encrypt sops file

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -38,3 +38,25 @@ spec:
   wait: true
   interval: 30m
   timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app self-signed-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/cert-manager/cert-manager/selfsigned
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml

@@ -0,0 +1,39 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name home-selfsigned-ca
+spec:
+  isCA: true
+  commonName: *name
+  subject:
+    organizations:
+      - ${SECRET_DOMAIN}
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name strong-selfsigned-ca
+spec:
+  isCA: true
+  commonName: *name
+  subject:
+    organizations:
+      - ${SECRET_DOMAIN}
+  secretName: strong-root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 384
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml

@@ -0,0 +1,17 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: home-ca-issuer
+spec:
+  ca:
+    secretName: root-secret
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: strong-ca-issuer
+spec:
+  ca:
+    secretName: strong-root-secret

kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./certificate.yaml
+  - ./clusterissuer.yaml

kubernetes/apps/external-secrets/app/helmrelease.yaml

@@ -0,0 +1,46 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: external-secrets
+      version: 0.10.5
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+        namespace: flux-charts
+
+  driftDetection:
+    mode: enabled
+  maxHistory: 3
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+
+  # https://github.com/external-secrets/external-secrets/blob/v0.7.2/deploy/charts/external-secrets/values.yaml
+  values:
+    installCRDs: true
+    replicaCount: 2
+    leaderElect: true
+
+    extraArgs:
+      loglevel: debug
+
+    serviceMonitor:
+      enabled: true
+    webhook:
+      serviceMonitor:
+        enabled: true
+    certController:
+      serviceMonitor:
+        enabled: true

kubernetes/apps/external-secrets/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - helmrelease.yaml

kubernetes/apps/external-secrets/bitwarden/clustersecretstore.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-login
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      headers:
+        Content-Type: application/json
+      result:
+        jsonPath: "$.data.login.{{ .remoteRef.property }}"
+
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-fields
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        jsonPath: "$.data.fields[?@.name==\"{{ .remoteRef.property }}\"].value"

kubernetes/apps/external-secrets/bitwarden/helmrelease.yaml

@@ -0,0 +1,78 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bitwarden-cli
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-charts
+
+  driftDetection:
+    mode: enabled
+  maxHistory: 3
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+
+  values:
+    defaultPodOptions:
+      securityContext:
+        seccompProfile: { type: RuntimeDefault }
+
+    controllers:
+      bitwarden-cli:
+        annotations:
+          reloader.stakater.com/auto: "true"
+
+        containers:
+          app:
+            image:
+              repository: ghcr.io/larivierec/bitwarden-cli
+              tag: 2024.9.0
+
+            envFrom:
+              - secretRef:
+                  name: bitwarden-cli-secret
+
+            probes:
+              liveness:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command: [ "sh", "-c", "curl -X POST -s http://127.0.0.1:8087/sync | jq -e '.success == true'" ]
+                  timeoutSeconds: 5
+              readiness:
+                enabled: false
+
+            resources:
+              requests:
+                memory: 256Mi
+                cpu: 100m
+              limits:
+                memory: 512Mi
+
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: false
+              capabilities: { drop: [ 'ALL' ] }
+
+    service:
+      app:
+        controller: bitwarden-cli
+        ports:
+          http:
+            port: 8087

kubernetes/apps/external-secrets/bitwarden/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./secret.sops.yaml
+- ./helmrelease.yaml
+- ./clustersecretstore.yaml

kubernetes/apps/external-secrets/bitwarden/secret.sops.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: bitwarden-cli-secret
+stringData:
+    BW_HOST: ENC[AES256_GCM,data:M9evGGPzM6IZz4ooRdtMi469bBDQzjFm4SJnz4iQj8UcGNsF,iv:1Ssk8J7q1XHbUifW6h4hDgnGhS+DLElU3Mbuq9VmoZ0=,tag:xMfiVa+5YZn4S/9VUqd+TA==,type:str]
+    BW_CLIENTID: ENC[AES256_GCM,data:k5owh4o61yxZW0EJwb0GxTUQEoMk8c0YRDFmsL/CeRumgZoVVnx/tMI=,iv:gCTPrl6mv0lZh9AxVm5JCSdnzrwLEOVoCgpTlSEgJ3g=,tag:SvSBHyFvIvde0YxYMIF9tA==,type:str]
+    BW_CLIENTSECRET: ENC[AES256_GCM,data:8/m9r17gDBf8fo42nLqSxWSn76lN4CaXEZMhZ6hS,iv:l91GjxP0JijlrGx4jM3ZZ7/4HEpBJLE2tp+ZFm351sw=,tag:n8JmlYTRqz8360bDRXdXhQ==,type:str]
+    BW_PASSWORD: ENC[AES256_GCM,data:JmoE3vQPWTzyQnbq1Lop,iv:SduCJUIEHt4SHKM/um+GQTnesjM0N7QHoxskEOa50Ds=,tag:ffsSUyg8qhH2CAZhhugQjQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWZXdTKys3MHZMb2ZTc3Fm
+            TW9XMVhTUTllOFVYekRod0EyT3AyR0p5MHlBCnI2c3B3Zk1HSUlFd3BMNUhJSDlX
+            VmVGbWdVdFBwMDQ2TmlCeGJHQzQyREkKLS0tIHozMXB3bCtOM0FGZHYzSnZhRzRM
+            dFM3QW92dWdUUkNNQndIa3RVNHNnMkkKCkdzT78tFGWsS+7bbvRdWvm8uXswKi9s
+            NuanHeoK0FV+GiMoPLuwC1e4W2g718PazHGveN5pCM7UFQPlKCctDA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-08T03:20:49Z"
+    mac: ENC[AES256_GCM,data:h5trsgnb2WPEFKyqrO3gV2HOxAnkaR9AMUv8gKKa+HIab/AkqAsFsC7XGNksOgyvWhMV1qH+myy8j9j5e3EdSqlV4CRzRYKMfgKUlgqPqd2GlpMZiBUZPW4hnRuxQN+DCBIJFY46es8MAiSa148DQwVsHrSgC6Gx5g2gaQbgzlo=,iv:XUWOROvebTkLiFCbRFUIdMC70w2+Vf8GELc7w32Kmfw=,tag:MpAJz5VrAzkY3lknZcgGjw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1

kubernetes/apps/external-secrets/certificates/bitwarden.yaml

@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name bitwarden-tls-certs
+spec:
+  secretName: *name
+  dnsNames:
+    - bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - localhost
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+    rotationPolicy: Always
+  duration: 168h # 7d
+  renewBefore: 24h # 1d
+  issuerRef:
+    name: home-ca-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bitwarden-css-certs
+  namespace: external-secrets
+spec:
+  secretName: bitwarden-css-certs
+  dnsNames:
+    - bitwarden-secrets-manager.external-secrets.svc.cluster.local
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+    rotationPolicy: Always
+  usages:
+    - client auth
+  issuerRef:
+    name: home-ca-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io

kubernetes/apps/external-secrets/certificates/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./bitwarden.yaml

kubernetes/apps/external-secrets/ks.yaml

@@ -0,0 +1,44 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app external-secrets
+  namespace: flux-system
+spec:
+  targetNamespace: external-secrets
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets-certs
+  path: ./kubernetes/apps/external-secrets/bitwarden
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app external-secrets-stores
+  namespace: flux-system
+spec:
+  targetNamespace: external-secrets
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/external-secrets/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/apps/external-secrets/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./ks.yaml

kubernetes/apps/external-secrets/namespace.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled