secretを指定

kubernetes/apps/auth/base/back.deployment.yaml

@@ -22,6 +22,19 @@ spec:
           envFrom:
             - configMapRef:
                 name: auth-conf
+            - secretRef:
+                name: auth-secret
+          env:
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: default.auth.postgres-cluster.credentials.postgresql.acid.zalan.do
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: default.auth.postgres-cluster.credentials.postgresql.acid.zalan.do
+                  key: password
           livenessProbe:
             httpGet:
               path: /healthz

kubernetes/apps/auth/base/external-secret.yaml

@@ -0,0 +1,14 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: auth-secret
+spec:
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  refreshInterval: 1m
+  data:
+    - secretKey: SESSION_SECRET
+      remoteRef:
+        key: auth
+        property: SESSION_SECRET

kubernetes/apps/auth/base/kustomization.yaml

@@ -2,23 +2,24 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - back.deployment.yaml
+  - back.service.yaml
+  - external-secret.yaml
   - front.deployment.yaml
   - image-repository.yaml
-  - back.service.yaml
   - front.service.yaml
 configMapGenerator:
   - name: auth-conf
     literals:
-      - DB_USER=auth
       - DB_HOST=postgres-cluster.database.svc.cluster.local
       - DB_PORT=5432
-      - DB_NAME=auth
+      - DB_NAME=
       - DB_SSLMODE=disable
       - DB_DEBUG=false
       - SERVER_URL=
       - SERVER_PORT=8080
       - SERVER_ALLOW_ORIGINS=
       - API_LOGIN_URL=
       - API_APPROVE_URL=
+      - NEXT_PUBLIC_BACKEND_URL=
 configurations:
   - kustomizeconfig.yaml

kubernetes/apps/auth/base/kustomizeconfig.yaml

@@ -3,3 +3,9 @@ nameReference:
     fieldSpecs:
       - kind: ImagePolicy
         path: spec/imageRepositoryRef/name
+  - kind: ExternalSecret
+    fieldSpecs:
+      - kind: Deployment
+        path: spec/template/spec/containers/env/valueFrom/secretKeyRef/name
+      - kind: Deployment
+        path: spec/template/spec/containers/envFrom/secretRef/name

kubernetes/apps/auth/production/kustomization.yaml

@@ -20,6 +20,8 @@ configMapGenerator:
   - name: auth-conf
     behavior: merge
     literals:
+      - DB_NAME=auth
       - SERVER_URL=https://auth.piny940.com/api/v1
       - API_LOGIN_URL=https://auth.piny940.com/
       - API_APPROVE_URL=https://auth.piny940.com/approve
+      - NEXT_PUBLIC_BACKEND_URL=https://auth.piny940.com/api/v1

kubernetes/apps/auth/staging/ingress.yaml

@@ -2,6 +2,8 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: auth
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /$1
 spec:
   ingressClassName: nginx
   tls:
@@ -12,7 +14,7 @@ spec:
     - host: stg-auth.piny940.com
       http:
         paths:
-          - path: /api/v1
+          - path: /api/v1/(.*)
             pathType: Prefix
             backend:
               service:

kubernetes/apps/auth/staging/kustomization.yaml

@@ -21,6 +21,8 @@ configMapGenerator:
   - name: auth-conf
     behavior: merge
     literals:
+      - DB_NAME=auth_staging
       - SERVER_URL=https://stg-auth.piny940.com/api/v1
       - API_LOGIN_URL=https://stg-auth.piny940.com/
       - API_APPROVE_URL=https://stg-auth.piny940.com/approve
+      - NEXT_PUBLIC_BACKEND_URL=https://stg-auth.piny940.com/api/v1