39 lines
1.6 KiB
YAML
39 lines
1.6 KiB
YAML
{{- /*
|
|
ExternalSecret (external-secrets.io) — pulls every bearer token from one Vault
|
|
path and syncs them into the K8s Secret `<name>-creds`. The deployment injects
|
|
that Secret with `envFrom`, so each Vault key becomes an env var verbatim.
|
|
|
|
Store these keys at the Vault path (externalSecrets.dataFrom.secretKey):
|
|
* MCP_AUTH_TOKEN — inbound bearer the RCA agent must present
|
|
* <TOKENENV> per backend — e.g. SUPPLY_MCP_TOKEN, referenced by the
|
|
registry's `tokenEnv:` (multi mode only)
|
|
Keys MUST be valid env var names (they map 1:1 to container env).
|
|
*/ -}}
|
|
{{- if .Values.externalSecrets.enabled -}}
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: {{ include "kubectl-mcp-server.credsSecretName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "kubectl-mcp-server.labels" . | nindent 4 }}
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-5"
|
|
spec:
|
|
refreshInterval: {{ .Values.externalSecrets.refreshInterval | quote }}
|
|
secretStoreRef:
|
|
name: {{ .Values.externalSecrets.secretStoreRef.name }}
|
|
kind: {{ .Values.externalSecrets.secretStoreRef.kind }}
|
|
target:
|
|
name: {{ include "kubectl-mcp-server.credsSecretName" . }}
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
dataFrom:
|
|
- extract:
|
|
conversionStrategy: Default
|
|
key: {{ required "externalSecrets.dataFrom.secretKey (Vault path) is required when externalSecrets.enabled" .Values.externalSecrets.dataFrom.secretKey }}
|
|
{{- if .Values.externalSecrets.dataFrom.version }}
|
|
version: {{ .Values.externalSecrets.dataFrom.version | quote }}
|
|
{{- end }}
|
|
{{- end }}
|