chemavxandClaude Opus 4.8
a86934c264
3a of the umami-secrets centralization. Adds umami-secrets-infisical synced from homelab/prod /umami (3 lowercase-hyphenated keys, passthrough). Parallel name — old out-of-band umami-secrets stays live until 3c. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: umami-secrets
|
|
namespace: umami
|
|
spec:
|
|
# Shared, read-only machine identity (no write grant, no PushSecret).
|
|
# Source is the /umami folder: app-secret (umami signing key), database-url
|
|
# (postgresql://user:pass@host — EMBEDS postgres-password), postgres-password.
|
|
# Infisical key names already match the deployments' secretKeyRef.key values
|
|
# (lowercase-hyphenated), so this is straight passthrough.
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /umami
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: umami-secrets-infisical # parallel name — old secret stays live until 3c
|
|
namespace: umami
|
|
creationPolicy: Owner
|
|
# key passthrough: synced Secret carries app-secret, database-url, postgres-password verbatim
|