From a4808f55288e4c70d9927b077d7eedaadef8b29d Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 15 Aug 2026 18:18:22 +1000
Subject: [PATCH] ghp: deploy service-token fork image + wire
 GHP_AUTH_SERVICE_TOKENS (#372)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Why: P4 step 3. Now that the CA-baked buildx plugin lets `docker-internal/ghp` push succeed, deploy the in-house ghp fork (`v0.20.0-unkin4`) which adds static admin service tokens — the mechanism the forthcoming Vault ghp secrets engine uses to authenticate as admin and mint scoped tokens.

How:
- image: ghcr.io/goodtune/ghp:0.20.0 -> artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4 (a LOCAL registry image, not the ghcr pull-through that previously ImagePullBackOff-ed).
- add env GHP_AUTH_SERVICE_TOKENS from Secret ghp-app key `service_token`, `optional: true` — ghp runs unchanged until the token is seeded.

Requires (Ben, runbook): seed `service_token` into kv/kubernetes/namespace/ghp/default/app (same pattern as encryption_key/github-app). The default role's templated policy already grants read; no terraform-vault change. The existing ghp-app reloader annotation rolls the Deployment once the key appears. This same token value later becomes the Vault ghp engine admin_token (P4 steps 5-6).

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/372
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
---
 apps/base/ghp/deployment.yaml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index e4619b7..10dc862 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: ghcr.io/goodtune/ghp:0.20.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.
@@ -88,6 +88,17 @@ spec:
                 secretKeyRef:
                   name: ghp-app
                   key: encryption_key
+            # Static admin service token for machine callers (the Vault ghp
+            # secrets engine authenticates with it to mint scoped tokens).
+            # optional: ghp runs fine without it until Ben seeds `service_token`
+            # into kv/kubernetes/namespace/ghp/default/app; the ghp-app reloader
+            # annotation then rolls this Deployment to pick it up.
+            - name: GHP_AUTH_SERVICE_TOKENS
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-app
+                  key: service_token
+                  optional: true
           volumeMounts:
             - name: github-app
               mountPath: /etc/ghp/github-app