TazLab K8s: External Secrets Detail

Level 3 (Detail) — ESO configuration, ClusterSecretStore, and all ExternalSecret manifests.

Concept

Infisical has been fully decommissioned. Only tazlab-secrets-vault (HashiCorp Vault) remains as the ClusterSecretStore backend.

ClusterSecretStore

Single store:

StoreBackendStatusManaged by
tazlab-secrets-vaultHashiCorp Vault (Hetzner)✅ PrimaryFlux (GitOps, tazlab-k8s/)

ExternalSecret Inventory

All secrets stored at secret/data/tazlab-k8s/static/<domain>/<consumer>/<KEY> in Vault KV v2. remoteRef.property: value on all entries. 4 ExternalSecrets remaining (most secrets migrated to VSO VaultStaticSecrets).

cert-manager

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/vaultstaticsecret-cert-manager.yaml).

tazlab-db (S3)

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/vaultstaticsecret-s3-backrest-creds.yaml).

GitHub (Flux Automation)

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/vaultstaticsecret-github-api-token.yaml).

OAuth2 Proxy

Files: infrastructure/auth/oauth2-proxy/externalsecret-oauth2-proxy-secrets.yaml, infrastructure/auth/oauth2-proxy/externalsecret-oauth2-proxy-dex-secret.yaml

Output SecretNamespaceKeysVault Path
oauth2-proxy-secretsauthOAUTH2_PROXY_CLIENT_SECRET, OAUTH2_PROXY_COOKIE_SECRETtazlab-k8s/static/auth/oauth2-proxy/OAUTH2_*
oauth2-proxy-dex-secretdexOAUTH2_PROXY_CLIENT_SECRETtazlab-k8s/static/auth/oauth2-proxy/OAUTH2_PROXY_CLIENT_SECRET

Dex

Files: infrastructure/configs/dex/externalsecret-dex-config-rendered.yaml, infrastructure/configs/dex/externalsecret-dex-google-oauth.yaml

Dex uses two ExternalSecrets: dex-config-rendered (templated ConfigMap with OIDC credentials from Vault) and dex-google-oauth (Google OAuth client credentials).

Tailscale Operator

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/).

Grafana Bootstrap

Migrated to VSO VaultStaticSecret (infrastructure/operators/vso/).

Refresh Policy

  • s3-backrest-creds: 24h (VaultStaticSecret, no longer ExternalSecret; S3 credentials change rarely)
  • cluster-vars ConfigMap: static, provisioned once by ephemeral-castle

DAG Position

bridge (Level 1, creates ClusterIssuer/IngressClass)
→ configs (Level 2, creates all ExternalSecrets)
→ instances/apps (Level 3, consume the resulting Kubernetes Secrets)

Design Rules

  1. Never add inline secret values to manifests — always use ExternalSecret
  2. Each ExternalSecret should have creationPolicy: Owner unless explicitly sharing across namespaces
  3. Use template for format conversion (e.g., s3.conf generation)
  4. Run tests/verify_manifest_purity.sh after any manifest change

Future Direction

Vault Secrets Operator (VSO) has been active since 2026-06-01, handling all new static secrets via VaultStaticSecret resources and PKI certificates via VaultPKISecret. ESO remains dormant with only 4 ExternalSecrets retained for Dex and OAuth2 Proxy. Vault Agent Injector (VAI) has been removed.

See Also