feat: rework ansible & secrets

2025-09-30 15:37:44 +02:00 · 2022-07-03 15:45:26 +02:00
parent 2f8c22a53c
commit 12736a97de
160 changed files with 3210 additions and 1785 deletions
--- a/cluster/core/cert-manager/kustomization.yaml
+++ b/cluster/core/cert-manager/kustomization.yaml
@@ -9,4 +9,4 @@ resources:
  - letsencrypt-production.yaml
  - letsencrypt-staging.yaml
  - prometheus-rule.yaml
-  - secret.enc.yaml
+  - secret.sops.yaml
--- a/cluster/core/cert-manager/secret.enc.yaml
+++ b/cluster/core/cert-manager/secret.enc.yaml
@@ -1,59 +0,0 @@
-kind: Secret
-apiVersion: v1
-metadata:
-    name: ovh-credentials
-    namespace: cert-manager
-stringData:
-    applicationSecret: ENC[AES256_GCM,data:gIaQ5jBtPjTb769oVDRJeN9tXSueRf48yIY6PTctfL4=,iv:TNpG3eVZjjP2u9+kjtISSTRUWCtQQA8yetaUyoQWDsI=,tag:itDnKq/nfe0W3Tsqv48wGw==,type:str]
-type: Opaque
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age: []
-    lastmodified: "2021-07-29T23:41:19Z"
-    mac: ENC[AES256_GCM,data:12BdFA2cIjmAYJ7Po1s76q4pO68nJfMmlLKyfMet0JlgISvQSU4VKnt+51p4fzAMztHLE8C5FPysfNPvadsIMV9WS6OTtq3qjy/qhNqM/y6l6mkMEL38H/426MHXXdj/QHfSuyovMYHEFkGBNikcia48ooSSYnssmttj9D0aL1E=,iv:aWKefe2o5V1RP8u3rBZ2R6YWKoX4zoSHtH72BbpNalE=,tag:F1dYap/uvelyb+4sfCrRjA==,type:str]
-    pgp:
-        - created_at: "2021-07-17T21:25:22Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA6nQR2zACjUjAQ/9GG5pSYEjWoVimLQ95TgQskBhjgGkdFncWoJ1c69wMTW3
-            C4nFAUgrxIYfOAmnsj38tOAHEIO4nbMsGKAsyJkH1H4RKtgl8FHVpkgbLs/k2I5x
-            ktsLt8X/CJEBd9iPatEdnGwq1+FADRsKjdioH87NCuONmBMRRSapyeTPYMR2/5RI
-            VdAnLqrVPXpHpU0HliyRXuy6RrysmCG96Xo4O/rjADJVxzVU3nBp0L0RyGRgdawD
-            OMLau2krM5WEx45utos+KvTmcHhe5rDkktpWblwTuj28HYqXG0FXp8NigasK2S/w
-            AdVEWBEdXNNYkiQJYvgJoCnQRC1KxDREAXRZLpfJ1lGgnzGO/q08EwGtFU4yyWMX
-            FAEBr47QUlWUACgHUVOm1jIcLMidgKHS4ORfNCQNA6pYLsNSgHaOjzTX8MgiLL1x
-            o5aj5AhAwkaj7XWvcDtHZW5o3knf+ntvfxIlYn379UfQjglp1filyJKtuVk2i8LR
-            RyK4j7TjOidSaM2XwKqZsVacSzNTvPuwl/atFXj+14UqRHzOgaYTzFzKHsO/kEl7
-            myrdW+0Uk9VTVm86FpPkaFrWsGlYvTemeJK/02I90N+llP1X3t48pNLtkcFV0Vue
-            EyOOVRRmYemzIDou+ZgB8f94Hl4MMST4Vonezt647Yf8215HedA1fTBn0fDL3pPS
-            XgHF24UjrdRDCM9S39/d2RE06ACkl1XBzE5SywpoPAWNdu3qWLF+29Eig+6k7gqn
-            AyJQtra9SzoruriC3Pwhq26uAgzyhhAePb1nyMgIBgjzkDg4zGrqgq9qgz5P61I=
-            =G+xw
-            -----END PGP MESSAGE-----
-          fp: 19B850FBA7685A526CF11E5F9BBE834259976EE8
-        - created_at: "2021-07-17T21:25:22Z"
-          enc: |
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA98IrODHuiZ9ARAAz+meIMba8DmMxU8sXGOO7aKWtIOQb7h/kP2X3aNAu4YT
-            rf1SxyqpYlpzejNMMfM3253HRlq053xCEKitQT3ixKacx/mmAsRuhuDVfXXTH17p
-            djiz4GtbgMoSn+iLv/UxMLgrxMAvkbrW/vEG2zcWnxyGd+KxqIJmxPAnShhb3QQT
-            y1i3q1aUFwen5xSgnQAVu9wpnpYaSqjeOnTD6ugnHG8Xo8WnKHcxBcBx/B2hN9QF
-            BgfvvxxqXLq31cga44FDT1Ox/IVUDcXGaxoDTKEkuWfKVB1Hb8vaNmRo+PDP1Zg8
-            tpbthWA4j/ctTJ25760j/R7BC+mcTLTqY22PCVhj47UE9Kus0IqrVS9JjRAfJadi
-            BbyVuSaTRXRm6hakH1xoGRK4smZBeOCX4oWqBn1rcwawQHB70HkTsTbS1LEHWzR7
-            nzmpHEzOnI1fWsYP6A6D8D9UpiuV9ByX8vUH1SCbKDB1ftPr3zEJEN4uog/HTgTh
-            GOLpzPqAO5gQFe9srK83CUgAVhoSlYSkgrFUYHNy8p0kDK+3lCC7lMGmrBQHWx7T
-            Df8aVwdrok1/cOztDfz2uuervWw54ZMgHjjrD6KBK20ZT7QN5fOZb/E80djWtlmY
-            NFD+lMBXBM+/hzHHiJx1SzOqjkpK2R9dGN++zi/pW/h9s5BZQr4/TZij4klyfuzS
-            XgFIhn0ph+1EapqOqRHnjeVxaDIx5m4K/Y+Vn2wZgCxn1GQ3gLBA3W93YMluAwY0
-            wTci6t2GZMxG4Pd3mcZeQGoxcd8MYkWOMegQY66MFUPB/R2FNLifeJuOR3KCIbA=
-            =Vnjd
-            -----END PGP MESSAGE-----
-          fp: 5749D0AE39445C1CCA6006DF8913091C690BDD69
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.1
--- a/cluster/core/cert-manager/secret.sops.yaml
+++ b/cluster/core/cert-manager/secret.sops.yaml
@@ -0,0 +1,28 @@
+kind: Secret
+apiVersion: v1
+metadata:
+    name: ovh-credentials
+    namespace: cert-manager
+stringData:
+    applicationSecret: ENC[AES256_GCM,data:9vWD0QZ5mSIVhTOg5BinGUhEdJW0Tv6/CzoJor2FO5I=,iv:ymVqh3DKnvTzKi8nWW6ULDLyJLfXE/HDGLmTmLuo9WE=,tag:Aoy6ClqB1K4HVNn6d8H94w==,type:str]
+type: Opaque
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDcGV1NGhhY3hOa0pjSThx
+            ZGt5Y2FPNVcrN0d1SCtCS2NjMHFjM2Y0QUJ3CncvUzB2QlpDL0xxZTQ4NVFyNm51
+            bFovMHhXRDVwSmpGaDR2YnBlTUQzTEkKLS0tIGx6bjRQNHQ4enJZN1UydEtiSkxP
+            d0Vid3lIQ0NPSmxicFlBN2NCRnE5ZFUKo1l3ST2oUmaWBgbjub/BWPpRzB588ZoJ
+            NvB6P1YivKsDZf/fsRT0gf1GPx9gZgql/w3g/9mggKANW4rFrMH1Mg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-07-03T14:42:43Z"
+    mac: ENC[AES256_GCM,data:shI/qzyWbCozb7CH4KgwZStp21+c/CsT5y+TtdzI+O5Xbbg4WHwUIw73DEqvOD8Rrj39Ym53L8f6G7apvAToU1nv23POs/e4ew2yMOhypfsw19hq93IDLmon6jmj7C2DCSwLWukzCX3/Ot+OELm8t8svZYDD+xE1wtYidmfiZdo=,iv:tURq+EP7UqMKaKHkWD4K3E4lLKFNqBLFut1Se8sC9No=,tag:RAbjiVPIEtkOoAFWE+/l7A==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3