TazLab K8s: External Secrets Detail

Level 3 (Detail) — Historical record of the ESO era and its removal. All ExternalSecrets and the ClusterSecretStore were deleted on 2026-08-27 (commit a96d732); this page documents what existed and what replaced it.

Concept

Infisical was fully decommissioned first; HashiCorp Vault (tazlab-secrets-vault) became the only secret backend. Delivery then migrated in two waves: VSO (VaultStaticSecret/VaultPKISecret/VaultDynamicSecret) took over everything, and on 2026-08-27 the remaining ESO resources (4 ExternalSecrets + the ClusterSecretStore) were removed. Zero ExternalSecret resources remain in the repository — verified by grep across all manifests.

Current State: ESO Dormant

  • ESO HelmRelease still installed: infrastructure/operators/eso/helmrelease.yaml (ESO 0.10.3) remains deployed as part of the Flux DAG (infrastructure-operators-eso).
  • Zero CRs: no ExternalSecret and no ClusterSecretStore objects are defined anywhere in tazlab-k8s/. ESO is now truly dormant at the CR level — no resources reconcile through it.
  • All static secrets are delivered via VSO VaultStaticSecret under infrastructure/operators/vso/. See Secrets Mapping.

ClusterSecretStore (Historical)

The single store tazlab-secrets-vault (HashiCorp Vault, Hetzner) was removed with the migration. Stores were Flux-managed from tazlab-k8s/.

ExternalSecret Inventory (Historical — All Removed)

Vault path layout was secret/data/tazlab-k8s/static/<domain>/<consumer>/<KEY> (KV v2), remoteRef.property: value. Final 4 ExternalSecrets before removal:

cert-manager

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/vaultstaticsecret-cert-manager.yaml → Secret cloudflare-api-token).

tazlab-db (S3)

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/vaultstaticsecret-s3-backrest-creds.yaml).

GitHub (Flux Automation)

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/vaultstaticsecret-github-api-token.yaml).

OAuth2 Proxy

Files (deleted): infrastructure/auth/oauth2-proxy/externalsecret-oauth2-proxy-secrets.yaml, externalsecret-oauth2-proxy-dex-secret.yaml.

Output SecretNow delivered by
oauth2-proxy-secrets (auth)VSO VaultStaticSecret oauth2-proxy-secrets-sync (Vault tazlab-k8s/static/auth/oauth2-proxy/merged)
oauth2-proxy-dex-secret (dex)VSO VaultStaticSecret oauth2-proxy-dex-secret-sync (Vault tazlab-k8s/static/auth/oauth2-proxy/merged)

Dex

Files (deleted): infrastructure/configs/dex/externalsecret-dex-config-rendered.yaml, externalsecret-dex-google-oauth.yaml. The secrets dex-config-rendered and dex-google-secrets no longer exist at all — Dex config is a plain static ConfigMap and Google OAuth credentials arrive as Secret dex-google-oauth via VSO vaultstaticsecret-dex-secrets-sync (Vault tazlab-k8s/static/auth/dex/merged). See Dex + OAuth2 Detail.

Tailscale Operator

ExternalSecret removed earlier (pre-2026-07-16): the operator OAuth secret is pre-provisioned by the Terraform engine layer.

Grafana Bootstrap

ExternalSecret removed; Grafana now uses VaultDynamicSecret grafana-db-creds and the placeholder adminPassword: change-me. See Monitoring Detail.

DAG Position (Historical)

bridge (Level 1, created ClusterIssuer/IngressClass)
→ configs (Level 2, created all ExternalSecrets)      # configs no longer creates any secrets
→ instances/apps (Level 3, consume the resulting Kubernetes Secrets)

Secret delivery now flows through the infrastructure-vso-secrets Kustomization instead of infrastructure-configs.

Design Rules (Still Valid)

  1. Never add inline secret values to manifests — always reference Vault via VSO
  2. Use VSO VaultStaticSecret for static secrets, VaultDynamicSecret for database credentials, VaultPKISecret for PKI certificates
  3. Run tests/verify_manifest_purity.sh after any manifest change

See Also