feat: overhaul

kubernetes/apps/default/lldap/app/externalsecret.yaml

@@ -4,7 +4,6 @@ apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: lldap
-  namespace: default
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
@@ -14,21 +13,29 @@ spec:
     template:
       engineVersion: v2
       data:
-        # App
         LLDAP_JWT_SECRET: "{{ .LLDAP_JWT_SECRET }}"
         LLDAP_LDAP_USER_PASS: "{{ .password }}"
         LLDAP_USER_DN: "{{ .username }}"
         LLDAP_LDAP_USER_EMAIL: "{{ .LLDAP_LDAP_USER_EMAIL }}"
         LLDAP_SERVER_KEY_SEED: "{{ .LLDAP_SERVER_KEY_SEED }}"
-        LLDAP_DATABASE_URL: "postgres://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres16-rw.database.svc.cluster.local/lldap"
-        # Postgres Init
-        INIT_POSTGRES_DBNAME: lldap
-        INIT_POSTGRES_HOST: postgres16-rw.database.svc.cluster.local
-        INIT_POSTGRES_USER: "{{ .POSTGRES_USER }}"
-        INIT_POSTGRES_PASS: "{{ .POSTGRES_PASS }}"
-        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
   dataFrom:
-    - extract:
-        key: cloudnative-pg
     - extract:
         key: lldap
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: lldap-db
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: crunchy-pgo-secrets
+  target:
+    name: lldap-db-secret
+    template:
+      engineVersion: v2
+      data:
+        LLDAP_DATABASE_URL: 'postgres://{{ index . "user" }}:{{ index . "password" }}@{{ index . "host" }}:{{ index . "port" }}/{{ index . "dbname" }}'
+  dataFrom:
+    - extract:
+        key: postgres-pguser-lldap

kubernetes/apps/default/lldap/app/helmrelease.yaml

@@ -4,7 +4,6 @@ apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: &app lldap
-  namespace: default
 spec:
   interval: 30m
   chart:
@@ -28,29 +27,11 @@ spec:
   uninstall:
     keepHistory: false
   values:
-    defaultPodOptions:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: *app
     controllers:
       lldap:
-        replicas: 2
-        strategy: RollingUpdate
         annotations:
           reloader.stakater.com/auto: "true"
-        initContainers:
-          init-db:
-            image:
-              repository: ghcr.io/onedr0p/postgres-init
-              tag: 16
-              pullPolicy: IfNotPresent
-            envFrom: &envFrom
-              - secretRef:
-                  name: lldap-secret
+          secret.reloader.stakater.com/reload: lldap-db-secret
         containers:
           app:
             image:
@@ -62,7 +43,11 @@ spec:
               LLDAP_HTTP_URL: https://lldap.${SECRET_EXTERNAL_DOMAIN}
               LLDAP_LDAP_PORT: &ldapPort 5389
               LLDAP_LDAP_BASE_DN: dc=home,dc=arpa
-            envFrom: *envFrom
+            envFrom:
+              - secretRef:
+                  name: lldap-secret
+              - secretRef:
+                  name: lldap-db-secret
             resources:
               requests:
                 cpu: 100m
@@ -92,7 +77,7 @@ spec:
             app in (
               lldap
             )
-        className: nginx
+        className: internal
         hosts:
           - host: &host "{{ .Release.Name }}.${SECRET_EXTERNAL_DOMAIN}"
             paths:

kubernetes/apps/default/lldap/app/kustomization.yaml

@@ -2,7 +2,6 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: default
 resources:
   - ./externalsecret.yaml
   - ./helmrelease.yaml

kubernetes/apps/default/lldap/ks.yaml

@@ -1,5 +1,5 @@
 ---
-# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
@@ -15,6 +15,8 @@ spec:
   sourceRef:
     kind: GitRepository
     name: home-ops-kubernetes
+  dependsOn:
+    - name: crunchy-postgres-operator-cluster
   wait: false
   interval: 30m
   retryInterval: 1m