unkin-agent
200a241d42
Add apps/base/repospawner with namespace, service account, job-spawning RBAC, the server Deployment, oauth2-proxy front door, internal and external gateways, and the VaultStaticSecrets backing them. Register the overlay in the platform ApplicationSet and AppProject.
43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
---
|
|
# Authentik OIDC client for the repospawner front door (client_id,
|
|
# client_secret, cookie_secret). The default k8s role's templated policy already
|
|
# grants read on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so
|
|
# no terraform-vault change is needed.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: oauth-credentials
|
|
namespace: repospawner
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/repospawner/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Woodpecker API token (key `token`). Optional by design: without it the server
|
|
# still starts and refuses `woodpecker: true` requests with 503. The server
|
|
# mounts it to answer /api/capabilities; the enablement Job mounts the same
|
|
# secret by name via REPOSPAWNER_WOODPECKER_SECRET.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: repospawner-woodpecker
|
|
namespace: repospawner
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: repospawner-woodpecker
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/repospawner/default/woodpecker
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|