Files
homelab/kubernetes/apps/monitoring/loki-basic-auth-externalsecret.yaml
claude-botandClaude Fable 5 a76b18a887 feat(secrets): migrate non-critical app secrets to OpenBao (apps batch)
evcc, otbr, libation, external-dns (apps), monitoring (4), woodpecker:
values in OpenBao KV (homelab/apps/*, loaded 2026-07-13), manifests are
now ExternalSecrets keeping the old Secret names. libation's payload is
a binary SQLite db — stored base64 in KV with decodingStrategy: Base64
on the ES. Decryption blocks dropped from apps/evcc/otbr/libation/
monitoring KS (paths sops-free) plus the dormant one on grafana-db.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRgBFn9m8a2ncFMLusikH6
2026-07-13 19:21:27 +02:00

16 lines
369 B
YAML

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: loki-basic-auth
namespace: monitoring
spec:
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: openbao
target:
name: loki-basic-auth # keeps the old Secret's name — consumers unchanged
dataFrom:
- extract:
key: apps/monitoring/loki-basic-auth