35 lines
1.3 KiB
Django/Jinja
35 lines
1.3 KiB
Django/Jinja
{#
|
|
Managed by Ansible (roles/k3s_app) — do not edit on the node.
|
|
|
|
The k3s counterpart of compose_stack's rendered .env: every key from the
|
|
app's Vault path, verbatim, in one Secret the app's manifests reference by
|
|
name. Keys are not renamed or filtered on the way through, which is what
|
|
keeps this role generic — an app decides what its environment looks like by
|
|
choosing its Vault keys, exactly as it does on Unraid, and the role stays
|
|
ignorant of any particular app's variables.
|
|
|
|
The intended consumer is an envFrom/secretRef in the app's own manifest,
|
|
so the values become environment variables without ever being named in a
|
|
committed file. See src/authentik/ansible/kubernetes/ for the worked
|
|
example.
|
|
|
|
Namespace lives here rather than in the app's manifests so it's guaranteed
|
|
to exist before anything mounts this Secret — a HelmChart CR's
|
|
createNamespace: true happens when the chart installs, which is after the
|
|
helm-controller job needs somewhere to put it.
|
|
-#}
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: {{ app_config.K8S_NAMESPACE }}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ app.name }}-secrets
|
|
namespace: {{ app_config.K8S_NAMESPACE }}
|
|
type: Opaque
|
|
stringData:
|
|
{% for key, value in (app_vault_secrets | default({})) | dictsort %}
|
|
{{ key }}: {{ value | string | to_json }}
|
|
{% endfor %}
|