TazLab K8s Secrets Mapping

The cluster delivers secrets via two mechanisms: Vault Secrets Operator (VSO) (primary, 8 VaultStaticSecret + VaultPKISecret resources under infrastructure/operators/vso/) and legacy External Secrets Operator (ESO) (dormant, a few ExternalSecret resources retained). All secrets originate from HashiCorp Vault (tazlab-secrets-vault). Infisical (tazlab-secrets) has been fully decommissioned.

All secrets stored under secret/data/tazlab-k8s/static/<domain>/<consumer>/<KEY> in Vault KV v2. remoteRef.property: value used for all entries. Secrets are delivered via VSO (VaultStaticSecret) or legacy ESO (ExternalSecret).

K8s SecretNamespaceVault Path (relative to secret/data/)
cloudflare-api-tokencert-manager, cloudflare-ddnstazlab-k8s/static/infra/cloudflare-ddns/CLOUDFLARE_API_TOKEN
github-api-tokenflux-systemtazlab-k8s/static/infra/github/GITHUB_TOKEN
mnemosyne-mcp-secretstazlab-dbtazlab-k8s/static/apps/mnemosyne-mcp/GEMINI_API_KEY
dex-google-secretsdextazlab-k8s/static/auth/dex/DEX_GOOGLE_*
dex-rendered-configdextazlab-k8s/static/auth/dex/DEX_GOOGLE_*
oauth2-proxy-secretsauthtazlab-k8s/static/auth/oauth2-proxy/OAUTH2_*
s3-backrest-credstazlab-dbtazlab-k8s/static/storage/tazlab-db/AWS_*
grafana-bootstrap-secretflux-systemtazlab-k8s/static/monitoring/grafana/GRAFANA_DB_PASSWORD
tailscale-operator-oauthtailscaletazlab-k8s/static/infra/tailscale/TAILSCALE_OPERATOR_*

VaultPKISecret (mTLS Certificates)

Client and server certificates for PostgreSQL mTLS, provisioned by VSO from pki_int/:

VaultPKISecretNamespaceCommon Name (CN)Purpose
vault-pki-tlsvso-system*.tazlab.netWildcard TLS for ingress (auth, dex)
db-client-grafana-tlsmonitoringgrafanaGrafana → PostgreSQL client cert
db-client-mnemosyne-tlstazlab-dbmnemosyneMnemosyne → PostgreSQL client cert

Vault Secrets Operator (VSO)

VSO is the primary delivery mechanism for cluster secrets. The infrastructure/operators/vso/ directory defines:

  • 8 VaultStaticSecret resources covering static secrets (API tokens, database credentials, OAuth configs)
  • VaultPKISecret resources for TLS certificates (e.g., db-client-grafana-tls)
  • VaultAuth resources for per-namespace Kubernetes auth (8 JWT auth roles on pki_int)
  • VaultConnection pointing to the Vault cluster

The Flux DAG ensures VSO operators deploy before VSO secret resources: infrastructure-operators-vso → infrastructure-vso-secrets → infrastructure-tls. See VSO Contract and Vault Entity for details.

See Also