Merge pull request #13827 from artsy/artsyjian/vault

feat: pull secrets from vault
artsy · May 6, 2024 · 3175996 · 3175996
2 parents 1eb7c17 + f40318c
commit 3175996
Show file tree

Hide file tree

Showing 2 changed files with 74 additions and 0 deletions.
diff --git a/hokusai/production.yml b/hokusai/production.yml
@@ -1,3 +1,36 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: force
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: force
+    creationPolicy: Owner
+    deletionPolicy: Merge
+    template:
+      engineVersion: v2
+      templateFrom:
+      - target: Data
+        {% raw %}
+        literal: |
+          {{ range $key, $value := . }}
+          {{$key}}: {{$value | fromJson | values | first}}
+          {{ end }}
+        {% endraw %}
+  dataFrom:
+  - find:
+      name:
+        regexp: "kubernetes/apps/force/*"
+    rewrite:
+    - regexp:
+        source: "kubernetes/apps/force/(.*)"
+        target: "$1"
+
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -46,6 +79,8 @@ spec:
         envFrom:
         - configMapRef:
             name: force-environment
+        - secretRef:
+            name: force
         image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/force:production
         imagePullPolicy: Always
         ports:
@@ -135,6 +170,8 @@ spec:
         envFrom:
         - configMapRef:
             name: force-environment
+        - secretRef:
+            name: force
         image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/force:production
         imagePullPolicy: Always
         ports:

diff --git a/hokusai/staging.yml b/hokusai/staging.yml
@@ -1,3 +1,36 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: force
+spec:
+  refreshInterval: "5m"
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: force
+    creationPolicy: Owner
+    deletionPolicy: Merge
+    template:
+      engineVersion: v2
+      templateFrom:
+      - target: Data
+        {% raw %}
+        literal: |
+          {{ range $key, $value := . }}
+          {{$key}}: {{$value | fromJson | values | first}}
+          {{ end }}
+        {% endraw %}
+  dataFrom:
+  - find:
+      name:
+        regexp: "kubernetes/apps/force/*"
+    rewrite:
+    - regexp:
+        source: "kubernetes/apps/force/(.*)"
+        target: "$1"
+
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -54,6 +87,8 @@ spec:
         envFrom:
         - configMapRef:
             name: force-environment
+        - secretRef:
+            name: force
         image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/force:staging
         imagePullPolicy: Always
         ports:
@@ -150,6 +185,8 @@ spec:
         envFrom:
         - configMapRef:
             name: force-environment
+        - secretRef:
+            name: force
         image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/force:staging
         imagePullPolicy: Always
         ports: