fixup! ♻️ migration externalsecrets

2025-09-17 18:24:14 +02:00 · 2023-07-12 19:22:13 +02:00
parent ffd2a98e97
commit 27171b64c4
10 changed files with 59 additions and 83 deletions
--- a/kubernetes/apps/default/ghostfolio/app/helmrelease.yaml
+++ b/kubernetes/apps/default/ghostfolio/app/helmrelease.yaml
@@ -27,6 +27,10 @@ spec:
  uninstall:
    keepHistory: false
  values:
+    controller:
+      strategy: RollingUpdate
+      annotations:
+        reloader.stakater.com/auto: "true"
    initContainers:
      01-init-db:
        image: ghcr.io/onedr0p/postgres-init:14.8
@@ -34,15 +38,12 @@ spec:
        envFrom: &envFrom
          - secretRef:
              name: ghostfolio-secret
-    controller:
-      annotations:
-        reloader.stakater.com/auto: "true"
    image:
      repository: docker.io/ghostfolio/ghostfolio
      tag: 1.287.0
    env:
      NODE_ENV: production
-      REDIS_HOST: redis.default.svc.cluster.local
+      REDIS_HOST: redis-headless.default.svc.cluster.local
      REDIS_PORT: 6379
    envFrom: *envFrom
    service:
--- a/kubernetes/apps/default/hajimari/app/helmrelease.yaml
+++ b/kubernetes/apps/default/hajimari/app/helmrelease.yaml
@@ -27,6 +27,8 @@ spec:
  uninstall:
    keepHistory: false
  values:
+    controller:
+      strategy: RollingUpdate
    env:
      TZ: ${TIMEZONE}
    hajimari:
--- a/kubernetes/apps/default/libreddit/app/helmrelease.yaml
+++ b/kubernetes/apps/default/libreddit/app/helmrelease.yaml
@@ -27,6 +27,8 @@ spec:
  uninstall:
    keepHistory: false
  values:
+    controller:
+      strategy: RollingUpdate
    image:
      repository: ghcr.io/auricom/libreddit
      tag: 0.30.1@sha256:58108c7aaf963cd7903c0e35f6af041f9ed77fdf8bd7019f79b9a989846ee97a
--- a/kubernetes/apps/default/nitter/app/helmrelease.yaml
+++ b/kubernetes/apps/default/nitter/app/helmrelease.yaml
@@ -28,6 +28,7 @@ spec:
    keepHistory: false
  values:
    controller:
+      strategy: RollingUpdate
      annotations:
        reloader.stakater.com/auto: "true"
    image:
--- a/kubernetes/apps/default/paperless/app/externalsecret.yaml
+++ b/kubernetes/apps/default/paperless/app/externalsecret.yaml
@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: paperless
+  namespace: default
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: paperless-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        # App
+        PAPERLESS_ADMIN_USER: "{{ .USERNAME }}"
+        PAPERLESS_ADMIN_PASSWORD: "{{ .PASSWORD }}"
+        PAPERLESS_SECRET_KEY: "{{ .PAPERLESS_SECRET_KEY }}"
+        PAPERLESS_DBUSER: &dbUser "{{ .POSTGRES_USER }}"
+        PAPERLESS_DBPASS: &dbPass "{{ .POSTGRES_PASS }}"
+        PAPERLESS_DBHOST: &dbHost postgres-rw.default.svc.cluster.local
+        PAPERLESS_DBPORT: "5432"
+
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: paperless
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
+  dataFrom:
+    - extract:
+        key: cloudnative-pg
+    - extract:
+        key: paperless
--- a/kubernetes/apps/default/paperless/app/helmrelease.yaml
+++ b/kubernetes/apps/default/paperless/app/helmrelease.yaml
@@ -6,7 +6,7 @@ metadata:
  name: &app paperless
  namespace: default
 spec:
-  interval: 15m
+  interval: 30m
  chart:
    spec:
      chart: app-template
@@ -15,7 +15,7 @@ spec:
        kind: HelmRepository
        name: bjw-s
        namespace: flux-system
-  maxHistory: 3
+  maxHistory: 2
  install:
    createNamespace: true
    remediation:
@@ -27,8 +27,13 @@ spec:
  uninstall:
    keepHistory: false
  values:
-    global:
-      nameOverride: *app
+    initContainers:
+      01-init-db:
+        image: ghcr.io/onedr0p/postgres-init:14.8
+        imagePullPolicy: IfNotPresent
+        envFrom: &envFrom
+          - secretRef:
+              name: &secret outline-secret
    image:
      repository: ghcr.io/paperless-ngx/paperless-ngx
      tag: 1.16.5
@@ -42,18 +47,12 @@ spec:
      PAPERLESS_OCR_LANGUAGES: fra
      PAPERLESS_OCR_LANGUAGE: fra
      PAPERLESS_PORT: 8000
-      PAPERLESS_DBHOST: ${POSTGRES_HOST}
-      PAPERLESS_DBPORT: ${POSTGRES_PORT}
      PAPERLESS_DBNAME: paperless
      PAPERLESS_REDIS: redis://paperless-redis.default.svc.cluster.local:6379
      PAPERLESS_TASK_WORKERS: 2
      PAPERLESS_TIME_ZONE: "Europe/Paris"
      PAPERLESS_URL: https://paperless.${SECRET_CLUSTER_DOMAIN}
-    envFrom:
-      - secretRef:
-          name: *app
-    podAnnotations:
-      secret.reloader.stakater.com/reload: *app
+    envFrom: *envFrom
    service:
      main:
        ports:
--- a/kubernetes/apps/default/paperless/app/kustomization.yaml
+++ b/kubernetes/apps/default/paperless/app/kustomization.yaml
@@ -4,8 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: default
 resources:
+  - ./externalsecret.yaml
  - ./helmrelease.yaml
  - ./redis
-  - ./secret.sops.yaml
-patchesStrategicMerge:
-  - ./patches/postgres.yaml
--- a/kubernetes/apps/default/paperless/app/patches/postgres.yaml
+++ b/kubernetes/apps/default/paperless/app/patches/postgres.yaml
@@ -1,32 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: &app paperless
-  namespace: default
-spec:
-  values:
-    initContainers:
-      init-db:
-        image: ghcr.io/onedr0p/postgres-initdb:14.8
-        env:
-          - name: POSTGRES_HOST
-            value: ${POSTGRES_HOST}
-          - name: POSTGRES_DB
-            value: *app
-          - name: POSTGRES_SUPER_PASS
-            valueFrom:
-              secretKeyRef:
-                name: postgres-superuser
-                key: password
-          - name: POSTGRES_USER
-            valueFrom:
-              secretKeyRef:
-                name: *app
-                key: PAPERLESS_DBUSER
-          - name: POSTGRES_PASS
-            valueFrom:
-              secretKeyRef:
-                name: *app
-                key: PAPERLESS_DBPASS
--- a/kubernetes/apps/default/paperless/app/secret.sops.yaml
+++ b/kubernetes/apps/default/paperless/app/secret.sops.yaml
@@ -1,33 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: paperless
-    namespace: default
-type: Opaque
-stringData:
-    PAPERLESS_ADMIN_USER: ENC[AES256_GCM,data:UMBtTvyE,iv:vZhUUErw66/8mRPcLh1H348ft7ItC9IOI3Gk1hi5w9E=,tag:3IX5RxMb6m87EOKIOqyPNQ==,type:str]
-    PAPERLESS_ADMIN_PASSWORD: ENC[AES256_GCM,data:3ce/of7nVeVGM0L6PeN21PdnlR8=,iv:WMt1Hagka1Q94XHyKtYOL/2TCHK534VHyPCIdf7m9p4=,tag:7ABSbgLNY+BqTUqQbr6gOg==,type:str]
-    PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:ABb6LpEmd7+fsN7U6RNGsj3EY8qOnwGfirljaQ==,iv:ZY+n28JYDGP0zj9DRo/E8hjLF996Hlvfj9Pl/cBv4qw=,tag:BCB3Y8PmeYt7kbnhBu/+PQ==,type:str]
-    PAPERLESS_DBUSER: ENC[AES256_GCM,data:QJJuRZa5Q2RA,iv:AMdb2Cq7RpJq58y11Y1wZ5DjKItjiIgXuWZw+BDw4kE=,tag:tUhEzpUZtJwwsezJ27sEmQ==,type:str]
-    PAPERLESS_DBPASS: ENC[AES256_GCM,data:SmOYMCIKVdb055LndV4=,iv:v+fvsgcnxFyITBhNT5Le3Oj4dgJmuuOINSQPe92NQpo=,tag:ATnfIcpuiGXKGaGHzAvRHA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
-            bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
-            VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
-            OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
-            LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-11-23T12:47:16Z"
-    mac: ENC[AES256_GCM,data:dK2hiLaWxTdeeesw6TuZdP2x572ipTJNser/wEFGwTkxn6ABcT6hQTnoo0TybM7xMNaIaf02DnwBZSOBSqo8LL5n+5d93CR4SE2gd2a3ogBf68r34mQVZ3kWYSZ/1K0L6eOJOjxPK5SoLwplW8JY1J1NhxMO3/zPsBqsFiXOnBw=,iv:5JV8DdNIyRPblCOxGXvAVePRPG038KgBGJh95F67O98=,tag:HITSMQZWEHi4dvD5cf1zOw==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3
--- a/kubernetes/apps/default/paperless/ks.yaml
+++ b/kubernetes/apps/default/paperless/ks.yaml
@@ -15,6 +15,7 @@ spec:
    name: home-ops-kubernetes
  dependsOn:
    - name: cluster-apps-cloudnative-pg-cluster
+    - name: cluster-apps-external-secrets-stores
  healthChecks:
    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
      kind: HelmRelease