From 8b8ca5fe9e27ddfff6bd2928d3a96220b5856abd Mon Sep 17 00:00:00 2001 From: sirius0xdev Date: Sun, 22 Mar 2026 19:24:53 +0000 Subject: [PATCH] add new secrets --- .../customer1/news_bot/analyst-cronjob.yaml | 2 +- .../news_bot/analyst-gemini-cronjob.yaml | 2 +- .../customer1/news_bot/kustomization.yaml | 1 + .../customer1/news_bot/news-app-password.yaml | 24 ++++++++++++++++++ .../customer1/news_bot/scraper-cronjob.yaml | 8 +++--- .../customer1/news_bot/telebot-cronjob.yaml | 2 +- apps/base/customer1/pg-cluster-customer1.yaml | 5 ++-- grafana-secrets.yaml | 25 +++++++++++++++---- grafanaSecrets1.yaml | 25 +++++++++++++++---- modules/db-bucket.tf | 9 +++++++ 10 files changed, 84 insertions(+), 19 deletions(-) create mode 100644 apps/base/customer1/news_bot/news-app-password.yaml diff --git a/apps/base/customer1/news_bot/analyst-cronjob.yaml b/apps/base/customer1/news_bot/analyst-cronjob.yaml index fb76c37..888c2d3 100644 --- a/apps/base/customer1/news_bot/analyst-cronjob.yaml +++ b/apps/base/customer1/news_bot/analyst-cronjob.yaml @@ -49,7 +49,7 @@ spec: - name: DB_PASSWORD valueFrom: secretKeyRef: - name: news-user-password + name: news-app-password key: password envFrom: - configMapRef: diff --git a/apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml b/apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml index 5b57bf6..0cbc9e5 100644 --- a/apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml +++ b/apps/base/customer1/news_bot/analyst-gemini-cronjob.yaml @@ -19,7 +19,7 @@ spec: - name: DB_PASSWORD valueFrom: secretKeyRef: - name: news-user-password + name: news-app-password key: password envFrom: - configMapRef: diff --git a/apps/base/customer1/news_bot/kustomization.yaml b/apps/base/customer1/news_bot/kustomization.yaml index a14ee70..b9eaa13 100644 --- a/apps/base/customer1/news_bot/kustomization.yaml +++ b/apps/base/customer1/news_bot/kustomization.yaml @@ -14,4 +14,5 @@ resources: - gemma-configmap.yaml - analyst-cronjob.yaml - ollama-storage.yaml + - news-app-password.yaml diff --git a/apps/base/customer1/news_bot/news-app-password.yaml b/apps/base/customer1/news_bot/news-app-password.yaml new file mode 100644 index 0000000..f4ae3b3 --- /dev/null +++ b/apps/base/customer1/news_bot/news-app-password.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +data: + password: ENC[AES256_GCM,data:d2MAWwaRAWBsz+/VNV46whVTqBY=,iv:B7Ho0E6Xkj9jQvUBM0EfwoMzdBKaS4l85KXkyO52xgM=,tag:WpdaN5bW9FQjpyMChTAR7w==,type:str] + username: ENC[AES256_GCM,data:ZofCHAydBukvd0NK,iv:QkEbrjtD1NTCZdVDbFZsKzC6rh4paPSSc/jRupOnl5s=,tag:T/aeQY13Gi5hOs9l8eXaIg==,type:str] +kind: Secret +metadata: + creationTimestamp: null + name: news-app-password + namespace: customer1 +sops: + age: + - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMTd4bnRsdnRQeXJ0RXBv + a3I1RmVheWx4S3dCVzI2Z0tDRnI0U0EzUFVFCnlOaUpGOHNTYUtHZ1g2MmpRT1M3 + YXJBUGFxWGNDUHlONFhpckt5QXV5MEUKLS0tIDdKeEpTSGdwQXZrUzRFWlQxZWtx + UEVZZzJRWjlmWFpLUUZnSVhxZWRsZUkKeEM9QZTc2dxD6JWJveid8yz9lBeTMsWy + 3omHFX2Ej5XAcM9RemiGHwclp2UBL8++5JeJlnVTbvNn+IkeH3gu5g== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-22T19:23:13Z" + mac: ENC[AES256_GCM,data:1Ddf5/F620muz4gDcGRaSAGFD4zKFyVEvc3uqPppG8NMdwMXhOrTMmkb2TXkpMcqdnt/sbX5hD9me+FHZ0yvttlf27uc/bI+RRoJDo9b3MJd6OkBB9YPTtPZ7WJXmBcfejPAHo8RSoM3Q9Y8EjbTxUBNfi7qLdMK/l3rW9lonhg=,iv:qQU5EhgkSuAdV0Rd9nr/c0wJhWgFK9IWSetLwfmA9Xs=,tag:7wSkcR8j6dBz+6WqSwIAWQ==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/apps/base/customer1/news_bot/scraper-cronjob.yaml b/apps/base/customer1/news_bot/scraper-cronjob.yaml index efd2130..5e0a34c 100644 --- a/apps/base/customer1/news_bot/scraper-cronjob.yaml +++ b/apps/base/customer1/news_bot/scraper-cronjob.yaml @@ -17,11 +17,11 @@ spec: resources: requests: - memory: "500Mi" - cpu: "100m" - limits: memory: "1Gi" cpu: "500m" + limits: + memory: "2Gi" + cpu: "1000m" envFrom: - configMapRef: name: scrapy-config @@ -29,7 +29,7 @@ spec: - name: DB_PASSWORD valueFrom: secretKeyRef: - name: news-user-password + name: news-app-password key: password volumeMounts: - name: url-storage diff --git a/apps/base/customer1/news_bot/telebot-cronjob.yaml b/apps/base/customer1/news_bot/telebot-cronjob.yaml index 6f2ecf1..504aa58 100644 --- a/apps/base/customer1/news_bot/telebot-cronjob.yaml +++ b/apps/base/customer1/news_bot/telebot-cronjob.yaml @@ -26,6 +26,6 @@ spec: - name: DB_PASSWORD valueFrom: secretKeyRef: - name: news-user-password + name: news-app-password key: password restartPolicy: OnFailure diff --git a/apps/base/customer1/pg-cluster-customer1.yaml b/apps/base/customer1/pg-cluster-customer1.yaml index 09ed775..f52fc15 100644 --- a/apps/base/customer1/pg-cluster-customer1.yaml +++ b/apps/base/customer1/pg-cluster-customer1.yaml @@ -5,6 +5,7 @@ metadata: namespace: customer1 spec: + serviceAccountName: cnpg-backup-sa managed: roles: - name: customer1 @@ -16,7 +17,7 @@ spec: ensure: present login: true passwordSecret: - name: news-user-password + name: news-app-password instances: 3 imageName: ghcr.io/cloudnative-pg/postgresql:15.2 storage: @@ -30,7 +31,7 @@ spec: serviceAccountTemplate: metadata: annotations: - iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com + iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com backup: barmanObjectStore: diff --git a/grafana-secrets.yaml b/grafana-secrets.yaml index 03bb812..962d9c9 100644 --- a/grafana-secrets.yaml +++ b/grafana-secrets.yaml @@ -1,9 +1,24 @@ apiVersion: v1 data: - GRAFANA_ADMIN_PASSWD: UGV0dWsxazE= - GRAFANA_ADMIN_USER: c2lyaXVz + GRAFANA_ADMIN_PASSWD: ENC[AES256_GCM,data:jxg51c5U2w6zgBXa,iv:nn2axEYen+kS0krlv2RXb2aHo29auu74QC5aHPmz6Nk=,tag:YUDr81JINm+oGYE5ESyDAQ==,type:str] + GRAFANA_ADMIN_USER: ENC[AES256_GCM,data:p7Ul3yAh9pc=,iv:WquGgBBeN/q0X0grDxkutE9KeaB7dSNvGuV1AcXPByQ=,tag:bm3iPB2f8f3sPVhE8ig4XQ==,type:str] kind: Secret metadata: - creationTimestamp: null - name: grafana-secrets - namespace: customer1 + creationTimestamp: null + name: grafana-secrets + namespace: customer1 +sops: + age: + - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNM2ZZWFhtRFdNNUhBbTB0 + MHFsRHFPTTBac3B1OTNYUEtUaTV1WlVYYlVjCktWc1BkZHNhYmRHRURDMVhIUXNZ + TWpKa1A0OGM0NnE1YUxNekJCTTRCclUKLS0tIEp1VUFmcUZyWURsRkJxOFFLUU9W + eUJIQjQ3aVVGQlBzNm0vdUprRlNrYmcKpPl8FMLi2Z/hDZcwrJvxp+KgE/k2bynp + aNbdattl09RorT1gm8WB2nzA6UJwFiZduRnwOus9W6GFV402Igf3Og== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-22T19:23:41Z" + mac: ENC[AES256_GCM,data:HB/FVs4vUpSh32qJqH70CYE7KfG1hU52e0qEF73iJChGsfoawahf1WYS3EQcKaQm6w6Q2AgE88TDwHhOLzns57jqM+1gkBoQfAb/P2qYuv2G9YDMsEQT8C8cSQsCRatCub4064i1exjv9/VM6vr5bcF7oz7bWKZBV7CeTdkwikQ=,iv:nE4w/WBk/eP//rscPUc/CdW6BKMpqd+clNtnwrSQrBU=,tag:OvApAtKsdgaZpzEv0Wwn/Q==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/grafanaSecrets1.yaml b/grafanaSecrets1.yaml index 8d8da57..39ab087 100644 --- a/grafanaSecrets1.yaml +++ b/grafanaSecrets1.yaml @@ -1,9 +1,24 @@ apiVersion: v1 data: - grafana_admin_password: UGV0dWsxazE= - grafana_admin_user: c2lyaXVz + grafana_admin_password: ENC[AES256_GCM,data:orvxn/NU9HDUKFwP,iv:8dAUYfKSKX9wL6/CBiU60wLSkZebDOjk/y7IcrVIFXw=,tag:Lb4Eku8S6HNbEa8xInF8iw==,type:str] + grafana_admin_user: ENC[AES256_GCM,data:/DjABi9gI6M=,iv:fXl0qg1+a3n8GXWT+zk2ooUvfyMpp/yT8UzFsEtTmtQ=,tag:FAF6kwq0aW5TVasXOwQobA==,type:str] kind: Secret metadata: - creationTimestamp: null - name: grafana_secrets - namespace: customer1 + creationTimestamp: null + name: grafana_secrets + namespace: customer1 +sops: + age: + - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQkYwQjZVT3BqM0RLRCt4 + eGY0aHRXYkJDQ1AzK1F5T0RuWFNVQVF5SWg4CkI0ckMrR01tcVVoU2c0SFZXTFJZ + ZitBMzUyQVNKMmtXNW1meFlUTy9VMFkKLS0tIEdaanlrVDBXWHd0dDZVdUlaZng0 + RGhCNEQwaHd5QlFoRlBzR2swRVVQUG8K9ESwtVP7k8m4mwAdu5syks51uSzyv3xN + 1ivdPU/Nzs3in1UNbdbg16PEGARrI2mh0DTHRCJcqFGyu3p92tqzww== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-22T19:23:34Z" + mac: ENC[AES256_GCM,data:NmMC0PT3QehIOeyi8yJ5h+KmZrygURNUOGYyu0xn3wCZQLJ5ry3SA8zwkjIkwZiaHs//yHoC7Xf245yxvdxDdIvSVpGjarhknaTbXrJWh5t0IHjG6nnvKIWT+E955ix5tBHA8BF21Ha1SmbGIEbtRdQExPiaze9vUHYsS2fNhYo=,iv:sG2+8TSYcAqH9PzeD5RA6xRVdVwSjK99kZFKPIJ+R+U=,tag:DugXE1/ax2r55nXCD7vRHg==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/modules/db-bucket.tf b/modules/db-bucket.tf index b830aef..647a719 100644 --- a/modules/db-bucket.tf +++ b/modules/db-bucket.tf @@ -40,3 +40,12 @@ resource "google_service_account_iam_binding" "workload_identity_binding" { output "gcp_sa_email" { value = google_service_account.cnpg_backup_sa.email } + +resource "google_service_account_iam_member" "token_creator_binding" { + service_account_id = google_service_account.cnpg_backup_sa.name + role = "roles/iam.serviceAccountTokenCreator" + + # This allows the GSA to generate tokens for itself when called by the pod + member = "serviceAccount:${google_service_account.cnpg_backup_sa.email}" +} +