feat: deploy external-secrets operator (#495)

kubernetes/apps/infrastructure/secrets/external-secrets/app/helmrelease.yaml

@@ -0,0 +1,43 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: external-secrets
+      version: 0.15.1
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    installCRDs: true
+    replicaCount: 1
+    leaderElect: true
+    image:
+      repository: ghcr.io/external-secrets/external-secrets
+    webhook:
+      image:
+        repository: ghcr.io/external-secrets/external-secrets
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+    certController:
+      image:
+        repository: ghcr.io/external-secrets/external-secrets
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+    serviceMonitor:
+      enabled: true
+      interval: 1m

kubernetes/apps/infrastructure/secrets/external-secrets/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: secrets
+resources:
+  - ./helmrelease.yaml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/infrastructure/secrets/external-secrets/ks.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: external-secrets
+  namespace: flux-system
+spec:
+  path: ./kubernetes/apps/infrastructure/secrets/external-secrets/app
+  prune: true
+  dependsOn:
+    - name: cluster-apps-onepassword
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: external-secrets
+      namespace: secrets
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: external-secrets-stores
+  namespace: flux-system
+spec:
+  path: ./kubernetes/apps/infrastructure/secrets/external-secrets/stores
+  prune: true
+  dependsOn:
+    - name: external-secrets
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/infrastructure/secrets/external-secrets/stores/1p-kubernetes.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: 1p-kubernetes
+spec:
+  provider:
+    onepassword:
+      connectHost: http://onepassword-connect.secrets.svc.cluster.local
+      vaults:
+        Kubernetes: 1
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            name: onepassword-api
+            key: token
+            namespace: secrets

kubernetes/apps/infrastructure/secrets/external-secrets/stores/1p-tf-dev.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: 1p-tf-dev
+spec:
+  provider:
+    onepassword:
+      connectHost: http://onepassword-connect.secrets.svc.cluster.local
+      vaults:
+        tf_dev: 1
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            name: onepassword-api
+            key: token
+            namespace: secrets

kubernetes/apps/infrastructure/secrets/external-secrets/stores/1p-tf-prod.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: 1p-tf-prod
+spec:
+  provider:
+    onepassword:
+      connectHost: http://onepassword-connect.secrets.svc.cluster.local
+      vaults:
+        tf_prod: 1
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            name: onepassword-api
+            key: token
+            namespace: secrets

kubernetes/apps/infrastructure/secrets/external-secrets/stores/1p-tf.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: 1p-tf
+spec:
+  provider:
+    onepassword:
+      connectHost: http://onepassword-connect.secrets.svc.cluster.local
+      vaults:
+        tf: 1
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            name: onepassword-api
+            key: token
+            namespace: secrets

kubernetes/apps/infrastructure/secrets/external-secrets/stores/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: secrets
+resources:
+  - ./1p-kubernetes.yaml
+  - ./1p-tf.yaml
+  - ./1p-tf-dev.yaml
+  - ./1p-tf-prod.yaml

kubernetes/apps/infrastructure/secrets/kustomization.yaml

@@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./onepassword/ks.yaml
+  - ./onepassword/ks.yaml
+  - ./external-secrets/ks.yaml

kubernetes/flux/repositories/helm/external-secrets.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-secrets
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://charts.external-secrets.io

kubernetes/flux/repositories/helm/kustomization.yaml

@@ -16,3 +16,4 @@ resources:
   - ./backube.yaml
   - ./immich-charts.yaml
   - ./controlplaneio.yaml
+  - ./external-secrets.yaml