mirror of
https://github.com/andwati/telecom-platform.git
synced 2026-10-21 20:24:27 +00:00
nutcas3
50e807f2da
- Add vault.hashicorp.com/agent-inject annotations to all Secret resources for Vault integration - Add vault.hashicorp.com/agent-inject-secret-* annotations with KV paths for database, redis, jwt, encryption, and payment secrets - Remove all base64-encoded hardcoded credentials from telecom-secrets, postgres-secret, grafana-secret, and influxdb-secret - Replace secret values with empty strings and comments
70 lines
2.2 KiB
YAML
70 lines
2.2 KiB
YAML
---
|
|
# Note: Secrets should be stored in Vault for production use
|
|
# This file is for development/testing purposes only
|
|
# For production, use the Vault integration in deployments/vault/
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: telecom-secrets
|
|
namespace: telecom-platform
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-inject-secret-database: "kv/data/telecom-platform/database"
|
|
vault.hashicorp.com/agent-inject-secret-redis: "kv/data/telecom-platform/redis"
|
|
vault.hashicorp.com/agent-inject-secret-jwt: "kv/data/telecom-platform/jwt"
|
|
vault.hashicorp.com/agent-inject-secret-encryption: "kv/data/telecom-platform/encryption"
|
|
vault.hashicorp.com/agent-inject-secret-payment: "kv/data/telecom-platform/payment"
|
|
type: Opaque
|
|
data:
|
|
# These should be replaced by Vault injection in production
|
|
DATABASE_PASSWORD: "" # Will be injected from Vault
|
|
REDIS_PASSWORD: "" # Will be injected from Vault
|
|
STRIPE_API_KEY: "" # Will be injected from Vault
|
|
STRIPE_WEBHOOK_SECRET: "" # Will be injected from Vault
|
|
ES2_API_KEY: "" # Will be injected from Vault
|
|
INFLUXDB_TOKEN: "" # Will be injected from Vault
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: postgres-secret
|
|
namespace: telecom-platform
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-inject-secret-credentials: "database/creds/telecom-platform"
|
|
type: Opaque
|
|
data:
|
|
# Will be injected from Vault database secrets engine
|
|
POSTGRES_PASSWORD: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-secret
|
|
namespace: telecom-monitoring
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-inject-secret-admin: "kv/data/telecom-platform/grafana"
|
|
type: Opaque
|
|
data:
|
|
# Will be injected from Vault
|
|
GF_SECURITY_ADMIN_PASSWORD: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: influxdb-secret
|
|
namespace: telecom-monitoring
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-inject-secret-config: "kv/data/telecom-platform/influxdb"
|
|
type: Opaque
|
|
data:
|
|
# Will be injected from Vault
|
|
INFLUXDB_ADMIN_USER: ""
|
|
INFLUXDB_ADMIN_PASSWORD: ""
|
|
INFLUXDB_USER: ""
|
|
INFLUXDB_PASSWORD: ""
|
|
INFLUXDB_ADMIN_TOKEN: ""
|
|
|