docker-erpnext/documentation/deployment-guides/aws-managed/kubernetes-manifests/secrets.yaml

# External Secrets Operator configuration for AWS Secrets Manager integration
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secretstore
  namespace: erpnext
  labels:
    app: erpnext
    component: secrets
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: erpnext-sa
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: erpnext-db-secret
  namespace: erpnext
  labels:
    app: erpnext
    component: database
spec:
  refreshInterval: 15s
  secretStoreRef:
    name: aws-secretstore
    kind: SecretStore
  target:
    name: erpnext-db-secret
    creationPolicy: Owner
    template:
      type: Opaque
      metadata:
        labels:
          app: erpnext
          component: database
      data:
        password: "{{ .password }}"
        # Additional database connection string templates
        mysql-uri: "mysql://admin:{{ .password }}@${DB_HOST}:3306/erpnext"
  data:
    - secretKey: password
      remoteRef:
        key: erpnext/database/password
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: erpnext-redis-secret
  namespace: erpnext
  labels:
    app: erpnext
    component: cache
spec:
  refreshInterval: 15s
  secretStoreRef:
    name: aws-secretstore
    kind: SecretStore
  target:
    name: erpnext-redis-secret
    creationPolicy: Owner
    template:
      type: Opaque
      metadata:
        labels:
          app: erpnext
          component: cache
      data:
        password: "{{ .password }}"
        # Redis connection strings with auth
        redis-cache-url: "redis://:{{ .password }}@${REDIS_HOST}:6379/0"
        redis-queue-url: "redis://:{{ .password }}@${REDIS_HOST}:6379/1"
        redis-socketio-url: "redis://:{{ .password }}@${REDIS_HOST}:6379/2"
  data:
    - secretKey: password
      remoteRef:
        key: erpnext/redis/password
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: erpnext-admin-secret
  namespace: erpnext
  labels:
    app: erpnext
    component: admin
spec:
  refreshInterval: 15s
  secretStoreRef:
    name: aws-secretstore
    kind: SecretStore
  target:
    name: erpnext-admin-secret
    creationPolicy: Owner
    template:
      type: Opaque
      metadata:
        labels:
          app: erpnext
          component: admin
      data:
        password: "{{ .password }}"
  data:
    - secretKey: password
      remoteRef:
        key: erpnext/admin/password
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: erpnext-api-secret
  namespace: erpnext
  labels:
    app: erpnext
    component: api
spec:
  refreshInterval: 15s
  secretStoreRef:
    name: aws-secretstore
    kind: SecretStore
  target:
    name: erpnext-api-secret
    creationPolicy: Owner
    template:
      type: Opaque
      metadata:
        labels:
          app: erpnext
          component: api
      data:
        api-key: "{{ .api_key }}"
        api-secret: "{{ .api_secret }}"
  data:
    - secretKey: api_key
      remoteRef:
        key: erpnext/api/credentials
        property: api_key
    - secretKey: api_secret
      remoteRef:
        key: erpnext/api/credentials
        property: api_secret
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: erpnext-ssl-certs
  namespace: erpnext
  labels:
    app: erpnext
    component: ssl
spec:
  refreshInterval: 24h
  secretStoreRef:
    name: aws-secretstore
    kind: SecretStore
  target:
    name: erpnext-ssl-certs
    creationPolicy: Owner
    template:
      type: kubernetes.io/tls
      metadata:
        labels:
          app: erpnext
          component: ssl
      data:
        tls.crt: "{{ .certificate }}"
        tls.key: "{{ .private_key }}"
        ca.crt: "{{ .ca_certificate }}"
  data:
    - secretKey: certificate
      remoteRef:
        key: erpnext/ssl/certificate
    - secretKey: private_key
      remoteRef:
        key: erpnext/ssl/private_key
    - secretKey: ca_certificate
      remoteRef:
        key: erpnext/ssl/ca_certificate
---
# Service Account with IRSA (IAM Roles for Service Accounts) annotations
apiVersion: v1
kind: ServiceAccount
metadata:
  name: erpnext-sa
  namespace: erpnext
  labels:
    app: erpnext
    component: serviceaccount
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::${ACCOUNT_ID}:role/eksctl-erpnext-cluster-addon-iamserviceaccount-erpnext-erpnext-sa-Role1-${ROLE_SUFFIX}
automountServiceAccountToken: true
---
# Additional service account for external secrets operator
apiVersion: v1
kind: ServiceAccount
metadata:
  name: external-secrets-sa
  namespace: erpnext
  labels:
    app: erpnext
    component: external-secrets
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::${ACCOUNT_ID}:role/eksctl-erpnext-cluster-addon-iamserviceaccount-external-secrets-external-secrets-operator-Role1-${ROLE_SUFFIX}
automountServiceAccountToken: true