Secrets and credentials

Sync ceph dashboard password to 1Password

op item get --vault "HomeLab" "K8s Service Cluster Ceph-01 Dashboard" --format json \
  | jq --arg new_value "$(kubectl get secret -n ceph-cluster rook-ceph-dashboard-password -o json \
                          | jq -r '.data.password' | base64 -d)" \
       '.fields |= map(if .id == "password" then .value = $new_value else . end)' \
  | op item edit "K8s Service Cluster Ceph-01 Dashboard" --vault "HomeLab" 2>&1 > /dev/null

Vault AppRole login

ROLE_ID=$(vault read auth/approle/role/backup/role-id -format=json | jq -r '.data.role_id')
SECRET_ID=$(vault write -force auth/approle/role/backup/secret-id -format=json | jq -r '.data.secret_id')
TOKEN=$(vault write auth/approle/login role_id=$ROLE_ID secret_id=$SECRET_ID -format=json | jq -r '.auth.client_token')

Create the GitLab container-access secret

Cluster image pulls from the project’s GitLab registry use a SOPS-encrypted kubernetes.io/dockerconfigjson secret, replicated into namespaces labelled request-gitlab-com-homelab-container-access-secret by the mittwald replicator.

Inline age public key

export GL_TOKEN=<token>

kubectl create secret docker-registry gitlab-com-homelab-container-access \
  --docker-username=k8s-homelab-deploy-token \
  --docker-password=$GL_TOKEN \
  --docker-server=registry.gitlab.com \
  --dry-run=client -o yaml \
  | yq eval '.metadata.annotations += {
      "replicator.v1.mittwald.de/replicate-to-matching": "request-gitlab-com-homelab-container-access-secret",
      "replicator.v1.mittwald.de/replicate-to": "flux-system"
    }' - \
  | sops \
      --age=age13vxjf834ly3cs6xfdxqya8jlw0v9jcw089dqy2kqjtnr30ngu5ks7ky2c7 \
      --encrypt \
      --encrypted-regex '^(data|stringData)$' \
      --input-type yaml --output-type yaml /dev/stdin \
  > gitlab-homelab-access-container.yaml

Via a SOPS config file

export SOPS_CONFIG=<path-to-.sops.yaml>

kubectl create secret docker-registry gitlab-com-homelab-container-access \
  --docker-username=k8s-homelab-deploy-token \
  --docker-password=$GL_TOKEN \
  --docker-server=registry.gitlab.com \
  --dry-run=client -o yaml \
  | sops --config $SOPS_CONFIG --encrypt /dev/stdin \
  > gitlab-homelab-access-container.yaml