tenant-secret-mounts-config.yaml

apiVersion: redhatcop.redhat.io/v1alpha1
kind: NamespaceConfig
metadata:
  name: tenant-secret-mounts
spec:
  labelSelector:
    matchExpressions:
      - key: team
        operator: Exists
      - key: application
        operator: Exists        
  templates:     
    - objectTemplate: |
        apiVersion: redhatcop.redhat.io/v1alpha1
        kind: SecretEngineMount
        metadata:
          name: static-secrets-{{ .Name }}
          namespace: vault-admin
        spec:
          authentication: 
            path: ${CLUSTER_NAME}
            role: vault-admin
            serviceAccount:
              name: default
          name: static-secrets                
          type: kv
          path: /applications/{{ .Labels.team }}/{{ .Name }} 
      excludedPaths:
        - .metadata
        - .status
        - .spec.replicas
        - .spec.config
        - .spec.externalEntropyAccess
        - .spec.local
        - .spec.sealWrap
    - objectTemplate: |        
        apiVersion: redhatcop.redhat.io/v1alpha1
        kind: SecretEngineMount
        metadata:
          name: databases-{{ .Name }}
          namespace: vault-admin
        spec:
          name: databases
          authentication: 
            path: ${CLUSTER_NAME}
            role: vault-admin
          type: database
          path: applications/{{ .Labels.team }}/{{ .Name }}
      excludedPaths:
        - .metadata
        - .status
        - .spec.replicas
        - .spec.config
        - .spec.externalEntropyAccess
        - .spec.local
        - .spec.sealWrap                  
    - objectTemplate: |
        kind: ClusterRoleBinding
        apiVersion: rbac.authorization.k8s.io/v1
        metadata:
          name: {{ .Name }}-vault-access
        subjects:
          - kind: ServiceAccount
            name: default
            namespace: {{ .Name }}
        roleRef:
          kind: ClusterRole
          name: system:auth-delegator
          apiGroup: rbac.authorization.k8s.io
      excludedPaths:	
        - .spec.replicas	
        - .metadata	
        - .status