Adding external secrets

ProfMoo · Sep 19, 2024 · 512d84d · 512d84d
1 parent acf845b
commit 512d84d
Show file tree

Hide file tree

Showing 13 changed files with 290 additions and 1 deletion.
diff --git a/kubernetes/homelab/apps/base/external-secrets/README.md b/kubernetes/homelab/apps/base/external-secrets/README.md
@@ -0,0 +1,3 @@
+# Bitwarden External Secrets
+
+<https://external-secrets.io/main/examples/bitwarden/>
diff --git a/kubernetes/homelab/apps/base/external-secrets/app/helm-release.yaml b/kubernetes/homelab/apps/base/external-secrets/app/helm-release.yaml
@@ -0,0 +1,43 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: kube-system
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: external-secrets
+      version: 0.10.3
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    installCRDs: true
+    serviceMonitor:
+      enabled: true
+      interval: 1m
+    webhook:
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+    certController:
+      serviceMonitor:
+        enabled: true
+        interval: 1m
+    # will be available in next version
+    # cert-manager creates the selfsigned ca
+    # https://cert-manager.io/docs/configuration/selfsigned/#bootstrapping-ca-issuers
+    bitwarden-sdk-server:
+      enabled: true
diff --git a/kubernetes/homelab/apps/base/external-secrets/app/kustomization.yaml b/kubernetes/homelab/apps/base/external-secrets/app/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helm-release.yaml
diff --git a/kubernetes/homelab/apps/base/external-secrets/bitwarden/apikey.secret.sops.yaml b/kubernetes/homelab/apps/base/external-secrets/bitwarden/apikey.secret.sops.yaml
@@ -0,0 +1,29 @@
+kind: Secret
+apiVersion: v1
+type: Opaque
+metadata:
+    name: bitwarden-apikey
+    namespace: base
+stringData:
+    BW_CLIENTID: ENC[AES256_GCM,data:gQedAMKB0hPz6r1INhKZbeEY0WDgaaeTBaFPWlIE53lzuNX7Df3HLis=,iv:7X/LLeXvxEemcuDtWDbV/rQCn+Ihqe4QKdjD9OAw7sE=,tag:pff4Pp2D1WePYF6pLBCAmQ==,type:str]
+    BW_CLIENTSECRET: ENC[AES256_GCM,data:/q98079jXKOi9i5fID/2WkQ6fdqM8m6AoQcbXuwv,iv:Sze5Wn1UGQBLF1SqzKmq1XrQxP/PALZ7ghyPnpd79XI=,tag:eYSKxzPCbjp0bPuf2we0+A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1jzax78wrm0emunjs6gev7ahxzlzuazd3j6fwql2q532ymnsm8qvqtps9te
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKalMxV3czRlZ1RmFHT3ph
+            RWhEeTFYRXBWeFE4Vk0xOTkvU2RXclE2eWdzCjV5d1daU3YzMHp6cDVtZXJaeHlN
+            c1BMNTNUSFlLakRUbEgxQU1oUitBWmcKLS0tIFNzLzJTM0dHUEpldjYyc1pXbmdY
+            VGpOTVpJWmh2UDAzZ05tZDJYRDFFNE0KjdCTZaCkuChaGjT2c6Dz+0ZYPXdWXFDI
+            wP1ADiNxn6yq1YCB/3R5khfODs5npkkf2zp9U4h0u6QnszpaKMsatA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-19T02:12:44Z"
+    mac: ENC[AES256_GCM,data:l76dv0QiRxoDYMuCj5b5UihWPzs4okOYsXB0SNGw69bGRpGUdReIM9mLTM0DMxpzY3bqgFnuH00X5Qm/OqZiUBIclkYKdnlV14JmKWP/OYMtHSLn3AuDGQhf9/mOlufxmKsjhInVcqhoN1BZJOha41oB1PKfFqyhq1G18DCIuYA=,iv:QHAY95fh6xaCtxfMeYnldaUYhde4q/kaeSlNOIUv8N8=,tag:hSom/Ia/683s29HNeMd/2w==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.8.1
diff --git a/kubernetes/homelab/apps/base/external-secrets/bitwarden/helm-release.yaml b/kubernetes/homelab/apps/base/external-secrets/bitwarden/helm-release.yaml
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app bitwarden
+  namespace: kube-system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+      interval: 5m
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    controllers:
+      bitwarden:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/larivierec/bitwarden-cli
+              tag: 2024.8.2@sha256:d7e0fddb9b054d6b5600623a955de96f3cfe5afe993642c3af3a1112da41fc04
+            envFrom:
+              - secretRef:
+                  name: bitwarden-apikey
+            probes:
+              liveness:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command:
+                      [
+                        "sh",
+                        "-c",
+                        "curl -X POST -s http://127.0.0.1:8087/sync | jq -e '.success == true'",
+                      ]
+                  timeoutSeconds: 5
+              readiness:
+                enabled: false
+              startup:
+                enabled: false
+            resources:
+              requests:
+                memory: 256Mi
+                cpu: 100m
+              limits:
+                memory: 512Mi
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 8087
diff --git a/kubernetes/homelab/apps/base/external-secrets/bitwarden/kustomization.yaml b/kubernetes/homelab/apps/base/external-secrets/bitwarden/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./apikey.secret.sops.yaml
+  - ./helm-release.yaml
+  - ./network-policy.yaml
diff --git a/kubernetes/homelab/apps/base/external-secrets/bitwarden/network-policy.yaml b/kubernetes/homelab/apps/base/external-secrets/bitwarden/network-policy.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: external-secrets-to-bw-cli
+  namespace: kube-system
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/instance: bitwarden
+      app.kubernetes.io/name: bitwarden
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/instance: external-secrets
+            app.kubernetes.io/name: external-secrets
+            k8s:io.kubernetes.pod.namespace: kube-system
diff --git a/kubernetes/homelab/apps/base/external-secrets/ks.yaml b/kubernetes/homelab/apps/base/external-secrets/ks.yaml
@@ -0,0 +1,53 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-external-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: "./kubernetes/main/apps/kube-system/external-secrets/app"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: profmoo-home
+  wait: true
+  dependsOn:
+    - name: cert-manager-self-signed-issuers
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-external-secrets-bitwarden
+  namespace: flux-system
+spec:
+  path: ./kubernetes/main/apps/kube-system/external-secrets/bitwarden
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: profmoo-home
+  wait: true
+  interval: 30m
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: vault-secrets
+  dependsOn:
+    - name: cluster-apps-external-secrets
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cluster-apps-external-secrets-stores
+  namespace: flux-system
+spec:
+  path: ./kubernetes/main/apps/kube-system/external-secrets/stores
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: profmoo-home
+  wait: true
+  interval: 30m
+  dependsOn:
+    - name: cluster-apps-external-secrets
+    - name: cluster-apps-external-secrets-bitwarden
diff --git a/kubernetes/homelab/apps/base/external-secrets/stores/cluster-secrets.yaml b/kubernetes/homelab/apps/base/external-secrets/stores/cluster-secrets.yaml
@@ -0,0 +1,23 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: test-secret
+  namespace: external-secrets
+spec:
+  target:
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TESTING: |-
+          {{ .testing-foobar }}
+  refreshInterval: 15m
+  data:
+    - secretKey: testing-foobar
+      sourceRef:
+        storeRef:
+          name: bitwarden-notes
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f9d87bb4-95de-43d7-89d8-b1f00024ce07
diff --git a/kubernetes/homelab/apps/base/external-secrets/stores/kustomization.yaml b/kubernetes/homelab/apps/base/external-secrets/stores/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret-store.yaml
+  - ./cluster-secrets.yaml
diff --git a/kubernetes/homelab/apps/base/external-secrets/stores/secret-store.yaml b/kubernetes/homelab/apps/base/external-secrets/stores/secret-store.yaml
@@ -0,0 +1,35 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-login
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden.kube-system.svc:8087/object/item/{{ .remoteRef.key }}"
+      headers:
+        Content-Type: application/json
+      result:
+        jsonPath: "$.data.login.{{ .remoteRef.property }}"
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-fields
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden.kube-system.svc:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        jsonPath: '$.data.fields[[email protected]=="{{ .remoteRef.property }}"].value'
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-notes
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden.kube-system.svc:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        jsonPath: "$.data.notes"
diff --git a/kubernetes/homelab/apps/base/kustomization.yaml b/kubernetes/homelab/apps/base/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - ./metrics-server/ks.yaml
   - ./reloader/ks.yaml
   - ./cert-approver/ks.yaml
+  - ./external-secrets/ks.yaml
diff --git a/kubernetes/homelab/apps/networking/external-dns/unifi/helm-release.yaml b/kubernetes/homelab/apps/networking/external-dns/unifi/helm-release.yaml
@@ -30,7 +30,7 @@ spec:
       webhook:
         image:
           repository: ghcr.io/kashalls/external-dns-unifi-webhook
-          tag: main@sha256:761fc83e56a0fdd9ab02d60376083f8fe8fbb88329fb11e8275038cdc9348214
+          tag: main@sha256:fe9720cbf0af98694b7ece216472a577677c97a3f79471f8359d79f4da607a0b
         env:
           - name: UNIFI_HOST
             value: https://192.168.1.1
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		# Bitwarden External Secrets

		<https://external-secrets.io/main/examples/bitwarden/>