unkin-agent
02f877540c
`go-cache-plugin serve` binds `127.0.0.1` only, so nothing outside the pod can reach it and laptops have no way to use the S3-backed Go cache without holding RGW credentials. - Run `go-cache-plugin serve` against the `gocache` bucket, path-style, explicit region to skip the GetBucketLocation probe - Add an nginx sidecar stream-proxying `:9090` to the loopback plugin port, `proxy_timeout 2h` - Publish it on PureLB `198.18.200.11`, `externalTrafficPolicy: Local` so the client IP reaches the allow rules - Restrict to workstation + pod CIDRs: GOCACHEPROG is unauthenticated and a poisoned entry runs in every consuming build Merge only after `docker-internal/go-cache-plugin:v0.1.0` is published. Reviewed-on: #496 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
37 lines
1.1 KiB
YAML
37 lines
1.1 KiB
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_backup.yaml
|
|
- cnpg_pooler.yaml
|
|
- gocache_bucket.yaml
|
|
- configmap_gocache-nginx.yaml
|
|
- deployment_gocache.yaml
|
|
- service_gocache.yaml
|
|
- serviceaccount_arrproxy_ci.yaml
|
|
- serviceaccount_autobackup_operator_ci.yaml
|
|
- serviceaccount_ghp.yaml
|
|
- serviceaccount_golib_ci.yaml
|
|
- serviceaccount_kea_operator_ci.yaml
|
|
- serviceaccount_mediamark_ci.yaml
|
|
- serviceaccount_plugin_docker_buildx.yaml
|
|
- serviceaccount_jellyfin_ha_src.yaml
|
|
- serviceaccount_jellyfin_plugin_sso.yaml
|
|
- serviceaccount_repospawner_ci.yaml
|
|
- serviceaccount_terraform_artifactapi.yaml
|
|
- serviceaccount_terraform_authentik.yaml
|
|
- serviceaccount_terraform_enc.yaml
|
|
- serviceaccount_terraform_git.yaml
|
|
- serviceaccount_terraform_infra.yaml
|
|
- serviceaccount_terraform_prowlarr.yaml
|
|
- serviceaccount_terraform_rancher.yaml
|
|
- serviceaccount_terraform_radarr.yaml
|
|
- serviceaccount_terraform_sonarr.yaml
|
|
- serviceaccount_terraform_vault.yaml
|
|
- serviceaccount_vimpack_ci.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|