mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
86 lines
3.6 KiB
YAML
86 lines
3.6 KiB
YAML
environments:
|
|
yc-k8s-test:
|
|
# vault-platform-secrets stack input. Inert for now (enabled:false) so it does
|
|
# NOT touch existing bootstrap creds already present in the contour Vault.
|
|
# kv_mount/path_prefix are also used by the secrets stack for sink=vault.
|
|
vault:
|
|
enabled: false
|
|
kv_mount: secrets
|
|
path_prefix: vault
|
|
kubernetes_auth_backend: kubernetes
|
|
default_rsa_bits: 4096
|
|
features:
|
|
create_regcred: false
|
|
create_smtp_auth: false
|
|
create_django_auth: false
|
|
create_rsa_keys: false
|
|
create_infra_secrets: false
|
|
create_infra_policies: false
|
|
create_infra_roles: false
|
|
create_app_policies: false
|
|
create_app_roles: false
|
|
common: {}
|
|
infrastructure: {}
|
|
applications: {}
|
|
secrets:
|
|
# 1) static secret -> k8s Secret (keys declared here, base64 as in k8s .data)
|
|
- name: test-static-k8s
|
|
namespace: contour
|
|
type: opaque
|
|
sink: k8s
|
|
lifecycle:
|
|
ignore_changes: false
|
|
data:
|
|
test-key: ENC[AES256_GCM,data:7oQuOfbWEIg9TrJoxEOYiw==,iv:gO1XJvtxQX1jL5xq5AR3TIYhBcNUUTJNNnFKCvEUr8o=,tag:/i3mdEXQgJ5QNoMgA9k+NQ==,type:str]
|
|
# 2) dynamic secret -> k8s Secret, from the in-cluster database outputs
|
|
- name: test-db-k8s
|
|
namespace: contour
|
|
type: database
|
|
sink: k8s
|
|
depends_on:
|
|
cluster: incluster
|
|
db: test_db
|
|
user: test_user
|
|
lifecycle:
|
|
ignore_changes: false
|
|
# 3) static secret -> Vault KV (secrets/vault/test/static)
|
|
- name: test-static-vault
|
|
namespace: contour
|
|
type: opaque
|
|
sink: vault
|
|
vault_path: vault/test/static
|
|
lifecycle:
|
|
ignore_changes: false
|
|
data:
|
|
test-key: ENC[AES256_GCM,data:4/MZysB8/zUfq7OhIWemhg==,iv:l9SXydQYvyO4ZrMnxjAI6P0XKi4ygrzm5Xdl6SYe0Ww=,tag:/rqrbx2tB6/YyAcIs+gXTg==,type:str]
|
|
# 4) dynamic secret -> Vault KV (secrets/vault/test/bucket), from MinIO bucket outputs
|
|
- name: test-bucket-vault
|
|
namespace: contour
|
|
type: s3
|
|
sink: vault
|
|
vault_path: vault/test/bucket
|
|
depends_on:
|
|
bucket: test-bucket
|
|
lifecycle:
|
|
ignore_changes: false
|
|
sops:
|
|
kms: []
|
|
gcp_kms: []
|
|
azure_kv: []
|
|
hc_vault: []
|
|
age:
|
|
- recipient: age198ea80z7gan2ruetn288ln6rl2qh7xtsqqpwrjtyn8maya3364fsvpdd63
|
|
enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhV2MybDRmMk53WHZITWYz
|
|
UmtYbHVYRFd3WnpaQkE0bVo4Z2d2OTNVWHgwCmpjL0hhTTBIZmNsNWxLSDRnTlh3
|
|
eHc1Y2R5cXFBK3hPbTJsZDFEWGJHOEkKLS0tIG5FdmNVMUlxbnJ3UEx3eUpSdTho
|
|
TFZIaWFBa2ZObmxubFFsUm8vYmI2MTAK+WOHWtrSphcvR/91FhFFb8qksmS4IcIn
|
|
oBVNWWvyF2WlEmgfFchamyRwUDrLfC0I3Jox5mPKsSg4ocZ/cCQoKQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
lastmodified: "2026-07-16T13:35:36Z"
|
|
mac: ENC[AES256_GCM,data:/Q4nThM0z/42iC6RY1wp8OdjCFz09kCbfwAFJkqnXSN0OQtbAjwrCTWiF3ix0QrfdwWjU7LEWga6knWH+b6UrXv9naVHeDjmSNjrDzVn9AWVMklgSn++1lr9dtmtE0dA0qET4rUrfDaVgHn4HATaC2WaasJnorccs55j0SNuHlc=,iv:TnXfidgw05JVC1Cuv15v3bTZHPyH2c60sOQstH0NxrA=,tag:Sjd4R/79ZUKIt2zxBDLLqA==,type:str]
|
|
pgp: []
|
|
encrypted_regex: ^(data)$
|
|
version: 3.9.0
|