talos + tofu + secrets kust k8s

kubernetes/apps/kustomization.yaml

@@ -12,3 +12,5 @@ resources:
   - tools/inventory/apps.yaml
   - infra/netbox/deployment.yaml
   - tools/finance-search/apps.yaml
+  - security/authentik/credentials.yaml
+  - media/immich/credentials.yaml

kubernetes/apps/media/immich/credentials.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-credentials
+  namespace: media
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: openbao-backend
+    kind: ClusterSecretStore
+  target:
+    name: immich-credentials
+  data:
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        key: secret/immich
+        property: DB_PASSWORD

kubernetes/apps/security/authentik/credentials.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: authentik-credentials
+  namespace: authentik
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: openbao-backend
+    kind: ClusterSecretStore
+  target:
+    name: authentik-credentials
+  data:
+    - secretKey: secret_key
+      remoteRef:
+        key: secret/authentik
+        property: secret_key
+    - secretKey: postgresql_password
+      remoteRef:
+        key: secret/authentik
+        property: postgresql_password

talos/patches/worker.yaml

@@ -1,5 +1,8 @@
 ---
 machine:
+  nodeLabels:
+    topology.kubernetes.io/region: atlas
+    topology.kubernetes.io/zone: pve0
   network:
     interfaces:
       - interface: ens18

tofu/secrets.tf

@@ -46,3 +46,37 @@ resource "vault_kv_secret_v2" "sure" {
     DB_PASSWORD = random_password.sure_db_password.result
   })
 }
+
+# 5. Секреты для Authentik SSO
+resource "random_password" "authentik_secret_key" {
+  length  = 50
+  special = false
+}
+
+resource "random_password" "authentik_db_password" {
+  length  = 32
+  special = false
+}
+
+resource "vault_kv_secret_v2" "authentik" {
+  mount = vault_mount.secret.path
+  name  = "authentik"
+  data_json = jsonencode({
+    secret_key          = random_password.authentik_secret_key.result
+    postgresql_password = random_password.authentik_db_password.result
+  })
+}
+
+# 6. Секрет для Immich Photos
+resource "random_password" "immich_db_password" {
+  length  = 32
+  special = false
+}
+
+resource "vault_kv_secret_v2" "immich" {
+  mount = vault_mount.secret.path
+  name  = "immich"
+  data_json = jsonencode({
+    DB_PASSWORD = random_password.immich_db_password.result
+  })
+}