diff --git a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml index dd968a0..d3b971c 100644 --- a/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml +++ b/apps/base/cert-manager/certificate_wildcard-unkin-net.yaml @@ -14,9 +14,9 @@ spec: secretTemplate: annotations: reflector.v1.k8s.emberstack.com/reflection-allowed: "true" - reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark" + reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner" reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" - reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark" + reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "cheeztv,arrstack,authentik,gitea,watchstate,mediamark,repospawner" privateKey: size: 4096 dnsNames: diff --git a/apps/base/repospawner/deployment.yaml b/apps/base/repospawner/deployment.yaml new file mode 100644 index 0000000..7c2a257 --- /dev/null +++ b/apps/base/repospawner/deployment.yaml @@ -0,0 +1,123 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: repospawner + namespace: repospawner + annotations: + secret.reloader.stakater.com/reload: "repospawner-woodpecker" +spec: + # Request state lives in memory and is rebuilt from Job labels on startup, so + # exactly one replica may exist at a time. + replicas: 1 + selector: + matchLabels: + app: repospawner + strategy: + type: Recreate + template: + metadata: + labels: + app: repospawner + spec: + serviceAccountName: repospawner + automountServiceAccountToken: true + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault + containers: + - name: repospawner + image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 8080 + name: http + protocol: TCP + env: + - name: REPOSPAWNER_NAMESPACE + value: repospawner + # The server passes its own image down to the Jobs, so this must + # match the image above exactly. + - name: REPOSPAWNER_IMAGE + value: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0 + - name: REPOSPAWNER_JOB_SERVICE_ACCOUNT + value: repospawner + - name: GITEA_URL + value: https://git.unkin.net + - name: REPOSPAWNER_TFGIT_REPO + value: unkin/terraform-git + - name: VAULT_ADDR + value: https://vault.service.consul:8200 + - name: WOODPECKER_SERVER + value: https://ci.k8s.syd1.au.unkin.net + # Name only: the enablement Job mounts this Secret itself. + - name: REPOSPAWNER_WOODPECKER_SECRET + value: repospawner-woodpecker + - name: REPOSPAWNER_WOODPECKER_TOKEN_FILE + value: /etc/repospawner/woodpecker/token + # oauth2-proxy --pass-user-headers forwards the Authentik groups as a + # comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is + # auth_request-response-only and never reaches a proxied upstream. + - name: REPOSPAWNER_GROUPS_HEADER + value: X-Forwarded-Groups + - name: REPOSPAWNER_ALLOWED_GROUPS + value: akP-repospawner-admin + volumeMounts: + - name: vault-token + mountPath: /var/run/secrets/vault + readOnly: true + - name: woodpecker-token + mountPath: /etc/repospawner/woodpecker + readOnly: true + livenessProbe: + httpGet: + path: /livez + port: http + initialDelaySeconds: 10 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /readyz + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 300m + memory: 256Mi + volumes: + # Native Vault kubernetes login: the default kubernetes.io token has the + # wrong audience, so the app reads this audience-vault projection. + - name: vault-token + projected: + sources: + - serviceAccountToken: + path: token + audience: vault + expirationSeconds: 600 + # Optional: absent, the server starts and refuses woodpecker requests. + - name: woodpecker-token + secret: + secretName: repospawner-woodpecker + optional: true + items: + - key: token + path: token + restartPolicy: Always diff --git a/apps/base/repospawner/gateway-external.yaml b/apps/base/repospawner/gateway-external.yaml new file mode 100644 index 0000000..c74e195 --- /dev/null +++ b/apps/base/repospawner/gateway-external.yaml @@ -0,0 +1,39 @@ +--- +# External (DMZ) front for repospawner on repospawner.unkin.net via the external +# Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's Encrypt +# *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager, +# reflected into this namespace as wildcard-unkin-net-tls by the emberstack +# reflector), so there is no cert-manager annotation here. The apex +# repospawner.unkin.net A record lives in the bind-operator unkin.net zone, NOT +# external-dns, so no external-dns annotation either. oauth2-proxy fronts both +# hostnames. +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + labels: + traefik.io/instance: external + name: repospawner-external + namespace: repospawner +spec: + gatewayClassName: traefik-external + listeners: + - name: http + port: 80 + protocol: HTTP + hostname: repospawner.unkin.net + allowedRoutes: + namespaces: + from: Same + - name: https + port: 443 + protocol: HTTPS + hostname: repospawner.unkin.net + allowedRoutes: + namespaces: + from: Same + tls: + mode: Terminate + certificateRefs: + - group: "" + kind: Secret + name: wildcard-unkin-net-tls diff --git a/apps/base/repospawner/gateway.yaml b/apps/base/repospawner/gateway.yaml new file mode 100644 index 0000000..d789926 --- /dev/null +++ b/apps/base/repospawner/gateway.yaml @@ -0,0 +1,38 @@ +--- +# Internal front for repospawner (cf. mediamark). +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + labels: + traefik.io/instance: internal + annotations: + cert-manager.io/cluster-issuer: vault-issuer + cert-manager.io/common-name: repospawner.k8s.syd1.au.unkin.net + cert-manager.io/private-key-size: "4096" + external-dns.alpha.kubernetes.io/hostname: repospawner.k8s.syd1.au.unkin.net + external-dns.alpha.kubernetes.io/target: 198.18.200.4 + name: repospawner + namespace: repospawner +spec: + gatewayClassName: traefik-internal + listeners: + - allowedRoutes: + namespaces: + from: Same + hostname: repospawner.k8s.syd1.au.unkin.net + name: http + port: 80 + protocol: HTTP + - allowedRoutes: + namespaces: + from: Same + hostname: repospawner.k8s.syd1.au.unkin.net + name: https + port: 443 + protocol: HTTPS + tls: + certificateRefs: + - group: "" + kind: Secret + name: repospawner-tls + mode: Terminate diff --git a/apps/base/repospawner/httproute-external.yaml b/apps/base/repospawner/httproute-external.yaml new file mode 100644 index 0000000..5ea8e03 --- /dev/null +++ b/apps/base/repospawner/httproute-external.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: repospawner-external-http-redirect + namespace: repospawner +spec: + hostnames: + - repospawner.unkin.net + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: repospawner-external + sectionName: http + rules: + - filters: + - type: RequestRedirect + requestRedirect: + scheme: https + statusCode: 301 + matches: + - path: + type: PathPrefix + value: / +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: repospawner-external + namespace: repospawner +spec: + hostnames: + - repospawner.unkin.net + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: repospawner-external + sectionName: https + rules: + - backendRefs: + - group: "" + kind: Service + name: repospawner-oauth2 + port: 4180 + weight: 1 + matches: + - path: + type: PathPrefix + value: / diff --git a/apps/base/repospawner/httproute.yaml b/apps/base/repospawner/httproute.yaml new file mode 100644 index 0000000..b4a9edf --- /dev/null +++ b/apps/base/repospawner/httproute.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: repospawner-http-redirect + namespace: repospawner +spec: + hostnames: + - repospawner.k8s.syd1.au.unkin.net + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: repospawner + sectionName: http + rules: + - filters: + - type: RequestRedirect + requestRedirect: + scheme: https + statusCode: 301 + matches: + - path: + type: PathPrefix + value: / +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: repospawner + namespace: repospawner +spec: + hostnames: + - repospawner.k8s.syd1.au.unkin.net + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: repospawner + sectionName: https + rules: + - backendRefs: + - group: "" + kind: Service + name: repospawner-oauth2 + port: 4180 + weight: 1 + matches: + - path: + type: PathPrefix + value: / diff --git a/apps/base/repospawner/kustomization.yaml b/apps/base/repospawner/kustomization.yaml new file mode 100644 index 0000000..e34f0bd --- /dev/null +++ b/apps/base/repospawner/kustomization.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - namespace.yaml + - serviceaccount.yaml + - vaultauth.yaml + - rbac.yaml + - vaultstaticsecret.yaml + - deployment.yaml + - oauth2-proxy-configmap.yaml + - oauth2-proxy-deployment.yaml + - service.yaml + - gateway.yaml + - httproute.yaml + - gateway-external.yaml + - httproute-external.yaml diff --git a/apps/base/repospawner/namespace.yaml b/apps/base/repospawner/namespace.yaml new file mode 100644 index 0000000..c4dc337 --- /dev/null +++ b/apps/base/repospawner/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/name: repospawner + name: repospawner diff --git a/apps/base/repospawner/oauth2-proxy-configmap.yaml b/apps/base/repospawner/oauth2-proxy-configmap.yaml new file mode 100644 index 0000000..16f4f8c --- /dev/null +++ b/apps/base/repospawner/oauth2-proxy-configmap.yaml @@ -0,0 +1,45 @@ +--- +# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come +# from the oauth-credentials Secret). Single auth front for repospawner on both +# host names; access is gated here on the akP-repospawner-admin Authentik group +# and re-checked by the app from X-Forwarded-Groups. +apiVersion: v1 +kind: ConfigMap +metadata: + name: repospawner-oauth2-env + namespace: repospawner +data: + OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180" + OAUTH2_PROXY_PROVIDER: "oidc" + OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.unkin.net/application/o/repospawner/" + # Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy + # derives scheme+host per request from X-Forwarded-Proto/Host, so the same + # deployment serves BOTH the external repospawner.unkin.net and internal + # repospawner.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are + # registered on the Authentik provider (terraform-authentik, separate PR). + OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback" + OAUTH2_PROXY_UPSTREAMS: "http://repospawner.repospawner.svc.cluster.local:8080/" + OAUTH2_PROXY_SCOPE: "openid email profile ak_groups" + # Populate session.Groups from the Authentik ak_groups claim; pass-user-headers + # then emits it as a single comma-joined X-Forwarded-Groups header. + OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups" + OAUTH2_PROXY_ALLOWED_GROUPS: "akP-repospawner-admin" + # Forward identity + groups to repospawner as X-Forwarded-{User,Email,Groups}. + # NOTE: set-xauthrequest is intentionally NOT set -- it only populates + # auth_request *response* headers, which never reach a proxied upstream. + OAUTH2_PROXY_PASS_USER_HEADERS: "true" + OAUTH2_PROXY_EMAIL_DOMAINS: "*" + # Authentik hardcodes email_verified=false in the id_token; authorization is + # enforced via ak_groups, so accepting the unverified email is safe. + OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" + OAUTH2_PROXY_COOKIE_SECURE: "true" + # One cookie domain per host (a single parent-domain cookie can't span + # unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain + # matching the request host. Whitelist both so post-auth `rd` redirects to + # either front door are honoured. + OAUTH2_PROXY_COOKIE_DOMAINS: "repospawner.unkin.net,repospawner.k8s.syd1.au.unkin.net" + OAUTH2_PROXY_WHITELIST_DOMAINS: "repospawner.unkin.net,repospawner.k8s.syd1.au.unkin.net" + OAUTH2_PROXY_REVERSE_PROXY: "true" + OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt" + OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256" + OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true" diff --git a/apps/base/repospawner/oauth2-proxy-deployment.yaml b/apps/base/repospawner/oauth2-proxy-deployment.yaml new file mode 100644 index 0000000..36cbc9a --- /dev/null +++ b/apps/base/repospawner/oauth2-proxy-deployment.yaml @@ -0,0 +1,133 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: repospawner-oauth2 + namespace: repospawner + annotations: + configmap.reloader.stakater.com/auto: "true" + secret.reloader.stakater.com/reload: "oauth-credentials,vault-ca-cert" +spec: + replicas: 2 + selector: + matchLabels: + app: repospawner-oauth2 + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + labels: + app: repospawner-oauth2 + spec: + serviceAccountName: default + automountServiceAccountToken: false + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault + initContainers: + # The Authentik issuer is served behind the internal unkin.net CA; + # combine the system roots with it so oauth2-proxy's OIDC HTTP client + # trusts the discovery endpoint. + - name: combine-certs + image: docker.io/library/alpine:3 + imagePullPolicy: IfNotPresent + command: + - sh + - -c + - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt + volumeMounts: + - name: vault-ca-cert + mountPath: /custom-ca + readOnly: true + - name: combined-certs + mountPath: /combined-certs + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + requests: + cpu: 50m + memory: 32Mi + limits: + cpu: 200m + memory: 64Mi + containers: + - name: oauth2-proxy + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3 + imagePullPolicy: IfNotPresent + ports: + - containerPort: 4180 + name: http + protocol: TCP + envFrom: + - configMapRef: + name: repospawner-oauth2-env + optional: false + env: + - name: OAUTH2_PROXY_CLIENT_ID + valueFrom: + secretKeyRef: + name: oauth-credentials + key: client_id + - name: OAUTH2_PROXY_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: oauth-credentials + key: client_secret + - name: OAUTH2_PROXY_COOKIE_SECRET + valueFrom: + secretKeyRef: + name: oauth-credentials + key: cookie_secret + volumeMounts: + - name: combined-certs + mountPath: /etc/ssl/combined + readOnly: true + livenessProbe: + httpGet: + path: /ping + port: http + initialDelaySeconds: 10 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /ready + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 500m + memory: 256Mi + volumes: + - name: vault-ca-cert + secret: + secretName: vault-ca-cert + items: + - key: ca.crt + path: ca.crt + - name: combined-certs + emptyDir: {} + restartPolicy: Always diff --git a/apps/base/repospawner/rbac.yaml b/apps/base/repospawner/rbac.yaml new file mode 100644 index 0000000..5816b4c --- /dev/null +++ b/apps/base/repospawner/rbac.yaml @@ -0,0 +1,48 @@ +--- +# The server creates one Job per request phase and polls Job/Pod state to drive +# the state machine and rebuild it after a restart. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: repospawner + namespace: repospawner +rules: + - apiGroups: + - batch + resources: + - jobs + verbs: + - create + - get + - list + - watch + - delete + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: repospawner + namespace: repospawner +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: repospawner +subjects: + - kind: ServiceAccount + name: repospawner + namespace: repospawner diff --git a/apps/base/repospawner/service.yaml b/apps/base/repospawner/service.yaml new file mode 100644 index 0000000..48c6c44 --- /dev/null +++ b/apps/base/repospawner/service.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: repospawner + namespace: repospawner +spec: + internalTrafficPolicy: Cluster + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: http + selector: + app: repospawner + sessionAffinity: None + type: ClusterIP +--- +# Front-door entry Service: both HTTPRoutes target this; all traffic enters via +# oauth2-proxy. +apiVersion: v1 +kind: Service +metadata: + name: repospawner-oauth2 + namespace: repospawner +spec: + internalTrafficPolicy: Cluster + ports: + - name: http + port: 4180 + protocol: TCP + targetPort: http + selector: + app: repospawner-oauth2 + sessionAffinity: None + type: ClusterIP diff --git a/apps/base/repospawner/serviceaccount.yaml b/apps/base/repospawner/serviceaccount.yaml new file mode 100644 index 0000000..93a62e4 --- /dev/null +++ b/apps/base/repospawner/serviceaccount.yaml @@ -0,0 +1,8 @@ +--- +# Bound to the Vault kubernetes auth role `repospawner`; the server and the Jobs +# it spawns both run as this account and log into Vault natively. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: repospawner + namespace: repospawner diff --git a/apps/base/repospawner/vaultauth.yaml b/apps/base/repospawner/vaultauth.yaml new file mode 100644 index 0000000..eaf0bb4 --- /dev/null +++ b/apps/base/repospawner/vaultauth.yaml @@ -0,0 +1,20 @@ +--- +# Only VSO uses this; repospawner itself authenticates to Vault directly with a +# projected audience-vault token, not through the operator. +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultAuth +metadata: + name: default + namespace: repospawner +spec: + allowedNamespaces: + - repospawner + kubernetes: + audiences: + - vault + role: default + serviceAccount: default + tokenExpirationSeconds: 600 + method: kubernetes + mount: k8s/au/syd1 + vaultConnectionRef: vso-system/default diff --git a/apps/base/repospawner/vaultstaticsecret.yaml b/apps/base/repospawner/vaultstaticsecret.yaml new file mode 100644 index 0000000..bcec730 --- /dev/null +++ b/apps/base/repospawner/vaultstaticsecret.yaml @@ -0,0 +1,42 @@ +--- +# Authentik OIDC client for the repospawner front door (client_id, +# client_secret, cookie_secret). The default k8s role's templated policy already +# grants read on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so +# no terraform-vault change is needed. +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultStaticSecret +metadata: + name: oauth-credentials + namespace: repospawner +spec: + destination: + create: true + name: oauth-credentials + overwrite: true + hmacSecretData: true + mount: kv + path: kubernetes/namespace/repospawner/default/oauth-credentials + refreshAfter: 5m + type: kv-v2 + vaultAuthRef: default +--- +# Woodpecker API token (key `token`). Optional by design: without it the server +# still starts and refuses `woodpecker: true` requests with 503. The server +# mounts it to answer /api/capabilities; the enablement Job mounts the same +# secret by name via REPOSPAWNER_WOODPECKER_SECRET. +apiVersion: secrets.hashicorp.com/v1beta1 +kind: VaultStaticSecret +metadata: + name: repospawner-woodpecker + namespace: repospawner +spec: + destination: + create: true + name: repospawner-woodpecker + overwrite: true + hmacSecretData: true + mount: kv + path: kubernetes/namespace/repospawner/default/woodpecker + refreshAfter: 5m + type: kv-v2 + vaultAuthRef: default diff --git a/apps/overlays/au-syd1/repospawner/kustomization.yaml b/apps/overlays/au-syd1/repospawner/kustomization.yaml new file mode 100644 index 0000000..3a0773c --- /dev/null +++ b/apps/overlays/au-syd1/repospawner/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../../base/repospawner diff --git a/argocd/applicationsets/platform.yaml b/argocd/applicationsets/platform.yaml index 20cfa68..fae41e9 100644 --- a/argocd/applicationsets/platform.yaml +++ b/argocd/applicationsets/platform.yaml @@ -41,6 +41,7 @@ spec: - path: apps/overlays/*/purelb - path: apps/overlays/*/reflector-system - path: apps/overlays/*/reloader-system + - path: apps/overlays/*/repospawner - path: apps/overlays/*/reposync - path: apps/overlays/*/traefik-system - path: apps/overlays/*/valkey-operator-system diff --git a/argocd/projects/platform.yaml b/argocd/projects/platform.yaml index 9c0ef74..ef702c8 100644 --- a/argocd/projects/platform.yaml +++ b/argocd/projects/platform.yaml @@ -59,6 +59,8 @@ spec: server: https://kubernetes.default.svc - namespace: 'puppet' server: https://kubernetes.default.svc + - namespace: 'repospawner' + server: https://kubernetes.default.svc - namespace: 'reposync' server: https://kubernetes.default.svc - namespace: 'vault'