diff --git a/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml index 7ab6160..8ae51f0 100644 --- a/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/affine" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: affine-secrets secretNamespace: affine diff --git a/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml index 9a5d293..df4b83e 100644 --- a/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/authentik-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/authentik" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: authentik-secrets secretNamespace: authentik diff --git a/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml index a6c03cf..290e520 100644 --- a/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/azure-ddns-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/azure-ddns" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: azure-ddns-secrets secretNamespace: azure-ddns diff --git a/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml new file mode 100644 index 0000000..2410c38 --- /dev/null +++ b/applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml @@ -0,0 +1,28 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: crowdsec-secrets + namespace: infisical +spec: + hostAPI: https://infisical.jsme.be + resyncInterval: 30 + authentication: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true + secretsScope: + projectSlug: "kubernetes" + envSlug: "prod" + secretsPath: "/crowdsec" + recursive: true + managedSecretReference: + secretName: crowdsec-secrets + secretNamespace: crowdsec + secretType: Opaque +# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`) +# under kubernetes / prod / /crowdsec in Infisical. It is shared by: +# - CrowdSec LAPI (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy) +# - the kdwils envoy bouncer (authenticates to LAPI + AppSec) diff --git a/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml index c557d38..4925a9c 100644 --- a/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/gitea" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: gitea-secrets secretNamespace: gitea diff --git a/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml index a2417c2..15e81fe 100644 --- a/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/gotify-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/gotify" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: gotify-secrets secretNamespace: gotify diff --git a/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml index f3fd42e..ce6bd9c 100644 --- a/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/immich" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: immich-secrets secretNamespace: immich diff --git a/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml index 317b480..ce1195a 100644 --- a/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/jellyfin" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: jellyfin-secrets secretNamespace: jellyfin diff --git a/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml index c75460b..6adf232 100644 --- a/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/longhorn" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: longhorn-secrets secretNamespace: longhorn-system diff --git a/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml index 16445e6..796a47e 100644 --- a/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/minecraft" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: minecraft-secrets secretNamespace: minecraft diff --git a/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml index ec5fe21..2adb800 100644 --- a/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/n8n" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: n8n-secrets secretNamespace: n8n diff --git a/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml index 2865a89..eddf212 100644 --- a/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/openwebui" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: openwebui-secrets secretNamespace: openwebui diff --git a/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml index 539b1fe..5d2de44 100644 --- a/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/outline" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: outline-secrets secretNamespace: outline diff --git a/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml index b217e7f..9d22dad 100644 --- a/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/passbolt-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/passbolt" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: passbolt-secrets secretNamespace: passbolt diff --git a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml index efbc766..9a869d7 100644 --- a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/pelican" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: pelican-secrets secretNamespace: pelican diff --git a/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml index 36a6eaf..6af1128 100644 --- a/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/resume-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/reactive_resume" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: resume-secrets secretNamespace: resume diff --git a/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml index 68386e5..9355674 100644 --- a/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/searxng-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/searxng" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: searxng-secrets secretNamespace: searxng diff --git a/applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml index f1b5068..a613949 100644 --- a/applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/uptime-kuma-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/uptime-kuma" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: uptime-kuma-secrets secretNamespace: uptime-kuma diff --git a/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml index 44acfc7..3ae3963 100644 --- a/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/vaultwarden" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: vaultwarden-secrets secretNamespace: vaultwarden diff --git a/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml index 5331700..afc6c98 100644 --- a/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/victoria-metrics" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: victoria-metrics-secrets secretNamespace: victoria-metrics diff --git a/applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml b/applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml index e00e6a3..4d5022d 100644 --- a/applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml +++ b/applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/zipline" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: zipline-secrets secretNamespace: zipline diff --git a/applications/infisical/universal-auth-secret.yaml b/applications/infisical/universal-auth-secret.yaml deleted file mode 100644 index c38e5a2..0000000 --- a/applications/infisical/universal-auth-secret.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# apiVersion: v1 -# kind: Secret -# metadata: -# name: infisical-universal-auth -# namespace: infisical -# type: Opaque -# stringData: -# clientId: "" -# clientSecret: "" diff --git a/infra/longhorn/longhorn-infisicalsecret.yaml b/infra/longhorn/longhorn-infisicalsecret.yaml index caf65b9..9b645c4 100644 --- a/infra/longhorn/longhorn-infisicalsecret.yaml +++ b/infra/longhorn/longhorn-infisicalsecret.yaml @@ -7,15 +7,17 @@ spec: hostAPI: https://infisical.jsme.be resyncInterval: 30 authentication: - universalAuth: + kubernetesAuth: + identityId: "9f65814e-bf4c-42fc-b382-26be15b11416" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true secretsScope: projectSlug: "kubernetes" envSlug: "prod" secretsPath: "/longhorn" recursive: true - credentialsRef: - secretName: infisical-universal-auth - secretNamespace: infisical managedSecretReference: secretName: cifs-secret secretNamespace: longhorn-system