2a6ec55755
db-credentials, jwt-secret, redis-credentials, s3-credentials. Each service only references the secrets it needs. Values are REPLACE_IN_DEPLOY markers — real values injected by scripts/deploy-secrets.sh. Also updated references in postgres.yaml, migrate.yaml, and postgres-init.yaml to use db-credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
59 lines
1.5 KiB
YAML
59 lines
1.5 KiB
YAML
# Database credentials — used by services that connect to PostgreSQL.
|
|
# Real values injected by scripts/deploy-secrets.sh from Scaleway Secrets Manager.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: db-credentials
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
type: Opaque
|
|
stringData:
|
|
password: "REPLACE_IN_DEPLOY"
|
|
---
|
|
# JWT signing secret — used by services that validate/issue JWTs.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: jwt-secret
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
type: Opaque
|
|
stringData:
|
|
secret: "REPLACE_IN_DEPLOY"
|
|
---
|
|
# Redis credentials — used by services with Redis connections.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: redis-credentials
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
type: Opaque
|
|
stringData:
|
|
password: "REPLACE_IN_DEPLOY"
|
|
---
|
|
# S3/Minio credentials for application-level access (model storage, data).
|
|
# NOT the same as minio-credentials (used by initContainers for binary fetch).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: s3-credentials
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: foxhunt
|
|
type: Opaque
|
|
stringData:
|
|
access-key: "REPLACE_IN_DEPLOY"
|
|
secret-key: "REPLACE_IN_DEPLOY"
|
|
---
|
|
# Registry pull secret for Scaleway Container Registry
|
|
# Create with:
|
|
# kubectl create secret docker-registry scw-registry \
|
|
# --namespace foxhunt \
|
|
# --docker-server=rg.fr-par.scw.cloud \
|
|
# --docker-username=foxhunt \
|
|
# --docker-password=<SCW_SECRET_KEY>
|