add new secrets

2026-03-22 19:24:53 +00:00 · 2026-03-22 19:24:53 +00:00 · 8b8ca5fe9e
commit 8b8ca5fe9e
parent 6928fc40f4
10 changed files with 84 additions and 19 deletions
--- a/apps/base/customer1/news_bot/analyst-cronjob.yaml
+++ b/apps/base/customer1/news_bot/analyst-cronjob.yaml
@ -49,7 +49,7 @@ spec:
                - name: DB_PASSWORD
                  valueFrom:
                    secretKeyRef:
-                      name: news-user-password
+                      name: news-app-password
                      key: password
              envFrom:
                - configMapRef:
--- a/apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml
+++ b/apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml
@ -19,7 +19,7 @@ spec:
                - name: DB_PASSWORD
                  valueFrom:
                    secretKeyRef:
-                      name: news-user-password
+                      name: news-app-password
                      key: password 
              envFrom:
                - configMapRef:
--- a/apps/base/customer1/news_bot/kustomization.yaml
+++ b/apps/base/customer1/news_bot/kustomization.yaml
@ -14,4 +14,5 @@ resources:
  - gemma-configmap.yaml
  - analyst-cronjob.yaml
  - ollama-storage.yaml
+  - news-app-password.yaml

--- a/apps/base/customer1/news_bot/news-app-password.yaml
+++ b/apps/base/customer1/news_bot/news-app-password.yaml
@ -0,0 +1,24 @@
+apiVersion: v1
+data:
+    password: ENC[AES256_GCM,data:d2MAWwaRAWBsz+/VNV46whVTqBY=,iv:B7Ho0E6Xkj9jQvUBM0EfwoMzdBKaS4l85KXkyO52xgM=,tag:WpdaN5bW9FQjpyMChTAR7w==,type:str]
+    username: ENC[AES256_GCM,data:ZofCHAydBukvd0NK,iv:QkEbrjtD1NTCZdVDbFZsKzC6rh4paPSSc/jRupOnl5s=,tag:T/aeQY13Gi5hOs9l8eXaIg==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: null
+    name: news-app-password
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMTd4bnRsdnRQeXJ0RXBv
+            a3I1RmVheWx4S3dCVzI2Z0tDRnI0U0EzUFVFCnlOaUpGOHNTYUtHZ1g2MmpRT1M3
+            YXJBUGFxWGNDUHlONFhpckt5QXV5MEUKLS0tIDdKeEpTSGdwQXZrUzRFWlQxZWtx
+            UEVZZzJRWjlmWFpLUUZnSVhxZWRsZUkKeEM9QZTc2dxD6JWJveid8yz9lBeTMsWy
+            3omHFX2Ej5XAcM9RemiGHwclp2UBL8++5JeJlnVTbvNn+IkeH3gu5g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-22T19:23:13Z"
+    mac: ENC[AES256_GCM,data:1Ddf5/F620muz4gDcGRaSAGFD4zKFyVEvc3uqPppG8NMdwMXhOrTMmkb2TXkpMcqdnt/sbX5hD9me+FHZ0yvttlf27uc/bI+RRoJDo9b3MJd6OkBB9YPTtPZ7WJXmBcfejPAHo8RSoM3Q9Y8EjbTxUBNfi7qLdMK/l3rW9lonhg=,iv:qQU5EhgkSuAdV0Rd9nr/c0wJhWgFK9IWSetLwfmA9Xs=,tag:7wSkcR8j6dBz+6WqSwIAWQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/apps/base/customer1/news_bot/scraper-cronjob.yaml
+++ b/apps/base/customer1/news_bot/scraper-cronjob.yaml
@ -17,11 +17,11 @@ spec:
            
            resources:
              requests:
-                memory: "500Mi"
-                cpu: "100m"
-              limits:
                memory: "1Gi"
                cpu: "500m"
+              limits:
+                memory: "2Gi"
+                cpu: "1000m"
            envFrom:
            - configMapRef:
                name: scrapy-config
@ -29,7 +29,7 @@ spec:
              - name: DB_PASSWORD
                valueFrom:
                  secretKeyRef:
-                    name: news-user-password 
+                    name: news-app-password 
                    key: password 
            volumeMounts:
              - name: url-storage
--- a/apps/base/customer1/news_bot/telebot-cronjob.yaml
+++ b/apps/base/customer1/news_bot/telebot-cronjob.yaml
@ -26,6 +26,6 @@ spec:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
-                  name: news-user-password 
+                  name: news-app-password 
                  key: password
          restartPolicy: OnFailure
--- a/apps/base/customer1/pg-cluster-customer1.yaml
+++ b/apps/base/customer1/pg-cluster-customer1.yaml
@ -5,6 +5,7 @@ metadata:
  namespace: customer1
  
 spec:
+  serviceAccountName: cnpg-backup-sa
  managed:
    roles:
      - name: customer1
@ -16,7 +17,7 @@ spec:
        ensure: present
        login: true 
        passwordSecret:
-          name: news-user-password
+          name: news-app-password
  instances: 3
  imageName: ghcr.io/cloudnative-pg/postgresql:15.2
  storage:
@ -30,7 +31,7 @@ spec:
  serviceAccountTemplate:
    metadata:
      annotations:
-        iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com
+        iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com  

  backup:
    barmanObjectStore:
--- a/grafana-secrets.yaml
+++ b/grafana-secrets.yaml
@ -1,9 +1,24 @@
 apiVersion: v1
 data:
-  GRAFANA_ADMIN_PASSWD: UGV0dWsxazE=
-  GRAFANA_ADMIN_USER: c2lyaXVz
+    GRAFANA_ADMIN_PASSWD: ENC[AES256_GCM,data:jxg51c5U2w6zgBXa,iv:nn2axEYen+kS0krlv2RXb2aHo29auu74QC5aHPmz6Nk=,tag:YUDr81JINm+oGYE5ESyDAQ==,type:str]
+    GRAFANA_ADMIN_USER: ENC[AES256_GCM,data:p7Ul3yAh9pc=,iv:WquGgBBeN/q0X0grDxkutE9KeaB7dSNvGuV1AcXPByQ=,tag:bm3iPB2f8f3sPVhE8ig4XQ==,type:str]
 kind: Secret
 metadata:
-  creationTimestamp: null
-  name: grafana-secrets
-  namespace: customer1
+    creationTimestamp: null
+    name: grafana-secrets
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNM2ZZWFhtRFdNNUhBbTB0
+            MHFsRHFPTTBac3B1OTNYUEtUaTV1WlVYYlVjCktWc1BkZHNhYmRHRURDMVhIUXNZ
+            TWpKa1A0OGM0NnE1YUxNekJCTTRCclUKLS0tIEp1VUFmcUZyWURsRkJxOFFLUU9W
+            eUJIQjQ3aVVGQlBzNm0vdUprRlNrYmcKpPl8FMLi2Z/hDZcwrJvxp+KgE/k2bynp
+            aNbdattl09RorT1gm8WB2nzA6UJwFiZduRnwOus9W6GFV402Igf3Og==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-22T19:23:41Z"
+    mac: ENC[AES256_GCM,data:HB/FVs4vUpSh32qJqH70CYE7KfG1hU52e0qEF73iJChGsfoawahf1WYS3EQcKaQm6w6Q2AgE88TDwHhOLzns57jqM+1gkBoQfAb/P2qYuv2G9YDMsEQT8C8cSQsCRatCub4064i1exjv9/VM6vr5bcF7oz7bWKZBV7CeTdkwikQ=,iv:nE4w/WBk/eP//rscPUc/CdW6BKMpqd+clNtnwrSQrBU=,tag:OvApAtKsdgaZpzEv0Wwn/Q==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/grafanaSecrets1.yaml
+++ b/grafanaSecrets1.yaml
@ -1,9 +1,24 @@
 apiVersion: v1
 data:
-  grafana_admin_password: UGV0dWsxazE=
-  grafana_admin_user: c2lyaXVz
+    grafana_admin_password: ENC[AES256_GCM,data:orvxn/NU9HDUKFwP,iv:8dAUYfKSKX9wL6/CBiU60wLSkZebDOjk/y7IcrVIFXw=,tag:Lb4Eku8S6HNbEa8xInF8iw==,type:str]
+    grafana_admin_user: ENC[AES256_GCM,data:/DjABi9gI6M=,iv:fXl0qg1+a3n8GXWT+zk2ooUvfyMpp/yT8UzFsEtTmtQ=,tag:FAF6kwq0aW5TVasXOwQobA==,type:str]
 kind: Secret
 metadata:
-  creationTimestamp: null
-  name: grafana_secrets
-  namespace: customer1
+    creationTimestamp: null
+    name: grafana_secrets
+    namespace: customer1
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQkYwQjZVT3BqM0RLRCt4
+            eGY0aHRXYkJDQ1AzK1F5T0RuWFNVQVF5SWg4CkI0ckMrR01tcVVoU2c0SFZXTFJZ
+            ZitBMzUyQVNKMmtXNW1meFlUTy9VMFkKLS0tIEdaanlrVDBXWHd0dDZVdUlaZng0
+            RGhCNEQwaHd5QlFoRlBzR2swRVVQUG8K9ESwtVP7k8m4mwAdu5syks51uSzyv3xN
+            1ivdPU/Nzs3in1UNbdbg16PEGARrI2mh0DTHRCJcqFGyu3p92tqzww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-22T19:23:34Z"
+    mac: ENC[AES256_GCM,data:NmMC0PT3QehIOeyi8yJ5h+KmZrygURNUOGYyu0xn3wCZQLJ5ry3SA8zwkjIkwZiaHs//yHoC7Xf245yxvdxDdIvSVpGjarhknaTbXrJWh5t0IHjG6nnvKIWT+E955ix5tBHA8BF21Ha1SmbGIEbtRdQExPiaze9vUHYsS2fNhYo=,iv:sG2+8TSYcAqH9PzeD5RA6xRVdVwSjK99kZFKPIJ+R+U=,tag:DugXE1/ax2r55nXCD7vRHg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/modules/db-bucket.tf
+++ b/modules/db-bucket.tf
@ -40,3 +40,12 @@ resource "google_service_account_iam_binding" "workload_identity_binding" {
 output "gcp_sa_email" {
  value = google_service_account.cnpg_backup_sa.email
 }
+
+resource "google_service_account_iam_member" "token_creator_binding" {
+  service_account_id = google_service_account.cnpg_backup_sa.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  
+  # This allows the GSA to generate tokens for itself when called by the pod
+  member             = "serviceAccount:${google_service_account.cnpg_backup_sa.email}"
+}
+