unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Deploy repospawner v0.1.0 #445

Merged
benvin merged 1 commits from benvin/deploy-repospawner into main 2026-08-30 15:40:07 +10:00
Conversation 0 Commits 1 Files Changed 18
+666 -2
unkin-agent commented 2026-08-30 15:24:07 +10:00
Member
Copy Link
Copy Source

Why

repospawner v0.1.0 is built and its Vault kubernetes auth role is applied, but nothing deploys it. It turns a "I want a new repository" request into a terraform-git pull request, follows that PR to merge, and optionally activates the repo in Woodpecker, so the review gate stays where it is instead of moving into an agent's hands.

How

  • Add apps/base/repospawner/: namespace, ServiceAccount repospawner, default VaultAuth for VSO, and a namespaced Role/RoleBinding granting jobs create/get/list/watch/delete plus pods and pods/log reads (mirrors mediamover).
  • Deployment pinned to artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0, one replica with the Recreate strategy because request state is in memory and rebuilt from Job labels; the same image reference is passed down as REPOSPAWNER_IMAGE so the spawned Jobs stay in step.
  • Mount a projected audience: vault service account token at /var/run/secrets/vault — the app logs into Vault natively rather than through VSO — and the repospawner-woodpecker Secret at /etc/repospawner/woodpecker, optional so the server still starts and refuses woodpecker: true with 503 when it is absent.
  • Two VaultStaticSecrets: oauth-credentials from kv/kubernetes/namespace/repospawner/default/oauth-credentials and repospawner-woodpecker (key token) from .../default/woodpecker, with reloader annotations on both consumers.
  • oauth2-proxy front door on the watchstate/mediamark pattern, gated on akP-repospawner-admin via the ak_groups claim and re-checked by the app from X-Forwarded-Groups; public repospawner.unkin.net on the reflected wildcard and internal repospawner.k8s.syd1.au.unkin.net on vault-issuer, both routed to the oauth2 Service.
  • Register the overlay in the platform ApplicationSet and AppProject, and append repospawner to the wildcard Certificate's two reflector namespace lists.

Depends on the terraform-authentik repospawner client being applied and kv/kubernetes/namespace/repospawner/default/oauth-credentials + .../woodpecker being seeded.

## Why repospawner v0.1.0 is built and its Vault kubernetes auth role is applied, but nothing deploys it. It turns a "I want a new repository" request into a terraform-git pull request, follows that PR to merge, and optionally activates the repo in Woodpecker, so the review gate stays where it is instead of moving into an agent's hands. ## How - Add `apps/base/repospawner/`: namespace, ServiceAccount `repospawner`, `default` VaultAuth for VSO, and a namespaced Role/RoleBinding granting jobs create/get/list/watch/delete plus pods and pods/log reads (mirrors mediamover). - Deployment pinned to `artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0`, one replica with the `Recreate` strategy because request state is in memory and rebuilt from Job labels; the same image reference is passed down as `REPOSPAWNER_IMAGE` so the spawned Jobs stay in step. - Mount a projected `audience: vault` service account token at `/var/run/secrets/vault` — the app logs into Vault natively rather than through VSO — and the `repospawner-woodpecker` Secret at `/etc/repospawner/woodpecker`, optional so the server still starts and refuses `woodpecker: true` with 503 when it is absent. - Two VaultStaticSecrets: `oauth-credentials` from `kv/kubernetes/namespace/repospawner/default/oauth-credentials` and `repospawner-woodpecker` (key `token`) from `.../default/woodpecker`, with reloader annotations on both consumers. - oauth2-proxy front door on the watchstate/mediamark pattern, gated on `akP-repospawner-admin` via the `ak_groups` claim and re-checked by the app from `X-Forwarded-Groups`; public `repospawner.unkin.net` on the reflected wildcard and internal `repospawner.k8s.syd1.au.unkin.net` on `vault-issuer`, both routed to the oauth2 Service. - Register the overlay in the platform ApplicationSet and AppProject, and append `repospawner` to the wildcard Certificate's two reflector namespace lists. Depends on the terraform-authentik `repospawner` client being applied and `kv/kubernetes/namespace/repospawner/default/oauth-credentials` + `.../woodpecker` being seeded.
unkin-agent added 1 commit 2026-08-30 15:24:07 +10:00
Deploy repospawner v0.1.0
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
200a241d42 
Add apps/base/repospawner with namespace, service account, job-spawning
RBAC, the server Deployment, oauth2-proxy front door, internal and
external gateways, and the VaultStaticSecrets backing them. Register the
overlay in the platform ApplicationSet and AppProject.
benvin merged commit a9a66a07b1 into main 2026-08-30 15:40:07 +10:00
benvin deleted branch benvin/deploy-repospawner 2026-08-30 15:40:07 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#445
Delete Branch "benvin/deploy-repospawner"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?