added external-secret

helm-overrides/k8s-admin-prd-ase1/external-secrets/custom-values.yaml

@@ -1,56 +1,37 @@
 external-secrets:
-  replicaCount: 1
+  # Fresh install — nothing runs this today, so no adoption gotchas here
+  # (unlike gitea/vault/contour). Replaces the Vault Agent Injector as the
+  # path for getting secrets into pods (see the injector.enabled: false
+  # note in ../vault/custom-values.yaml) — nothing is wired to a
+  # SecretStore/ClusterSecretStore backend yet, that's a separate step
+  # once this controller itself is up and healthy.
+  #
+  # installCRDs defaults to true — leaving it, this is a fresh cluster
+  # with no existing SecretStore/ExternalSecret CRs whose schema this
+  # could clobber.
+  #
+  # All three components (controller, webhook, cert-controller) default
+  # to unbounded resources — every other app in this repo gets trimmed
+  # requests/limits for the same reason, staying consistent here.
+  resources:
+    requests:
+      cpu: 25m
+      memory: 32Mi
+    limits:
+      memory: 128Mi
 
-  # -- If set, install and upgrade CRDs through helm chart.
-  installCRDs: true
-
-  crds:
-    # -- If true, create CRDs for Cluster External Secret.
-    createClusterExternalSecret: true
-    # -- If true, create CRDs for Cluster Secret Store.
-    createClusterSecretStore: true
-  metrics:
-    service:
-      # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
-      enabled: false
-
-      # -- Metrics service port to scrape
-      port: 8080
-
-  # -- Annotations to add to Pod
-  podAnnotations:
-    prometheus.io/scrape: "true"
-    prometheus.io/port: "8080"
-    prometheus.io/path: "/metrics"
-
-  tolerations:
-    - effect: NoSchedule
-      key: dedicated
-      operator: Equal
-      value: devops
-  nodeSelector:
-    dedicated: devops
-  certController:
-    tolerations:
-      - effect: NoSchedule
-        key: dedicated
-        operator: Equal
-        value: devops
-    nodeSelector:
-      dedicated: devops
-    podAnnotations:
-      prometheus.io/scrape: "true"
-      prometheus.io/port: "8080"
-      prometheus.io/path: "/metrics"
   webhook:
-    tolerations:
+    resources:
-      - effect: NoSchedule
+      requests:
-        key: dedicated
+        cpu: 25m
-        operator: Equal
+        memory: 32Mi
-        value: devops
+      limits:
-    nodeSelector:
+        memory: 64Mi
-      dedicated: devops
+
-    podAnnotations:
+  certController:
-      prometheus.io/scrape: "true"
+    resources:
-      prometheus.io/port: "8080"
+      requests:
-      prometheus.io/path: "/metrics"
+        cpu: 25m
+        memory: 32Mi
+      limits:
+        memory: 64Mi

helm-overrides/k8s-admin-prd-ase1/vault/custom-values.yaml

@@ -1,22 +1,24 @@
 vault:
-  # This is your live `helm get values vault -n vault` output, verbatim —
+  # This started as your live `helm get values vault -n vault` output,
-  # not a rewrite. Production mode (file storage, not dev), standalone
+  # verbatim. One deliberate deviation from that since: injector.enabled
-  # (no HA/raft). Init/unseal are still NEVER in Git or scripted: run by
+  # is now false, not true. Secret delivery into pods is going through
-  # hand and keep the unseal keys / root token in a password manager, same
+  # External Secrets Operator instead of Vault Agent Injector sidecars —
-  # as claude.md says. This adoption only manages Vault's own Deployment
+  # nothing currently depends on the injector (claude.md's "Pending / not
-  # config, not its data or seal state.
+  # yet built" list has "Vault Agent Injector annotations for pulling
+  # secrets at pod start" — never actually wired up to any workload), so
+  # this removes an unused webhook rather than breaking anything live.
+  #
+  # Production mode (file storage, not dev), standalone (no HA/raft).
+  # Init/unseal are still NEVER in Git or scripted: run by hand and keep
+  # the unseal keys / root token in a password manager, same as claude.md
+  # says. This adoption only manages Vault's own Deployment config, not
+  # its data or seal state.
   #
   # `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH
   # required — this is claude.md issue #10 (Vault UI 404'd until both were
   # set; the chart has two separate toggles for the same thing).
   injector:
-    enabled: true
+    enabled: false
-    resources:
-      limits:
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
 
   server:
     dataStorage:

helm-templates/external-secrets-2.6.0/Chart.yaml

@@ -1,7 +0,0 @@
-apiVersion: v2
-name: external-secrets
-version: 1.0.0
-dependencies:
-  - name: external-secrets
-    version: 2.6.0
-    repository: https://charts.external-secrets.io

helm-templates/external-secrets/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: external-secrets
+  repository: https://charts.external-secrets.io
+  version: 2.6.0
+digest: sha256:18576e23abafb5305e77f03826b4f6d7f7b48adaf18934416511ea7f8d757b26
+generated: "2026-08-31T07:51:26.802283+05:30"

helm-templates/external-secrets/Chart.yaml

@@ -3,5 +3,10 @@ name: external-secrets
 version: 1.0.0
 dependencies:
   - name: external-secrets
-    version: 0.5.9
+    # Was 0.5.9 (very old pre-1.0 stream). Using the version the fleet's
+    # own external-secrets-2.6.0 versioned sibling already targeted as its
+    # upgrade candidate, rather than picking a fresh version myself — no
+    # live install here to match, but no reason to skip a decision someone
+    # already made deliberately, either.
+    version: 2.6.0
     repository: https://charts.external-secrets.io