SecretZero/examples/kubernetes-basic.yml at main · zloeber/SecretZero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# Kubernetes Secrets Example
# Basic example for storing secrets in Kubernetes cluster


variables:
  namespace: default
  cluster_context: my-cluster

providers:
  kubernetes:
    kind: kubernetes
    auth:
      kind: ambient
      config:
        context: "{{ var.cluster_context }}"

secrets:
  # Basic Opaque secret
  - name: database_password
    kind: random_password
    config:
      length: 24
      special: true
    targets:
      - provider: kubernetes
        kind: kubernetes_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: postgres-credentials
          data_key: password
          secret_type: Opaque
          labels:
            app: myapp
            component: database
          annotations:
            description: PostgreSQL database password
            managed-by: secretzero

  # API key secret
  - name: api_key
    kind: random_string
    config:
      length: 32
      charset: hex
    targets:
      - provider: kubernetes
        kind: kubernetes_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: app-secrets
          data_key: api-key
          labels:
            app: myapp

  # Multiple secrets in same Secret object
  - name: redis_password
    kind: random_password
    config:
      length: 16
      special: false
    targets:
      - provider: kubernetes
        kind: kubernetes_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: app-secrets  # Same secret object
          data_key: redis-password
          labels:
            app: myapp

  # TLS certificate (for ingress/service)
  - name: tls_certificate
    kind: templates.tls_cert

templates:
  tls_cert:
    description: TLS certificate and key
    fields:
      tls.crt:
        description: TLS certificate
        generator:
          kind: static
          config:
            # In production, use a real certificate or cert-manager
            default: |
              -----BEGIN CERTIFICATE-----
              MIICljCCAX4CCQCKz...example...
              -----END CERTIFICATE-----
      tls.key:
        description: TLS private key
        generator:
          kind: static
          config:
            # In production, use a real key or cert-manager
            default: |
              -----BEGIN PRIVATE KEY-----
              MIIEvgIBADANBgkqh...example...
              -----END PRIVATE KEY-----
    targets:
      - provider: kubernetes
        kind: kubernetes_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: myapp-tls
          secret_type: kubernetes.io/tls
          labels:
            app: myapp
            type: tls

metadata:
  project: kubernetes-secrets
  owner: platform-team
  description: Basic Kubernetes secret management