# Sealed Secrets Configuration for SwarmCare
# Encrypted secrets management

---
# Install Sealed Secrets Controller
apiVersion: v1
kind: Namespace
metadata:
  name: sealed-secrets

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sealed-secrets-controller
  namespace: sealed-secrets
  labels:
    app: sealed-secrets-controller
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sealed-secrets-controller
  template:
    metadata:
      labels:
        app: sealed-secrets-controller
    spec:
      serviceAccountName: sealed-secrets-controller
      containers:
      - name: sealed-secrets-controller
        image: quay.io/bitnami/sealed-secrets-controller:v0.24.0
        ports:
        - containerPort: 8080
          name: http
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
        readinessProbe:
          httpGet:
            path: /healthz
            port: http
        resources:
          requests:
            cpu: 50m
            memory: 64Mi
          limits:
            cpu: 200m
            memory: 256Mi

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sealed-secrets-controller
  namespace: sealed-secrets

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sealed-secrets-controller
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "update", "patch"]
- apiGroups: ["bitnami.com"]
  resources: ["sealedsecrets"]
  verbs: ["get", "list", "watch", "update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sealed-secrets-controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sealed-secrets-controller
subjects:
- kind: ServiceAccount
  name: sealed-secrets-controller
  namespace: sealed-secrets

---
# Example: Sealed Secret for database credentials
# Generated with: kubeseal --format yaml < secret.yaml > sealed-secret.yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: database-secret
  namespace: swarmcare
spec:
  encryptedData:
    username: AgBX... # Encrypted value
    password: AgBY... # Encrypted value
    url: AgBZ...      # Encrypted value

---
# Example: Sealed Secret for Redis
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: redis-secret
  namespace: swarmcare
spec:
  encryptedData:
    password: AgBA... # Encrypted value
    url: AgBB...      # Encrypted value

---
# ConfigMap with secrets management guidelines
apiVersion: v1
kind: ConfigMap
metadata:
  name: secrets-management-guide
  namespace: swarmcare
data:
  README.md: |
    # Secrets Management with Sealed Secrets

    ## Creating a Sealed Secret

    1. Create regular Kubernetes secret:
    ```yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: my-secret
      namespace: swarmcare
    type: Opaque
    stringData:
      username: myuser
      password: mypassword
    ```

    2. Seal the secret:
    ```bash
    kubectl create secret generic my-secret \
      --from-literal=username=myuser \
      --from-literal=password=mypassword \
      --dry-run=client -o yaml | \
      kubeseal --format yaml > my-sealed-secret.yaml
    ```

    3. Apply sealed secret:
    ```bash
    kubectl apply -f my-sealed-secret.yaml
    ```

    ## Updating Secrets

    1. Update the sealed secret file
    2. Apply the changes: `kubectl apply -f sealed-secret.yaml`
    3. Controller automatically updates the underlying secret

    ## Backup and Disaster Recovery

    - Sealed secrets are safe to commit to git
    - Back up the sealed-secrets controller private key
    - Store backup in Azure Key Vault

    ## Rotation

    - Rotate secrets every 90 days
    - Use Azure Key Vault for automated rotation
    - Monitor expiration dates with alerts

    ## Best Practices

    1. Never commit unencrypted secrets
    2. Use separate sealed secrets per environment
    3. Limit secret access with RBAC
    4. Enable audit logging for secret access
    5. Use workload identity when possible
