chemavxandClaude Opus 4.8
f87f03d542
Out-of-band Secret -> Infisical homelab/prod /vaultwarden. Parallel-name target vaultwarden-secret-infisical (Owner), passthrough. Old vaultwarden-secret stays live until decommission. Applied via kubectl (not ArgoCD-managed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: vaultwarden-secret
|
|
namespace: vaultwarden
|
|
spec:
|
|
# Shared, read-only machine identity (no write grant, no PushSecret).
|
|
# Source is the /vaultwarden folder: ADMIN_TOKEN (Argon2id PHC protecting the
|
|
# /admin panel — replaced the old PLACEHOLDER_CHANGE_ME), DOMAIN, SIGNUPS_ALLOWED.
|
|
# Consumed via envFrom on the vaultwarden Deployment; Infisical key names already
|
|
# match the env var names (UPPER_SNAKE), so this is straight passthrough.
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /vaultwarden
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: vaultwarden-secret-infisical # parallel name — old secret stays live until 3c
|
|
namespace: vaultwarden
|
|
creationPolicy: Owner
|
|
# key passthrough: synced Secret carries ADMIN_TOKEN, DOMAIN, SIGNUPS_ALLOWED verbatim
|