ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
457
services/project-delivery/k8s/vso.yaml
Normal file
457
services/project-delivery/k8s/vso.yaml
Normal file
|
|
@ -0,0 +1,457 @@
|
|||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: locutory-pull
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/tokens/project-delivery-source
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: locutory-pull
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "token" }}'
|
||||
vaultAuthRef: source
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: rcon-publisher
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: rcon-publisher
|
||||
serviceAccount: rcon-publisher-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: rcon-publisher
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: versitygw/users/rcon-publisher
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: rcon-publisher
|
||||
create: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
accesskey:
|
||||
text: rcon-publisher
|
||||
secretkey:
|
||||
text: '{{ get .Secrets "secretAccessKey" }}'
|
||||
vaultAuthRef: rcon-publisher
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: locutory-pages
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: locutory-pages
|
||||
serviceAccount: locutory-pages-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: locutory-pages
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: cloudflare/pages-publisher
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: locutory-pages
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "api-token" }}'
|
||||
vaultAuthRef: locutory-pages
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: apk-signing
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: apk-signing
|
||||
serviceAccount: apk-signing-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: artifacts
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: project-delivery-artifacts
|
||||
serviceAccount: project-delivery-artifacts-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: cache-reader
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: project-delivery-cache-reader
|
||||
serviceAccount: project-delivery-cache-reader-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: cache-writer
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: project-delivery-cache-writer
|
||||
serviceAccount: project-delivery-cache-writer-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: lazaret-publisher
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: lazaret-publisher
|
||||
serviceAccount: lazaret-publisher-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: quorate-pull
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: quorate-pull
|
||||
serviceAccount: quorate-pull-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: quorate-push
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: quorate-push
|
||||
serviceAccount: quorate-push-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: source
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: project-delivery-source
|
||||
serviceAccount: project-delivery-source-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: quay-reader
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: project-delivery-quay-reader
|
||||
serviceAccount: project-delivery-quay-reader-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: quay-writer
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: project-delivery-quay-writer
|
||||
serviceAccount: project-delivery-quay-writer-vso
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: apk-signing
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: project-delivery/apk-signing
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: apk-signing
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
private.pem:
|
||||
text: '{{ get .Secrets "private" }}'
|
||||
remora.rsa.pub:
|
||||
text: '{{ get .Secrets "public" }}'
|
||||
nuthatch.rsa.pub:
|
||||
text: '{{ get .Secrets "public" }}'
|
||||
vaultAuthRef: apk-signing
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: lazaret-publisher
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/tokens/lazaret-publisher
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: lazaret-publisher
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "token" }}'
|
||||
vaultAuthRef: lazaret-publisher
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quorate-pull
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo/tokens/quorate-pull
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: quorate-pull
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "token" }}'
|
||||
vaultAuthRef: quorate-pull
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quorate-push
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/tokens/quorate-push
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: quorate-push
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "token" }}'
|
||||
vaultAuthRef: quorate-push
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: source
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/tokens/project-delivery-source
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: project-delivery-source
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
token:
|
||||
text: '{{ get .Secrets "token" }}'
|
||||
vaultAuthRef: source
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: cache-reader
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: versitygw/users/project-delivery-cache-reader
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: project-delivery-cache-reader
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
accesskey:
|
||||
text: project-delivery-cache-reader
|
||||
secretkey:
|
||||
text: '{{ get .Secrets "secretAccessKey" }}'
|
||||
vaultAuthRef: cache-reader
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: cache-writer
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: versitygw/users/project-delivery-cache-writer
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: project-delivery-cache-writer
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
accesskey:
|
||||
text: project-delivery-cache-writer
|
||||
secretkey:
|
||||
text: '{{ get .Secrets "secretAccessKey" }}'
|
||||
vaultAuthRef: cache-writer
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-reader
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: quay/oauth/project-delivery-reader
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: quay-reader
|
||||
create: true
|
||||
overwrite: true
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
.dockerconfigjson:
|
||||
text: |
|
||||
{{- $token := get .Secrets "token" -}}
|
||||
{"auths":{"registry.quorate.internal":{"username":"$oauthtoken","password":"{{ $token }}","auth":"{{ printf "%s:%s" "$oauthtoken" $token | b64enc }}"}}}
|
||||
vaultAuthRef: quay-reader
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-writer
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: quay/oauth/project-delivery-writer
|
||||
refreshAfter: 5m
|
||||
destination:
|
||||
name: quay-writer
|
||||
create: true
|
||||
overwrite: true
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
.dockerconfigjson:
|
||||
text: |
|
||||
{{- $token := get .Secrets "token" -}}
|
||||
{"auths":{"registry.quorate.internal":{"username":"$oauthtoken","password":"{{ $token }}","auth":"{{ printf "%s:%s" "$oauthtoken" $token | b64enc }}"}}}
|
||||
vaultAuthRef: quay-writer
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: quay-internal-ca
|
||||
namespace: project-delivery
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: argo/artifacts
|
||||
refreshAfter: 1h
|
||||
destination:
|
||||
name: quay-internal-ca
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes: [.*]
|
||||
templates:
|
||||
ca.crt:
|
||||
text: |
|
||||
{{ get .Secrets "internal_ca_cert" }}
|
||||
vaultAuthRef: artifacts
|
||||
Loading…
Reference in a new issue