External Secrets Operator

# เพิ่ม External Secrets Helm repository
helm repo add external-secrets https://charts.external-secrets.io
helm repo update

# ติดตั้ง External Secrets Operator
helm install external-secrets \
  external-secrets/external-secrets \
  -n external-secrets \
  --create-namespace \
  --wait

kubectl apply -f https://charts.external-secrets.io/latest/crds.yaml
kubectl apply -f https://charts.external-secrets.io/latest/rbac.yaml
kubectl apply -f https://charts.external-secrets.io/latest/chart.yaml

helm repo add bitnami https://charts.bitnami.com/bitnami

helm install external-secrets \
  bitnami/external-secrets \
  -n external-secrets \
  --create-namespace

# ติดตั้งจาก OperatorHub (Nov 2025 official support)

# 1. เข้า OpenShift Web Console
# 2. Navigate to Operators > OperatorHub
# 3. Search for "External Secrets"
# 4. clic Install External Secrets Operator
# 5. Select Namespace and clic Install

# หรือใช้ CLI
kubectl create namespace external-secrets
kubectl apply -f https://operatorhub.io/install/external-secrets.yaml

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
  namespace: default
spec:
  refreshInterval: "1h"
  secretStoreRef:
    name: vault-secretstore
    kind: SecretStore
  target:
    name: db-credentials
    creationPolicy: Owner
    template:
      type: Opaque
      data:
        db-password: "{{ .password | toString }}"
  data:
    - secretKey: username
      remoteRef:
        key: database
        property: username
    - secretKey: password
      remoteRef:
        key: database
        property: password

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: full-stack-secrets
  namespace: default
spec:
  refreshInterval: "30m"
  secretStoreRef:
    name: vault-secretstore
    kind: SecretStore
  target:
    name: full-stack-secrets
    creationPolicy: Owner
    template:
      type: Opaque
      data:
        connection-string: |
          mysql://{{ .username }}:{{ .password }}@db:3306/{{ .database }}
        app-config: |
          {
            "database_host": "db",
            "database_port": 3306,
            "database_name": "{{ .database }}"
          }
  dataFrom:
    - key: production/app

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: multi-backend-secrets
  namespace: default
spec:
  refreshInterval: "1h"
  target:
    name: multi-backend-secrets
    creationPolicy: Owner
  data:
    # From Vault
    - secretKey: api_key
      remoteRef:
        key: vault/api
        property: key
        secretStoreRef:
          name: vault-secretstore
          kind: SecretStore
    # From AWS
    - secretKey: db_password
      remoteRef:
        key: aws/db-credentials
        secretStoreRef:
          name: aws-secretstore
          kind: SecretStore

# ไม่ดี - มีสิทธิ์เกินจำเป็น
path "secret/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# ดี - มีสิทธิ์เฉพาะตามความจำเป็น
path "secret/data/app/database" {
  capabilities = ["read"]
}

path "secret/data/app/api" {
  capabilities = ["read"]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": [
        "arn:aws:secretsmanager:*:123456789012:secret:app/*"
      ]
    }
  ]
}

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: rotating-db-credentials
  namespace: default
spec:
  refreshInterval: "12h"  # ตรวจสอบทุก 12 ชั่วโมง
  secretStoreRef:
    name: vault-secretstore
    kind: SecretStore
  target:
    name: db-credentials-rotating
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: dynamic/db-creds
        property: username
    - secretKey: password
      remoteRef:
        key: dynamic/db-creds
        property: password

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-eso-to-vault
  namespace: external-secrets
spec:
  podSelector:
    matchLabels:
      app: external-secrets
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/8  # Private network only!
    ports:
    - protocol: TCP
      port: 8200
    - protocol: TCP
      port: 443

# Terraform example untuk enable vault audit
resource "vault_audit" "file" {
  type        = "file"
  description = "Audit logs"

  options = {
    file_path = "/vault/audit/logs"
  }
}

resource "vault_audit" "syslog" {
  type        = "syslog"
  description = "Syslog audit"

  options = {
    address   = "syslog.example.com:514"
    facility  = "LOCAL0"
    format    = "default"
  }
}