benvin
1e0f1762d3
CI installed vault by shelling out to `dnf install vault -y`, which reads metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads the 169MB vendored vault RPM from the unkin repo on every pipeline run (~39s per plan/apply job). - Replace the dnf install with a pinned curl of the upstream vault zip from the artifactapi hashicorp-releases remote proxy, extracted with python3 to /usr/local/bin/vault. - Pin the version via a VAULT_VERSION env var (1.20.0).
23 lines
780 B
YAML
23 lines
780 B
YAML
when:
|
|
- event: pull_request
|
|
|
|
steps:
|
|
- name: plan
|
|
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
|
environment:
|
|
VAULT_AUTH_METHOD: kubernetes
|
|
VAULT_VERSION: "1.20.0"
|
|
commands:
|
|
- curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
|
|
- make plan
|
|
backend_options:
|
|
kubernetes:
|
|
serviceAccountName: terraform-vault
|
|
resources:
|
|
requests:
|
|
memory: 512Mi
|
|
cpu: 1
|
|
limits:
|
|
memory: 2Gi
|
|
cpu: 2
|