From 793483913cd8fb46a4652b00baa088f81005dbf2 Mon Sep 17 00:00:00 2001
From: devops <devops@local>
Date: Wed, 16 Sep 2026 16:15:06 +0000
Subject: [PATCH] platform: ClusterSecretStore (vault k8s auth) + demo-app
 ExternalSecret

---
 apps/platform.yaml                         | 16 ++++++++++++++++
 manifests/demo-app/deployment.yaml         |  4 ++++
 manifests/demo-app/externalsecret.yaml     | 22 ++++++++++++++++++++++
 manifests/platform/clustersecretstore.yaml | 19 +++++++++++++++++++
 4 files changed, 61 insertions(+)
 create mode 100644 apps/platform.yaml
 create mode 100644 manifests/demo-app/externalsecret.yaml
 create mode 100644 manifests/platform/clustersecretstore.yaml

diff --git a/apps/platform.yaml b/apps/platform.yaml
new file mode 100644
index 0000000..c15d4a0
--- /dev/null
+++ b/apps/platform.yaml
@@ -0,0 +1,16 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: platform
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://ns31240276.ip-51-195-4.eu/devops/gitops.git
+    targetRevision: main
+    path: manifests/platform
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated: { prune: true, selfHeal: true }
diff --git a/manifests/demo-app/deployment.yaml b/manifests/demo-app/deployment.yaml
index 9a90a4f..05e5286 100644
--- a/manifests/demo-app/deployment.yaml
+++ b/manifests/demo-app/deployment.yaml
@@ -32,6 +32,10 @@ spec:
         - name: app
           # ye tag pipeline commit karti hai - haath se mat badlo
           image: ns31240276.ip-51-195-4.eu:5000/swim/demo-app:12
+          # Secrets Vault se aate hain - git me kabhi nahi.
+          envFrom:
+            - secretRef:
+                name: demo-app-secrets
           ports:
             - containerPort: 8000
           securityContext:
diff --git a/manifests/demo-app/externalsecret.yaml b/manifests/demo-app/externalsecret.yaml
new file mode 100644
index 0000000..d26d7bd
--- /dev/null
+++ b/manifests/demo-app/externalsecret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: demo-app-secrets
+  namespace: demo-app
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-swim
+    kind: ClusterSecretStore
+  target:
+    name: demo-app-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: GREETING
+      remoteRef:
+        key: demo-app
+        property: greeting
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        key: demo-app
+        property: db_password
diff --git a/manifests/platform/clustersecretstore.yaml b/manifests/platform/clustersecretstore.yaml
new file mode 100644
index 0000000..0f04865
--- /dev/null
+++ b/manifests/platform/clustersecretstore.yaml
@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-swim
+spec:
+  provider:
+    vault:
+      server: "https://ns31240276.ip-51-195-4.eu:8444"
+      path: "swim"
+      version: v2
+      auth:
+        # Koi static token nahi. ESO apni ServiceAccount ka JWT dikhata hai,
+        # Vault use k8s TokenReview se verify karta hai. Token 1 ghante me expire.
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "eso"
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets