From df78e7ce51aed2ec2f4ac2e2e0783718657eaf08 Mon Sep 17 00:00:00 2001
From: hermes-agent <hermes@grachevko.ru>
Date: Thu, 17 Sep 2026 18:18:33 +0000
Subject: [PATCH] =?UTF-8?q?fix(security):=20CR=20ESO=20=D0=B2=20=D0=BE?=
 =?UTF-8?q?=D1=82=D0=B4=D0=B5=D0=BB=D1=8C=D0=BD=D1=8B=D0=B9=20Kustomizatio?=
 =?UTF-8?q?n=20=D0=BF=D0=BE=D1=81=D0=BB=D0=B5=20=D0=BE=D0=BF=D0=B5=D1=80?=
 =?UTF-8?q?=D0=B0=D1=82=D0=BE=D1=80=D0=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../app/clustersecretstore.yaml               |  0
 .../app/externalsecret.yaml                   |  0
 .../app/kustomization.yaml                    |  6 ++++++
 .../security/external-secrets-stores/ks.yaml  | 21 +++++++++++++++++++
 .../external-secrets/app/kustomization.yaml   |  2 --
 kubernetes/apps/security/kustomization.yaml   |  1 +
 6 files changed, 28 insertions(+), 2 deletions(-)
 rename kubernetes/apps/security/{external-secrets => external-secrets-stores}/app/clustersecretstore.yaml (100%)
 rename kubernetes/apps/security/{external-secrets => external-secrets-stores}/app/externalsecret.yaml (100%)
 create mode 100644 kubernetes/apps/security/external-secrets-stores/app/kustomization.yaml
 create mode 100644 kubernetes/apps/security/external-secrets-stores/ks.yaml

diff --git a/kubernetes/apps/security/external-secrets/app/clustersecretstore.yaml b/kubernetes/apps/security/external-secrets-stores/app/clustersecretstore.yaml
similarity index 100%
rename from kubernetes/apps/security/external-secrets/app/clustersecretstore.yaml
rename to kubernetes/apps/security/external-secrets-stores/app/clustersecretstore.yaml
diff --git a/kubernetes/apps/security/external-secrets/app/externalsecret.yaml b/kubernetes/apps/security/external-secrets-stores/app/externalsecret.yaml
similarity index 100%
rename from kubernetes/apps/security/external-secrets/app/externalsecret.yaml
rename to kubernetes/apps/security/external-secrets-stores/app/externalsecret.yaml
diff --git a/kubernetes/apps/security/external-secrets-stores/app/kustomization.yaml b/kubernetes/apps/security/external-secrets-stores/app/kustomization.yaml
new file mode 100644
index 0000000..4e52424
--- /dev/null
+++ b/kubernetes/apps/security/external-secrets-stores/app/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./clustersecretstore.yaml
+  - ./externalsecret.yaml
diff --git a/kubernetes/apps/security/external-secrets-stores/ks.yaml b/kubernetes/apps/security/external-secrets-stores/ks.yaml
new file mode 100644
index 0000000..0790518
--- /dev/null
+++ b/kubernetes/apps/security/external-secrets-stores/ks.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: external-secrets-stores
+spec:
+  interval: 1h
+  path: ./kubernetes/apps/security/external-secrets-stores/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: security
+  wait: true
+  # ClusterSecretStore и ExternalSecret — это CR, которые ставят CRD'ы из чарта
+  # external-secrets. В одном Kustomization с HelmRelease оператора они падали бы
+  # с `no matches for kind "ClusterSecretStore"`, потому что CRD'ы появляются
+  # только после установки релиза. Поэтому отдельный Kustomization и dependsOn.
+  dependsOn:
+    - name: external-secrets
diff --git a/kubernetes/apps/security/external-secrets/app/kustomization.yaml b/kubernetes/apps/security/external-secrets/app/kustomization.yaml
index f47595c..10bfeb9 100644
--- a/kubernetes/apps/security/external-secrets/app/kustomization.yaml
+++ b/kubernetes/apps/security/external-secrets/app/kustomization.yaml
@@ -4,5 +4,3 @@ kind: Kustomization
 resources:
   - ./ocirepository.yaml
   - ./helmrelease.yaml
-  - ./clustersecretstore.yaml
-  - ./externalsecret.yaml
diff --git a/kubernetes/apps/security/kustomization.yaml b/kubernetes/apps/security/kustomization.yaml
index 4e1672b..1a461f8 100644
--- a/kubernetes/apps/security/kustomization.yaml
+++ b/kubernetes/apps/security/kustomization.yaml
@@ -9,4 +9,5 @@ components:
 resources:
   - ./namespace.yaml
   - ./external-secrets/ks.yaml
+  - ./external-secrets-stores/ks.yaml
   - ./vault/ks.yaml