fix security issue of using default auth secret

apps/kaneo/app-secret.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: kaneo-app-secret
+  namespace: kaneo
+spec:
+  type: kv-v2
+
+  mount: secret
+  path: kaneo
+
+  destination:
+    create: true
+    name: kaneo-app-secret
+    type: Opaque
+    transformation:
+      excludeRaw: true
+      templates:
+        auth_secret:
+          text: '{{ get .Secrets "auth_secret" }}'
+
+  vaultAuthRef: kaneo

apps/kaneo/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
+  - app-secret.yaml
   - oauth-secret.yaml
   - postgres-volume.yaml
   - postgres-cluster.yaml

apps/kaneo/release.yaml

@@ -58,6 +58,10 @@ spec:
       env:
         clientUrl: "https://kaneo.lumpiasty.xyz"
         disablePasswordRegistration: true
+        existingSecret:
+          enabled: true
+          name: kaneo-app-secret
+          key: auth_secret
         database:
           external:
             enabled: true

vault/policy/kaneo.hcl

@@ -1,3 +1,7 @@
 path "secret/data/authentik/kaneo" {
     capabilities = ["read"]
 }
+
+path "secret/data/kaneo" {
+    capabilities = ["read"]
+}