claude-botandClaude Opus 4.8
ab6589aced
First fan-out of the secret-rotation pattern proven on woodpecker, now using the cleaner openbao-namespace design: the rotation Job runs in the openbao ns so it reaches OpenBao intra-namespace — NO NetworkPolicy edits needed (unlike woodpecker's apps-ns job). Per-secret isolation: its own scoped policy+role (rotator-paperless) so a compromised job can only touch the paperless KV path. - openbao/rotation/paperless.yaml: SA + quarterly/on-demand CronJob (openbao ns) that bao kv patch's secret-key at homelab/apps/paperless (DB creds preserved). - openbao/policies/rotator-paperless.hcl: least-privilege policy (manual bootstrap, documented in-file). - paperless.yaml: reloader annotation; externalsecret.yaml: refreshInterval 1h->10m. Rotating the Django SECRET_KEY invalidates paperless sessions (re-login); no data loss. Requires the one-time OpenBao bootstrap before first run. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015K7gLUVVnutvDnzV2TrMRJ
19 lines
558 B
YAML
19 lines
558 B
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: paperless-secrets
|
|
namespace: paperless
|
|
spec:
|
|
# 10m (was 1h) so an automated secret-key rotation propagates into the k8s
|
|
# Secret within ~10m; Reloader then restarts paperless. See
|
|
# kubernetes/infrastructure/openbao/rotation/paperless.yaml.
|
|
refreshInterval: 10m
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: openbao
|
|
target:
|
|
name: paperless-secrets # keeps the old Secret's name — consumers unchanged
|
|
dataFrom:
|
|
- extract:
|
|
key: apps/paperless
|