Brad Rodgers
b9f2c72bd4
All checks were successful
CI / ci (push) Successful in 1m55s
- k3s pulls git.7tl-homelab.com/... over valid TLS (no registries.yaml/node config) - CI still pushes internally to 10.66.15.22:3000 (fast, insecure-trusted) - ExternalSecret materializes gitea-registry dockerconfigjson from OpenBao - deployment uses imagePullSecrets: gitea-registry - .env added to .dockerignore
27 lines
1.0 KiB
YAML
27 lines
1.0 KiB
YAML
# Materializes a docker-registry pull secret (gitea-registry) from OpenBao via the existing
|
|
# ClusterSecretStore, so the private Gitea package can be pulled by k3s without a static secret
|
|
# in Git. Store a read:package Gitea PAT in OpenBao at `cluster/bluecap-registry` with fields
|
|
# `username` (e.g. bmr_bluecap) and `password` (the token).
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitea-registry
|
|
namespace: bluecap-strategies
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: openbao-cluster
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitea-registry
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
.dockerconfigjson: |
|
|
{"auths":{"git.7tl-homelab.com":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
|
|
data:
|
|
- secretKey: username
|
|
remoteRef: { key: bluecap-registry, property: username }
|
|
- secretKey: password
|
|
remoteRef: { key: bluecap-registry, property: password }
|