Ben Vincent
8ce1b5f6bd
The internal intermediate CA re-key broke CA consumers because Reloader ignored Secrets and could not restart on the vault-ca-cert Secret. Enabling generic secret watching naively would restart every workload on each Vault/VSO secret rotation, so this scopes existing auto annotations to ConfigMaps and makes secret reload opt-in per Secret. - set reloader ignoreSecrets: false so Secrets are watched - convert every generic reloader.stakater.com/auto to the configmap-only configmap.reloader.stakater.com/auto form (22 annotations, 19 files) - add explicit secret.reloader.stakater.com/reload: "vault-ca-cert" to the CA consumers (artifactapi api, cephrgw-operator, puppetserver master+compiler, litellm, logarchiver) so CA rotation restarts them - add secret.reloader.stakater.com/reload: "kanidm-tls" so the cert-manager leaf renewal rolls kanidm - add docs/ca-rotation.md runbook and index it Closes #326 Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
68 lines
2.1 KiB
YAML
68 lines
2.1 KiB
YAML
agent:
|
|
replicaCount: 3
|
|
env:
|
|
WOODPECKER_MAX_WORKFLOWS: "8"
|
|
WOODPECKER_BACKEND_K8S_PRIORITY_CLASS: power
|
|
WOODPECKER_BACKEND_K8S_STORAGE_CLASS: cephrbd-fast-delete
|
|
WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 10G
|
|
WOODPECKER_BACKEND_K8S_STORAGE_RWX: false
|
|
# Required from woodpecker 3.16.0 (GHSA-qf34-295c-26v8): step-level
|
|
# serviceAccountName is gated behind this agent flag (default false).
|
|
# The estate's pipelines set backend_options.kubernetes.serviceAccountName
|
|
# (terraform-* jobs rely on per-SA Vault k8s auth), so keep this enabled.
|
|
WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP: "true"
|
|
WOODPECKER_LOG_LEVEL: debug
|
|
#extraSecretNamesForEnvFrom:
|
|
# - woodpecker-default-agent-secret
|
|
persistence:
|
|
storageClass: cephrbd-fast-delete
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
limits:
|
|
memory: 128Mi
|
|
|
|
server:
|
|
statefulSet:
|
|
replicaCount: 1
|
|
env:
|
|
WOODPECKER_HOST: 'https://ci.k8s.syd1.au.unkin.net'
|
|
WOODPECKER_OPEN: "true"
|
|
WOODPECKER_ADMIN: "unkinben"
|
|
WOODPECKER_DISABLE_USER_AGENT_REGISTRATION: "true"
|
|
WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure"
|
|
extraSecretNamesForEnvFrom:
|
|
- woodpecker-gitea
|
|
- woodpecker-postgres-credentials
|
|
- woodpecker-database-config
|
|
persistentVolume:
|
|
storageClass: cephrbd-fast-delete
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: vault-issuer
|
|
cert-manager.io/common-name: ci.k8s.syd1.au.unkin.net
|
|
cert-manager.io/private-key-size: "4096"
|
|
external-dns.alpha.kubernetes.io/hostname: ci.k8s.syd1.au.unkin.net
|
|
external-dns.alpha.kubernetes.io/target: 198.18.200.0
|
|
ingressClassName: nginx
|
|
hosts:
|
|
- host: ci.k8s.syd1.au.unkin.net
|
|
paths:
|
|
- path: /
|
|
backend:
|
|
servicePort: 80
|
|
tls:
|
|
- hosts:
|
|
- ci.k8s.syd1.au.unkin.net
|
|
secretName: ci-tls
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
limits:
|
|
memory: 128Mi
|