Stellar-K8s/examples/secret-rotation-example.yaml at main · OtowoOrg/Stellar-K8s · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
---
# Example: Automated Secret Rotation for Database Credentials
#
# This example demonstrates how to enable automated rotation of PostgreSQL
# database passwords for Stellar Core and Horizon nodes.
#
# Features:
# - Monthly password rotation (configurable via cron schedule)
# - Zero-downtime credential updates
# - Audit logging of all rotation events
# - Automatic pod restarts to pick up new credentials
# - Webhook notifications for rotation events

apiVersion: stellar.org/v1alpha1
kind: StellarNode
metadata:
  name: horizon-with-secret-rotation
  namespace: stellar
spec:
  nodeType: Horizon
  network: testnet
  version: "v21.0.0"

  # Database configuration
  database:
    host: postgres.stellar.svc.cluster.local
    port: 5432
    database: horizon
    user: horizon
    passwordSecret: horizon-db-credentials

  # Automated secret rotation configuration
  secretRotation:
    enabled: true

    # Rotation schedule (cron format)
    # Default: "0 0 1 * *" (first day of every month at midnight)
    # Examples:
    #   - "0 0 1 * *"     # Monthly on the 1st
    #   - "0 0 * * 0"     # Weekly on Sunday
    #   - "0 0 1 */3 *"   # Quarterly
    schedule: "0 0 1 * *"

    # Password length (default: 32)
    passwordLength: 32

    # Database connection timeout in seconds
    dbTimeoutSeconds: 30

    # Maximum retry attempts
    maxRetries: 3

    # Enable audit logging
    auditLoggingEnabled: true

    # Optional: External audit log destination
    auditLogDestination: "https://audit-logs.example.com/api/events"

    # Optional: Notification webhook for rotation events
    notificationWebhook: "https://slack.example.com/hooks/secret-rotation"

  storage:
    storageClass: "standard"
    size: "100Gi"

  resources:
    limits:
      cpu: "2000m"
      memory: "4Gi"
    requests:
      cpu: "1000m"
      memory: "2Gi"

---
# Example: Validator with Managed Database and Secret Rotation
apiVersion: stellar.org/v1alpha1
kind: StellarNode
metadata:
  name: validator-with-rotation
  namespace: stellar
spec:
  nodeType: Validator
  network: mainnet
  version: "v21.0.0"

  # Managed database (CloudNativePG)
  managedDatabase:
    enabled: true
    databaseName: stellar
    username: stellar
    storageSize: "500Gi"
    instances: 3
    backup:
      enabled: true
      schedule: "0 2 * * *"
      retentionDays: 30

  # Automated secret rotation
  secretRotation:
    enabled: true
    schedule: "0 0 1 */2 *" # Bi-monthly rotation
    passwordLength: 40
    auditLoggingEnabled: true
    notificationWebhook: "https://alerts.example.com/webhooks/rotation"

  validatorConfig:
    seedSecretRef: "validator-seed"
    enableHistoryArchive: true
    historyArchiveUrls:
      - "s3://stellar-history/mainnet"

  storage:
    storageClass: "fast-ssd"
    size: "1Ti"
    mode: Local

  resources:
    limits:
      cpu: "4000m"
      memory: "8Gi"
    requests:
      cpu: "2000m"
      memory: "4Gi"

---
# Kubernetes Secret for Database Credentials
# This secret will be automatically updated by the secret rotation process
apiVersion: v1
kind: Secret
metadata:
  name: horizon-db-credentials
  namespace: stellar
type: Opaque
stringData:
  password: "initial-password-change-me"
  # The operator will update this password automatically based on the rotation schedule