d5e8c28a6a
This commit converts all application secrets to SealedSecrets, preventing plaintext secrets from being stored in git. Changes: - Added .gitignore to prevent future plaintext secret commits - Created 20 SealedSecret manifests across 8 applications: * Stalwart (4 secrets): admin credentials, OAuth proxy, OIDC, S3 backup * Directus (5 secrets): admin, agent token, app secrets, DB, OIDC * Paperclip (4 secrets): main secrets, auth, OIDC, session * Forgejo (2 secrets): postgres, backup * BookStack (2 secrets): OIDC, MySQL * Passbolt (2 secrets): MariaDB, app secrets * Pocket ID (1 secret) - Removed hardcoded secrets from 6 stalwart deployment files - Replaced plaintext credentials with references to sealed secrets All sealed secrets have been applied to the cluster and services verified to be running correctly. Related: DEV-203 Co-Authored-By: Paperclip <noreply@paperclip.ing>
18 lines
2.5 KiB
YAML
18 lines
2.5 KiB
YAML
---
|
|
apiVersion: bitnami.com/v1alpha1
|
|
kind: SealedSecret
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: paperclip-oidc-secret
|
|
namespace: platform-prod
|
|
spec:
|
|
encryptedData:
|
|
client-id: AgAW44lRQJw+NgeQYhxFklVOFieFew0Nq/fInttWrf3G81QDXJkclqNAFTk7xMsvDff4N3OpGdPojFwdmng78ZXtvYkgvoR9iu3uIItZlMOZqdtSBsHMOJtls36G2slPA3z4OEmCxW7bnRzrUpV6VbSKCCa8A5AAMZAxHFGUGDrm61wen0U9jIDDn+Xa2AMf3XoHWVZEQ9cBg77ruhNmmw4JssI6rbuDkiFmSKMAmNubel/IjhAtZ2FJvA32Zz2Q0p2DEXSsx8jXdSRtPL0tvZICltojBBL2HXQ8dTZKOQqo+JXzJx6hKbCHPORzirIhCyZSFrZv2ac8qo3y2XzMM9EQVAs3QJHXiNqi9jFD/OV862OoOo8cVe/tk2h3/bj49pR1WPp+Mmdza/U7oxtj+Mns9nO78KJsqQDT22b2vnvTQBY6fzDsmBw2+rEAZx4UlEW9xaApzwv2V7ZermIQuo5AQw+HXN3HKESJyfCZoeMX204qNSHhh88n6O8VTxin1ZB2OomF8+CZrmANluHNNsGPVwFFMl7sr9fdtLlnb2x8ux+oRi29/6K/x4mYgk2lVg+VHD58NV9HFFb08kq6rSP71WJE1eCZSix8HIL1Io6ahUDfNQ0sHk/OHni/BwY7S7cYgVGv2n6nyy5uJ8oT5/ce2vE4TXABdkNonbM/igA3nIsh6YC4oiGz2Ck2mehixxvn+7TpluhWodJvTExvw2I6tntE1dmXG1Q6FrHyO17quY17Ah8=
|
|
client-secret: AgB73qCz4Rp0ZasaqZ6kbROSIuo0Dld7WStDV40Kel3pfTeFhvTALVy3Lp1OjYHzUZ6v2AeolLH0ewmEEyXOdDCspgXfURxXAgoCi6oFYrfeXJIvVlvbnPyVvAbFaVmyFGtVrQyFi+tbhd77YMxquA2fYobCWc3NHIDf9EnLEgfLvdjoWhk3BsCBzFmqgbxsOAPkkhcocqcTff4DntUY/FnsHVRCESid3r+xZsa+Bu3wTSJZH/CyOfRss8vaieBVW3DDglV2/GCCN7TUmdaZuLx3SwAw/zDkOHThkBz59SieVuJf1LP/ax8euMZ+dVLWQ+dc0lDBx+RdzV/hILny+7NzqoegCkRcqapBRgDxQygu1NHwbgkW6jWASaMrrP0VmBus1vQezkXeYoJK+ECrD2WBZ+WlW+9k7yqwZFW3xeC9BJ5N8HTdjivzatQ66m0ovSyTyYGyBYfJ+DUNiD30hRUHMRKmynpLs4dCFCFvWT9vXt87WeSKLKngSB285Q39URKOk9eJZL7Ob8lBCzAZ0rlnQKeUO5Zo1hdVFvuDAQIh0ELiKMMlGDJZEs4qU2yPk26tskZEHw4Wez7v8ANK4HTBUKalqJ0uio3xeEg/xZw6zrZH5tG3tiMGVGScfLaSErFVwZh3j2wSOhrOaqa/3FwhRmWjnl6Ol6Dr6OU1dO/8B7dhU3AP8d5tQMsyApJ2J7kUDNtqxvhqrMe5cp3p313Wj/XzMzFtloEU/s0gBmpoLw==
|
|
issuer: AgBoZ2oQ/RvqabCnuUQP5cDtBHJdx9nDUlEMp2GSDJ/T5jnB1fuBe5dM/031GBR0378udqmiv7KCCq9eSIlYGQoKomvWQwEa4nEamQktu9xzYxGUzwOK6oH55Tpe2OMXSC0BG5Wx7mZX9JMA/ZBkqDuE/XynLO1P3VedePZwSP6EKkaGqQ1csqmVivYoPh1kMGN/MI9c/IwhdqM8NQOK7jXwZKHWI0oLl9eUJh9d73w/f3EVslMNYFnhBPPN7lD4TtwJRk/iQueeFMaazObnY4LDlzjI28v3aFmptie5QMVBRXcGcotIs5NS04JOkwuxp8uPBDRTYGenWglYzab5Ep5dZywxF+4SQbUETxcki4UIdahFe1F2t3NlIuuzVQy0ltDkWCueepPybv8tuYY36IpZfHVFNYuCa9snMDlPQWs2/EXkxwFkVldxhhXXcGIimE+UI3t685xTvhiGVwIOSPIK/41CvprZWdMpw5iWeF2V/2RPKhfE2Pa9ARPgX6dZ4+LPO40HOHaDfhhlBIj+UbUq3pjRsLzRB7gij0bbkejTq+jQGefEjzTkO6vGvcRKAuWc5bSO0TBKQL3ItgBKKLhqcAjjXo9T0XXhennL2PDdLQLl9ixLzFkTLSlRXMRTRtk3a0hVI7vXY5POwnxuyqKEKhNTaqis9yi+bm0wAtza4/uw0ZdjFNmV7b47KSUFmlzdze8CHgLEkhk6x3i0eBUb0av+NLS8oz4pYg==
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: paperclip-oidc-secret
|
|
namespace: platform-prod
|
|
type: Opaque
|