use openshift/kubernetes secrets for storing keys (don't forget to ba…

…se64 encode the values!)
willemvd · Dec 19, 2016 · dcfb3da · dcfb3da
1 parent 21286b7
commit dcfb3da
Showing 1 changed file with 39 additions and 6 deletions.
diff --git a/openshift-postgresql-s3-backup-scheduledJob.yaml b/openshift-postgresql-s3-backup-scheduledJob.yaml
@@ -1,6 +1,21 @@
 apiVersion: v1
 kind: List
 items:
+- apiVersion: "v1"
+  kind: "Secret"
+  metadata:
+    name: "aws-s3-secret"
+  data:
+    # don't forget to base64 encode your values
+    aws-access-key-id: ""
+    aws-secret-access-key: ""
+- apiVersion: "v1"
+  kind: "Secret"
+  metadata:
+    name: "openssl-encryption-secret"
+  data:
+    # don't forget to base64 encode your values
+    encryption-pass-phrase: ""
 - apiVersion: batch/v2alpha1
   kind: ScheduledJob
   metadata:
@@ -29,13 +44,22 @@ items:
               - name: PGPASSWORD
                 value:
               - name: ENCRYPTION_PASS_PHRASE
-                value:
+                valueFrom:
+                  secretKeyRef:
+                    name: openssl-encryption-secret
+                    key: encryption-pass-phrase
               - name: OPENSSL_CIPHER_TYPE
                 value: aes-256-cbc
               - name: AWS_ACCESS_KEY_ID
-                value:
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-s3-secret
+                    key: aws-access-key-id
               - name: AWS_SECRET_ACCESS_KEY
-                value:
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-s3-secret
+                    key: aws-secret-access-key
               - name: AWS_DEFAULT_REGION
                 value:
               - name: S3_BUCKET_NAME
@@ -71,13 +95,22 @@ items:
               - name: PGPASSWORD
                 value:
               - name: ENCRYPTION_PASS_PHRASE
-                value:
+                valueFrom:
+                  secretKeyRef:
+                    name: openssl-encryption-secret
+                    key: encryption-pass-phrase
               - name: OPENSSL_CIPHER_TYPE
                 value: aes-256-cbc
               - name: AWS_ACCESS_KEY_ID
-                value:
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-s3-secret
+                    key: aws-access-key-id
               - name: AWS_SECRET_ACCESS_KEY
-                value:
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-s3-secret
+                    key: aws-secret-access-key
               - name: AWS_DEFAULT_REGION
                 value:
               - name: S3_BUCKET_NAME