fixup! ♻️ migration externalsecrets

kubernetes/apps/default/ghostfolio/app/helmrelease.yaml

@@ -27,6 +27,10 @@ spec:
   uninstall:
     keepHistory: false
   values:
+    controller:
+      strategy: RollingUpdate
+      annotations:
+        reloader.stakater.com/auto: "true"
     initContainers:
       01-init-db:
         image: ghcr.io/onedr0p/postgres-init:14.8
@@ -34,15 +38,12 @@ spec:
         envFrom: &envFrom
           - secretRef:
               name: ghostfolio-secret
-    controller:
-      annotations:
-        reloader.stakater.com/auto: "true"
     image:
       repository: docker.io/ghostfolio/ghostfolio
       tag: 1.287.0
     env:
       NODE_ENV: production
-      REDIS_HOST: redis.default.svc.cluster.local
+      REDIS_HOST: redis-headless.default.svc.cluster.local
       REDIS_PORT: 6379
     envFrom: *envFrom
     service:

kubernetes/apps/default/hajimari/app/helmrelease.yaml

@@ -27,6 +27,8 @@ spec:
   uninstall:
     keepHistory: false
   values:
+    controller:
+      strategy: RollingUpdate
     env:
       TZ: ${TIMEZONE}
     hajimari:

kubernetes/apps/default/libreddit/app/helmrelease.yaml

@@ -27,6 +27,8 @@ spec:
   uninstall:
     keepHistory: false
   values:
+    controller:
+      strategy: RollingUpdate
     image:
       repository: ghcr.io/auricom/libreddit
       tag: 0.30.1@sha256:58108c7aaf963cd7903c0e35f6af041f9ed77fdf8bd7019f79b9a989846ee97a

kubernetes/apps/default/nitter/app/helmrelease.yaml

@@ -28,6 +28,7 @@ spec:
     keepHistory: false
   values:
     controller:
+      strategy: RollingUpdate
       annotations:
         reloader.stakater.com/auto: "true"
     image:

kubernetes/apps/default/paperless/app/externalsecret.yaml

@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: paperless
+  namespace: default
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: paperless-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        # App
+        PAPERLESS_ADMIN_USER: "{{ .USERNAME }}"
+        PAPERLESS_ADMIN_PASSWORD: "{{ .PASSWORD }}"
+        PAPERLESS_SECRET_KEY: "{{ .PAPERLESS_SECRET_KEY }}"
+        PAPERLESS_DBUSER: &dbUser "{{ .POSTGRES_USER }}"
+        PAPERLESS_DBPASS: &dbPass "{{ .POSTGRES_PASS }}"
+        PAPERLESS_DBHOST: &dbHost postgres-rw.default.svc.cluster.local
+        PAPERLESS_DBPORT: "5432"
+
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: paperless
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
+  dataFrom:
+    - extract:
+        key: cloudnative-pg
+    - extract:
+        key: paperless

kubernetes/apps/default/paperless/app/helmrelease.yaml

@@ -6,7 +6,7 @@ metadata:
   name: &app paperless
   namespace: default
 spec:
-  interval: 15m
+  interval: 30m
   chart:
     spec:
       chart: app-template
@@ -15,7 +15,7 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
-  maxHistory: 3
+  maxHistory: 2
   install:
     createNamespace: true
     remediation:
@@ -27,8 +27,13 @@ spec:
   uninstall:
     keepHistory: false
   values:
-    global:
+    initContainers:
-      nameOverride: *app
+      01-init-db:
+        image: ghcr.io/onedr0p/postgres-init:14.8
+        imagePullPolicy: IfNotPresent
+        envFrom: &envFrom
+          - secretRef:
+              name: &secret outline-secret
     image:
       repository: ghcr.io/paperless-ngx/paperless-ngx
       tag: 1.16.5
@@ -42,18 +47,12 @@ spec:
       PAPERLESS_OCR_LANGUAGES: fra
       PAPERLESS_OCR_LANGUAGE: fra
       PAPERLESS_PORT: 8000
-      PAPERLESS_DBHOST: ${POSTGRES_HOST}
-      PAPERLESS_DBPORT: ${POSTGRES_PORT}
       PAPERLESS_DBNAME: paperless
       PAPERLESS_REDIS: redis://paperless-redis.default.svc.cluster.local:6379
       PAPERLESS_TASK_WORKERS: 2
       PAPERLESS_TIME_ZONE: "Europe/Paris"
       PAPERLESS_URL: https://paperless.${SECRET_CLUSTER_DOMAIN}
-    envFrom:
+    envFrom: *envFrom
-      - secretRef:
-          name: *app
-    podAnnotations:
-      secret.reloader.stakater.com/reload: *app
     service:
       main:
         ports:

kubernetes/apps/default/paperless/app/kustomization.yaml

@@ -4,8 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: default
 resources:
+  - ./externalsecret.yaml
   - ./helmrelease.yaml
   - ./redis
-  - ./secret.sops.yaml
-patchesStrategicMerge:
-  - ./patches/postgres.yaml

kubernetes/apps/default/paperless/app/patches/postgres.yaml

@@ -1,32 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: &app paperless
-  namespace: default
-spec:
-  values:
-    initContainers:
-      init-db:
-        image: ghcr.io/onedr0p/postgres-initdb:14.8
-        env:
-          - name: POSTGRES_HOST
-            value: ${POSTGRES_HOST}
-          - name: POSTGRES_DB
-            value: *app
-          - name: POSTGRES_SUPER_PASS
-            valueFrom:
-              secretKeyRef:
-                name: postgres-superuser
-                key: password
-          - name: POSTGRES_USER
-            valueFrom:
-              secretKeyRef:
-                name: *app
-                key: PAPERLESS_DBUSER
-          - name: POSTGRES_PASS
-            valueFrom:
-              secretKeyRef:
-                name: *app
-                key: PAPERLESS_DBPASS

kubernetes/apps/default/paperless/app/secret.sops.yaml

@@ -1,33 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: paperless
-    namespace: default
-type: Opaque
-stringData:
-    PAPERLESS_ADMIN_USER: ENC[AES256_GCM,data:UMBtTvyE,iv:vZhUUErw66/8mRPcLh1H348ft7ItC9IOI3Gk1hi5w9E=,tag:3IX5RxMb6m87EOKIOqyPNQ==,type:str]
-    PAPERLESS_ADMIN_PASSWORD: ENC[AES256_GCM,data:3ce/of7nVeVGM0L6PeN21PdnlR8=,iv:WMt1Hagka1Q94XHyKtYOL/2TCHK534VHyPCIdf7m9p4=,tag:7ABSbgLNY+BqTUqQbr6gOg==,type:str]
-    PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:ABb6LpEmd7+fsN7U6RNGsj3EY8qOnwGfirljaQ==,iv:ZY+n28JYDGP0zj9DRo/E8hjLF996Hlvfj9Pl/cBv4qw=,tag:BCB3Y8PmeYt7kbnhBu/+PQ==,type:str]
-    PAPERLESS_DBUSER: ENC[AES256_GCM,data:QJJuRZa5Q2RA,iv:AMdb2Cq7RpJq58y11Y1wZ5DjKItjiIgXuWZw+BDw4kE=,tag:tUhEzpUZtJwwsezJ27sEmQ==,type:str]
-    PAPERLESS_DBPASS: ENC[AES256_GCM,data:SmOYMCIKVdb055LndV4=,iv:v+fvsgcnxFyITBhNT5Le3Oj4dgJmuuOINSQPe92NQpo=,tag:ATnfIcpuiGXKGaGHzAvRHA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
-            bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
-            VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
-            OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
-            LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-11-23T12:47:16Z"
-    mac: ENC[AES256_GCM,data:dK2hiLaWxTdeeesw6TuZdP2x572ipTJNser/wEFGwTkxn6ABcT6hQTnoo0TybM7xMNaIaf02DnwBZSOBSqo8LL5n+5d93CR4SE2gd2a3ogBf68r34mQVZ3kWYSZ/1K0L6eOJOjxPK5SoLwplW8JY1J1NhxMO3/zPsBqsFiXOnBw=,iv:5JV8DdNIyRPblCOxGXvAVePRPG038KgBGJh95F67O98=,tag:HITSMQZWEHi4dvD5cf1zOw==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3

kubernetes/apps/default/paperless/ks.yaml

@@ -15,6 +15,7 @@ spec:
     name: home-ops-kubernetes
   dependsOn:
     - name: cluster-apps-cloudnative-pg-cluster
+    - name: cluster-apps-external-secrets-stores
   healthChecks:
     - apiVersion: helm.toolkit.fluxcd.io/v2beta1
       kind: HelmRelease