unkin-agent
1d5e8edbdd
Deploy goodtune/ghp so estate agents have a GitHub proxy. Mirrors the artifactapi app structure under apps/base/ghp with a CNPG Postgres backend, VSO-synced GitHub App + encryption secrets, an internal Vault-PKI serving cert, a PreSync migration hook, and platform ApplicationSet/project registration.
38 lines
866 B
YAML
38 lines
866 B
YAML
---
|
|
# GitHub App credentials (app_id, client_id, client_secret, private_key).
|
|
# Ben populates kv/kubernetes/ghp/github-app via the runbook; VSO syncs it here.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: ghp-github-app
|
|
namespace: ghp
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: ghp-github-app
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/ghp/github-app
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Application encryption key (encryption_key) from kv/kubernetes/ghp/app.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: ghp-app
|
|
namespace: ghp
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: ghp-app
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/ghp/app
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|