platform: ClusterSecretStore (vault k8s auth) + demo-app ExternalSecret

apps/platform.yaml

@@ -0,0 +1,16 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: platform
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://ns31240276.ip-51-195-4.eu/devops/gitops.git
+    targetRevision: main
+    path: manifests/platform
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated: { prune: true, selfHeal: true }

manifests/demo-app/deployment.yaml

@@ -32,6 +32,10 @@ spec:
         - name: app
           # ye tag pipeline commit karti hai - haath se mat badlo
           image: ns31240276.ip-51-195-4.eu:5000/swim/demo-app:12
+          # Secrets Vault se aate hain - git me kabhi nahi.
+          envFrom:
+            - secretRef:
+                name: demo-app-secrets
           ports:
             - containerPort: 8000
           securityContext:

manifests/demo-app/externalsecret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: demo-app-secrets
+  namespace: demo-app
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-swim
+    kind: ClusterSecretStore
+  target:
+    name: demo-app-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: GREETING
+      remoteRef:
+        key: demo-app
+        property: greeting
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        key: demo-app
+        property: db_password

manifests/platform/clustersecretstore.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-swim
+spec:
+  provider:
+    vault:
+      server: "https://ns31240276.ip-51-195-4.eu:8444"
+      path: "swim"
+      version: v2
+      auth:
+        # Koi static token nahi. ESO apni ServiceAccount ka JWT dikhata hai,
+        # Vault use k8s TokenReview se verify karta hai. Token 1 ghante me expire.
+        kubernetes:
+          mountPath: "kubernetes"
+          role: "eso"
+          serviceAccountRef:
+            name: external-secrets
+            namespace: external-secrets