Mayne0213
3366a6b5b8
- and CNPG infrastructure components Add three critical infrastructure components via GitOps: - Velero: Backup and disaster recovery solution - Configured with Minio S3 backend - Daily full cluster backups (30-day retention) - Hourly backups for critical namespaces (7-day retention) - Credentials managed via External Secrets from Vault - Falco: Runtime security monitoring - eBPF-based threat detection - Custom rules for container security - Falcosidekick for alert forwarding - Prometheus metrics enabled - CNPG (CloudNativePG): PostgreSQL operator - Kubernetes-native PostgreSQL management - Automated failover and backups - Will replace Bitnami PostgreSQL All components follow existing GitOps patterns: - Helm charts deployed via ArgoCD - Values managed in Git - Automated sync with selfHeal enabled
34 lines
702 B
YAML
34 lines
702 B
YAML
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: velero-s3-credentials
|
|
namespace: velero
|
|
spec:
|
|
refreshInterval: 1h
|
|
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
|
|
target:
|
|
name: velero-s3-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
cloud: |
|
|
[default]
|
|
aws_access_key_id={{ .minioAccessKey }}
|
|
aws_secret_access_key={{ .minioSecretKey }}
|
|
|
|
data:
|
|
- secretKey: minioAccessKey
|
|
remoteRef:
|
|
key: secret/data/minio
|
|
property: accessKey
|
|
|
|
- secretKey: minioSecretKey
|
|
remoteRef:
|
|
key: secret/data/minio
|
|
property: secretKey
|