From de51f6cf3d95a30430fd6fa7c30dac5f4d447d67 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 21:53:09 +1100
Subject: [PATCH] Deploy encapi v0.2.0 with Vault OIDC

---
 apps/base/encapi/configmap.yaml  |  2 ++
 apps/base/encapi/deployment.yaml | 29 ++++++++++++++++++++++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/apps/base/encapi/configmap.yaml b/apps/base/encapi/configmap.yaml
index 0d000fd..eea454c 100644
--- a/apps/base/encapi/configmap.yaml
+++ b/apps/base/encapi/configmap.yaml
@@ -11,3 +11,5 @@ data:
   DBPORT: "5432"
   DBUSER: encapi
   DBSSL: require
+  ENCAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
+  SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt
diff --git a/apps/base/encapi/deployment.yaml b/apps/base/encapi/deployment.yaml
index 38ee52a..bbe0440 100644
--- a/apps/base/encapi/deployment.yaml
+++ b/apps/base/encapi/deployment.yaml
@@ -6,6 +6,7 @@ metadata:
   namespace: encapi
   annotations:
     configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
   replicas: 2
   selector:
@@ -21,9 +22,22 @@ spec:
         app: encapi
     spec:
       automountServiceAccountToken: true
+      initContainers:
+        - name: combine-certs
+          image: alpine:3
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
       containers:
         - name: encapi
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
@@ -38,6 +52,10 @@ spec:
             - secretRef:
                 name: environment
                 optional: false
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
           livenessProbe:
             httpGet:
               path: /healthz
@@ -61,4 +79,13 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
       restartPolicy: Always
-- 
2.47.3