Enable Vault OIDC auth on artifactapi config writes (#552)

artifactapi v3.14.0 can require a Vault-issued bearer JWT for writes to /api/v2/remotes and /api/v2/virtuals, so config changes stop being open to anything in-cluster.

- bump artifactapi and artifactapi-ui images to v3.14.0
- set ARTIFACTAPI_OIDC_ISSUER to the Vault identity OIDC issuer and ARTIFACTAPI_OIDC_AUDIENCE to artifactapi

Requires terraform-artifactapi #64 merged first.

Reviewed-on: #552
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/artifactapi/api-deployment.yaml

@@ -36,7 +36,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.14.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/artifactapi/configmap.yaml

@@ -5,6 +5,8 @@ metadata:
   name: api-env
   namespace: artifactapi
 data:
+  ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
+  ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
   DBHOST: postgres-pooler
   DBNAME: artifacts
   DBPORT: "5432"

apps/base/artifactapi/image-keeper.yaml

@@ -49,7 +49,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.14.0
           imagePullPolicy: IfNotPresent
           command: ["/keeper/true"]
           volumeMounts:
@@ -69,7 +69,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.14.0
           imagePullPolicy: IfNotPresent
           command: ["true"]
           resources:

apps/base/artifactapi/ui-deployment.yaml

@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.14.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80