CI images move off the packer-images monorepo to semver-released container-* repos.
- run RPM build steps on docker-internal/rpmbuilder:0.1.0-alma9
Reviewed-on: #3
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
Why: standardize Go CI on the estate gobuilder image and cut cold build/test
time with the shared S3 build cache.
- build/test/pre-commit/release(build) now use gobuilder:0.1.2-alma9
- add GOCACHE_* env + AWS creds (org secrets) to those steps
- cache dir is absolute (/tmp/gocache), metrics enabled
- bump k8s resource requests/limits for compile+cache overhead
- packaging/upload steps (nfpm, no Go) left untouched
Reviewed-on: #2
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
A Vault/OpenBao secrets engine that manages BIND TSIG keys via the
bind-operator companion API (Vault -> HTTP API -> BindTSIGKey CRs).
- backend + cmd entry point (plugin.ServeMultiplex), modelled on
vault-plugin-secrets-litellm
- config path: companion API url/token/tls + defaults
- static-roles/static-creds: stable named key with managed rotation
- roles/creds: dynamic, lease-bound keys (revoke deletes the CR)
- tsig_key secret type with revoke/renew
- HTTP client for the companion API contract (/v1/keys CRUD + rotate)
- Makefile, Woodpecker CI (pre-commit/build/test + tag release RPMs),
nfpm packaging (vault + openbao flavours)
- e2e: mock companion API + Vault + OpenBao in docker-compose, full
lifecycle per engine; unit tests for the dynamic + static flows
unkin-agent
benvin
unkinben
gitadmin