unkin-agent
8a1d544393
artifactapi v3.14.0 can require a Vault-issued bearer JWT for writes to /api/v2/remotes and /api/v2/virtuals, so config changes stop being open to anything in-cluster. - bump artifactapi and artifactapi-ui images to v3.14.0 - set ARTIFACTAPI_OIDC_ISSUER to the Vault identity OIDC issuer and ARTIFACTAPI_OIDC_AUDIENCE to artifactapi Requires terraform-artifactapi #64 merged first. Reviewed-on: #552 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
19 lines
490 B
YAML
19 lines
490 B
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: api-env
|
|
namespace: artifactapi
|
|
data:
|
|
ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
|
|
ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
|
|
DBHOST: postgres-pooler
|
|
DBNAME: artifacts
|
|
DBPORT: "5432"
|
|
DBUSER: artifacts
|
|
MINIO_BUCKET: artifactapi-prod-k8s-syd1-au
|
|
MINIO_ENDPOINT: radosgw.service.consul
|
|
MINIO_SECURE: "true"
|
|
REDIS_URL: redis://redis:6379
|
|
SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt
|