mirror of
https://github.com/skoelle/kctl-tui.git
synced 2026-09-17 20:10:24 +00:00
stefankoelle
720064454b
The force-sync pre-filled the ExternalSecret object name with the Kubernetes secret name (e.g. job-apply-common-secrets), but the kubectl annotate command must target the ExternalSecret CRD object (e.g. job-apply). Added external_secret_name_template config option with fallback to k8s_secret_name_template.
75 lines
3.4 KiB
YAML
75 lines
3.4 KiB
YAML
# Example configuration for kctl-tui.
|
|
# Copy this file to ~/.kctl-tui/config.yaml and adjust the values to your
|
|
# own AWS/Kubernetes setup. Do NOT commit your real config.yaml with
|
|
# company- or project-specific account IDs, contexts, or label names to a
|
|
# public repository.
|
|
|
|
# Top-level grouping the tool starts from (e.g. network boundary such as
|
|
# internal/external-facing clusters). This is the outermost navigation
|
|
# level; press Esc from the team-selection screen to get here.
|
|
contexts:
|
|
- "internal"
|
|
- "external"
|
|
|
|
# Pre-selected on startup so the tool can jump straight to team selection
|
|
# instead of asking for the context every time. Falls back to the first
|
|
# entry of 'contexts' if omitted.
|
|
default_context: "internal"
|
|
|
|
# Environments switchable from the control panel (e.g. "1) beta" /
|
|
# "2) prod"). The first two entries are also used for the two k9s status
|
|
# panes shown side by side.
|
|
envs:
|
|
- "beta"
|
|
- "prod"
|
|
|
|
# AWS region used for all AWS Secrets Manager calls.
|
|
aws_region: "eu-central-1"
|
|
|
|
# AWS account ID, used to fill the {account_id} placeholder below.
|
|
# 123456789012 is a placeholder, not a real account.
|
|
aws_account_id: "123456789012"
|
|
|
|
# Builds the AWS Secrets Manager secret ID from the chosen namespace and
|
|
# environment. Available placeholders: {namespace}, {env}.
|
|
secret_name_template: "tf-{namespace}-{env}-secrets"
|
|
|
|
# Builds the Kubernetes secret name from the chosen namespace. Kept as a
|
|
# separate template from secret_name_template above because the AWS side
|
|
# and the Kubernetes side commonly follow different naming conventions
|
|
# (e.g. the Kubernetes secret is per-namespace only, without an env
|
|
# segment, because each environment already has its own cluster).
|
|
# Available placeholders: {namespace}.
|
|
k8s_secret_name_template: "{namespace}-common-secrets"
|
|
|
|
# Builds the ExternalSecret CRD object name to annotate when a force-sync
|
|
# is requested. This is often different from the Kubernetes secret name
|
|
# because the ExternalSecret CRD and the resulting Secret are separate
|
|
# objects (e.g. ExternalSecret "job-apply" produces Secret
|
|
# "job-apply-common-secrets"). Falls back to k8s_secret_name_template
|
|
# if omitted. Available placeholders: {namespace}.
|
|
external_secret_name_template: "{namespace}"
|
|
|
|
# Builds the actual kubectl context name/ARN from region, account ID, env,
|
|
# and context. Available placeholders: {region}, {account_id}, {env},
|
|
# {context}. Adjust the literal parts ("tf-", "-1", cluster naming, ARN
|
|
# shape) to match how your own EKS clusters/contexts are actually named.
|
|
context_template: "arn:aws:eks:{region}:{account_id}:cluster/tf-{env}-{context}-1"
|
|
|
|
# The namespace label key used to group namespaces by team/ownership in
|
|
# the team-selection screen. Adjust this to whatever label your
|
|
# organization actually uses (can contain a domain prefix, e.g.
|
|
# "example.org/team").
|
|
team_label_key: "example.org/team"
|
|
|
|
# Command used to (re-)authenticate with AWS before the Secrets workflow,
|
|
# if 'aws sts get-caller-identity' fails (e.g. an expired AWS SSO session).
|
|
# Defaults to "aws sso login" if omitted. Override this if your organization
|
|
# wraps SSO login in a custom script or needs a specific --profile, e.g.:
|
|
# aws_sso_login_command: "aws sso login --profile my-profile"
|
|
aws_sso_login_command: "aws sso login"
|
|
|
|
# Check for updates on startup and prompt to update if a newer version is
|
|
# available. Set to false to disable. Defaults to true if omitted.
|
|
# auto_update_check: true
|