35 lines
1.1 KiB
Markdown
35 lines
1.1 KiB
Markdown
# Secrets
|
|
|
|
`nereus-db` holds two keys, used by `postgres.yaml` and `rollout.yaml`:
|
|
|
|
- `POSTGRES_PASSWORD`
|
|
- `DATABASE_URL` — `postgres://nereus:<password>@nereus-postgres:5432/nereus?sslmode=disable`
|
|
|
|
It is not in `base/kustomization.yaml`. Plaintext never lands in the repo, and
|
|
gitleaks runs on every push.
|
|
|
|
## dev (k3d)
|
|
|
|
Create it directly, before `kubectl apply -k deploy/overlays/dev`:
|
|
|
|
```fish
|
|
set pw (openssl rand -hex 16)
|
|
kubectl create secret generic nereus-db -n nereus \
|
|
--from-literal=POSTGRES_PASSWORD=$pw \
|
|
--from-literal=DATABASE_URL="postgres://nereus:$pw@nereus-postgres:5432/nereus?sslmode=disable"
|
|
```
|
|
|
|
Rotating means deleting the secret, the StatefulSet's PVC, and restarting —
|
|
Postgres only reads `POSTGRES_PASSWORD` when it initialises the data directory.
|
|
|
|
## prod (sealed)
|
|
|
|
Write the plaintext to `nereus-db.plain.yaml` (gitignored), then:
|
|
|
|
```fish
|
|
kubeseal --format yaml < nereus-db.plain.yaml > nereus-db-sealed.yaml
|
|
```
|
|
|
|
Commit only `nereus-db-sealed.yaml` and add it to the prod overlay. The
|
|
controller isn't installed yet — `kubectl get crd | grep sealed` comes back
|
|
empty.
|