29 lines
1.2 KiB
YAML
29 lines
1.2 KiB
YAML
# TEMPLATE ONLY — do NOT commit a real key. The real secret is created
|
|
# out-of-band and is deliberately excluded from kustomization.yaml so no key
|
|
# lands in git.
|
|
#
|
|
# Secret shape (m11p5 §4): `tidaldb-credentials` / key `TIDAL_API_KEY` — the
|
|
# stress/Ref-A lineage. The in-repo stress Jobs (tidal-stress/k8s/) are the
|
|
# exit-gate harness and already read this exact shape; the StatefulSet injects it
|
|
# as the `TIDAL_API_KEY` env var. EVERY pod and EVERY client uses the same key
|
|
# (forwarded requests pass the caller's Authorization verbatim).
|
|
#
|
|
# Create the real one (do not apply this file):
|
|
# kubectl -n tidaldb-cluster create secret generic tidaldb-credentials \
|
|
# --from-literal=TIDAL_API_KEY="$(openssl rand -hex 32)"
|
|
#
|
|
# In production manage it with External Secrets Operator / Sealed Secrets / Vault.
|
|
# If the key is empty the server runs UNAUTHENTICATED and logs a WARN — never do
|
|
# that on a shared network.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: tidaldb-credentials
|
|
namespace: tidaldb-cluster
|
|
labels:
|
|
app.kubernetes.io/name: tidaldb
|
|
app.kubernetes.io/part-of: tidaldb
|
|
type: Opaque
|
|
stringData:
|
|
TIDAL_API_KEY: "replace-me-do-not-commit"
|