From 09417935cacfdc1d99d86c93b51d394f1c82543d Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 16 Oct 2026 22:20:05 +1100
Subject: [PATCH] Enable Vault OIDC auth on artifactapi config writes

---
 apps/base/artifactapi/api-deployment.yaml | 2 +-
 apps/base/artifactapi/configmap.yaml      | 2 ++
 apps/base/artifactapi/image-keeper.yaml   | 4 ++--
 apps/base/artifactapi/ui-deployment.yaml  | 2 +-
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/apps/base/artifactapi/api-deployment.yaml b/apps/base/artifactapi/api-deployment.yaml
index 6bfe867..14a2656 100644
--- a/apps/base/artifactapi/api-deployment.yaml
+++ b/apps/base/artifactapi/api-deployment.yaml
@@ -36,7 +36,7 @@ spec:
               mountPath: /combined-certs
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.14.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
diff --git a/apps/base/artifactapi/configmap.yaml b/apps/base/artifactapi/configmap.yaml
index 5a3f814..f1ad42e 100644
--- a/apps/base/artifactapi/configmap.yaml
+++ b/apps/base/artifactapi/configmap.yaml
@@ -5,6 +5,8 @@ metadata:
   name: api-env
   namespace: artifactapi
 data:
+  ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
+  ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
   DBHOST: postgres-pooler
   DBNAME: artifacts
   DBPORT: "5432"
diff --git a/apps/base/artifactapi/image-keeper.yaml b/apps/base/artifactapi/image-keeper.yaml
index 49488cd..1793af0 100644
--- a/apps/base/artifactapi/image-keeper.yaml
+++ b/apps/base/artifactapi/image-keeper.yaml
@@ -49,7 +49,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.14.0
           imagePullPolicy: IfNotPresent
           command: ["/keeper/true"]
           volumeMounts:
@@ -69,7 +69,7 @@ spec:
             capabilities:
               drop: ["ALL"]
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.14.0
           imagePullPolicy: IfNotPresent
           command: ["true"]
           resources:
diff --git a/apps/base/artifactapi/ui-deployment.yaml b/apps/base/artifactapi/ui-deployment.yaml
index 62f5c9d..0623ccc 100644
--- a/apps/base/artifactapi/ui-deployment.yaml
+++ b/apps/base/artifactapi/ui-deployment.yaml
@@ -22,7 +22,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.13.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.14.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80
-- 
2.47.3