keyhan
a2fe61b1f6
Build and Deploy Platform / build-and-deploy (push) Successful in 16m13s
Backend validate-production-config requires a non-default ELASTIC_PASSWORD; read it from abrban-platform-secrets.elastic-password like other credentials. Co-authored-by: Cursor <cursoragent@cursor.com>
33 lines
1.5 KiB
YAML
33 lines
1.5 KiB
YAML
# Example: seal platform secrets for namespace cloudhost.
|
|
# Full guide (any environment): RUNBOOK-DEPLOY.fa.md — Phase 3
|
|
# Real SealedSecret lives in cloud-host-gitops/sealed-secrets/ — never commit plaintext passwords.
|
|
#
|
|
# Required keys (must match backend Deployment + validate-production-config):
|
|
# postgres-password, jwt-secret, jwt-refresh-secret, cluster-kubeconfig-key,
|
|
# redis-password, elastic-password (must match elasticsearch-credentials in logging)
|
|
#
|
|
# Generate (replace CHANGE_ME_* with strong random values):
|
|
#
|
|
# kubectl -n cloudhost create secret generic abrban-platform-secrets \
|
|
# --from-literal=postgres-password='CHANGE_ME_PG' \
|
|
# --from-literal=jwt-secret='CHANGE_ME_JWT_32CHARS_MIN' \
|
|
# --from-literal=jwt-refresh-secret='CHANGE_ME_REFRESH_32CHARS_MIN' \
|
|
# --from-literal=cluster-kubeconfig-key='0123456789abcdef0123456789abcdef' \
|
|
# --from-literal=redis-password='CHANGE_ME_REDIS' \
|
|
# --from-literal=elastic-password='CHANGE_ME_ELASTIC' \
|
|
# --dry-run=client -o json \
|
|
# | kubeseal \
|
|
# --controller-name=sealed-secrets-controller \
|
|
# --controller-namespace=kube-system \
|
|
# --format yaml \
|
|
# > ../cloud-host-gitops/sealed-secrets/abrban-platform-secrets.yaml
|
|
#
|
|
# Then in platform/values-abrban.yaml:
|
|
# secrets:
|
|
# existingSecret: abrban-platform-secrets
|
|
#
|
|
# Apply:
|
|
# kubectl apply -f ../cloud-host-gitops/sealed-secrets/abrban-platform-secrets.yaml
|
|
#
|
|
# Rotate redis-password: update SealedSecret, sync Argo, restart backend + redis pods.
|