unkin-agent
a4efca8ee5
Woodpecker uploaders now mint Vault OIDC tokens, so anonymous local-repo writes can be rejected. - set `ARTIFACTAPI_AUTH_UPLOADS: "true"` in the artifactapi `api-env` configmap Merge after unkin/vault-plugin-secrets-litellm#6. Reviewed-on: #574 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
20 lines
525 B
YAML
20 lines
525 B
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: api-env
|
|
namespace: artifactapi
|
|
data:
|
|
ARTIFACTAPI_AUTH_UPLOADS: "true"
|
|
ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
|
|
ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
|
|
DBHOST: postgres-pooler
|
|
DBNAME: artifacts
|
|
DBPORT: "5432"
|
|
DBUSER: artifacts
|
|
MINIO_BUCKET: artifactapi-prod-k8s-syd1-au
|
|
MINIO_ENDPOINT: radosgw.service.consul
|
|
MINIO_SECURE: "true"
|
|
REDIS_URL: redis://redis:6379
|
|
SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt
|