Use HashiCorp Vault to fetch password required by MariaDB MaxScale

docs/infrastructure-mariadb.md

@@ -47,6 +47,7 @@ kubectl exec --stdin=true --tty=true vault-0 -n vault -- \
 kubectl exec --stdin=true --tty=true vault-0 -n vault -- \
     vault kv put -mount=osh/mariadb mariadb-root-password root-password=$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)
 ```
+
 - MaxScale password:
 ``` shell
 kubectl exec --stdin=true --tty=true vault-0 -n vault -- \

kustomize/mariadb-cluster/base/vault/kustomization.yaml

@@ -3,3 +3,4 @@ resources:
   - vaultauth.yaml
   - vaultconnection.yaml
   - mariadb-root-password.yaml
+  - mariadb-maxscale.yaml

kustomize/mariadb-cluster/base/vault/mariadb-maxscale.yaml

@@ -0,0 +1,24 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: maxscale
+  namespace: openstack
+spec:
+  type: kv-v2
+
+# mount path
+  mount: 'osh/mariadb'
+
+# path of the secret
+  path: maxscale
+
+# dest k8s secret
+  destination:
+     name: maxscale
+     create: true
+
+# static secret refresh interval
+  refreshAfter: 30s
+
+# Name of the CRD to authenticate to Vault
+  vaultAuthRef: vault-auth