add vault secret store
This commit is contained in:
parent
902557b9e7
commit
aaaad3f7a0
6 changed files with 55 additions and 9 deletions
18
flake.lock
18
flake.lock
|
@ -434,11 +434,11 @@
|
||||||
"utils": "utils_2"
|
"utils": "utils_2"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1673948101,
|
"lastModified": 1674041176,
|
||||||
"narHash": "sha256-cD0OzFfnLFeeaz4jVszH9QiMTn+PBxmcYzrp+xujpwM=",
|
"narHash": "sha256-cMf1BQzI39nHQ0H/mOatthbbI3392qLmJ9gU0u520P4=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "bd3efacb82c721edad1ce9eda583df5fb62ab00a",
|
"rev": "2c29ae48f9a149151bdd82f429ac61d4412c312a",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -455,11 +455,11 @@
|
||||||
"xdph": "xdph"
|
"xdph": "xdph"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1673958010,
|
"lastModified": 1674039296,
|
||||||
"narHash": "sha256-5SY1hQjLrl4vXaolP6Xf3+uMFitc06oe9ibB+x97Cds=",
|
"narHash": "sha256-VkhsLIKY/evIu/FRB9ughThrjva0YfJ8N8C0IYCJRPg=",
|
||||||
"owner": "hyprwm",
|
"owner": "hyprwm",
|
||||||
"repo": "Hyprland",
|
"repo": "Hyprland",
|
||||||
"rev": "c31c627cf85ea4fd40c1647c84d89b5e6f186785",
|
"rev": "32c11bb212dd88e4fe8e573f35649448f7d8911c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -855,11 +855,11 @@
|
||||||
},
|
},
|
||||||
"nur": {
|
"nur": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1674021312,
|
"lastModified": 1674046168,
|
||||||
"narHash": "sha256-kW00Hpb2jqX7zDHnw/us7DH4lChTa6DoVcZZrd9CKwE=",
|
"narHash": "sha256-5ffayoK//QsJYYhq0roW47e+ogz2AdV0+dKgvhG4FRM=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "NUR",
|
"repo": "NUR",
|
||||||
"rev": "993b34d7fc525534c59229312c1ff21a976def54",
|
"rev": "87d0c5acda6b08d96134dc2c7c96f0e6e38e8375",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
1
flux/olympus/core/external-secrets/.gitignore
vendored
Normal file
1
flux/olympus/core/external-secrets/.gitignore
vendored
Normal file
|
@ -0,0 +1 @@
|
||||||
|
vault-secret-id.yaml
|
|
@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
kind: Kustomization
|
kind: Kustomization
|
||||||
resources:
|
resources:
|
||||||
- helm-release.yaml
|
- helm-release.yaml
|
||||||
|
- vault-secret-store.yaml
|
||||||
|
|
|
@ -0,0 +1,7 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: vault-secret-id
|
||||||
|
namespace: security
|
||||||
|
data:
|
||||||
|
secret-id: XXXXXX # Obtain by `vault write -f auth/approle/role/external-secrets/secret-id`
|
27
flux/olympus/core/external-secrets/vault-secret-store.yaml
Normal file
27
flux/olympus/core/external-secrets/vault-secret-store.yaml
Normal file
|
@ -0,0 +1,27 @@
|
||||||
|
apiVersion: external-secrets.io/v1beta1
|
||||||
|
kind: ClusterSecretStore
|
||||||
|
metadata:
|
||||||
|
name: vault
|
||||||
|
namespace: security
|
||||||
|
spec:
|
||||||
|
provider:
|
||||||
|
vault:
|
||||||
|
server: "http://vault.olympus:8200"
|
||||||
|
path: "k8s"
|
||||||
|
version: "v2"
|
||||||
|
auth:
|
||||||
|
# VaultAppRole authenticates with Vault using the
|
||||||
|
# App Role auth mechanism
|
||||||
|
# https://www.vaultproject.io/docs/auth/approle
|
||||||
|
appRole:
|
||||||
|
# Path where the App Role authentication backend is mounted
|
||||||
|
path: "approle"
|
||||||
|
# RoleID configured in the App Role authentication backend
|
||||||
|
# `vault read auth/approle/role/external-secrets/role-id`
|
||||||
|
roleId: "bb841a0e-45c1-9dab-36f0-f72647d6aff0"
|
||||||
|
# Reference to a key in a K8 Secret that contains the App Role SecretId
|
||||||
|
# (not commited in git)
|
||||||
|
secretRef:
|
||||||
|
name: "vault-secret-id"
|
||||||
|
namespace: "security"
|
||||||
|
key: "secret-id"
|
|
@ -21,6 +21,16 @@
|
||||||
# Power Management
|
# Power Management
|
||||||
services.upower.enable = true;
|
services.upower.enable = true;
|
||||||
services.thermald.enable = true;
|
services.thermald.enable = true;
|
||||||
|
services.power-profiles-daemon.enable = false;
|
||||||
|
services.tlp = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
CPU_BOOST_ON_AC = 1;
|
||||||
|
CPU_BOOST_ON_BAT = 0;
|
||||||
|
CPU_SCALING_GOVERNOR_ON_AC = "performance";
|
||||||
|
CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
powerManagement = {
|
powerManagement = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
Loading…
Reference in a new issue