From 1e0f1762d3fd881e2e70f420261b911040ffe84b Mon Sep 17 00:00:00 2001 From: benvin Date: Sat, 25 Jul 2026 00:27:21 +1000 Subject: [PATCH 1/2] ci: fetch vault from artifactapi instead of dnf install CI installed vault by shelling out to `dnf install vault -y`, which reads metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads the 169MB vendored vault RPM from the unkin repo on every pipeline run (~39s per plan/apply job). - Replace the dnf install with a pinned curl of the upstream vault zip from the artifactapi hashicorp-releases remote proxy, extracted with python3 to /usr/local/bin/vault. - Pin the version via a VAULT_VERSION env var (1.20.0). --- .woodpecker/apply.yaml | 3 ++- .woodpecker/plan.yaml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml index 49a9322..389d9c1 100644 --- a/.woodpecker/apply.yaml +++ b/.woodpecker/apply.yaml @@ -7,8 +7,9 @@ steps: image: git.unkin.net/unkin/almalinux9-opentofu:20260606 environment: VAULT_AUTH_METHOD: kubernetes + VAULT_VERSION: "1.20.0" commands: - - dnf install vault -y + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan - make apply backend_options: diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml index 3800f90..d288e46 100644 --- a/.woodpecker/plan.yaml +++ b/.woodpecker/plan.yaml @@ -6,8 +6,9 @@ steps: image: git.unkin.net/unkin/almalinux9-opentofu:20260606 environment: VAULT_AUTH_METHOD: kubernetes + VAULT_VERSION: "1.20.0" commands: - - dnf install vault -y + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan backend_options: kubernetes: -- 2.47.3 From 282730e578120b4bf13e44145b7b935923cd995e Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 25 Jul 2026 00:32:22 +1000 Subject: [PATCH 2/2] Escape VAULT_VERSION for woodpecker YAML substitution ($$ -> shell) --- .woodpecker/apply.yaml | 2 +- .woodpecker/plan.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.woodpecker/apply.yaml b/.woodpecker/apply.yaml index 389d9c1..6eb54b4 100644 --- a/.woodpecker/apply.yaml +++ b/.woodpecker/apply.yaml @@ -9,7 +9,7 @@ steps: VAULT_AUTH_METHOD: kubernetes VAULT_VERSION: "1.20.0" commands: - - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan - make apply backend_options: diff --git a/.woodpecker/plan.yaml b/.woodpecker/plan.yaml index d288e46..6f7191e 100644 --- a/.woodpecker/plan.yaml +++ b/.woodpecker/plan.yaml @@ -8,7 +8,7 @@ steps: VAULT_AUTH_METHOD: kubernetes VAULT_VERSION: "1.20.0" commands: - - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt + - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt - make plan backend_options: kubernetes: -- 2.47.3