # upgrade candidate, rather than picking a fresh version myself — no + # live install here to match, but no reason to skip a decision someone + # already made deliberately, either. + version: 2.6.0 repository: https://charts.external-secrets.io \ No newline at end of file diff --git a/helm-templates/external-secrets/charts/external-secrets-2.6.0.tgz b/helm-templates/external-secrets/charts/external-secrets-2.6.0.tgz new file mode 100644 index 0000000..327ec45 Binary files /dev/null and b/helm-templates/external-secrets/charts/external-secrets-2.6.0.tgz differ