From b9f2c72bd47b0f5a6323ac83b4a2d1b3a3120e93 Mon Sep 17 00:00:00 2001 From: Brad Rodgers Date: Fri, 17 Jul 2026 07:13:58 -0400 Subject: [PATCH] deploy: private package pull via External Secrets; pull over public HTTPS (no k3s restart) - k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config) - CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted) - ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao - deployment uses imagePullSecrets: gitea-registry - .env added to .dockerignore --- .dockerignore | 2 ++ .gitea/workflows/ci.yml | 15 ++++++++++----- k8s/deployment.yaml | 13 +++++++------ k8s/externalsecret-registry.yaml | 26 ++++++++++++++++++++++++++ k8s/kustomization.yaml | 17 +++++++++-------- 5 files changed, 54 insertions(+), 19 deletions(-) create mode 100644 k8s/externalsecret-registry.yaml diff --git a/.dockerignore b/.dockerignore index fe1754e..c7ee11f 100644 --- a/.dockerignore +++ b/.dockerignore @@ -8,3 +8,5 @@ README.md docs k8s .DS_Store +.env +.env.* diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 4ca0d17..69b2f6b 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -27,7 +27,11 @@ on: - '**/*.md' env: - IMAGE: 10.66.15.22:3000/bmr_bluecap/bcs-website + # Push over the internal HTTP endpoint (fast, no edge; host dockerd trusts it as insecure). + PUSH_IMAGE: 10.66.15.22:3000/bmr_bluecap/bcs-website + # k3s pulls over the public HTTPS endpoint (valid TLS -> no registries.yaml / node config / restart). + # Same Gitea package as PUSH_IMAGE, just a different access path. + DEPLOY_IMAGE: git.7tl-homelab.com/bmr_bluecap/bcs-website jobs: ci: @@ -70,7 +74,7 @@ jobs: - name: Build & push image to Gitea Packages run: | echo "${{ secrets.CI_TOKEN }}" | docker login 10.66.15.22:3000 -u "${{ github.repository_owner }}" --password-stdin - docker build -t "$IMAGE:${{ steps.tag.outputs.sha }}" -t "$IMAGE:latest" . + docker build -t "$PUSH_IMAGE:${{ steps.tag.outputs.sha }}" -t "$PUSH_IMAGE:latest" . # Registry pushes can time out on a slow blob; docker push is resumable, so retry. push_retry() { for i in 1 2 3 4 5; do @@ -80,14 +84,15 @@ jobs: done return 1 } - push_retry "$IMAGE:${{ steps.tag.outputs.sha }}" - push_retry "$IMAGE:latest" + push_retry "$PUSH_IMAGE:${{ steps.tag.outputs.sha }}" + push_retry "$PUSH_IMAGE:latest" - name: Bump k8s image tag and commit back run: | git config user.name "gitea-actions[bot]" git config user.email "gitea-actions@bmr_bluecap" - (cd k8s && kustomize edit set image "$IMAGE=$IMAGE:${{ steps.tag.outputs.sha }}") + # Deployment references the public HTTPS image (what k3s pulls); bump its tag. + (cd k8s && kustomize edit set image "$DEPLOY_IMAGE=$DEPLOY_IMAGE:${{ steps.tag.outputs.sha }}") git add k8s/kustomization.yaml git diff --cached --quiet && { echo "no image change"; exit 0; } git commit -m "ci: deploy ${{ steps.tag.outputs.sha }} [skip ci]" diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml index 4507454..147ec08 100644 --- a/k8s/deployment.yaml +++ b/k8s/deployment.yaml @@ -13,14 +13,15 @@ spec: labels: app: bluecap-website spec: - # If the Gitea package is PRIVATE, create a docker-registry secret (ideally via - # External Secrets) named `gitea-registry` in this namespace and uncomment: - # imagePullSecrets: - # - name: gitea-registry + # Private Gitea package -> pull auth from the External-Secrets-managed dockerconfigjson + # (see k8s/externalsecret-registry.yaml). + imagePullSecrets: + - name: gitea-registry containers: - name: website - # Tag is managed by CI via kustomize (see k8s/kustomization.yaml `images`). - image: 10.66.15.22:3000/bmr_bluecap/bcs-website:latest + # Pulled over public HTTPS (valid cert -> no node registry config). Tag managed by CI + # via kustomize (see k8s/kustomization.yaml `images`). + image: git.7tl-homelab.com/bmr_bluecap/bcs-website:latest imagePullPolicy: IfNotPresent ports: - name: http diff --git a/k8s/externalsecret-registry.yaml b/k8s/externalsecret-registry.yaml new file mode 100644 index 0000000..98a54d5 --- /dev/null +++ b/k8s/externalsecret-registry.yaml @@ -0,0 +1,26 @@ +# Materializes a docker-registry pull secret (gitea-registry) from OpenBao via the existing +# ClusterSecretStore, so the private Gitea package can be pulled by k3s without a static secret +# in Git. Store a read:package Gitea PAT in OpenBao at `cluster/bluecap-registry` with fields +# `username` (e.g. bmr_bluecap) and `password` (the token). +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: gitea-registry + namespace: bluecap-strategies +spec: + refreshInterval: 1h + secretStoreRef: + name: openbao-cluster + kind: ClusterSecretStore + target: + name: gitea-registry + template: + type: kubernetes.io/dockerconfigjson + data: + .dockerconfigjson: | + {"auths":{"git.7tl-homelab.com":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}} + data: + - secretKey: username + remoteRef: { key: bluecap-registry, property: username } + - secretKey: password + remoteRef: { key: bluecap-registry, property: password } diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml index df544ec..c7ee25f 100644 --- a/k8s/kustomization.yaml +++ b/k8s/kustomization.yaml @@ -1,14 +1,15 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- namespace.yaml -- configmap.yaml -- deployment.yaml -- service.yaml -- ingress.yaml + - namespace.yaml + - configmap.yaml + - externalsecret-registry.yaml + - deployment.yaml + - service.yaml + - ingress.yaml # CI updates newTag to the immutable git-sha via `kustomize edit set image` (see .gitea/workflows/ci.yml). +# Name is the public HTTPS pull endpoint that k3s uses. images: -- name: 10.66.15.22:3000/bmr_bluecap/bcs-website - newName: 10.66.15.22:3000/bmr_bluecap/bcs-website - newTag: 79f2e8a78b9f + - name: git.7tl-homelab.com/bmr_bluecap/bcs-website + newTag: latest