37 lines
1.5 KiB
YAML
37 lines
1.5 KiB
YAML
{{- /*
|
|
ExternalSecret to sync Root CA from Vault via ESO.
|
|
Creates the Root CA K8s Secret that cert-manager's Root CA Issuer references.
|
|
Only needed when rootCA.mode is "external" and externalSecret.enabled is true.
|
|
Uses dataFrom.extract to pull all keys from a single Vault path.
|
|
*/}}
|
|
|
|
{{- if and .Values.useCertManager (eq .Values.certManager.rootCA.mode "external") .Values.certManager.externalSecret.enabled }}
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
|
|
namespace: {{ include "common.names.namespace" . | quote }}
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-5"
|
|
{{- if .Values.commonAnnotations }}
|
|
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
|
{{- end }}
|
|
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
|
spec:
|
|
dataFrom:
|
|
- extract:
|
|
conversionStrategy: Default
|
|
key: {{ .Values.certManager.externalSecret.vaultPath }}
|
|
{{- if .Values.certManager.externalSecret.vaultVersion }}
|
|
version: {{ .Values.certManager.externalSecret.vaultVersion | quote }}
|
|
{{- end }}
|
|
refreshInterval: {{ .Values.certManager.externalSecret.refreshInterval | quote }}
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: {{ .Values.certManager.externalSecret.secretStoreRef.name }}
|
|
target:
|
|
name: {{ .Values.certManager.rootCA.secretName }}
|
|
creationPolicy: Owner
|
|
deletionPolicy: Retain
|
|
{{- end }}
|