Will Anderson
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
---
|
|
# SecretStore for GKE — uses GCP Secret Manager directly via Workload Identity.
|
|
# The DocuSeal GCP SA has secretmanager.secretAccessor on its own secrets
|
|
# (see servers/gcp/docuseal.tf).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: SecretStore
|
|
metadata:
|
|
name: gcp-secretmanager
|
|
namespace: docuseal
|
|
spec:
|
|
provider:
|
|
gcpsm:
|
|
projectID: neuron-785695
|
|
# Workload Identity — ESO impersonates the docuseal-gke GCP SA to access
|
|
# Secret Manager. No JSON key file required.
|
|
auth:
|
|
workloadIdentity:
|
|
clusterLocation: us-central1
|
|
clusterName: neuron-platform
|
|
serviceAccountRef:
|
|
name: docuseal
|
|
namespace: docuseal
|
|
---
|
|
# Pull all DocuSeal secrets from GCP Secret Manager into a single k8s Secret.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: docuseal-secrets
|
|
namespace: docuseal
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: gcp-secretmanager
|
|
kind: SecretStore
|
|
target:
|
|
name: docuseal-secrets
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: secret_key_base
|
|
remoteRef:
|
|
key: docuseal-secret-key-base
|
|
- secretKey: smtp_host
|
|
remoteRef:
|
|
key: docuseal-smtp-host
|
|
- secretKey: smtp_port
|
|
remoteRef:
|
|
key: docuseal-smtp-port
|
|
- secretKey: smtp_username
|
|
remoteRef:
|
|
key: docuseal-smtp-username
|
|
- secretKey: smtp_password
|
|
remoteRef:
|
|
key: docuseal-smtp-password
|
|
- secretKey: smtp_from
|
|
remoteRef:
|
|
key: docuseal-smtp-from
|