adam
d7f2ae69ca
excludeRaw alone left all home_assistant source keys (api_key, vantage_*, etc.) in the synced secret, so envFrom injected them into the web container. Add transformation.excludes ['.*'] so only the templated MQTT_USERNAME/MQTT_PASSWORD remain.
36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
# MQTT broker creds for the web container, synced from OpenBao by VSO.
|
|
#
|
|
# Reads secret/home_assistant (keys mqtt_user / mqtt_pass) and renders a k8s
|
|
# Secret `jbod-mqtt` with MQTT_USERNAME / MQTT_PASSWORD keys (consumed via
|
|
# envFrom in the DaemonSet). VSO's `vso-read` policy can read secret/data/*,
|
|
# so unlike the claude-read token it CAN read home_assistant — no creds ever
|
|
# touch these manifests.
|
|
#
|
|
# Verify the transformation syntax against the installed VSO version.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: jbod-mqtt
|
|
namespace: jbod-monitor
|
|
spec:
|
|
vaultAuthRef: vault-secrets-operator-system/openbao-kubernetes
|
|
mount: secret
|
|
type: kv-v2
|
|
path: home_assistant
|
|
refreshAfter: 1h
|
|
destination:
|
|
name: jbod-mqtt
|
|
create: true
|
|
transformation:
|
|
excludeRaw: true
|
|
# Drop ALL passthrough source keys (api_key, vantage_*, etc.) — keep only
|
|
# the templated MQTT_USERNAME/MQTT_PASSWORD below. Without this, envFrom
|
|
# would inject the entire home_assistant secret into the web container.
|
|
excludes:
|
|
- ".*"
|
|
templates:
|
|
MQTT_USERNAME:
|
|
text: '{{ .Secrets.mqtt_user }}'
|
|
MQTT_PASSWORD:
|
|
text: '{{ .Secrets.mqtt_pass }}'
|