Fresh repo - removed all old commits

k3s/rpi/dev-stuff/vault/instruction.txt

@@ -0,0 +1,11 @@
+# Ref - https://developer.hashicorp.com/vault/docs/platform/k8s/helm
+
+# Add vault repo to Helm
+helm repo add hashicorp https://helm.releases.hashicorp.com
+
+# Get chart values and customize them
+helm show values hashicorp/vault > values.yaml
+
+# Install vault
+helm install vault hashicorp/vault --namespace dev-stuff --values values.yaml
+

k3s/rpi/dev-stuff/vault/pki/README.md

@@ -0,0 +1 @@
+This archive contains the Vault PKI config files encrypted with the previous SOPS key (it's on the Mac). WIP - need to decrypt them with the old key and encrypt them with the current one...

k3s/rpi/dev-stuff/vault/pki/dev/vault.pki.sops-issuer.yaml

@@ -0,0 +1,39 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+    name: vault-issuer
+    namespace: dev-stuff
+spec:
+    vault:
+        server: ENC[AES256_GCM,data:qViDrVjQCu+dKNOg7tZv13k+jGFu14TnVkNTVsy/myq0dw4LibB+k9N03nfUZJoGn7nmrmpr,iv:1n27H4eByzvu/iTcfxDvs1zHfIzIMX3pH4J9kEFIytE=,tag:OFuwt2NW+NdabzcirWoY5A==,type:str]
+        path: ENC[AES256_GCM,data:GG3VzW6pNqkbqUqYYEUf9/FO,iv:AyDI9/2zHebEjP8HxM5artmldxHm0L416SJlZYj7g7E=,tag:H7XenGLoz8pPbGB3OEIYAQ==,type:str]
+        auth:
+            kubernetes:
+                mountPath: ENC[AES256_GCM,data:98XGDNyNPDmufAmNcaVwyYWh/Q==,iv:mcwXpsLaNv/rDLnRbUy1y8PiGpp38RrAfbNmBF4ptEM=,tag:c/kFHao8rvfB5fQEo4UHJg==,type:str]
+                role: ENC[AES256_GCM,data:sHtsZBJwisv7nw==,iv:b7fxdvSmcrLtPVKHZ4KETqxg/GztiAVpMtlE1FNGjUg=,tag:RaHmojcYVfodpNdgUjMG2A==,type:str]
+                secretRef:
+                    name: ENC[AES256_GCM,data:9slTvF4HPC0ShhRUrd0z3w==,iv:kBIEmTq1lhv3MQDZeXbm+udfWuFcMen1PHtxEkkDkNU=,tag:m5kQoylrMgzxNyMa5Kt1sg==,type:str]
+                    key: ENC[AES256_GCM,data:J7s1lp0=,iv:Xfj74jIe/F6FNChpYsHMFxZ7z6JIlx0TrIH6oqEXtr0=,tag:ljhnuSIn7gXQmwW9o9PskA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-09-21T21:50:08Z"
+    mac: ENC[AES256_GCM,data:JtFDBC4AXs0ZR2vks82ucvO7ix4FCENmAQLyM5UlnpdVjiXdpsNlzPHMEmH+9TYfQ7SbOGlFkY2THYRBzDFvbG3bewWX4I3NgSQdG+77rwB43TL+0ODYlwNb+JC2Ki3aU37Or15NzSncDuRnD4zioMNnMLR4dxLD4Ynvomw/K1o=,iv:H2F31T5EED04D2UIzpp8TCKgKjCVaFxqWJyYvUYOBsk=,tag:I5hzm/+WfP2kVhXn+cp+iA==,type:str]
+    pgp:
+        - created_at: "2024-09-21T21:50:07Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DDn3iFPdf38cSAQdA5253cY3ohOfPT3LiepZnaFjF/s74WH0Vx57NooSq9Esw
+            xZeb0UVPVyQltfuVIljlloZna1pn6Kz2q4zLfSscM9L1sAsXLgPE9+Ss392U0VFH
+            1GgBCQIQhn0aHm8V1ffB4Xqxl/8/ZCRKZGaqiaPoaOcbcDwVkEhPZCUwSyAjYfYU
+            7J6t8/BMcGhT7/HDO0DPvPIFvj0O5KjDpV7IRhRB3fhrMTxrhJjFb0wL9gkGPUOD
+            V4J8brqPtqe98g==
+            =DWeq
+            -----END PGP MESSAGE-----
+          fp: 8BABE93B3C84CC99514E1FFD5F374229A7875770
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.0

k3s/rpi/dev-stuff/vault/pki/dev/vault.pki.sops-secret.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: issuer-token-dev
+    namespace: dev-stuff
+    annotations:
+        kubernetes.io/service-account.name: dev-issuer
+type: kubernetes.io/service-account-token
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-09-21T21:49:41Z"
+    mac: ENC[AES256_GCM,data:u5QdLfhK3Xr5QZ0Oc2DeunegEIinhryXvamWbau0DFwkNxh1lDR4fg2zMWXN9cMdEqI30pT8Ss6e7FKW5RJ8Vd2p+vc7mZk9Y4wkz2tPGnj+aogMXfdXOQCyeimDEr1GiOCQhSIgMafAcDkCq5rjFBO/vKIPtFFBrEgnZDc0KYw=,iv:avmXzBpepBn81HLeGZcdxSt7EtNiGmyg7koMCoEgNSc=,tag:VE33HYiylylNc3Fg0/KeEw==,type:str]
+    pgp:
+        - created_at: "2024-09-21T21:49:41Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DDn3iFPdf38cSAQdAaLDmTqNWv2hQ6oVR1+hZcdwA5Jnq8JoAOU3QQYH+2DMw
+            HIdaULnl41HcyDEpIIs0YYxPq0IGoaZPTWWhSfRapNwCmF2wd+40Fr9333IhY6bg
+            1GYBCQIQ+fqmC/vXCm86jR2FafDs+aQw7diVDLQOWEW3PlW4joFCGadWvGksOduG
+            NqOQpm5ZNP+F5quQHBO/eccfaEapLiEgr8kdR4+fv0WKF3d3rrlIGQZEfZGLl+v8
+            f/FtUp+DS7I=
+            =NWBy
+            -----END PGP MESSAGE-----
+          fp: 8BABE93B3C84CC99514E1FFD5F374229A7875770
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.0

k3s/rpi/dev-stuff/vault/pki/home/vault.pki.sops-issuer.yaml

@@ -0,0 +1,39 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+    name: vault-issuer
+    namespace: home-stuff
+spec:
+    vault:
+        server: ENC[AES256_GCM,data:phlIfcixd+0J1k3Zgk9hTRB+bhi5lhcYR02M8CsSAdGvrd+ADneiNaR7epN4V34Mhk20Eg/f,iv:GafkQCKMrr5SWycoshMSKWkh/K1dlJQrEyZ/M1ufltw=,tag:++oFEPXLLdMBRQWNMGOXtw==,type:str]
+        path: ENC[AES256_GCM,data:GaANkuvBioQhPxLH3BdgLIN35w==,iv:/vPgwtGXOXqCIRHbtkShwnii7GRdp9cp1hLZufwcuqI=,tag:7KV3px7yeu5eZBL18SKwTw==,type:str]
+        auth:
+            kubernetes:
+                mountPath: ENC[AES256_GCM,data:ZHrRPjeS2O/NxufCcIf56JessQ==,iv:ugfuAhO84cs1n9Pq5N4L4qgME5GRhBkfXkNPVLKsV5U=,tag:nsm+RZ6gTXA7Hmrfjwh2gA==,type:str]
+                role: ENC[AES256_GCM,data:7yj55vwBU32y00U=,iv:5F285Fsnk5WlHUI8Ip9Zy5b36b77P12wRDBGChIR4Z0=,tag:bxPP0oON8efo6Dw4l3lVOA==,type:str]
+                secretRef:
+                    name: ENC[AES256_GCM,data:z7EstY+w8ieSBql+ofooOwQ=,iv:SjDipthrpXvVtEDiJN/vjemJKS2MmXfmyDTAZDhym+4=,tag:xLrlWdD60T66D4YVZGf/gQ==,type:str]
+                    key: ENC[AES256_GCM,data:S2r55HM=,iv:rbU/Vs8xvmnMs2uP+iCyEQe8jEnw6DA2Gz5mksFODXQ=,tag:hagxdLuLmM+ufFbFpzLJDg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-09-21T21:52:03Z"
+    mac: ENC[AES256_GCM,data:Scrg3nrfpeAwK2yEWGWg8Zmg7eDRYA8rZH2voyQHJNvH8DJKTxaWus8CgZPIJi+ypJqxYfMueWPC2ZIsHJHOwrMiGNoL++Z4t1BNpCMaF8oytYPYZBTrrmN8egMPBSqqwkfHyDY9cCBxQRLJsBV3Kt2HbjJMHp6TPeJJG63Fm1M=,iv:+cjJtEaTGOM0VamDPfvmQlQPlDljtkotP+iS8uOILyY=,tag:qPGF8YJR1vr4UMZsRysj5Q==,type:str]
+    pgp:
+        - created_at: "2024-09-21T21:52:02Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DDn3iFPdf38cSAQdAVmmNCiR5E08s5f/rc0UCeP2DrpLykFBCpv6ziUZGKhAw
+            ha22WXMkOuPBPYDOv8FkNKn2cRQ5MgO1BZ8nz1zBvHP5wj+dZRyvGfkHa/WIMf5s
+            1GgBCQIQbcxwAvGAXPyIXbcdrQ7esrqdMMxxrnQHp0G0jhJiMuOAc/WNqLxzPhMb
+            e18+81L26IWzau5Zyvx89nOmGk8OVJpcSV02iHoOj9Oa/kuVq26ND4uDLYMxt7RE
+            2tVpZapBMay9tQ==
+            =9AwU
+            -----END PGP MESSAGE-----
+          fp: 8BABE93B3C84CC99514E1FFD5F374229A7875770
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.0

k3s/rpi/dev-stuff/vault/pki/home/vault.pki.sops-secret.yaml

@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: issuer-token-home
+    namespace: home-stuff
+    annotations:
+        kubernetes.io/service-account.name: home-issuer
+type: kubernetes.io/service-account-token
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2024-09-21T21:51:49Z"
+    mac: ENC[AES256_GCM,data:ekalRb4H8EZB+CD/1ux0KDCnOMAAdMcrwabVTyR9/xa8kBnfCQGhCj1TJmXnlwjLP8ppJxN5Zwd8wvd9+A2N+c5SX9YfmKxa/Efl207rjWcZYYx74hNTKpulKmaX7llnkwWc8826YffmSA3ecfWzCDTqCqk1nm3QtGj0QED3Cu0=,iv:e44jQb/6jz4XG0FOSobFSZKDBVUWtkbcXRU8aIgk9FM=,tag:9DGw+q5fw8BqFtVoHUK69g==,type:str]
+    pgp:
+        - created_at: "2024-09-21T21:51:49Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DDn3iFPdf38cSAQdA34cxt3wfSYxfk2B0sel6xeahw3edFLMX32A0UG26nlgw
+            NEWIX8oBzR05zIADSxYj9vDTm1H8r85TQJvYPEa2C/qJOEsZxhM2n4wcME4q+Yo9
+            1GgBCQIQxksYSUPIAQXCU6+VkMyrCdrkC7QpgFkomSbYisC5sMCU5KsAMTkO3uMi
+            7W2eslgexFXlHVBMetBBuPlOzAS1JaocMdwYuHtIkNs6x7Ay2T/73lzM5dsLhzyA
+            X5cqtauiCBW26A==
+            =KAo2
+            -----END PGP MESSAGE-----
+          fp: 8BABE93B3C84CC99514E1FFD5F374229A7875770
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.0