added external-secret

2026-08-31 07:55:46 +05:30
parent 7747e9eb59
commit 1f5f58af85
6 changed files with 61 additions and 74 deletions
@@ -1,56 +1,37 @@
 external-secrets:
-  replicaCount: 1
+  # Fresh install — nothing runs this today, so no adoption gotchas here
+  # (unlike gitea/vault/contour). Replaces the Vault Agent Injector as the
+  # path for getting secrets into pods (see the injector.enabled: false
+  # note in ../vault/custom-values.yaml) — nothing is wired to a
+  # SecretStore/ClusterSecretStore backend yet, that's a separate step
+  # once this controller itself is up and healthy.
+  #
+  # installCRDs defaults to true — leaving it, this is a fresh cluster
+  # with no existing SecretStore/ExternalSecret CRs whose schema this
+  # could clobber.
+  #
+  # All three components (controller, webhook, cert-controller) default
+  # to unbounded resources — every other app in this repo gets trimmed
+  # requests/limits for the same reason, staying consistent here.
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+    limits:
+      memory: 128Mi

-  # -- If set, install and upgrade CRDs through helm chart.
-  installCRDs: true
-
-  crds:
-    # -- If true, create CRDs for Cluster External Secret.
-    createClusterExternalSecret: true
-    # -- If true, create CRDs for Cluster Secret Store.
-    createClusterSecretStore: true
-  metrics:
-    service:
-      # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
-      enabled: false
-
-      # -- Metrics service port to scrape
-      port: 8080
-
-  # -- Annotations to add to Pod
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8080"
-    prometheus.io/path: "/metrics"
-
-  tolerations:
-    - effect: NoSchedule
-      key: dedicated
-      operator: Equal
-      value: devops
-  nodeSelector:
-    dedicated: devops
-  certController:
-    tolerations:
-      - effect: NoSchedule
-        key: dedicated
-        operator: Equal
-        value: devops
-    nodeSelector:
-      dedicated: devops
-    podAnnotations:
-      prometheus.io/scrape: "true"
-      prometheus.io/port: "8080"
-      prometheus.io/path: "/metrics"
  webhook:
-    tolerations:
-      - effect: NoSchedule
-        key: dedicated
-        operator: Equal
-        value: devops
-    nodeSelector:
-      dedicated: devops
-    podAnnotations:
-      prometheus.io/scrape: "true"
-      prometheus.io/port: "8080"
-      prometheus.io/path: "/metrics"
+    resources:
+      requests:
+        cpu: 25m
+        memory: 32Mi
+      limits:
+        memory: 64Mi
+
+  certController:
+    resources:
+      requests:
+        cpu: 25m
+        memory: 32Mi
+      limits:
+        memory: 64Mi
@@ -1,22 +1,24 @@
 vault:
-  # This is your live `helm get values vault -n vault` output, verbatim —
-  # not a rewrite. Production mode (file storage, not dev), standalone
-  # (no HA/raft). Init/unseal are still NEVER in Git or scripted: run by
-  # hand and keep the unseal keys / root token in a password manager, same
-  # as claude.md says. This adoption only manages Vault's own Deployment
-  # config, not its data or seal state.
+  # This started as your live `helm get values vault -n vault` output,
+  # verbatim. One deliberate deviation from that since: injector.enabled
+  # is now false, not true. Secret delivery into pods is going through
+  # External Secrets Operator instead of Vault Agent Injector sidecars —
+  # nothing currently depends on the injector (claude.md's "Pending / not
+  # yet built" list has "Vault Agent Injector annotations for pulling
+  # secrets at pod start" — never actually wired up to any workload), so
+  # this removes an unused webhook rather than breaking anything live.
+  #
+  # Production mode (file storage, not dev), standalone (no HA/raft).
+  # Init/unseal are still NEVER in Git or scripted: run by hand and keep
+  # the unseal keys / root token in a password manager, same as claude.md
+  # says. This adoption only manages Vault's own Deployment config, not
+  # its data or seal state.
  #
  # `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH
  # required — this is claude.md issue #10 (Vault UI 404'd until both were
  # set; the chart has two separate toggles for the same thing).
  injector:
-    enabled: true
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
+    enabled: false

  server:
    dataStorage: