Remove Vault dependency for deployments

services/Adminer/configMap-Adminer.yml

@@ -11,6 +11,6 @@ data:
       * @param string result of password_hash
       */
       return new AdminerLoginPasswordLess(
-        $password_hash = password_hash(rtrim(file_get_contents('/vault/secrets/sqlitepw')), PASSWORD_DEFAULT)
+        $password_hash = password_hash(getEnv('sqlitepw'), PASSWORD_DEFAULT)
       );
     ?>

services/Adminer/deploy-Adminer.yml

@@ -23,14 +23,6 @@ spec:
       app: adminer
   template:
     metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-inject-secret-sqlitepw: "secret/adminer"
-        vault.hashicorp.com/role: "adminer"
-        vault.hashicorp.com/agent-inject-template-sqlitepw: |
-          {{ with secret "secret/adminer" -}}
-            {{ .Data.data.sqlitepw }}
-          {{- end }}
       labels:
         app: adminer
     spec:
@@ -38,6 +30,9 @@ spec:
       containers:
       - name: adminer
         image: bv11-cr01.bessems.eu/proxy/library/adminer
+        envFrom:
+        - secretRef:
+            name: adminer-secret
         ports:
           - name: web
             containerPort: 8080

services/Adminer/secret-Adminer.yml.template

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: adminer-secret
+  labels:
+    app: adminer
+stringData:
+  sqlitepw: '<removed>'

services/Bitwarden/deploy-Bitwarden.yml

@@ -26,16 +26,6 @@ spec:
       app: bitwarden
   template:
     metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-inject-secret-bitwarden: "secret/bitwarden"
-        vault.hashicorp.com/role: "bitwarden"
-        vault.hashicorp.com/agent-inject-template-bitwarden: |
-          {{ with secret "secret/bitwarden" -}}
-            export ADMIN_TOKEN="{{ .Data.data.admintoken }}"
-            export YUBICO_CLIENT_ID="{{ .Data.data.yubicoclientid }}"
-            export YUBICO_SECRET_KEY="{{ .Data.data.yubicosecretkey }}"
-          {{- end }}
       labels:
         app: bitwarden
     spec:
@@ -43,7 +33,6 @@ spec:
       containers:
       - name: bitwarden
         image: bv11-cr01.bessems.eu/proxy/vaultwarden/server
-        args: ["sh", "-c", ". /vault/secrets/bitwarden && /start.sh"]
         env:
         - name: ENABLE_DB_WAL
           value: "false"
@@ -59,6 +48,9 @@ spec:
           value: "debug"
         - name: EXTENDED_LOGGING
           value: "true"
+        envFrom:
+        - secretRef:
+            name: bitwarden-secret
         ports:
           - name: ui
             containerPort: 8080

services/Bitwarden/secret-Bitwarden.yml.template

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bitwarden-secret
+  labels:
+    app: bitwarden
+stringData:
+    admintoken: '<removed>'
+    yubicoclientid: '<removed>'
+    yubicosecretkey: '<removed>'

services/DroneCI/deploy-DroneCI.yml

@@ -23,16 +23,6 @@ spec:
       app: drone
   template:
     metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-inject-secret-drone: "secret/drone"
-        vault.hashicorp.com/role: "drone"
-        vault.hashicorp.com/agent-inject-template-drone: |
-          {{ with secret "secret/drone" -}}
-            export DRONE_RPC_SECRET="{{ .Data.data.rpcsecret }}"
-            export DRONE_GITEA_CLIENT_ID="{{ .Data.data.giteaclientid }}"
-            export DRONE_GITEA_CLIENT_SECRET="{{ .Data.data.giteaclientsecret }}"
-          {{- end }}
       labels:
         app: drone
     spec:
@@ -40,7 +30,6 @@ spec:
       containers:
       - name: drone
         image: drone/drone:latest
-        command: ["sh", "-c", ". /vault/secrets/drone && /bin/drone-server"]
         env:
         - name: DRONE_SERVER_PROTO
           value: 'https'
@@ -52,8 +41,6 @@ spec:
           value: 'false'
         - name: DRONE_GITEA_SERVER
           value: 'https://code.spamasaurus.com'
-#        - name: DRONE_LOGS_DEBUG
-#          value: 'true'
         - name: DRONE_GIT_ALWAYS_AUTH
           value: 'false'
         - name: DRONE_AGENTS_ENABLED
@@ -62,6 +49,9 @@ spec:
           value: 'username:djpbessems,admin:true'
         - name: DRONE_TMATE_ENABLED
           value: 'false'
+        envFrom:
+        - secretRef:
+            name: drone-secret
         ports:
           - name: ui
             containerPort: 80
@@ -70,7 +60,6 @@ spec:
           name: flexvolsmb-drone-data
       - name: drone-runner
         image: drone/drone-runner-kube:latest
-        command: ["sh", "-c", ". /vault/secrets/drone && /bin/drone-runner-kube"]
         ports:
         - containerPort: 3000
         env:
@@ -82,6 +71,9 @@ spec:
           value: '2'
         - name: DRONE_RUNNER_MAX_PROCS
           value: '3'
+        envFrom:
+        - secretRef:
+            name: drone-secret
       volumes:
       - name: flexvolsmb-drone-data
         persistentVolumeClaim:

services/DroneCI/secret-DroneCI.yml.template

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: drone-secret
+  labels:
+    app: drone
+stringData:
+  DRONE_RPC_SECRET: '<removed>'
+  DRONE_GITEA_CLIENT_ID: '<removed>'
+  DRONE_GITEA_CLIENT_SECRET: '<removed>'

services/PVR/deploy-Plex.yml

@@ -43,6 +43,8 @@ spec:
         volumeMounts:
         - mountPath: /config
           name: longhorn-plex-config
+        - mountPath: /preroll
+          name: flexvolsmb-plex-preroll
         - mountPath: /data/series
           name: flexvolsmb-pvr-series
         - mountPath: /data/songs
@@ -55,6 +57,9 @@ spec:
       - name: longhorn-plex-config
         persistentVolumeClaim:
           claimName: longhorn-plex-config
+      - name: flexvolsmb-plex-preroll
+        persistentVolumeClaim:
+          claimName: flexvolsmb-plex-preroll
       - name: flexvolsmb-pvr-series
         persistentVolumeClaim:
           claimName: flexvolsmb-pvr-series
@@ -106,3 +111,36 @@ spec:
   resources:
     requests:
       storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: flexvolsmb-plex-preroll
+  namespace: pvr
+spec:
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  storageClassName: flexvolsmb-plex-preroll
+  flexVolume:
+    driver: mount/smb
+    secretRef:
+      name: smb-secret
+    options:
+      opts: domain=bessems.eu,file_mode=0777,dir_mode=0777,iocharset=utf8,cache=none
+      server: 192.168.11.225
+      share: /K3s.Volumes/plex/preroll
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: flexvolsmb-plex-preroll
+  namespace: pvr
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: flexvolsmb-plex-preroll
+  resources:
+    requests:
+      storage: 1Gi