Update k8s manifests

2026-03-10 21:06:16 +08:00 · 2026-03-10 21:06:16 +08:00 · a21aa6d573
commit a21aa6d573
parent bd580b780d
6 changed files with 114 additions and 1 deletions
--- a/k8s/apps/vaultwarden/helmrelease.yaml
+++ b/k8s/apps/vaultwarden/helmrelease.yaml
@ -29,6 +29,19 @@ spec:
      signupsMatchEmail: true
      onlySSO: true
      enforceSSO: true
+    smtp:
+      existingSecret: vaultwarden-smtp-secret
+      host:
+        existingSecretKey: SMTP_HOST
+      port:
+        existingSecretKey: SMTP_PORT
+      from:
+        existingSecretKey: SMTP_FROM
+      username:
+        existingSecretKey: SMTP_USERNAME
+      password:
+        existingSecretKey: SMTP_PASSWORD
+      security: starttls
    ingress:
      enabled: true
      class: traefik
--- a/k8s/infrastructure/observability/kube-prometheus-stack.yaml
+++ b/k8s/infrastructure/observability/kube-prometheus-stack.yaml
@ -44,10 +44,15 @@ spec:
        existingSecret: grafana-admin-secret
        userKey: admin-user
        passwordKey: admin-password
-      envFromSecret: grafana-oidc-secret
+      envFromSecrets:
+        - grafana-oidc-secret
+        - grafana-smtp-secret
      grafana.ini:
        server:
          root_url: https://grafana.n0ball.tw
+        smtp:
+          enabled: true
+          from_name: Grafana Homelab
        auth:
          disable_login_form: true
        auth.generic_oauth:
--- a/k8s/infrastructure/sops/grafana-smtp-secret.yaml
+++ b/k8s/infrastructure/sops/grafana-smtp-secret.yaml
@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: grafana-smtp-secret
+    namespace: observability
+stringData:
+    GF_SMTP_HOST: ENC[AES256_GCM,data:pcMCTkBAVIOtYt4g+QwCWSwrlGov,iv:RsEI/u7pu36otzp4iylxX9kMIvvdTuZLgoLcDNeYIHk=,tag:jV8scVfJqzOiEYft8Pmy9g==,type:str]
+    GF_SMTP_USER: ENC[AES256_GCM,data:HO198RSQeA==,iv:lO4AF255RWANTBeruxnBZjjkZHrag+jK7s61Z+twq5U=,tag:u+Ng9BEwcyCInSm3FxQQfg==,type:str]
+    GF_SMTP_PASSWORD: ENC[AES256_GCM,data:KPvsEbNfH9wq6OylI+wYNw==,iv:JGe+bCmuirDK+FFitF4PSDZeZyjxXMZL3ATTXoHdVco=,tag:RedLh8ZbJcPT63vX15nxaw==,type:str]
+    GF_SMTP_FROM_ADDRESS: ENC[AES256_GCM,data:t0RUd5S1bA5fUz+zMEoyhdo=,iv:/u9Lm7NKx9Ud1uPmTaDax0I3xAK79QVwrge9nZTz2s4=,tag:fGi0ZvgBg33QvtaZ0jebaQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1y5rw08wm2s2hemapzf43c0l4xass7fhc55qh3n4cxtuxzrj8q3cqtydy7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NWVBanN0dWtRdWRuWkc3
+            Y1pjV2x4aHhtUS90Syt2UDd3WVFYZnBmTzNJCkZrRU96a2RINk9hNE9QOERJcjJn
+            b0x2RWlhWVJkY3lBQ1JVYlRXeUZjd28KLS0tIEN3d1lEemZBZFlKSHQ4MTI0V1Jx
+            LzBEMVU2Y28zeG02aXZVcVZUZVdhL28KdvVWj8RUoUh/FbJ4RvEaleObickamT/4
+            gLPSSWlsTm5c8j6NJ57gqA5Wx3RP6dmWiuR4qcSC21Qmn5av2ZyEuQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-10T13:00:16Z"
+    mac: ENC[AES256_GCM,data:CpxAK7sEYaQBygYi+UMfXw6U3U2dsBg6ttJZzyqljSF5fvBKGa59zRZ9KCUfOc0dhCtDLb8ZgJMyCJB7n03knMnd8AiaByWWUhkwewHe5x6OJQbX6FcwrdW+4fyYeUCThPTgOpVmdPQNuuObtTUMLLMmKD2ImckGUbiwfrkWzYc=,iv:GIojxu2imK2dAc5PZnw+KsYW0SLrwtBP2H6cDBJuAVQ=,tag:JtqmpJQussm6gzVvBi1JTA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
--- a/k8s/infrastructure/sops/kustomization.yaml
+++ b/k8s/infrastructure/sops/kustomization.yaml
@ -8,3 +8,6 @@ resources:
  - vaultwarden-db-secret.yaml
  - grafana-oidc-secret.yaml
  - vaultwarden-oidc-secret.yaml
+  - smtp-secret.yaml
+  - grafana-smtp-secret.yaml
+  - vaultwarden-smtp-secret.yaml
--- a/k8s/infrastructure/sops/smtp-secret.yaml
+++ b/k8s/infrastructure/sops/smtp-secret.yaml
@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: smtp-secret
+    namespace: keycloak
+stringData:
+    SMTP_HOST: ENC[AES256_GCM,data:UEwWSAWIz/naRLEiM9g8qQ==,iv:ZBSnYkYNVBFT1XoRKukyQpFMxcAG3mr3xvWo1jAD28c=,tag:KS8NKuzKTQYRwCNwDEVW9g==,type:str]
+    SMTP_PORT: ENC[AES256_GCM,data:o7gHuw==,iv:PdaGtPUTjMEpS4i/+07LueYqQnaCJrZ7TyYoRElDVp4=,tag:t4kgYepghKKG+oAXDCEecg==,type:str]
+    SMTP_USER: ENC[AES256_GCM,data:SnOdJ57L9g==,iv:cjjVQFPf7n1EBvHv25Z78RVxCZ9a2vzjUT5DCMQXfdY=,tag:u3734VYdskZhYMxOFEbkLw==,type:str]
+    SMTP_PASSWORD: ENC[AES256_GCM,data:VrGs3IT7qd50jglhbKJYiQ==,iv:gDqzuFnEkInQE4m9oJJtL68mQDVht+7S7FaOovX8zAY=,tag:1j2cVjkTcZ31zMBVPYxDaw==,type:str]
+    SMTP_FROM: ENC[AES256_GCM,data:d05nyEkSj4HzsHdxeEg4nAA=,iv:D/Ss9fWSEj404seTYLFdojRO3wHcJXk6A4d2ppDsoks=,tag:7ofdjjrV/yF9L2+GVFIjPQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1y5rw08wm2s2hemapzf43c0l4xass7fhc55qh3n4cxtuxzrj8q3cqtydy7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwcXBXNVR5bjRTMjAxYVAw
+            S0FuemUyb3BzN0laekNnQmEySGxvV3puKzA0CjV5Qm0zOVIxVkt2UWw4WkZWRXpI
+            dFJHYXlkZUdNQVJwOVVBa2NnTmxyOHMKLS0tIGdzRXFrUDN4TUx1ODZyTjNyVkRl
+            elBLRFZOcVZYclZHTEJDUjhOanJuL0EKrB2275gBAab0QfBmz1Pb0Om28LDP1KrX
+            tWD6cz9+Km+b51jkLYB1s2BkEozuuucK4mlNOMrg0jLstB83gZfhdA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-10T12:46:22Z"
+    mac: ENC[AES256_GCM,data:C+OfrN7tVE7NEytMSGSvO+QxgXb6yd0jPTEkN4zOMuRHkwlTCRCiYnDUMad7IM6nil/Mn4XWwefGTLjgDnkFApM186qbzpwKkJV9DHGu98ArgpND8PyLPpBGy1jDw6cP7hJH489cgWwtga6PgKACrcgGNsGPMC/Zf10tax71xqM=,iv:7v+R/xssKGJ/declxVYGzhWFKk09p9f5ZytS/Nae4pw=,tag:IZl8CWnkmecuOP7B6l6xNA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4
--- a/k8s/infrastructure/sops/vaultwarden-smtp-secret.yaml
+++ b/k8s/infrastructure/sops/vaultwarden-smtp-secret.yaml
@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: vaultwarden-smtp-secret
+    namespace: vaultwarden
+stringData:
+    SMTP_HOST: ENC[AES256_GCM,data:3W0K1w+12QaeXQ3ZKmfWcA==,iv:FAuCjO8nJhcXbYFAR+9/InvYrKbip8NBwyC50obAxcM=,tag:C+3ne2+NNgPrVtjPIgM8+Q==,type:str]
+    SMTP_PORT: ENC[AES256_GCM,data:hL5OSg==,iv:1u2LYguWXOzJdIaGkDVT/SERB6Gy+elplmOeUuyFs8k=,tag:gHm4EFw1yBCOidZuBgvThQ==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:ic0HgEgWpg==,iv:tbpfzmRzS1jNxEHTfK/t0s9JwUfRDHo+5AiMAUCQYQk=,tag:msollEvqME+TvWaDWccIbg==,type:str]
+    SMTP_PASSWORD: ENC[AES256_GCM,data:RqU2+cTBZVDupZ4d8FP1vw==,iv:YqaXzXeTcs+N13tfALJVUjrmVrd1SfSowpsuUSkTtJo=,tag:zFhVrGqLNimXOcDHgrCb3w==,type:str]
+    SMTP_FROM: ENC[AES256_GCM,data:xwcIFe/m1zg5EouSnmF2,iv:2CBFKRM7y47gOqZOC/yXv0GDu0kG2HH0VNMW2wvcbkk=,tag:jmzYXHt88yGn+jbUmYV1eA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1y5rw08wm2s2hemapzf43c0l4xass7fhc55qh3n4cxtuxzrj8q3cqtydy7m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMR0hDZXgycW9rME5mWE5U
+            NlF6L2Rra2ZyWnpITktVVFFUWEpNQ0oxYkQ0ClFpalpMWFJhdVV0RktsdDdHbTRJ
+            NGxvak9tc1lMRGNiZ0dUdUpXK1Z0TmcKLS0tIGhaL1RzRE9mNGRrZ3VRaEZwY0Va
+            OG16dzRrNDRtaHZ2T0NHazhNc3ZHc3MKvj+MZS6FDRcLSxVjvMBMVf79EF4+IpEF
+            t7ABQyuPeRhpcvR0F/xD0LiIwmP9fOrXupJwWoYI9yi/U6gd+dBEQQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-10T13:00:16Z"
+    mac: ENC[AES256_GCM,data:rtvXMau47oy1q4iKL7oRRqfVN8rjAHPXpB41gxlGmCJYWvrWixwhWVUw2a9CTH+boL18KuQvWrtTAKjAmcoSiBAX28YeL/aivu1BHcniV8PRuP3aQ5iEMDv75F1h9xW3ggD3mkyV3wKGJluc/IVsrxaIokmYGxXN/AnS6bg8G18=,iv:evLmbX6w3tWpAnx/FRw8NgzLo+ZzfUGaRHtc2oq0vhc=,tag:jDGBTgHreN1krG9dJvkzdA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.4