unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat(artifactapi): mount terraform registry signing key #217

Closed
unkinben wants to merge 1 commits from benvin/artifactapi-tf-signing into main
pull from: benvin/artifactapi-tf-signing
merge into: unkin:main
Conversation 1 Commits 1 Files Changed 1
+19
unkinben commented 2026-07-03 17:51:48 +10:00
Owner
Copy Link
Copy Source

Why

artifactapi #102 makes local terraform repos a real provider registry, which requires a GPG key to sign SHA256SUMS. This mounts that key into the api deployment.

Changes

  • Mount secret artifactapi-tf-signing at /etc/artifactapi/tf-signing (optional: true).
  • Set TF_SIGNING_KEY_PATH, and TF_SIGNING_KEY_PASSPHRASE from the secret's optional passphrase key.

The mount is optional, so the pod runs before the secret exists; artifactapi keeps the registry disabled until a readable key is present. Safe to merge ahead of the image bump — the current v3.7.3 image just ignores the new env/volume.

Operator step

Create the secret out of band (not committed — the pre-commit hook blocks plain secrets):

kubectl -n artifactapi create secret generic artifactapi-tf-signing \
  --from-file=private-key.asc=./private-key.asc

Once #102 is tagged/built and the image bumped, /.well-known/terraform.json starts serving and terraform init works against the registry.

Note

No HTTPRoute change: / already routes /.well-known and /terraform to the API service.

## Why artifactapi #102 makes local terraform repos a real provider registry, which requires a GPG key to sign `SHA256SUMS`. This mounts that key into the api deployment. ## Changes - Mount secret `artifactapi-tf-signing` at `/etc/artifactapi/tf-signing` (`optional: true`). - Set `TF_SIGNING_KEY_PATH`, and `TF_SIGNING_KEY_PASSPHRASE` from the secret's optional `passphrase` key. The mount is optional, so the pod runs before the secret exists; artifactapi keeps the registry disabled until a readable key is present. Safe to merge ahead of the image bump — the current v3.7.3 image just ignores the new env/volume. ## Operator step Create the secret out of band (not committed — the pre-commit hook blocks plain secrets): ``` kubectl -n artifactapi create secret generic artifactapi-tf-signing \ --from-file=private-key.asc=./private-key.asc ``` Once #102 is tagged/built and the image bumped, `/.well-known/terraform.json` starts serving and `terraform init` works against the registry. ## Note No HTTPRoute change: `/` already routes `/.well-known` and `/terraform` to the API service.
unkinben added 1 commit 2026-07-03 18:40:36 +10:00
feat(artifactapi): mount terraform registry signing key
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
9d4739505d 
Wires the GPG signing key the terraform provider registry needs into the api
deployment. The secret is mounted optional so the pod runs before it exists;
artifactapi leaves the registry disabled until a readable key is present.

- mount secret artifactapi-tf-signing at /etc/artifactapi/tf-signing (optional)
- set TF_SIGNING_KEY_PATH, and TF_SIGNING_KEY_PASSPHRASE from the secret's
  optional passphrase key

Create the secret out of band with an armored private key:
  kubectl -n artifactapi create secret generic artifactapi-tf-signing \
    --from-file=private-key.asc=./private-key.asc
unkinben force-pushed benvin/artifactapi-tf-signing from 6302b84c76 to 9d4739505d 2026-07-03 18:40:36 +10:00 Compare
unkinben commented 2026-07-03 18:47:00 +10:00
Author
Owner
Copy Link
Copy Source

Superseded — no longer needed.

artifactapi now self-provisions the terraform registry signing key: on first start it generates a GPG keypair and stores it in the database (signing_keys table), shared across replicas. No K8s secret to mount. TF_SIGNING_KEY_PATH remains as an optional bring-your-own override, so this wiring can be re-introduced later if desired. Closing.

Superseded — no longer needed. artifactapi now self-provisions the terraform registry signing key: on first start it generates a GPG keypair and stores it in the database (`signing_keys` table), shared across replicas. No K8s secret to mount. `TF_SIGNING_KEY_PATH` remains as an optional bring-your-own override, so this wiring can be re-introduced later if desired. Closing.
unkinben closed this pull request 2026-07-03 18:47:00 +10:00
Some checks are pending
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Required
Details
ci/woodpecker/pr/vector-test
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#217
Delete Branch "benvin/artifactapi-tf-signing"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?