feat: authelia use external secrets from vault

helm/authelia/values.yaml

@@ -11,7 +11,7 @@ configMap:
   identity_validation:
     reset_password:
       secret:
-        value: f86cac59ff096d5dba433b5242eef1c409421165fe3ad7414827f71382ad0e84
+        path: /secrets/authelia-secrets/AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE
   notifier:
     disable_startup_check: true
     filesystem:
@@ -23,20 +23,20 @@ configMap:
       domain: uzbutterfly.com
       subdomain: auth
     encryption_key:
-      value: 03e75899a8f009bb3c1877c63a864f37f7e38fed0fabd599eb871d259ac86148
+      path: /secrets/authelia-secrets/AUTHELIA_SESSION_SECRET_FILE
     redis:
       enabled: true
       host: authelia-redis-master
       port: 6379
   storage:
     encryption_key:
-      value: 0b1bbffd77ba566e6441dcb848d6b25a165443d339d356482f86b6dcedc39c79
+      path: /secrets/authelia-secrets/AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
     postgres:
       address: tcp://authelia-postgres-postgresql:5432
       database: authelia
       enabled: true
       password:
-        value: authelia_pg_pass
+        path: /secrets/authelia-secrets/AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
       username: authelia
   theme: dark
   totp:
@@ -57,3 +57,13 @@ secret:
       items:
       - key: users.yml
         path: users.yml
+    authelia-secrets:
+      items:
+      - key: AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE
+        path: AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE
+      - key: AUTHELIA_SESSION_SECRET_FILE
+        path: AUTHELIA_SESSION_SECRET_FILE
+      - key: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
+        path: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
+      - key: AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
+        path: AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE

k8s/external-secrets/authelia.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: authelia-secret
+  namespace: authelia
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: authelia-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE
+      remoteRef:
+        key: secret/authelia
+        property: resetPasswordSecret
+    - secretKey: AUTHELIA_SESSION_SECRET_FILE
+      remoteRef:
+        key: secret/authelia
+        property: sessionEncryptionKey
+    - secretKey: AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE
+      remoteRef:
+        key: secret/authelia
+        property: storageEncryptionKey
+    - secretKey: AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE
+      remoteRef:
+        key: secret/authelia
+        property: postgresPassword