FEAT(k8s): add ArgoCD configuration

- Add ArgoCD application configuration
- Reorganize k8s manifests

deploy/k8s/kustomization.yaml

@@ -5,10 +5,10 @@ namespace: mas
 
 resources:
   - namespace.yaml
-  - ../vault/mas-api-keys.yaml
-  - ../vault/mas-postgres.yaml
-  - ../vault/postgresql-root-password.yaml
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - mas-api-keys.yaml
+  - mas-postgres.yaml
+  - postgresql-root-password.yaml
 

deploy/k8s/mas-api-keys.yaml

@@ -0,0 +1,31 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: mas-api-keys
+  namespace: mas
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: mas-api-keys
+    creationPolicy: Owner
+  data:
+    - secretKey: anthropic-api-key
+      remoteRef:
+        key: mas/api-keys
+        property: ANTHROPIC_API_KEY
+    - secretKey: groq-api-key
+      remoteRef:
+        key: mas/api-keys
+        property: GROQ_API_KEY
+    - secretKey: openai-api-key
+      remoteRef:
+        key: mas/api-keys
+        property: OPENAI_API_KEY
+    - secretKey: google-api-key
+      remoteRef:
+        key: mas/api-keys
+        property: GOOGLE_API_KEY
+

deploy/k8s/mas-postgres.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: mas-postgres
+  namespace: mas
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: mas-postgres
+    creationPolicy: Owner
+  data:
+    - secretKey: password
+      remoteRef:
+        key: mas/postgres
+        property: PASSWORD
+

deploy/k8s/postgresql-root-password.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: postgresql-root-password
+  namespace: mas
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: postgresql-root-password
+    creationPolicy: Owner
+  data:
+    - secretKey: password
+      remoteRef:
+        key: databases/postgresql
+        property: PASSWORD
+