improve secret management

Author: sabban

crowdsec-docs/docs/appsec/quickstart/traefik.mdx

@@ -340,8 +340,72 @@ Instead if you define the configuration using labels on the containers you can a
 ```
 </TabItem>
 <TabItem value="kubernetes">
-For Kubernetes, keep the Traefik bouncer key in a `Secret`, mount it into the
-Traefik pod, and reference it with `crowdsecLapiKeyFile`.
+For Kubernetes, use the same secret management pattern as in the [Traefik
+bouncer setup](/u/bouncers/traefik#store-the-traefik-bouncer-key-in-a-kubernetes-secret):
+store the shared bouncer key in Kubernetes secrets and reference it from both
+CrowdSec and Traefik.
+
+Two secrets are needed because CrowdSec and Traefik run in different
+namespaces:
+
+- In the `crowdsec` namespace, CrowdSec LAPI reads `BOUNCER_KEY_traefik` from
+  the `crowdsec-keys` secret.
+- In the `traefik` namespace, Traefik mounts the same key from the
+  `crowdsec-bouncer-key` secret as a file.
+
+Both secrets must contain the same `BOUNCER_KEY_traefik` value. If you already
+created them for the base bouncer setup, you can reuse them here.
+
+Create or update the secrets:
+
+```yaml title="crowdsec-keys.yaml"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: crowdsec-keys
+  namespace: crowdsec
+type: Opaque
+stringData:
+  ENROLL_KEY: "<your-existing-enroll-key>"
+  BOUNCER_KEY_traefik: "<your-shared-traefik-bouncer-key>"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: crowdsec-bouncer-key
+  namespace: traefik
+type: Opaque
+stringData:
+  BOUNCER_KEY_traefik: "<your-shared-traefik-bouncer-key>"
+```
+
+Apply it:
+
+```bash
+kubectl apply -f crowdsec-keys.yaml
+```
+
+Then make sure the CrowdSec Helm values reference `BOUNCER_KEY_traefik` from
+the `crowdsec-keys` secret:
+
+```yaml title="crowdsec-values.yaml"
+lapi:
+  env:
+    - name: BOUNCER_KEY_traefik
+      valueFrom:
+        secretKeyRef:
+          name: crowdsec-keys
+          key: BOUNCER_KEY_traefik
+```
+
+Apply the CrowdSec release again:
+
+```bash
+helm upgrade --install crowdsec crowdsec/crowdsec --namespace crowdsec --create-namespace -f crowdsec-values.yaml
+```
+
+Then configure Traefik to mount the `crowdsec-bouncer-key` secret and
+reference it with `crowdsecLapiKeyFile`.
 
 Use a Traefik values file like this: