From 014a79ddee5ff585ef39dde04cdad7c75a0e16ae Mon Sep 17 00:00:00 2001 From: benvin Date: Sat, 25 Jul 2026 00:27:21 +1000 Subject: [PATCH 1/2] ci: fetch vault from artifactapi instead of dnf install CI installed vault by shelling out to `dnf install vault -y`, which reads metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads the 169MB vendored vault RPM from the unkin repo on every pipeline run (~39s per plan/apply job). - Replace the dnf install with a pinned curl of the upstream vault zip from the artifactapi hashicorp-releases remote proxy, extracted with python3 to /usr/local/bin/vault. - Pin the version via a VAULT_VERSION env var (1.20.0). --- .woodpecker/apply.yaml | 3 ++- .woodpecker/plan.yaml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml index d86c17c..e5a2420 100644 --- a/.woodpecker/apply.yaml +++ b/.woodpecker/apply.yaml @@ -7,8 +7,9 @@ steps: image: git.unkin.net/unkin/almalinux9-opentofu:20260606 environment: VAULT_AUTH_METHOD: kubernetes + VAULT_VERSION: "1.20.0" commands: - - dnf install vault -y + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan - make apply backend_options: diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml index a4c016b..0b95ee7 100644 --- a/.woodpecker/plan.yaml +++ b/.woodpecker/plan.yaml @@ -6,8 +6,9 @@ steps: image: git.unkin.net/unkin/almalinux9-opentofu:20260606 environment: VAULT_AUTH_METHOD: kubernetes + VAULT_VERSION: "1.20.0" commands: - - dnf install vault -y + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan backend_options: kubernetes: From 71f431abfd23b41cca96fe09193d72a757469e71 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 25 Jul 2026 00:32:21 +1000 Subject: [PATCH 2/2] Escape VAULT_VERSION for woodpecker YAML substitution ($$ -> shell) --- .woodpecker/apply.yaml | 2 +- .woodpecker/plan.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml index e5a2420..30b9f35 100644 --- a/.woodpecker/apply.yaml +++ b/.woodpecker/apply.yaml @@ -9,7 +9,7 @@ steps: VAULT_AUTH_METHOD: kubernetes VAULT_VERSION: "1.20.0" commands: - - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan - make apply backend_options: diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml index 0b95ee7..754f134 100644 --- a/.woodpecker/plan.yaml +++ b/.woodpecker/plan.yaml @@ -8,7 +8,7 @@ steps: VAULT_AUTH_METHOD: kubernetes VAULT_VERSION: "1.20.0" commands: - - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan backend_options: kubernetes: