28 lines
1.1 KiB
YAML
28 lines
1.1 KiB
YAML
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: grafana-telegram
|
|
namespace: monitoring
|
|
spec:
|
|
# Shared, read-only machine identity (no write grant, no PushSecret).
|
|
# NOTE: the monitoring namespace is applied OUT-OF-BAND (not an ArgoCD app),
|
|
# so this CR is created with `kubectl apply` — committing it here is for record.
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
# Reused from the shared /telegram path (same token as the other namespaces;
|
|
# 7th and final copy of the Telegram bot token leaving git).
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /telegram
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: grafana-telegram-infisical # parallel name — old grafana-telegram stays live until 3c
|
|
namespace: monitoring
|
|
creationPolicy: Owner
|
|
# key passthrough: synced Secret carries TELEGRAM_BOT_TOKEN + TELEGRAM_CHAT_ID
|
|
# verbatim — Grafana's env secretKeyRefs use those exact names (no remap).
|