fixup! ♻️ migration externalsecrets

kubernetes/apps/default/semaphore/app/externalsecret.yaml

@@ -0,0 +1,37 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: semaphore
+  namespace: default
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  target:
+    name: semaphore-secret
+    creationPolicy: Owner
+    template:
+      data:
+        # Ansible Semaphore
+        SEMAPHORE_DB_USER: &dbUser "{{ .POSTGRES_USER }}"
+        SEMAPHORE_DB_PASS: &dbPass "{{ .POSTGRES_PASS }}"
+        SEMAPHORE_DB_HOST: &dbHost postgres-rw.default.svc.cluster.local
+        SEMAPHORE_DB_PORT: "5432"
+        SEMAPHORE_DB: &dbName semaphore
+        SEMAPHORE_ADMIN_PASSWORD: "{{ .SEMAPHORE_ADMIN_PASSWORD }}"
+        SEMAPHORE_ADMIN_NAME: "{{ .SEMAPHORE_ADMIN_NAME }}"
+        SEMAPHORE_ADMIN: "{{ .SEMAPHORE_ADMIN }}"
+        SEMAPHORE_ACCESS_KEY_ENCRYPTION: "{{ .SEMAPHORE_ACCESS_KEY_ENCRYPTION }}"
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+  dataFrom:
+    - extract:
+        key: cloudnative-pg
+    - extract:
+        key: semaphore

kubernetes/apps/default/semaphore/app/helmrelease.yaml

@@ -6,7 +6,7 @@ metadata:
   name: semaphore
   namespace: default
 spec:
-  interval: 15m
+  interval: 30m
   chart:
     spec:
       chart: app-template
@@ -15,7 +15,7 @@ spec:
         kind: HelmRepository
         name: bjw-s
         namespace: flux-system
-  maxHistory: 3
+  maxHistory: 2
   install:
     createNamespace: true
     remediation:
@@ -28,11 +28,12 @@ spec:
     keepHistory: false
   values:
     initContainers:
-      init-db:
-        image: ghcr.io/onedr0p/postgres-initdb:14.8
-        envFrom:
+      01-init-db:
+        image: ghcr.io/onedr0p/postgres-init:14.8
+        imagePullPolicy: IfNotPresent
+        envFrom: &envFrom
           - secretRef:
-              name: semaphore-secret
+              name: &secret semaphore-secret
     controller:
       annotations:
         reloader.stakater.com/auto: "true"
@@ -40,12 +41,11 @@ spec:
       repository: docker.io/semaphoreui/semaphore
       tag: v2.8.91
     env:
+      SEMAPHORE_DB_DIALECT: postgres
       SEMAPHORE_LDAP_ACTIVATED: "no"
       SEMAPHORE_PLAYBOOK_PATH: /tmp/semaphore/
       SEMAPHORE_ADMIN_EMAIL: "${SECRET_CLUSTER_DOMAIN_EMAIL}"
-    envFrom:
-      - secretRef:
-          name: semaphore-secret
+    envFrom: *envFrom
     service:
       main:
         ports:

kubernetes/apps/default/semaphore/app/kustomization.yaml

@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: default
 resources:
+  - ./externalsecret.yaml
   - ./helmrelease.yaml
-  - ./secret.sops.yaml

kubernetes/apps/default/semaphore/app/secret.sops.yaml

@@ -1,45 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: semaphore-secret
-    namespace: default
-type: Opaque
-stringData:
-    #ENC[AES256_GCM,data:sgvfTo/EWQFqeQ2xZ/iLCPov,iv:SF3b5MYuNOSlK+o4hLGHOk9e1vSpN7kSQUSrhTIA2tc=,tag:dpKEfawky8MPqniHVZ52Sw==,type:comment]
-    SEMAPHORE_DB_DIALECT: ENC[AES256_GCM,data:nyDaS8zCV4o=,iv:YCQiaTeAxm4bGCeNx6kJI8u/hOlQ36C97Fuef5FenNs=,tag:75QZEHB0cF92NaPjbd44KA==,type:str]
-    SEMAPHORE_DB_USER: ENC[AES256_GCM,data:FOFePOCsxamf,iv:556TKMhCRhHWEyPwLvFPFMwmo9RKiz1pW9OJJUsSwgk=,tag:6rPAfthdf73N1X83S+UynQ==,type:str]
-    SEMAPHORE_DB_PASS: ENC[AES256_GCM,data:Nl66upZmTE4xykvseIqtsS2w5G4=,iv:QkW7oGqDyY9G5yi1yMAhw3y48RmPGWqoKNL9tlUm5MU=,tag:Wu5fPPywslQOC8dGBea0bw==,type:str]
-    SEMAPHORE_DB_HOST: ENC[AES256_GCM,data:SlxTav3/SdtmeLD+NdB6oo8rb58FMYeM3odW4gey2OWGIwmzvw==,iv:Udz0Nu9zIk/h+8vur9wfC92iK5RjSpAoyV1Z4pb/5sY=,tag:zJPys79V5yz04nvj0VlcKg==,type:str]
-    SEMAPHORE_DB_PORT: ENC[AES256_GCM,data:qvnfig==,iv:jBXljtUMN7IM1JZHBa35FpwVdiKdOXKDJYJGeH1wTQU=,tag:PbwIlXX2CMRWxUnmKoDsSQ==,type:str]
-    SEMAPHORE_DB: ENC[AES256_GCM,data:v1dS1uIC8tGz,iv:nUz0Q88R/CnDmKuc//YqaAq3Mkbi+6miWkf9W0xmMbE=,tag:YopXWX3B70HHxq1Gc8NqUQ==,type:str]
-    SEMAPHORE_ADMIN_PASSWORD: ENC[AES256_GCM,data:yLiUSF9VyLN5YNfvAafUaV0KyaA=,iv:4BV3mxZMso0u2c/5jCAaEHbqijZiaLvATM6kJmcCvKY=,tag:tmHatfh3jHUX4MAzcUM7XQ==,type:str]
-    SEMAPHORE_ADMIN_NAME: ENC[AES256_GCM,data:zXt5NHSg,iv:NN/j6bFE03XbljhzQiTTkRRHqx/YU0nWHpGzjTKdC5Y=,tag:dteln0PGY4+b4hzaa7/mWw==,type:str]
-    SEMAPHORE_ADMIN: ENC[AES256_GCM,data:FMxAjLY=,iv:Oj9N3OBgAHBO+FAaqbMy70/F8hloUHWx8lXpUuaY6m0=,tag:xCw/C2s15dMSbD5z8wPhVA==,type:str]
-    SEMAPHORE_ACCESS_KEY_ENCRYPTION: ENC[AES256_GCM,data:ct9BMd7uE0DcD2kHsNkqD5vnfpAwLKLHImJu1ih56CHmhV03d3OrYDjHQ1g=,iv:MFCc4EvM40Q+1+xK5zTYXhFGkfEvkLmZuIbkOZI/0U4=,tag:sOkZUUNlikdeUp6Ax+Og4w==,type:str]
-    #ENC[AES256_GCM,data:G9yw2//y27PlVIHYhgA=,iv:qJ+cx+HixCnkGSARdo5fFYDJQT3jHearN00HeO0EwMk=,tag:yPer6XrUnfpKwrdsBlSkRA==,type:comment]
-    POSTGRES_DB: ENC[AES256_GCM,data:tsx2YRZtnx9u,iv:8zVFcdkLjSmbFgHXafyTBeXNmzTvvo9b5WPNRbtLHAM=,tag:yXOIDOp8Hm0dQuKfs5k1ig==,type:str]
-    POSTGRES_HOST: ENC[AES256_GCM,data:J7athqTJ9IEmr754JHpXxX7OepWTfuwxRCVUhy9cs/C+60nFNw==,iv:7q7sjl2SlIeDxRMtmf6ojU7hQ7wfH4dS/lheSz8TstI=,tag:SC/84LbwWT+ZxBflXvaHpw==,type:str]
-    POSTGRES_SUPER_PASS: ENC[AES256_GCM,data:vihjmp4ehKUnXu4G3fxz/g==,iv:JGU0/W49NuacVNK5FE4Y8xviVT9nKhcJxuoZYj1UYDA=,tag:XIb324L6UHD/eu5omlRLEw==,type:str]
-    POSTGRES_PASS: ENC[AES256_GCM,data:qgKq9wFrS11Ts3brLGV7xJfbkE0=,iv:Jy3leaCr7MljBCpKzVDiyroBQw37W1/GIw9itA/Pb7o=,tag:0JnelzWhN2oXCsMRlRW2Cw==,type:str]
-    POSTGRES_USER: ENC[AES256_GCM,data:oNBXe1ln8LlO,iv:tgGEQyNy8aS2Gjm8yZR0rVzWN1FEcCKanjUKGAlbrkg=,tag:jeA4HSoK3kSFqvJTFyWGMw==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2
-            bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC
-            VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw
-            OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+
-            LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-01-20T21:37:28Z"
-    mac: ENC[AES256_GCM,data:dagIu0cei3FxxV9iiLhHWimUpO///hZ2e/GaZ99go9XgVuMuJ5Nu3xLrgV/49qs4gQDsqA6XEoTeOpWK+6geO2k/dFxYQZixj3SH3CpWyrGl6lc+yFDLuCHLklh0OpKG9x7R9BlUkWt1M27Tmr1mdV6NZXqOZazJp4bT/ucETIE=,iv:LVi/RYrruDCk0C9LcyxSW1kO3zRKKJh1LLl5FYq325w=,tag:ng6MhZofV1t2XSghYC8u/Q==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.3