unkinben
b1b2112c66
## Why The new terraform-rancher CI pipeline runs as a pod in the woodpecker namespace; its ServiceAccount token is what Vault binds to the `woodpecker_terraform_rancher` k8s auth role (see terraform-vault#86) for rancher2 provider auth + Consul state. ## Change - Add `ServiceAccount/terraform-rancher` (woodpecker ns) and wire it into the woodpecker kustomization, mirroring the other terraform-* runner SAs. ## Validation `kustomize build apps/base/woodpecker` renders it; pre-commit clean. Reviewed-on: #257 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
19 lines
523 B
YAML
19 lines
523 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_pooler.yaml
|
|
- serviceaccount_terraform_artifactapi.yaml
|
|
- serviceaccount_terraform_authentik.yaml
|
|
- serviceaccount_terraform_git.yaml
|
|
- serviceaccount_terraform_prowlarr.yaml
|
|
- serviceaccount_terraform_rancher.yaml
|
|
- serviceaccount_terraform_radarr.yaml
|
|
- serviceaccount_terraform_sonarr.yaml
|
|
- serviceaccount_terraform_vault.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|