unkin-agent
2dad204428
encapi v0.2.0 authenticates writes with Vault identity OIDC tokens; it must validate the issuer, which is served with the internal Vault CA. - bump encapi image to v0.2.0 - set ENCAPI_OIDC_ISSUER to the Vault identity OIDC issuer - trust the Vault CA via a combined bundle and SSL_CERT_FILE, matching artifactapi Reviewed-on: #567 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
16 lines
335 B
YAML
16 lines
335 B
YAML
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: encapi-env
|
|
namespace: encapi
|
|
data:
|
|
LISTEN_ADDR: ":8000"
|
|
DBHOST: postgres-pooler
|
|
DBNAME: encapi
|
|
DBPORT: "5432"
|
|
DBUSER: encapi
|
|
DBSSL: require
|
|
ENCAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
|
|
SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt
|