Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.
- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.
The migrate Job was a PreSync hook but connects to postgres-rw, whose CNPG
Cluster + generated postgres-app secret apply in the Sync phase (after all
PreSync hooks). On a fresh install migrate ran before Postgres existed, failed,
exhausted backoffLimit, failed PreSync, and blocked the Sync phase that creates
the DB.
- Move migrate off PreSync to a Sync-phase hook at sync-wave 1.
- Put the CNPG Cluster + backup resources, VSO auth/secrets, and Certificate at
wave 0 so the DB is Healthy (and creds/cert exist) before migrate runs.
- Put the Deployment + Service/Gateway/HTTPRoute/PDB/VMServiceScrape at wave 2
so serve starts after migrate completes.
- Add a writable /tmp emptyDir to the serve container and migrate Job (root FS
is read-only) so codeload/staging writes cannot crash the process.
Deploy goodtune/ghp so estate agents have a GitHub proxy. Mirrors the
artifactapi app structure under apps/base/ghp with a CNPG Postgres backend,
VSO-synced GitHub App + encryption secrets, an internal Vault-PKI serving cert,
a PreSync migration hook, and platform ApplicationSet/project registration.
unkin-agent