Files
homeprod/kubernetes/infrastructure/cert-manager-issuer/ovh-credentials-secret.yaml

51 lines
2.8 KiB
YAML

# OVH API Credentials for DNS-01 Challenges
#
# OVH API credentials with the following permissions:
# - GET, POST, PUT, DELETE on /domain/zone/*
#
# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager),
# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace
# to the webhook's own namespace, and the webhook looks up credential secrets
# there (see ch.ResourceNamespace in the webhook's ovhClient() function).
#
# SOPS will encrypt the stringData fields on pre-commit.
apiVersion: v1
kind: Secret
metadata:
name: ovh-credentials
namespace: cert-manager
labels:
app.kubernetes.io/name: cert-manager-webhook-ovh
app.kubernetes.io/component: ovh-credentials
type: Opaque
stringData:
applicationKey: ENC[AES256_GCM,data:qOGxuFHguxe7e7pVfd1eiw==,iv:CC5CMc+VTL8aW4injRN2GxQvWf4nobGuQYhuUytHDfQ=,tag:3l8srdCgAtnz/fWqn+VrdA==,type:str]
applicationSecret: ENC[AES256_GCM,data:tvj/Km80zHBLA+gLqjCA0wKh9y/+g20O+kE2zZzEDVM=,iv:SKfeoThkwFbNGjNdQQByqAk/+dbyCLyzft1eXVh3a3o=,tag:qHoR2ZqEkfulKzdE/GvZrw==,type:str]
consumerKey: ENC[AES256_GCM,data:gGTsvDEy0DZvTiHP2mdghBrDbwE5hmkNDJtDf4CJEPc=,iv:EgvG8TmZuY4hWs3YD4y9zpJv/Ndu5tnGLs+hIMWvZU4=,tag:R4tSbVvJjkyXe/N93CRSSw==,type:str]
sops:
lastmodified: "2026-08-26T19:28:03Z"
mac: ENC[AES256_GCM,data:xNUZ8stxMx7Y2ggmjBaF5FX0NtC18JJcaDgU52V4b+pnG72t8+P83DkYY3Xr6gWJfmS9wFNs3vZ8TJ+nvVP0C62zoN9cmC0BolJrTOyQ2rpoUu/0Xj+Tbfiwnmbm76yZ+SdQJLYg3n7fNG/g6fh88/BUERi0NAVil228ExFFliE=,iv:2Nu2LaqVYqM5WchoPqoHkCJcXypGHskDjLHFYRC4eTk=,tag:2H9FSAQ3UNGSxSx3WhUD1Q==,type:str]
pgp:
- created_at: "2026-08-26T19:28:03Z"
enc: |-
-----BEGIN PGP MESSAGE-----
hQIMA7uy4qQr71wiAQ//XxGw3gzr7UtuMakZqWGp6uZ5mZ42KscvHpQCZchh0wZb
01Dq6HLl6EMwu+fpnfkOU05SxozkaKvLw+xzTX4TExbfE3GBTjpJ5R4e/aj5B24M
iw32oy+y2jCIzMS0PKxIkhIJrClv5hRSZt5dVDzln5sOapXapE5iLpM/glerIwXk
i4EfntjzNhOUFCbwnH2F/s1ZKmwZWw88GNff26aAIDOhNiEyB7kz0s6Gr575cKvw
CdZrHDtfl7ZoP4JiozNXzXF65+YnIiG5kli1A0GVF/9XUeqgXTUHYJKvdGcHFAqs
NysLbdsoppDJUUpqWvU1gS0X6PifZWkd3Sv0LDaoV7TIa8UWHZMbyV9W/1NiGSjt
VVBO+ezQgpSFbEVixz1WEDyD9MPBAvWq+PS2QQcUc0aep8xRqoWAe1pojjs2k0DJ
2vcFkWmdj0RVngNvw3rBAxrYY8DtqrNOjc0B9s+2ZqIN9TT+9IWaS65Xh0wRMZoy
Ntxr7oyG3wicA8YFRH3WxLJiTqOOeYYgc+Qltds7fb79hJScdXNxbC8mFjo9zOUV
bnHSQrjj/Se6tzSpZt7yF/+3aBTAUsOfOXHO1md/ydjCBpO6eUYU+T6m+buIJ6F8
M7kov+/x5on8k9dcNjkwdVuOztIuIXGUaJ41idrGKOSvtAjW0CGO3VU67e76NwnS
XgGVAwNds2Bfs8mQfmKdhvCrJnPxqtN29z5fguTMGTPqMncsx62mhdwI6tgAgEdD
qEX+tRkjpgoa8yO3gkvu7J3+oQ2HQ5mOZaSyl/Xz4ALP4+MOEHEiMNWcDmotq/Q=
=BT71
-----END PGP MESSAGE-----
fp: DC6910268E657FF70BA7EC289974494E76938DDC
encrypted_regex: ^(data|stringData|.*key|.*crt)$
version: 3.10.2