mirror of
https://github.com/stackblitz-labs/bolt.diy
synced 2025-06-26 18:26:38 +00:00
db9a2c9292
- Add ExternalSecret for auth secrets (SESSION_SECRET, GitHub OAuth) via AWS Secrets Manager - Separate user-configurable provider API keys into dedicated K8s Secret - Update deployment to use three-layer configuration model: * ConfigMap: non-sensitive public settings * ExternalSecret → Secret: infrastructure auth secrets from AWS * Secret: user-configurable provider API keys managed via UI - Add comprehensive documentation for AWS Secrets Manager setup - Include K8s deployment architecture guide with troubleshooting commands - Enable secure, auditable, and rotatable secrets management for production This follows enterprise security best practices with proper separation of concerns between infrastructure and user secrets.
32 lines
1.0 KiB
YAML
32 lines
1.0 KiB
YAML
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: buildify-auth-secrets
|
|
namespace: buildify
|
|
annotations:
|
|
description: "Authentication secrets for Buildify application"
|
|
owner: "DevOps Team"
|
|
lastRotated: "2025-05-31" # Update this when secrets are rotated
|
|
spec:
|
|
refreshInterval: "1h" # Check for updates every hour
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: aws-secretsmanager
|
|
target:
|
|
name: buildify-auth-secrets # K8s Secret that will be created
|
|
creationPolicy: Owner
|
|
data:
|
|
# Map each key from AWS Secrets Manager to the corresponding key in the K8s Secret
|
|
- secretKey: SESSION_SECRET
|
|
remoteRef:
|
|
key: buildify/auth # AWS Secrets Manager secret name
|
|
property: SESSION_SECRET # JSON property in the secret
|
|
- secretKey: GITHUB_CLIENT_ID
|
|
remoteRef:
|
|
key: buildify/auth
|
|
property: GITHUB_CLIENT_ID
|
|
- secretKey: GITHUB_CLIENT_SECRET
|
|
remoteRef:
|
|
key: buildify/auth
|
|
property: GITHUB_CLIENT_SECRET
|