38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
{{- /*
|
|
ESO → K8s Secret that holds the Root CA (cert + key).
|
|
Lives in the cert-manager namespace so the private key stays off app
|
|
namespaces; cert-manager reads it when the ClusterIssuer signs leaf certs.
|
|
*/}}
|
|
{{- if .Values.externalSecret.enabled }}
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: {{ .Values.rootCASecretName }}
|
|
namespace: {{ .Values.namespace }}
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-5"
|
|
{{- with .Values.commonAnnotations }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- with .Values.commonLabels }}
|
|
labels:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
dataFrom:
|
|
- extract:
|
|
conversionStrategy: Default
|
|
key: {{ .Values.externalSecret.vaultPath }}
|
|
{{- if .Values.externalSecret.vaultVersion }}
|
|
version: {{ .Values.externalSecret.vaultVersion | quote }}
|
|
{{- end }}
|
|
refreshInterval: {{ .Values.externalSecret.refreshInterval | quote }}
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: {{ .Values.externalSecret.secretStoreRef.name }}
|
|
target:
|
|
name: {{ .Values.rootCASecretName }}
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
{{- end }}
|