chore(k8s): unify secrets template into one k8s/secrets.example.yaml

Replace the single-secret towerops-llm template with one
multi-document YAML covering every Secret the Deployment references:
towerops-secrets, towerops-db, towerops-aws, towerops-redis,
towerops-billing, towerops-llm.

Workflow: copy k8s/secrets.example.yaml to k8s/secrets.yaml (which is
gitignored), fill in real values, kubectl apply. Real values never land
in git.
This commit is contained in:
Graham McIntire 2026-05-09 18:01:09 -05:00
parent b6513ec301
commit 32c9575952
4 changed files with 106 additions and 35 deletions

2
.gitignore vendored
View file

@ -99,7 +99,7 @@ profiles.json
# Stride API credentials (contains secrets - never commit)
.stride_auth.md
# Local k8s secret manifest — copy from any *.example.yaml in k8s/, fill in
# Local k8s secret manifest — copy from k8s/secrets.example.yaml, fill in
# real values, then `kubectl apply -f k8s/secrets.yaml`. Never commit.
k8s/secrets.yaml

View file

@ -13,22 +13,27 @@ Required secrets in the `towerops` namespace:
Optional secrets:
- `towerops-llm` - DeepSeek API credentials for LLM-powered insight enrichment.
Optional — when missing, insights still display without an AI summary.
- `towerops-billing` - Stripe credentials. Every key is optional in the deployment.
### Local secrets workflow
The file `k8s/secrets.yaml` is gitignored. Use it to keep one-or-more
`Secret` manifests with real values for hand-application against the
cluster. Bootstrap from any `*.example.yaml` template:
`k8s/secrets.yaml` is gitignored. Use it to keep every `Secret` manifest
the deployment needs in one place for hand-application against the
cluster. Bootstrap from the unified template:
```bash
cp k8s/towerops-llm-secret.example.yaml k8s/secrets.yaml
# edit k8s/secrets.yaml — fill in DEEPSEEK_API_KEY, etc.
cp k8s/secrets.example.yaml k8s/secrets.yaml
# edit k8s/secrets.yaml — fill in DATABASE_URL, AWS keys, RELEASE_COOKIE,
# SECRET_KEY_BASE, CLOAK_KEY, and any optional ones (DEEPSEEK_API_KEY,
# Stripe keys, etc.)
kubectl apply -f k8s/secrets.yaml
kubectl rollout restart deployment/towerops -n towerops
```
`k8s/secrets.yaml` may contain multiple `---`-separated documents if you
need more than one secret. It is excluded from git via `.gitignore`.
`k8s/secrets.yaml` is one multi-document YAML covering every Secret the
deployment references (towerops-secrets, towerops-db, towerops-aws,
towerops-redis, towerops-billing, towerops-llm). It is excluded from git
via `.gitignore` so real values never accidentally land in source.
For local development, the project root `.envrc` is used by direnv.

93
k8s/secrets.example.yaml Normal file
View file

@ -0,0 +1,93 @@
# Unified template for every Kubernetes Secret the towerops Deployment
# references. Bootstrap your local copy:
#
# cp k8s/secrets.example.yaml k8s/secrets.yaml
# # edit k8s/secrets.yaml — fill in real values
# kubectl apply -f k8s/secrets.yaml
# kubectl rollout restart deployment/towerops -n towerops
#
# k8s/secrets.yaml is gitignored — never commit real secrets. Real
# values live in 1Password.
#
# Secret-by-secret:
# * towerops-secrets — application secrets (REQUIRED)
# * towerops-db — Postgres connection (REQUIRED, envFrom)
# * towerops-aws — AWS credentials (REQUIRED, envFrom)
# * towerops-redis — Redis connection (REQUIRED, envFrom)
# * towerops-billing — Stripe (optional)
# * towerops-llm — DeepSeek API key for insight enrichment (optional)
# * gitlab-registry — Docker registry creds (image pull, separate workflow)
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-secrets
namespace: towerops
type: Opaque
stringData:
# Generate with: openssl rand -base64 32
RELEASE_COOKIE: ""
# Generate with: mix phx.gen.secret (or openssl rand -base64 64)
SECRET_KEY_BASE: ""
# Generate with: openssl rand -base64 32
# CRITICAL: losing this makes encrypted columns unrecoverable.
CLOAK_KEY: ""
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-db
namespace: towerops
type: Opaque
stringData:
# Full ecto:// URL — used envFrom in the deployment.
DATABASE_URL: "ecto://USER:PASSWORD@HOST:5432/DATABASE"
# Optional pool tuning (defaults applied in runtime.exs if unset)
POOL_SIZE: ""
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-aws
namespace: towerops
type: Opaque
stringData:
AWS_ACCESS_KEY_ID: ""
AWS_SECRET_ACCESS_KEY: ""
AWS_REGION: ""
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-redis
namespace: towerops
type: Opaque
stringData:
# envFrom block injects whatever keys exist here.
REDIS_URL: "redis://HOST:6379/0"
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-billing
namespace: towerops
type: Opaque
stringData:
# Stripe — every key is optional; the deployment marks them optional: true.
STRIPE_SECRET_KEY: ""
STRIPE_WEBHOOK_SECRET: ""
STRIPE_PRICE_ID: ""
STRIPE_METER_ID: ""
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-llm
namespace: towerops
type: Opaque
stringData:
# DeepSeek API key — get one at https://platform.deepseek.com/
# Without this, insight LLM enrichment stays no-op (insights still render).
DEEPSEEK_API_KEY: ""
# Optional: override the default model (default: deepseek-v4-pro).
DEEPSEEK_MODEL: ""

View file

@ -1,27 +0,0 @@
# Template for the towerops-llm secret. Apply with values filled in:
#
# kubectl create secret generic towerops-llm \
# --from-literal=DEEPSEEK_API_KEY="<your-deepseek-key>" \
# --from-literal=DEEPSEEK_MODEL="deepseek-v4-pro" \
# -n towerops
#
# Or apply this file directly after replacing the placeholder strings with
# your real values, then run: kubectl apply -f k8s/towerops-llm-secret.example.yaml
#
# This file is committed as a placeholder — DO NOT put real keys in here.
# Real values live in 1Password and are created in the cluster manually.
#
# The deployment references this secret with `optional: true`, so the app
# will start fine without it (LLM enrichment just stays no-op).
---
apiVersion: v1
kind: Secret
metadata:
name: towerops-llm
namespace: towerops
type: Opaque
stringData:
# DeepSeek API key — get one at https://platform.deepseek.com/
DEEPSEEK_API_KEY: ""
# Optional: override the default model (default: deepseek-v4-pro)
DEEPSEEK_MODEL: ""