unkin-agent
1d5e8edbdd
Deploy goodtune/ghp so estate agents have a GitHub proxy. Mirrors the artifactapi app structure under apps/base/ghp with a CNPG Postgres backend, VSO-synced GitHub App + encryption secrets, an internal Vault-PKI serving cert, a PreSync migration hook, and platform ApplicationSet/project registration.
27 lines
650 B
YAML
27 lines
650 B
YAML
---
|
|
# Serving cert off the internal Vault-PKI CA (agents already trust vault-ca-cert).
|
|
# SANs cover the GitHub endpoints ghp impersonates plus its own management host.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: ghp-tls
|
|
namespace: ghp
|
|
labels:
|
|
app.kubernetes.io/name: ghp
|
|
app.kubernetes.io/instance: ghp
|
|
spec:
|
|
secretName: ghp-tls
|
|
issuerRef:
|
|
kind: ClusterIssuer
|
|
name: vault-issuer
|
|
commonName: ghp.k8s.syd1.au.unkin.net
|
|
dnsNames:
|
|
- github.com
|
|
- api.github.com
|
|
- codeload.github.com
|
|
- "*.githubcopilot.com"
|
|
- ghp.k8s.syd1.au.unkin.net
|
|
privateKey:
|
|
algorithm: RSA
|
|
size: 4096
|