fix: Use SealedSecrets for CrowdSec bouncer API key

Replace hardcoded bouncer key with SealedSecrets in both crowdsec
and ingress namespaces. CrowdSec LAPI pre-registers the bouncer
via BOUNCER_KEY_ingress env var, ingress-nginx reads the same key
from its namespace's secret.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

kubernetes/apps/crowdsec/bouncer-secret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: crowdsec-bouncer-key
+  namespace: crowdsec
+spec:
+  encryptedData:
+    key: AgAXOKwAYFUYaOWatROeEt8Kw8fTUbHibipBy9/nAFJW8N3yWYQNNmNeA2y7X+UUWPSJhrbtlSKE0r0THsI0vAG5R3hrToO5qoaRL2XaG9/38HQZrngRTIOKeZVIo3maUNeiz/sEjmgbguFNqpWpp/tKRu5XMmRka80bcjXyb+NGsPpIPfQaJmILqEST/cI0pB3vr8rLeblGoJr6sGiG8Mwh0XUr6L9flXRIFEvlepWzzViwixiP9bcGjarO4BxwCgMN2FjWM0uuLSnzVweJzx4js1SuiQ/+mG3CDOhxj97SjD3tkTCEebp34bhKezLpMcCmliuTAch6MvDJ6B1dlsE/YByDTrelz+TOnmD4dLjjoHTAqTs0IDqWmye3GKIAn1O21wz2L7OQq0IJkPuBiDZArHeBoTq0zkEBL7v8vRW/smp1hSxYrz8LJieVB2DmaIpep6P6o+t8YiPMFHfnYMpm5A6/SejDdE4X0y35kVsRiS/FAuIv+CZiuhp6ZLSUxSyToXKezGXmq5pb4jBwFNm4BOjTI2IkDS+1elzYVF/zvp2q+uH4V9+/iNwAZWl/ad8/ZXtcTUFo31ib5XDagLu0MQWaKtmAL06LSJSjZSQJfh8qxu8M0ClRx3ylbS9p2n48wZX/az56H51gojmqxwO5cBYa8VYGEzgaJ17LDW02fbzGqBK1nvI5UIWXxlt+vf6y1RTuKDGmsKapdQA2nApVjLNxhmuAvcxCpnY1l3j3tvwRPzCrz81OMrf3hg==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: crowdsec-bouncer-key
+      namespace: crowdsec

kubernetes/apps/crowdsec/helmrelease.yaml

@@ -43,19 +43,19 @@ spec:
           storageClassName: ceph-block
           size: 100Mi
       env:
-        - name: ENROLL_KEY
-          value: ""
         - name: ENROLL_INSTANCE_NAME
           value: "k8s-homelab"
+        - name: BOUNCER_KEY_ingress
+          valueFrom:
+            secretKeyRef:
+              name: crowdsec-bouncer-key
+              key: key
 
     agent:
       acquisition:
         - namespace: ingress
           podName: ingress-nginx-controller-*
           program: nginx
-        - namespace: apps
-          podName: "*"
-          program: nginx
       env:
         - name: COLLECTIONS
           value: "crowdsecurity/nginx crowdsecurity/http-cve crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules"

kubernetes/apps/crowdsec/kustomization.yaml

@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - bouncer-secret.yaml
   - helmrelease.yaml

kubernetes/infrastructure/ingress-nginx/bouncer-secret.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: crowdsec-bouncer-key
+  namespace: ingress
+spec:
+  encryptedData:
+    key: AgCjzQ1q7CUPl48Q/ypEBdpG8aEKHqnkc1rC9eWBxIRi82BaYFPTLmADgItjE2iPxLO8j5NzCr35zO+6IxhcMhD4Bz8KL17fE7UwLfe0wosy/a7g8x7XOCAbW5V6mF6E79i2C+QQ0sVyqIcv4Umz8/vCZHJKJW/muAcU/sLGeT1+Flvw+MkCWegFyfDzgcgyK2k+p7dsJ66uOfZA9CKwBC49PhSAeM1UdTT+OhpI11bw9VhPlG6Qdx9Tf/717nkXHEjZH95LyWXgdL+UOywdYvUp1bHBBqgkR5j1kaOi19TzUK3odN50FPQpHKJmOjC5tVLSWPLlQ58csn3KmHARPuAj234iolZoLcnA7BNlYK6KXpPYygRwfahUx0jx2jdnBvt2LNvl2rQHVKW+CUrhKeIhvPq0SzaCv3yMrMe0SvmT+3KMFwKzOdoxVjQYy0gGSp6TqK0qeqAQwWftrMCS2syEOehJAbmLYWdj6Guj7QccBnXY98YIL7EU+CCD0KWdsySYfOlXostRTObD4D0U0IVo6zKx70X+JyANNaNoW3mvg7PktA45ZdqjY3FeHRaBlc5ioPiNrZY40cgoBlETo9gI9Mw61D/agvIx9fL3nUfNh+GBenpMkYlXDWZvRfRTLGd5hsawFgyFrD0p1yg+gAmWtRPUZr0wKDP7v4dj7Ali/a+DTjqWY26aBm5OPe3VreONqUvNb2CC1phukDId3whOKx4bw7PDOir+Lb73nvc2xSw9djaiSGeDCV7hlQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: crowdsec-bouncer-key
+      namespace: ingress

kubernetes/infrastructure/ingress-nginx/helmrelease.yaml

@@ -57,7 +57,10 @@ spec:
             - name: API_URL
               value: "http://crowdsec-service.crowdsec.svc.cluster.local:8080"
             - name: API_KEY
-              value: "bbIE6wveGukLm+o9c2Tee9fx1+R6GHXyRxv7Se1xwtw"
+              valueFrom:
+                secretKeyRef:
+                  name: crowdsec-bouncer-key
+                  key: key
             - name: BOUNCER_CONFIG
               value: "/crowdsec/crowdsec-bouncer.conf"
           volumeMounts:

kubernetes/infrastructure/ingress-nginx/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: ingress
 resources:
+  - bouncer-secret.yaml
   - helmrelease.yaml