External Secret使うようにしてみる

.editorconfig

@@ -5,5 +5,5 @@ charset = utf-8
 insert_final_newline = true
 end_of_line = lf
 
-[*.yml]
+[*.{yml,yaml}]
 indent_style = space

infra/k8s/helm/templates/jetdisc/configMap.yaml

@@ -5,3 +5,4 @@ metadata:
 data:
   BOT_NAME: {{ .Values.configMap.botName | quote }}
   STORE_DRIVER: {{ .Values.configMap.storeDriver | quote }}
+  SET_COMMANDS_TARGET_SERVERS: {{ .Values.configMap.setCommandsTargetServers }}

infra/k8s/helm/templates/jetdisc/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           envFrom:
             - secretRef:
-                name: jetdisc-secret
+                name: {{ .Values.externalSecrets.targetName }}
             - configMapRef:
                 name: jetdisc-configmap
           resources: {{- toYaml .Values.resources | nindent 12 }}

infra/k8s/helm/templates/jetdisc/externalsecret.yaml

@@ -0,0 +1,19 @@
+{{ if .Values.externalSecrets.enabled }}
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: jetdisc-external-secret
+spec:
+  refreshInterval: {{ .Values.externalSecrets.refreshInterval }}
+  secretStoreRef:
+    kind: {{ .Values.externalSecrets.secretStoreRef.kind }}
+    name: {{ .Values.externalSecrets.secretStoreRef.name }}
+    namespace: {{  .Values.externalSecrets.secretStoreRef.namespace }}
+  target:
+    name: {{ .Values.externalSecrets.targetName }}
+    creationPolicy: {{ .Values.externalSecrets.creationPolicy }}
+  data:
+    - secretKey: DISCORD_APP_TOKEN
+      remoteRef:
+        key: jetdisc_discord_app_token
+{{ end }}

infra/k8s/helm/values.yaml

@@ -8,11 +8,11 @@ image:
 
 secrets:
   discordAppToken: ""
-  setCommandsTargetServers: ""
 
 configMap:
   botName: ""
   storeDriver: "local"
+  setCommandsTargetServers: ""
 
 resources:
   limits:
@@ -21,3 +21,12 @@ resources:
   requests:
     cpu: 250m
     memory: 128Mi
+
+externalSecrets:
+  enabled: true
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: secretstore
+  targetName: jetdisc-secret
+  creationPolicy: Owner
+  refreshInterval: 1h