Add external secrets

README.md

@@ -15,6 +15,7 @@ helm upgrade -i cilium cilium/cilium \
 helm install argocd oci://ghcr.io/argoproj/argo-helm/argo-cd -n argocd --create-namespace
 
 kubectl apply -f ./apps/apps.yaml
+kubectl create secret generic bitwarden-access-token -n external-secrets --from-literal token=$BW_ACCESS_TOKEN
 ```
 
 ## Notes

apps/external-secrets.yaml

@@ -0,0 +1,71 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: v0.18.2
+    helm:
+      valuesObject:
+        bitwarden-sdk-server:
+          enabled: true
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden
+spec:
+  provider:
+    bitwardensecretsmanager:
+      apiURL: https://vault.bitwarden.eu/api
+      identityURL: https://vault.bitwarden.eu/identity
+      auth:
+        secretRef:
+          credentials:
+            namespace: external-secrets
+            name: bitwarden-access-token
+            key: token
+      caProvider:
+        type: Secret
+        namespace: external-secrets
+        name: bitwarden-tls-certs
+        key: ca.crt
+
+      organizationID: b461238b-9b93-4598-b12c-b32c00834ab6
+      projectID: b63f0f85-2c6f-4f99-b999-b32c009d7bdf
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bitwarden-tls-certs
+  namespace: external-secrets
+spec:
+  secretName: bitwarden-tls-certs
+  dnsNames:
+    - bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - localhost
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+  issuerRef:
+    name: selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io

charts/transmission/secrets.yaml

@@ -0,0 +1,14 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: transmisison
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    # This name must match the metadata.name in the `SecretStore`
+    name: bitwarden-secretsmanager
+    kind: SecretStore
+  data:
+  - secretKey: test
+    remoteRef:
+      key: "secret-name"