TazLab K8s Secrets Mapping

The cluster delivers secrets via Vault Secrets Operator (VSO) — 13 VaultStaticSecret resources (9 excluding the hindsight app) plus VaultPKISecret and VaultDynamicSecret resources under infrastructure/operators/vso/. Legacy External Secrets Operator (ESO) was removed entirely on 2026-08-27 (commit a96d732) — zero ExternalSecrets/ClusterSecretStore remain. All secrets originate from HashiCorp Vault (tazlab-secrets-vault). Infisical (tazlab-secrets) has been fully decommissioned.

All secrets stored under secret/data/tazlab-k8s/static/<domain>/<consumer>/<KEY> in Vault KV v2. Secrets are delivered exclusively via VSO (VaultStaticSecret, VaultDynamicSecret, VaultPKISecret).

K8s SecretNamespaceVault Path (relative to secret/data/)
cloudflare-api-tokencert-manager, cloudflare-ddnstazlab-k8s/static/infra/cloudflare-ddns/CLOUDFLARE_API_TOKEN
github-api-tokenflux-systemtazlab-k8s/static/infra/github/GITHUB_TOKEN
mnemosyne-mcp-secretstazlab-dbtazlab-k8s/static/apps/mnemosyne-mcp/GEMINI_API_KEY
dex-google-oauthdextazlab-k8s/static/auth/dex/merged (VSO dex-secrets-sync)
oauth2-proxy-dex-secretdextazlab-k8s/static/auth/oauth2-proxy/merged (VSO oauth2-proxy-dex-secret-sync)
oauth2-proxy-secretsauthtazlab-k8s/static/auth/oauth2-proxy/merged (VSO oauth2-proxy-secrets-sync)
s3-backrest-credstazlab-dbtazlab-k8s/static/storage/tazlab-db/AWS_*
grafana-dynamic-credsmonitoringVault database/creds/grafana (VSO VaultDynamicSecret grafana-db-creds)
tailscale-operator-oauthtailscalePre-provisioned by the Terraform engine layer (not Vault-delivered)

VaultPKISecret (mTLS Certificates)

Client and server certificates for PostgreSQL mTLS, provisioned by VSO from pki_int/:

VaultPKISecretNamespaceCommon Name (CN)Purpose
vault-pki-tlsvso-system*.tazlab.netWildcard TLS for ingress (auth, dex)
db-client-grafana-tlsmonitoringgrafanaGrafana → PostgreSQL client cert
db-client-mnemosyne-tlstazlab-dbmnemosyneMnemosyne → PostgreSQL client cert

Vault Secrets Operator (VSO)

VSO is the primary delivery mechanism for cluster secrets. The infrastructure/operators/vso/ directory defines:

  • 13 VaultStaticSecret resources (9 excluding the hindsight app) covering static secrets (API tokens, database backup credentials, OAuth client credentials — dex/oauth2 use consolidated */merged Vault paths)
  • VaultDynamicSecret resources for database credentials (e.g. grafana-db-creds for Grafana)
  • VaultPKISecret resources for TLS certificates (e.g., db-client-grafana-tls)
  • VaultAuth resources for per-namespace Kubernetes auth
  • VaultConnection pointing to the Vault cluster

The Flux DAG ensures VSO operators deploy before VSO secret resources: infrastructure-operators-vso → infrastructure-vso-secrets → infrastructure-tls. See Tailscale Vault Contract, Vault Entity, and the Flux DAG for details.

See Also