Migrate sops secrets to Vault hosted external secrets

Author: soerenschneider

apps/bookstack/components/oidc/kustomization.yaml

@@ -12,13 +12,3 @@ configMapGenerator:
       - "OIDC_DUMP_USER_DETAILS=false"
       - "OIDC_USER_TO_GROUPS=true"
       - "OIDC_GROUPS_CLAIM=resource_access.bookstack.roles"
-patches:
-  - target:
-      kind: "Deployment"
-      name: "bookstack"
-    patch: |
-      - op: "add"
-        path: "/spec/template/spec/containers/0/envFrom/-"
-        value:
-          secretRef:
-            name: "bookstack-oidc"

apps/bookstack/components/oidc/upsert-secret-bookstack-oidc.sh

@@ -9,13 +9,3 @@ configMapGenerator:
       - "GF_DATABASE_TYPE=mysql"
       - "GF_DATABASE_SSL_MODE=true"
       - "GF_DATABASE_CA_CERT_PATH=/etc/ssl/certs/ca-certificates.crt"
-patches:
-  - target:
-      kind: "Deployment"
-      name: "grafana"
-    patch: |-
-      - op: "add"
-        path: "/spec/template/spec/containers/0/envFrom/-"
-        value:
-          secretRef:
-            name: "grafana-database-mariadb"

apps/grafana/components/database-mariadb/kustomization.yaml

@@ -0,0 +1,34 @@
+---
+apiVersion: "external-secrets.io/v1beta1"
+kind: "ExternalSecret"
+metadata:
+  name: "bookstack"
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: "vault"
+    kind: "ClusterSecretStore"
+  target:
+    name: "bookstack"
+    creationPolicy: "Owner"
+  data:
+    - secretKey: "APP_KEY"
+      remoteRef:
+        key: "secret/soeren.cloud/env/prod/bookstack"
+        property: "APP_KEY"
+    - secretKey: "DB_PASSWORD"
+      remoteRef:
+        key: "secret/soeren.cloud/env/prod/bookstack"
+        property: "DB_PASSWORD"
+    - secretKey: "DB_USERNAME"
+      remoteRef:
+        key: "secret/soeren.cloud/env/prod/bookstack"
+        property: "DB_USERNAME"
+    - secretKey: "OIDC_CLIENT_ID"
+      remoteRef:
+        key: "secret/soeren.cloud/env/prod/bookstack"
+        property: "OIDC_CLIENT_ID"
+    - secretKey: "OIDC_CLIENT_SECRET"
+      remoteRef:
+        key: "secret/soeren.cloud/env/prod/bookstack"
+        property: "OIDC_CLIENT_SECRET"

apps/monitoring/prometheus-vault-token-sync/cronjob.yaml renamed to apps/monitoring/prometheus-vault-token-syncer/cronjob.yaml

@@ -5,8 +5,7 @@ namespace: bookstack
 resources:
   - ../../../apps/bookstack
   - namespace.yaml
-  - sops-secret-bookstack.yaml
-  - sops-secret-bookstack-oidc.yaml
+  - external-secret-bookstack.yaml
 components:
   - ../../../apps/bookstack/components/istio
   - ../../../apps/bookstack/components/oidc