Secrets 一元管理チャート secret-manager v0.1.0 を実装

クラスター横断で使う認証情報を1チャートで管理し、複数ネームスペースへ同一 Secret として配布する仕組みを実装。 - distribution: namespaces への複製 / kubernetes-reflector 自動同期 / stakater-Reloader 連携を選択可能 - common: namePrefix・共通ラベル/アノテーション・immutable - mail.providers: SMTP/IMAP/POP3 のサーバ情報 + パスワードを一元管理。 source 可能な smtp.env と任意の msmtprc スニペットを Secret に同梱 - api.credentials: 任意のキー/値集合を Opaque Secret 化（envFrom 向け） - generic.secrets: 任意 type（dockerconfigjson / tls / basic-auth 等） - values.schema.json による厳格バリデーション - examples/（Gmail・M365・SendGrid・SES・Mailgun・reflector） - .gitea/workflows/helm-release.yaml で Package Registry へ自動発行 - README.md にセキュリティモデル・values リファレンス・参照方法を記載 - 平文資格情報の混入防止に .gitignore を整備
2026-08-31 09:41:41 +09:00
parent 507fd48d11
commit f374cd2e49
16 changed files with 1329 additions and 1 deletions
@@ -0,0 +1,152 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "title": "secret-manager values",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "nameOverride": { "type": "string" },
+    "fullnameOverride": { "type": "string" },
+    "distribution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["namespaces", "includeReleaseNamespace", "reflector", "reloader"],
+      "properties": {
+        "namespaces": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "includeReleaseNamespace": { "type": "boolean" },
+        "reflector": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled", "namespaceRegex"],
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "namespaceRegex": { "type": "string", "minLength": 1 }
+          }
+        },
+        "reloader": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["enabled"],
+          "properties": {
+            "enabled": { "type": "boolean" }
+          }
+        }
+      }
+    },
+    "common": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["namePrefix", "labels", "annotations", "immutable"],
+      "properties": {
+        "namePrefix": { "type": "string" },
+        "labels": { "type": "object" },
+        "annotations": { "type": "object" },
+        "immutable": { "type": "boolean" }
+      }
+    },
+    "mail": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["providers"],
+      "properties": {
+        "providers": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["enabled", "smtp"],
+            "properties": {
+              "enabled": { "type": "boolean" },
+              "renderMsmtprc": { "type": "boolean" },
+              "namespacesOverride": { "type": "array", "items": { "type": "string" } },
+              "annotations": { "type": "object" },
+              "smtp": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["host"],
+                "properties": {
+                  "host": { "type": "string", "minLength": 1 },
+                  "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+                  "security": { "type": "string", "enum": ["none", "starttls", "tls"] },
+                  "username": { "type": "string" },
+                  "password": { "type": "string" },
+                  "from": { "type": "string" },
+                  "fromName": { "type": "string" },
+                  "replyTo": { "type": "string" },
+                  "authMethod": { "type": "string", "enum": ["plain", "login", "cram-md5"] }
+                }
+              },
+              "imap": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "host": { "type": "string" },
+                  "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+                  "security": { "type": "string", "enum": ["none", "starttls", "tls"] },
+                  "username": { "type": "string" },
+                  "password": { "type": "string" }
+                }
+              },
+              "pop3": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {
+                  "host": { "type": "string" },
+                  "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+                  "security": { "type": "string", "enum": ["none", "starttls", "tls"] },
+                  "username": { "type": "string" },
+                  "password": { "type": "string" }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "api": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["credentials"],
+      "properties": {
+        "credentials": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["enabled", "data"],
+            "properties": {
+              "enabled": { "type": "boolean" },
+              "data": { "type": "object", "minProperties": 1 },
+              "namespacesOverride": { "type": "array", "items": { "type": "string" } },
+              "annotations": { "type": "object" }
+            }
+          }
+        }
+      }
+    },
+    "generic": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["secrets"],
+      "properties": {
+        "secrets": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["enabled", "data"],
+            "properties": {
+              "enabled": { "type": "boolean" },
+              "type": { "type": "string" },
+              "data": { "type": "object", "minProperties": 1 },
+              "namespacesOverride": { "type": "array", "items": { "type": "string" } },
+              "annotations": { "type": "object" }
+            }
+          }
+        }
+      }
+    }
+  }
+}