add DocuSeal to GKE — manifests, Terraform, Argo CD app; update ci-base Dockerfile

2026-05-05 10:38:45 -05:00
parent 73b9095d83
commit 086a7b0bf0
8 changed files with 291 additions and 1 deletions
@@ -0,0 +1,56 @@
+---
+# SecretStore for GKE — uses GCP Secret Manager directly via Workload Identity.
+# The DocuSeal GCP SA has secretmanager.secretAccessor on its own secrets
+# (see servers/gcp/docuseal.tf).
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: gcp-secretmanager
+  namespace: docuseal
+spec:
+  provider:
+    gcpsm:
+      projectID: neuron-785695
+      # Workload Identity — ESO impersonates the docuseal-gke GCP SA to access
+      # Secret Manager. No JSON key file required.
+      auth:
+        workloadIdentity:
+          clusterLocation: us-central1
+          clusterName: neuron-platform
+          serviceAccountRef:
+            name: docuseal
+            namespace: docuseal
+---
+# Pull all DocuSeal secrets from GCP Secret Manager into a single k8s Secret.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: docuseal-secrets
+  namespace: docuseal
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: gcp-secretmanager
+    kind: SecretStore
+  target:
+    name: docuseal-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: secret_key_base
+      remoteRef:
+        key: docuseal-secret-key-base
+    - secretKey: smtp_host
+      remoteRef:
+        key: docuseal-smtp-host
+    - secretKey: smtp_port
+      remoteRef:
+        key: docuseal-smtp-port
+    - secretKey: smtp_username
+      remoteRef:
+        key: docuseal-smtp-username
+    - secretKey: smtp_password
+      remoteRef:
+        key: docuseal-smtp-password
+    - secretKey: smtp_from
+      remoteRef:
+        key: docuseal-smtp-from