Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(external-secrets): rework onepassword #3076

Merged
merged 3 commits into from
Jan 17, 2025
Merged

chore(external-secrets): rework onepassword #3076

merged 3 commits into from
Jan 17, 2025

Conversation

ishioni
Copy link
Owner

@ishioni ishioni commented Jan 17, 2025

Rework eso

@ishioni-bot ishioni-bot bot added area/kubernetes Changes made in the kubernetes directory cluster/talos size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 17, 2025
@ishioni-bot
Copy link
Contributor

ishioni-bot bot commented Jan 17, 2025 •
edited
Loading

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Elapsed time
✅ COPYPASTE jscpd yes no 1.33s
✅ REPOSITORY git_diff yes no 0.03s
✅ REPOSITORY secretlint yes no 2.76s
✅ YAML prettier 66 0 1.69s
✅ YAML yamllint 66 0 1.1s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

@ishioni-bot
Copy link
Contributor

ishioni-bot bot commented Jan 17, 2025 •
edited
Loading 

--- kubernetes/talos/apps/security/external-secrets/app Kustomization: flux-system/security-external-secrets HelmRelease: security/external-secrets

+++ kubernetes/talos/apps/security/external-secrets/app Kustomization: flux-system/security-external-secrets HelmRelease: security/external-secrets

@@ -1,75 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: external-secrets
-    kustomize.toolkit.fluxcd.io/name: security-external-secrets
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: external-secrets
-  namespace: security
-spec:
-  chart:
-    spec:
-      chart: external-secrets
-      sourceRef:
-        kind: HelmRepository
-        name: external-secrets
-        namespace: flux-system
-      version: 0.12.1
-  install:
-    crds: CreateReplace
-  interval: 30m
-  upgrade:
-    crds: CreateReplace
-  values:
-    certController:
-      resources:
-        limits:
-          memory: 150Mi
-        requests:
-          cpu: 15m
-          memory: 80Mi
-      serviceMonitor:
-        enabled: true
-        interval: 1m
-    installCRDs: true
-    leaderElect: true
-    replicaCount: 2
-    resources:
-      limits:
-        memory: 150Mi
-      requests:
-        cpu: 15m
-        memory: 50Mi
-    serviceMonitor:
-      enabled: true
-      interval: 1m
-    topologySpreadConstraints:
-    - labelSelector:
-        matchLabels:
-          app.kubernetes.io/instance: external-secrets
-          app.kubernetes.io/name: external-secrets
-      maxSkew: 1
-      topologyKey: kubernetes.io/hostname
-      whenUnsatisfiable: DoNotSchedule
-    webhook:
-      replicaCount: 2
-      resources:
-        limits:
-          memory: 100Mi
-        requests:
-          cpu: 15m
-          memory: 50Mi
-      serviceMonitor:
-        enabled: true
-        interval: 1m
-      topologySpreadConstraints:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/instance: external-secrets
-            app.kubernetes.io/name: external-secrets-cert-controller
-        maxSkew: 1
-        topologyKey: kubernetes.io/hostname
-        whenUnsatisfiable: DoNotSchedule
-
--- kubernetes/talos/apps/security/onepassword-connect/app Kustomization: flux-system/security-onepassword-connect HelmRelease: security/onepassword-connect

+++ kubernetes/talos/apps/security/onepassword-connect/app Kustomization: flux-system/security-onepassword-connect HelmRelease: security/onepassword-connect

@@ -1,140 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    app.kubernetes.io/name: onepassword-connect
-    kustomize.toolkit.fluxcd.io/name: security-onepassword-connect
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: onepassword-connect
-  namespace: security
-spec:
-  chart:
-    spec:
-      chart: app-template
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s
-        namespace: flux-system
-      version: 3.6.1
-  dependsOn:
-  - name: external-secrets
-  interval: 30m
-  values:
-    controllers:
-      onepassword-connect:
-        annotations:
-          secret.reloader.stakater.com/reload: onepassword-connect-secret
-        containers:
-          api:
-            env:
-              OP_BUS_PEERS: localhost:11221
-              OP_BUS_PORT: '11220'
-              OP_HTTP_PORT: 8080
-              OP_SESSION:
-                valueFrom:
-                  secretKeyRef:
-                    key: 1password-credentials.json
-                    name: onepassword-connect-secret
-              XDG_DATA_HOME: /config
-            image:
-              repository: ghcr.io/onedr0p/onepassword-connect-api
-              tag: 1.7.2
-            probes:
-              liveness:
-                custom: true
-                enabled: true
-                spec:
-                  failureThreshold: 3
-                  httpGet:
-                    path: /heartbeat
-                    port: 8080
-                  initialDelaySeconds: 15
-                  periodSeconds: 30
-              readiness:
-                custom: true
-                enabled: true
-                spec:
-                  httpGet:
-                    path: /health
-                    port: 8080
-                  initialDelaySeconds: 15
-              startup:
-                enabled: false
-            resources:
-              limits:
-                memory: 128Mi
-              requests:
-                cpu: 5m
-            securityContext:
-              allowPrivilegeEscalation: false
-              capabilities:
-                drop:
-                - ALL
-              readOnlyRootFilesystem: true
-          sync:
-            env:
-              OP_BUS_PEERS: localhost:11220
-              OP_BUS_PORT: 11221
-              OP_HTTP_PORT: 8081
-              OP_SESSION:
-                valueFrom:
-                  secretKeyRef:
-                    key: 1password-credentials.json
-                    name: onepassword-connect-secret
-              XDG_DATA_HOME: /config
-            image:
-              repository: ghcr.io/onedr0p/onepassword-sync
-              tag: 1.7.2
-            probes:
-              liveness:
-                custom: true
-                enabled: true
-                spec:
-                  failureThreshold: 3
-                  httpGet:
-                    path: /heartbeat
-                    port: 8081
-                  initialDelaySeconds: 15
-                  periodSeconds: 30
-              readiness:
-                custom: true
-                enabled: true
-                spec:
-                  httpGet:
-                    path: /health
-                    port: 8081
-                  initialDelaySeconds: 15
-            resources:
-              limits:
-                memory: 128Mi
-              requests:
-                cpu: 5m
-            securityContext:
-              allowPrivilegeEscalation: false
-              capabilities:
-                drop:
-                - ALL
-              readOnlyRootFilesystem: true
-        strategy: RollingUpdate
-    defaultPodOptions:
-      securityContext:
-        fsGroup: 999
-        fsGroupChangePolicy: OnRootMismatch
-        runAsGroup: 999
-        runAsNonRoot: true
-        runAsUser: 999
-        seccompProfile:
-          type: RuntimeDefault
-    persistence:
-      config:
-        globalMounts:
-        - path: /config
-        type: emptyDir
-    service:
-      api:
-        controller: onepassword-connect
-        ports:
-          http:
-            port: 8080
-
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/database-cloudnative-pg-cluster

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/database-cloudnative-pg-cluster

@@ -12,13 +12,13 @@

     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg
   - name: storage-openebs
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/database/cloudnative-pg/cluster
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/default-homepage

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/default-homepage

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: homepage
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/default/homepage/app
   postBuild:
     substitute:
       APP: homepage
       APP_GID: '568'
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-bazarr

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-bazarr

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/bazarr/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-lidarr

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-lidarr

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/lidarr/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-prowlarr

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-prowlarr

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/prowlarr/app
   postBuild:
     substitute:
       APP: prowlarr
       APP_GID: '5000'
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-qbittorrent

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-qbittorrent

@@ -13,13 +13,12 @@

       app.kubernetes.io/name: qbittorrent
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/qbittorrent/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-radarr

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-radarr

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-iscsi
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/radarr/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-recyclarr

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-recyclarr

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: recyclarr
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/recyclarr/app
   postBuild:
     substitute:
       APP: recyclarr
     substituteFrom:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-sonarr

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/downloads-sonarr

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/downloads/sonarr/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-system-addons

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/flux-system-addons

@@ -10,13 +10,13 @@

 spec:
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/flux-system/add-ons
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/github-arc

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/github-arc

@@ -10,13 +10,13 @@

 spec:
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/github/arc/operator
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/talos-system-talos-backup

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/talos-system-talos-backup

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: talos-backup
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/kube-system/talos-backup/app
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-gatus

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-gatus

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/monitor/gatus/app
   postBuild:
     substitute:
       APP: gatus
       HOSTNAME: status.movishell.pl
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-grafana

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-grafana

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: grafana
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/monitor/grafana/app
   postBuild:
     substitute:
       APP: grafana
       AUTH_HOSTNAME: auth.movishell.pl
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-kube-prometheus-stack

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-kube-prometheus-stack

@@ -15,13 +15,13 @@

     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: monitor-prometheus-operator-crds
   - name: storage-democratic-csi-iscsi
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/monitor/kube-prometheus-stack/app
   postBuild:
     substitute:
       ALERT_HOSTNAME: alerts.ishioni.casa
       APP: kube-prometheus-stack
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-thanos

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-thanos

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: storage-democratic-csi-iscsi
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: monitor-kube-prometheus-stack
   interval: 30m
   path: ./kubernetes/talos/apps/monitor/thanos/app
   postBuild:
     substituteFrom:
     - kind: ConfigMap
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-unpoller

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/monitor-unpoller

@@ -10,13 +10,13 @@

 spec:
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/monitor/unpoller/app
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/network-cert-manager-issuers

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/network-cert-manager-issuers

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: network-cert-manager
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/network/cert-manager/issuers
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/network-external-dns-cloudflare

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/network-external-dns-cloudflare

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: external-dns-cloudflare
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/network/external-dns/cloudflare
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/network-external-dns-unifi

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/network-external-dns-unifi

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: external-dns-unifi
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/network/external-dns/unifi
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-authentik

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-authentik

@@ -15,13 +15,13 @@

     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
   - name: database-dragonfly-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/security/authentik/app
   postBuild:
     substitute:
       APP: authentik
       HOSTNAME: auth.movishell.pl
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-external-secrets

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-external-secrets

@@ -13,13 +13,13 @@

       app.kubernetes.io/name: external-secrets
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   interval: 30m
-  path: ./kubernetes/talos/apps/security/external-secrets/app
+  path: ./kubernetes/talos/apps/security/external-secrets/operator
   postBuild:
     substituteFrom:
     - kind: ConfigMap
       name: cluster-settings
     - kind: Secret
       name: cluster-secrets
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-secret-store

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-secret-store

@@ -1,35 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: security-secret-store
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: secret-store
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-  - name: security-external-secrets
-  - name: security-onepassword-connect
-  interval: 30m
-  path: ./kubernetes/talos/apps/security/external-secrets/stores
-  postBuild:
-    substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-    - kind: Secret
-      name: cluster-secrets
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homelab-ops
-  targetNamespace: security
-  wait: true
-
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-onepassword-connect

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-onepassword-connect

@@ -1,32 +0,0 @@

----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: cluster-apps
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: security-onepassword-connect
-  namespace: flux-system
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: onepassword-connect
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  interval: 30m
-  path: ./kubernetes/talos/apps/security/onepassword-connect/app
-  postBuild:
-    substituteFrom:
-    - kind: ConfigMap
-      name: cluster-settings
-    - kind: Secret
-      name: cluster-secrets
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homelab-ops
-  targetNamespace: security
-  wait: true
-
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-atuin

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-atuin

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/atuin/app
   postBuild:
     substitute:
       APP: atuin
       HOSTNAME: atuin.ishioni.casa
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-audiobookshelf

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-audiobookshelf

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-iscsi
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/audiobookshelf/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-immich

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-immich

@@ -15,13 +15,13 @@

     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-dragonfly-cluster
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/immich/app
   postBuild:
     substitute:
       APP: immich
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-navidrome

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-navidrome

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-iscsi
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/navidrome/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-nextcloud

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-nextcloud

@@ -15,13 +15,13 @@

     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
   - name: database-dragonfly-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/nextcloud/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-paperless

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-paperless

@@ -15,13 +15,13 @@

     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
   - name: database-dragonfly-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/paperless/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-partdb

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/selfhosted-partdb

@@ -14,13 +14,13 @@

   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
   - name: database-cloudnative-pg-cluster
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-democratic-csi-nfs
   - name: storage-volsync
   interval: 30m
   path: ./kubernetes/talos/apps/selfhosted/partdb/app
   postBuild:
     substitute:
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/storage-democratic-csi-nfs

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/storage-democratic-csi-nfs

@@ -10,13 +10,13 @@

 spec:
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-snapshot-controller
   interval: 30m
   path: ./kubernetes/talos/apps/storage/democratic-csi/nfs
   postBuild:
     substituteFrom:
     - kind: ConfigMap
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/storage-democratic-csi-iscsi

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/storage-democratic-csi-iscsi

@@ -10,13 +10,13 @@

 spec:
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   dependsOn:
-  - name: security-secret-store
+  - name: security-onepassword-store
   - name: storage-snapshot-controller
   interval: 30m
   path: ./kubernetes/talos/apps/storage/democratic-csi/iscsi
   postBuild:
     substituteFrom:
     - kind: ConfigMap
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-onepassword

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-onepassword

@@ -0,0 +1,32 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: security-onepassword
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: onepassword
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 30m
+  path: ./kubernetes/talos/apps/security/external-secrets/onepassword/
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab-ops
+  targetNamespace: security
+  wait: true
+
--- kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-onepassword-store

+++ kubernetes/talos/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/security-onepassword-store

@@ -0,0 +1,35 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: security-onepassword-store
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: secret-store
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: security-external-secrets
+  - name: security-onepassword
+  interval: 30m
+  path: ./kubernetes/talos/apps/security/external-secrets/stores
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homelab-ops
+  targetNamespace: security
+  wait: true
+
--- kubernetes/talos/apps/security/external-secrets/stores Kustomization: flux-system/security-secret-store ClusterSecretStore: security/onepassword-connect

+++ kubernetes/talos/apps/security/external-secrets/stores Kustomization: flux-system/security-secret-store ClusterSecretStore: security/onepassword-connect

@@ -1,23 +0,0 @@

----
-apiVersion: external-secrets.io/v1beta1
-kind: ClusterSecretStore
-metadata:
-  labels:
-    app.kubernetes.io/name: secret-store
-    kustomize.toolkit.fluxcd.io/name: security-secret-store
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: onepassword-connect
-  namespace: security
-spec:
-  provider:
-    onepassword:
-      auth:
-        secretRef:
-          connectTokenSecretRef:
-            key: token
-            name: onepassword-connect-secret
-            namespace: security
-      connectHost: http://onepassword-connect.security.svc.cluster.local:8080
-      vaults:
-        Homelab: 1
-
--- kubernetes/talos/apps/kube-system/talos-backup/app Kustomization: flux-system/talos-system-talos-backup ExternalSecret: kube-system/talos-s3-secret

+++ kubernetes/talos/apps/kube-system/talos-backup/app Kustomization: flux-system/talos-system-talos-backup ExternalSecret: kube-system/talos-s3-secret

@@ -11,13 +11,13 @@

 spec:
   dataFrom:
   - extract:
       key: talos
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: talos-s3-secret
     template:
       data:
         AGE_X25519_PUBLIC_KEY: '{{ .AGE_PUBLIC_KEY }}'
--- kubernetes/talos/apps/network/cert-manager/issuers Kustomization: flux-system/network-cert-manager-issuers ExternalSecret: network/certmanager-cloudflare-secret

+++ kubernetes/talos/apps/network/cert-manager/issuers Kustomization: flux-system/network-cert-manager-issuers ExternalSecret: network/certmanager-cloudflare-secret

@@ -13,11 +13,11 @@

   - remoteRef:
       key: cloudflare
       property: CERT_MANAGER_TOKEN
     secretKey: API_TOKEN
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: certmanager-cloudflare-secret
 
--- kubernetes/talos/apps/github/arc/operator Kustomization: flux-system/github-arc ExternalSecret: github/arc-auth

+++ kubernetes/talos/apps/github/arc/operator Kustomization: flux-system/github-arc ExternalSecret: github/arc-auth

@@ -20,11 +20,11 @@

   - remoteRef:
       key: actions-runner-controller
       property: PRIVATE_KEY
     secretKey: PRIVATE_KEY
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: arc-auth
 
--- kubernetes/talos/apps/storage/democratic-csi/iscsi Kustomization: flux-system/storage-democratic-csi-iscsi ExternalSecret: storage/dcsi-iscsi-secret

+++ kubernetes/talos/apps/storage/democratic-csi/iscsi Kustomization: flux-system/storage-democratic-csi-iscsi ExternalSecret: storage/dcsi-iscsi-secret

@@ -12,13 +12,13 @@

   - extract:
       conversionStrategy: Default
       decodingStrategy: None
       key: democratic-csi
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: dcsi-iscsi-secret
     template:
       data:
         driver-config-file.yaml: |
--- kubernetes/talos/apps/network/external-dns/cloudflare Kustomization: flux-system/network-external-dns-cloudflare ExternalSecret: network/externaldns-cloudflare-secret

+++ kubernetes/talos/apps/network/external-dns/cloudflare Kustomization: flux-system/network-external-dns-cloudflare ExternalSecret: network/externaldns-cloudflare-secret

@@ -11,13 +11,13 @@

 spec:
   dataFrom:
   - extract:
       key: cloudflare
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: externaldns-cloudflare-secret
     template:
       data:
         CF_API_TOKEN: '{{ .EXTERNAL_DNS_TOKEN }}'
--- kubernetes/talos/apps/network/external-dns/unifi Kustomization: flux-system/network-external-dns-unifi ExternalSecret: network/externaldns-unifi-secret

+++ kubernetes/talos/apps/network/external-dns/unifi Kustomization: flux-system/network-external-dns-unifi ExternalSecret: network/externaldns-unifi-secret

@@ -11,13 +11,13 @@

 spec:
   dataFrom:
   - extract:
       key: unifi
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: externaldns-unifi-secret
     template:
       data:
         UNIFI_API_KEY: '{{ .EXTERNALDNS_KEY }}'
--- kubernetes/talos/apps/monitor/unpoller/app Kustomization: flux-system/monitor-unpoller ExternalSecret: monitor/unpoller-secret

+++ kubernetes/talos/apps/monitor/unpoller/app Kustomization: flux-system/monitor-unpoller ExternalSecret: monitor/unpoller-secret

@@ -10,13 +10,13 @@

 spec:
   dataFrom:
   - extract:
       key: unifi
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: unpoller-secret
     template:
       data:
         UP_UNIFI_DEFAULT_API_KEY: '{{ .UNPOLLER_KEY }}'
--- kubernetes/talos/apps/storage/democratic-csi/nfs Kustomization: flux-system/storage-democratic-csi-nfs ExternalSecret: storage/dcsi-ssd-nfs-secret

+++ kubernetes/talos/apps/storage/democratic-csi/nfs Kustomization: flux-system/storage-democratic-csi-nfs ExternalSecret: storage/dcsi-ssd-nfs-secret

@@ -12,13 +12,13 @@

   - extract:
       conversionStrategy: Default
       decodingStrategy: None
       key: democratic-csi
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: dcsi-ssd-nfs-secret
     template:
       data:
         driver-config-file.yaml: |
--- kubernetes/talos/apps/downloads/recyclarr/app Kustomization: flux-system/downloads-recyclarr ExternalSecret: downloads/recyclarr-secret

+++ kubernetes/talos/apps/downloads/recyclarr/app Kustomization: flux-system/downloads-recyclarr ExternalSecret: downloads/recyclarr-secret

@@ -13,13 +13,13 @@

   - extract:
       key: sonarr
   - extract:
       key: radarr
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: recyclarr-secret
     template:
       data:
         RADARR_API_KEY: '{{ .RADARR__API_KEY }}'
--- kubernetes/talos/apps/database/cloudnative-pg/cluster Kustomization: flux-system/database-cloudnative-pg-cluster ExternalSecret: database/cloudnative-pg-secret

+++ kubernetes/talos/apps/database/cloudnative-pg/cluster Kustomization: flux-system/database-cloudnative-pg-cluster ExternalSecret: database/cloudnative-pg-secret

@@ -24,13 +24,13 @@

   - remoteRef:
       key: cloudnative-pg
       property: POSTGRES_S3_SECRET_KEY
     secretKey: s3-secret-key
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: cloudnative-pg-secret
     template:
       metadata:
         labels:
--- kubernetes/talos/apps/flux-system/add-ons Kustomization: flux-system/flux-system-addons ExternalSecret: flux-system/flux-github-token

+++ kubernetes/talos/apps/flux-system/add-ons Kustomization: flux-system/flux-system-addons ExternalSecret: flux-system/flux-github-token

@@ -12,11 +12,11 @@

   - remoteRef:
       key: flux
       property: GITHUB_TOKEN
     secretKey: token
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: flux-github-token
 
--- kubernetes/talos/apps/flux-system/add-ons Kustomization: flux-system/flux-system-addons ExternalSecret: flux-system/flux-telegram-token

+++ kubernetes/talos/apps/flux-system/add-ons Kustomization: flux-system/flux-system-addons ExternalSecret: flux-system/flux-telegram-token

@@ -12,13 +12,13 @@

   - extract:
       conversionStrategy: Default
       decodingStrategy: None
       key: flux
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: flux-telegram-token
     template:
       data:
         address: https://api.telegram.org
--- kubernetes/talos/apps/flux-system/add-ons Kustomization: flux-system/flux-system-addons ExternalSecret: flux-system/flux-github-webhook

+++ kubernetes/talos/apps/flux-system/add-ons Kustomization: flux-system/flux-system-addons ExternalSecret: flux-system/flux-github-webhook

@@ -12,11 +12,11 @@

   - remoteRef:
       key: flux
       property: GITHUB_WEBHOOK_TOKEN
     secretKey: token
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: flux-github-webhook
 
--- kubernetes/talos/apps/monitor/grafana/app Kustomization: flux-system/monitor-grafana ExternalSecret: monitor/grafana-secret

+++ kubernetes/talos/apps/monitor/grafana/app Kustomization: flux-system/monitor-grafana ExternalSecret: monitor/grafana-secret

@@ -13,13 +13,13 @@

   - extract:
       key: grafana
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: grafana-secret
     template:
       data:
         GF_AUTH_GENERIC_OAUTH_CLIENT_ID: '{{ .OIDC_CLIENT_ID }}'
--- kubernetes/talos/apps/default/homepage/app Kustomization: flux-system/default-homepage ExternalSecret: default/homepage-secret

+++ kubernetes/talos/apps/default/homepage/app Kustomization: flux-system/default-homepage ExternalSecret: default/homepage-secret

@@ -93,13 +93,13 @@

   - remoteRef:
       key: nextcloud
       property: METRICS_TOKEN
     secretKey: nextcloud_token
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: homepage-secret
     template:
       data:
         HOMEPAGE_VAR_AUDIOBOOKSHELF_TOKEN: '{{ .audiobookshelf_token }}'
--- kubernetes/talos/apps/downloads/bazarr/app Kustomization: flux-system/downloads-bazarr ExternalSecret: downloads/bazarr-secret

+++ kubernetes/talos/apps/downloads/bazarr/app Kustomization: flux-system/downloads-bazarr ExternalSecret: downloads/bazarr-secret

@@ -13,13 +13,13 @@

   - extract:
       key: bazarr
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: bazarr-secret
     template:
       data:
         INIT_POSTGRES_DBNAME: bazarr
--- kubernetes/talos/apps/downloads/sonarr/app Kustomization: flux-system/downloads-sonarr ExternalSecret: downloads/sonarr-secret

+++ kubernetes/talos/apps/downloads/sonarr/app Kustomization: flux-system/downloads-sonarr ExternalSecret: downloads/sonarr-secret

@@ -13,13 +13,13 @@

   - extract:
       key: sonarr
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: sonarr-secret
     template:
       data:
         INIT_POSTGRES_DBNAME: sonarr
--- kubernetes/talos/apps/downloads/prowlarr/app Kustomization: flux-system/downloads-prowlarr ExternalSecret: downloads/prowlarr-secret

+++ kubernetes/talos/apps/downloads/prowlarr/app Kustomization: flux-system/downloads-prowlarr ExternalSecret: downloads/prowlarr-secret

@@ -13,13 +13,13 @@

   - extract:
       key: prowlarr
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: prowlarr-secret
     template:
       data:
         INIT_POSTGRES_DBNAME: prowlarr
--- kubernetes/talos/apps/downloads/lidarr/app Kustomization: flux-system/downloads-lidarr ExternalSecret: downloads/lidarr-secret

+++ kubernetes/talos/apps/downloads/lidarr/app Kustomization: flux-system/downloads-lidarr ExternalSecret: downloads/lidarr-secret

@@ -13,13 +13,13 @@

   - extract:
       key: lidarr
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: lidarr-secret
     template:
       data:
         INIT_POSTGRES_DBNAME: lidarr
--- kubernetes/talos/apps/selfhosted/atuin/app Kustomization: flux-system/selfhosted-atuin ExternalSecret: selfhosted/atuin-secret

+++ kubernetes/talos/apps/selfhosted/atuin/app Kustomization: flux-system/selfhosted-atuin ExternalSecret: selfhosted/atuin-secret

@@ -13,13 +13,13 @@

   - extract:
       key: atuin
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: atuin-secret
     template:
       data:
         ATUIN_DB_URI: postgres://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-16-rw.database.svc.cluster.local/atuin
--- kubernetes/talos/apps/selfhosted/audiobookshelf/app Kustomization: flux-system/selfhosted-audiobookshelf ExternalSecret: selfhosted/audiobookshelf-secret

+++ kubernetes/talos/apps/selfhosted/audiobookshelf/app Kustomization: flux-system/selfhosted-audiobookshelf ExternalSecret: selfhosted/audiobookshelf-secret

@@ -11,13 +11,13 @@

 spec:
   dataFrom:
   - extract:
       key: audiobookshelf
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: audiobookshelf-secret
     template:
       data:
         AUDIOBOOKSHELF_OIDC_CLIENT_ID: '{{ .OIDC_CLIENT_ID }}'
--- kubernetes/talos/apps/downloads/radarr/app Kustomization: flux-system/downloads-radarr ExternalSecret: downloads/radarr-secret

+++ kubernetes/talos/apps/downloads/radarr/app Kustomization: flux-system/downloads-radarr ExternalSecret: downloads/radarr-secret

@@ -13,13 +13,13 @@

   - extract:
       key: radarr
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: radarr-secret
     template:
       data:
         INIT_POSTGRES_DBNAME: radarr
--- kubernetes/talos/apps/monitor/gatus/app Kustomization: flux-system/monitor-gatus ExternalSecret: monitor/gatus-secret

+++ kubernetes/talos/apps/monitor/gatus/app Kustomization: flux-system/monitor-gatus ExternalSecret: monitor/gatus-secret

@@ -15,13 +15,13 @@

   - extract:
       key: telegram-glados
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: gatus-secret
     template:
       data:
         CUSTOM_TELEGRAM_BOT_TOKEN: '{{ .TELEGRAM_BOT_TOKEN }}'
--- kubernetes/talos/apps/selfhosted/partdb/app Kustomization: flux-system/selfhosted-partdb ExternalSecret: selfhosted/partdb-secret

+++ kubernetes/talos/apps/selfhosted/partdb/app Kustomization: flux-system/selfhosted-partdb ExternalSecret: selfhosted/partdb-secret

@@ -13,13 +13,13 @@

   - extract:
       key: partdb
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: partdb-secret
     template:
       data:
         DATABASE_URL: postgresql://{{ .POSTGRES_USER }}:{{ .POSTGRES_PASS }}@postgres-16-rw.database.svc.cluster.local:5432/partdb?serverVersion=16.3&charset=utf8
--- kubernetes/talos/apps/monitor/kube-prometheus-stack/app Kustomization: flux-system/monitor-kube-prometheus-stack ExternalSecret: monitor/thanos-objectstore-secret

+++ kubernetes/talos/apps/monitor/kube-prometheus-stack/app Kustomization: flux-system/monitor-kube-prometheus-stack ExternalSecret: monitor/thanos-objectstore-secret

@@ -11,13 +11,13 @@

 spec:
   dataFrom:
   - extract:
       key: thanos
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: thanos-objectstore-secret
     template:
       data:
         objstore.yml: |
--- kubernetes/talos/apps/monitor/kube-prometheus-stack/app Kustomization: flux-system/monitor-kube-prometheus-stack ExternalSecret: monitor/alertmanager-secret

+++ kubernetes/talos/apps/monitor/kube-prometheus-stack/app Kustomization: flux-system/monitor-kube-prometheus-stack ExternalSecret: monitor/alertmanager-secret

@@ -11,13 +11,13 @@

 spec:
   dataFrom:
   - extract:
       key: telegram-glados
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: alertmanager-secret
     template:
       data:
         TELEGRAM_BOT_TOKEN: '{{ .TELEGRAM_BOT_TOKEN }}'
--- kubernetes/talos/apps/security/authentik/app Kustomization: flux-system/security-authentik ExternalSecret: security/authentik-secret

+++ kubernetes/talos/apps/security/authentik/app Kustomization: flux-system/security-authentik ExternalSecret: security/authentik-secret

@@ -15,13 +15,13 @@

   - extract:
       key: cloudnative-pg
   - extract:
       key: smtp
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: authentik-secret
     template:
       data:
         AUTHENTIK_EMAIL__FROM: Authentik <[email protected]>
--- kubernetes/talos/apps/selfhosted/paperless/app Kustomization: flux-system/selfhosted-paperless ExternalSecret: selfhosted/paperless-secret

+++ kubernetes/talos/apps/selfhosted/paperless/app Kustomization: flux-system/selfhosted-paperless ExternalSecret: selfhosted/paperless-secret

@@ -13,13 +13,13 @@

   - extract:
       key: paperless
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: paperless-secret
     template:
       data:
         INIT_POSTGRES_DBNAME: paperless
--- kubernetes/talos/apps/selfhosted/immich/app Kustomization: flux-system/selfhosted-immich ExternalSecret: selfhosted/immich-config-secret

+++ kubernetes/talos/apps/selfhosted/immich/app Kustomization: flux-system/selfhosted-immich ExternalSecret: selfhosted/immich-config-secret

@@ -13,13 +13,13 @@

   - extract:
       key: immich
   - extract:
       key: smtp
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: immich-config-secret
     template:
       templateFrom:
       - configMap:
--- kubernetes/talos/apps/selfhosted/immich/app Kustomization: flux-system/selfhosted-immich ExternalSecret: selfhosted/immich-secret

+++ kubernetes/talos/apps/selfhosted/immich/app Kustomization: flux-system/selfhosted-immich ExternalSecret: selfhosted/immich-secret

@@ -13,13 +13,13 @@

   - extract:
       key: immich
   - extract:
       key: cloudnative-pg
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: immich-secret
     template:
       data:
         DB_DATABASE_NAME: immich
--- kubernetes/talos/apps/selfhosted/nextcloud/app Kustomization: flux-system/selfhosted-nextcloud ExternalSecret: selfhosted/nextcloud-secret

+++ kubernetes/talos/apps/selfhosted/nextcloud/app Kustomization: flux-system/selfhosted-nextcloud ExternalSecret: selfhosted/nextcloud-secret

@@ -15,13 +15,13 @@

   - extract:
       key: cloudnative-pg
   - extract:
       key: smtp
   secretStoreRef:
     kind: ClusterSecretStore
-    name: onepassword-connect
+    name: onepassword
   target:
     creationPolicy: Owner
     name: nextcloud-secret
     template:
       data:
         ADMIN_PASS: '{{ .ADMIN_PASS }}'
--- kubernetes/talos/apps/security/external-secrets/operator Kustomization: flux-system/security-external-secrets HelmRelease: security/external-secrets

+++ kubernetes/talos/apps/security/external-secrets/operator Kustomization: flux-system/security-external-secrets HelmRelease: security/external-secrets

@@ -0,0 +1,75 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: external-secrets
+    kustomize.toolkit.fluxcd.io/name: security-external-secrets
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: external-secrets
+  namespace: security
+spec:
+  chart:
+    spec:
+      chart: external-secrets
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+        namespace: flux-system
+      version: 0.12.1
+  install:
+    crds: CreateReplace
+  interval: 30m
+  upgrade:
+    crds: CreateReplace
+  values:
+    certController:
+      resources:
+        limits:
+          memory: 150Mi
+        requests:
+          cpu: 15m
+          memory: 80Mi
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+    installCRDs: true
+    leaderElect: true
+    replicaCount: 2
+    resources:
+      limits:
+        memory: 150Mi
+      requests:
+        cpu: 15m
+        memory: 50Mi
+    serviceMonitor:
+      enabled: true
+      interval: 1m
+    topologySpreadConstraints:
+    - labelSelector:
+        matchLabels:
+          app.kubernetes.io/instance: external-secrets
+          app.kubernetes.io/name: external-secrets
+      maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: DoNotSchedule
+    webhook:
+      replicaCount: 2
+      resources:
+        limits:
+          memory: 100Mi
+        requests:
+          cpu: 15m
+          memory: 50Mi
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app.kubernetes.io/instance: external-secrets
+            app.kubernetes.io/name: external-secrets-cert-controller
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+
--- kubernetes/talos/apps/security/external-secrets/onepassword Kustomization: flux-system/security-onepassword HelmRelease: security/onepassword

+++ kubernetes/talos/apps/security/external-secrets/onepassword Kustomization: flux-system/security-onepassword HelmRelease: security/onepassword

@@ -0,0 +1,140 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: onepassword
+    kustomize.toolkit.fluxcd.io/name: security-onepassword
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: onepassword
+  namespace: security
+spec:
+  chart:
+    spec:
+      chart: app-template
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+      version: 3.6.1
+  dependsOn:
+  - name: external-secrets
+  interval: 30m
+  values:
+    controllers:
+      onepassword:
+        annotations:
+          secret.reloader.stakater.com/reload: onepassword-secret
+        containers:
+          api:
+            env:
+              OP_BUS_PEERS: localhost:11221
+              OP_BUS_PORT: '11220'
+              OP_HTTP_PORT: 8080
+              OP_SESSION:
+                valueFrom:
+                  secretKeyRef:
+                    key: 1password-credentials.json
+                    name: onepassword-secret
+              XDG_DATA_HOME: /config
+            image:
+              repository: ghcr.io/onedr0p/onepassword-connect-api
+              tag: 1.7.2
+            probes:
+              liveness:
+                custom: true
+                enabled: true
+                spec:
+                  failureThreshold: 3
+                  httpGet:
+                    path: /heartbeat
+                    port: 8080
+                  initialDelaySeconds: 15
+                  periodSeconds: 30
+              readiness:
+                custom: true
+                enabled: true
+                spec:
+                  httpGet:
+                    path: /health
+                    port: 8080
+                  initialDelaySeconds: 15
+              startup:
+                enabled: false
+            resources:
+              limits:
+                memory: 128Mi
+              requests:
+                cpu: 5m
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              readOnlyRootFilesystem: true
+          sync:
+            env:
+              OP_BUS_PEERS: localhost:11220
+              OP_BUS_PORT: 11221
+              OP_HTTP_PORT: 8081
+              OP_SESSION:
+                valueFrom:
+                  secretKeyRef:
+                    key: 1password-credentials.json
+                    name: onepassword-secret
+              XDG_DATA_HOME: /config
+            image:
+              repository: ghcr.io/onedr0p/onepassword-sync
+              tag: 1.7.2
+            probes:
+              liveness:
+                custom: true
+                enabled: true
+                spec:
+                  failureThreshold: 3
+                  httpGet:
+                    path: /heartbeat
+                    port: 8081
+                  initialDelaySeconds: 15
+                  periodSeconds: 30
+              readiness:
+                custom: true
+                enabled: true
+                spec:
+                  httpGet:
+                    path: /health
+                    port: 8081
+                  initialDelaySeconds: 15
+            resources:
+              limits:
+                memory: 128Mi
+              requests:
+                cpu: 5m
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              readOnlyRootFilesystem: true
+        strategy: RollingUpdate
+    defaultPodOptions:
+      securityContext:
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 999
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+    persistence:
+      config:
+        globalMounts:
+        - path: /config
+        type: emptyDir
+    service:
+      api:
+        controller: onepassword
+        ports:
+          http:
+            port: 8080
+
--- kubernetes/talos/apps/security/external-secrets/stores Kustomization: flux-system/security-onepassword-store ClusterSecretStore: security/onepassword

+++ kubernetes/talos/apps/security/external-secrets/stores Kustomization: flux-system/security-onepassword-store ClusterSecretStore: security/onepassword

@@ -0,0 +1,23 @@

+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  labels:
+    app.kubernetes.io/name: secret-store
+    kustomize.toolkit.fluxcd.io/name: security-onepassword-store
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: onepassword
+  namespace: security
+spec:
+  provider:
+    onepassword:
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            key: token
+            name: onepassword-secret
+            namespace: security
+      connectHost: http://onepassword.security.svc.cluster.local:8080
+      vaults:
+        Homelab: 1
+

@ishioni-bot
Copy link
Contributor

ishioni-bot bot commented Jan 17, 2025 

--- HelmRelease: security/onepassword-connect Service: security/onepassword-connect

+++ HelmRelease: security/onepassword-connect Service: security/onepassword-connect

@@ -1,22 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: onepassword-connect
-  labels:
-    app.kubernetes.io/instance: onepassword-connect
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: onepassword-connect
-    app.kubernetes.io/service: onepassword-connect
-spec:
-  type: ClusterIP
-  ports:
-  - port: 8080
-    targetPort: 8080
-    protocol: TCP
-    name: http
-  selector:
-    app.kubernetes.io/component: onepassword-connect
-    app.kubernetes.io/instance: onepassword-connect
-    app.kubernetes.io/name: onepassword-connect
-
--- HelmRelease: security/onepassword-connect Deployment: security/onepassword-connect

+++ HelmRelease: security/onepassword-connect Deployment: security/onepassword-connect

@@ -1,133 +0,0 @@

----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: onepassword-connect
-  labels:
-    app.kubernetes.io/component: onepassword-connect
-    app.kubernetes.io/instance: onepassword-connect
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: onepassword-connect
-  annotations:
-    secret.reloader.stakater.com/reload: onepassword-connect-secret
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: onepassword-connect
-      app.kubernetes.io/name: onepassword-connect
-      app.kubernetes.io/instance: onepassword-connect
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/component: onepassword-connect
-        app.kubernetes.io/instance: onepassword-connect
-        app.kubernetes.io/name: onepassword-connect
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      securityContext:
-        fsGroup: 999
-        fsGroupChangePolicy: OnRootMismatch
-        runAsGroup: 999
-        runAsNonRoot: true
-        runAsUser: 999
-        seccompProfile:
-          type: RuntimeDefault
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-      - env:
-        - name: OP_BUS_PEERS
-          value: localhost:11221
-        - name: OP_BUS_PORT
-          value: '11220'
-        - name: OP_HTTP_PORT
-          value: '8080'
-        - name: OP_SESSION
-          valueFrom:
-            secretKeyRef:
-              key: 1password-credentials.json
-              name: onepassword-connect-secret
-        - name: XDG_DATA_HOME
-          value: /config
-        image: ghcr.io/onedr0p/onepassword-connect-api:1.7.2
-        livenessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /heartbeat
-            port: 8080
-          initialDelaySeconds: 15
-          periodSeconds: 30
-        name: api
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 15
-        resources:
-          limits:
-            memory: 128Mi
-          requests:
-            cpu: 5m
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - mountPath: /config
-          name: config
-      - env:
-        - name: OP_BUS_PEERS
-          value: localhost:11220
-        - name: OP_BUS_PORT
-          value: '11221'
-        - name: OP_HTTP_PORT
-          value: '8081'
-        - name: OP_SESSION
-          valueFrom:
-            secretKeyRef:
-              key: 1password-credentials.json
-              name: onepassword-connect-secret
-        - name: XDG_DATA_HOME
-          value: /config
-        image: ghcr.io/onedr0p/onepassword-sync:1.7.2
-        livenessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /heartbeat
-            port: 8081
-          initialDelaySeconds: 15
-          periodSeconds: 30
-        name: sync
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8081
-          initialDelaySeconds: 15
-        resources:
-          limits:
-            memory: 128Mi
-          requests:
-            cpu: 5m
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - mountPath: /config
-          name: config
-      volumes:
-      - emptyDir: {}
-        name: config
-
--- HelmRelease: security/onepassword Service: security/onepassword

+++ HelmRelease: security/onepassword Service: security/onepassword

@@ -0,0 +1,22 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: onepassword
+  labels:
+    app.kubernetes.io/instance: onepassword
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: onepassword
+    app.kubernetes.io/service: onepassword
+spec:
+  type: ClusterIP
+  ports:
+  - port: 8080
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/component: onepassword
+    app.kubernetes.io/instance: onepassword
+    app.kubernetes.io/name: onepassword
+
--- HelmRelease: security/onepassword Deployment: security/onepassword

+++ HelmRelease: security/onepassword Deployment: security/onepassword

@@ -0,0 +1,133 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: onepassword
+  labels:
+    app.kubernetes.io/component: onepassword
+    app.kubernetes.io/instance: onepassword
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: onepassword
+  annotations:
+    secret.reloader.stakater.com/reload: onepassword-secret
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: onepassword
+      app.kubernetes.io/name: onepassword
+      app.kubernetes.io/instance: onepassword
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: onepassword
+        app.kubernetes.io/instance: onepassword
+        app.kubernetes.io/name: onepassword
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 999
+        runAsNonRoot: true
+        runAsUser: 999
+        seccompProfile:
+          type: RuntimeDefault
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - env:
+        - name: OP_BUS_PEERS
+          value: localhost:11221
+        - name: OP_BUS_PORT
+          value: '11220'
+        - name: OP_HTTP_PORT
+          value: '8080'
+        - name: OP_SESSION
+          valueFrom:
+            secretKeyRef:
+              key: 1password-credentials.json
+              name: onepassword-secret
+        - name: XDG_DATA_HOME
+          value: /config
+        image: ghcr.io/onedr0p/onepassword-connect-api:1.7.2
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /heartbeat
+            port: 8080
+          initialDelaySeconds: 15
+          periodSeconds: 30
+        name: api
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 15
+        resources:
+          limits:
+            memory: 128Mi
+          requests:
+            cpu: 5m
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /config
+          name: config
+      - env:
+        - name: OP_BUS_PEERS
+          value: localhost:11220
+        - name: OP_BUS_PORT
+          value: '11221'
+        - name: OP_HTTP_PORT
+          value: '8081'
+        - name: OP_SESSION
+          valueFrom:
+            secretKeyRef:
+              key: 1password-credentials.json
+              name: onepassword-secret
+        - name: XDG_DATA_HOME
+          value: /config
+        image: ghcr.io/onedr0p/onepassword-sync:1.7.2
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /heartbeat
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 30
+        name: sync
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8081
+          initialDelaySeconds: 15
+        resources:
+          limits:
+            memory: 128Mi
+          requests:
+            cpu: 5m
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /config
+          name: config
+      volumes:
+      - emptyDir: {}
+        name: config
+

@ishioni ishioni merged commit 40de5af into master Jan 17, 2025
12 checks passed
@ishioni ishioni deleted the chore/external-secrets-rework branch January 17, 2025 22:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
area/kubernetes Changes made in the kubernetes directory cluster/talos size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ishioni