nordisk/holger

deploy/k8s/secret.yaml

# TLS material for holger, mounted at /etc/holger/tls and referenced from the
# RON config's `ron_tls`. In production prefer cert-manager (a Certificate
# resource writes this Secret for you) or sealed-secrets/SOPS over committing
# key material. `ca.crt` is only needed when enabling mTLS (client_ca).
apiVersion: v1
kind: Secret
metadata:
  name: holger-tls
  namespace: holger
type: kubernetes.io/tls
stringData:
  tls.crt: |
    -----BEGIN CERTIFICATE-----
    # server certificate chain (PEM)
    -----END CERTIFICATE-----
  tls.key: |
    -----BEGIN PRIVATE KEY-----
    # server private key (PEM)
    -----END PRIVATE KEY-----
  # ca.crt: |
  #   -----BEGIN CERTIFICATE-----
  #   # client-cert CA bundle for mTLS (PEM)
  #   -----END CERTIFICATE-----
---
# The operator's bearer token, mounted at /etc/holger/auth/token and named by the
# config's `auth` block (HOL-NCSC: Holger refuses a listener off loopback without an
# auth method). Replace the placeholder with a long random value.
apiVersion: v1
kind: Secret
metadata:
  name: holger-auth
  namespace: holger
type: Opaque
stringData:
  token: "replace-with-a-long-random-token-0123456789"