Erich Blume
13895bb04a
Follow-up to #367. That PR localized external-secrets but the Dagger build (on indri's Apple Silicon runner) only produces an **arm64** image — and external-secrets also runs on **ringtail (amd64)** via the same shared manifest. This completes the localization so both clusters run the local binary on their native arch. ## Approach (matches the kube-state-metrics dual-build pattern) - **`containers/external-secrets/default.nix`** (new) — builds the **amd64** image on ringtail's nix-container-builder. `buildGoModule` with Go 1.26 (v2.2.0 requires ≥1.26.1; nixpkgs default is 1.25.x) and `-tags all_providers`, faithful to upstream. Same v2.2.0 source from the forge mirror. - **`argocd/manifests/external-secrets-ringtail/`** (new) — thin kustomize overlay that reuses the shared indri manifest as a base and overrides **only** the image to the `-nix` (amd64) tag. No manifest duplication. - **`argocd/apps/external-secrets-ringtail.yaml`** — repointed at the new overlay. Result: indri → `v2.2.0-…` (arm64, Dagger), ringtail → `v2.2.0-…-nix` (amd64, nix). ## Build Run #581 built both arches at the branch commit. Verified the nix image is `linux/amd64`, entrypoint = the binary, user 65534. ## Deployed from branch & verified on ringtail (k3s, amd64) - All 3 pods rolled to the nix amd64 image, `1/1 Running` (no exec-format error → arch correct) - Controller logs clean - **Live secret fetch proven:** force-synced `homepage/homepage-grafana` → `refreshTime` advanced, `Ready=True` - **All 20** ringtail ExternalSecrets remain `SecretSynced=True` ## Post-merge The `external-secrets-ringtail` app is temporarily pointed at this branch + overlay path (apps app left on `main`, manual-sync, untouched). After merge: ``` argocd app sync apps # picks up the new Application path on main argocd app set external-secrets-ringtail --revision main && argocd app sync external-secrets-ringtail ``` I'll also rebuild off `main` so both clusters land on stable main-sha tags (as done for indri in #367). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #368
56 lines
1.6 KiB
Nix
56 lines
1.6 KiB
Nix
# Nix-built External Secrets Operator (amd64, for ringtail k3s).
|
|
# Builds v2.2.0 from the forge mirror with all secret providers compiled in,
|
|
# faithful to upstream's `make build` (-tags all_providers). The container.py
|
|
# sibling builds the arm64 image for indri's minikube; this default.nix builds
|
|
# the amd64 image on ringtail's nix-container-builder.
|
|
{ pkgs ? import <nixpkgs> { } }:
|
|
|
|
let
|
|
version = "2.2.0";
|
|
|
|
src = pkgs.fetchgit {
|
|
url = "https://forge.ops.eblu.me/mirrors/external-secrets.git";
|
|
rev = "v${version}";
|
|
hash = "sha256-eAocOAp5s4CFRrpKfQr2lf3Ji+6nQQ1A5/eTw5B7v9U=";
|
|
};
|
|
|
|
# external-secrets v2.2.0 requires Go >= 1.26.1; nixpkgs default go is 1.25.x.
|
|
external-secrets = (pkgs.buildGoModule.override { go = pkgs.go_1_26; }) {
|
|
inherit src version;
|
|
pname = "external-secrets";
|
|
vendorHash = "sha256-0xuBK3fjAplPLAElHvKB6d+2lDz+De/s91fV4dPZwjE=";
|
|
|
|
doCheck = false;
|
|
|
|
subPackages = [ "." ];
|
|
|
|
tags = [ "all_providers" ];
|
|
|
|
ldflags = [ "-s" "-w" ];
|
|
|
|
meta = with pkgs.lib; {
|
|
description = "Kubernetes operator that integrates external secret management systems";
|
|
homepage = "https://github.com/external-secrets/external-secrets";
|
|
license = licenses.asl20;
|
|
mainProgram = "external-secrets";
|
|
};
|
|
};
|
|
in
|
|
|
|
pkgs.dockerTools.buildLayeredImage {
|
|
name = "blumeops/external-secrets";
|
|
contents = [
|
|
external-secrets
|
|
pkgs.cacert
|
|
pkgs.tzdata
|
|
];
|
|
|
|
config = {
|
|
Entrypoint = [ "${external-secrets}/bin/external-secrets" ];
|
|
Env = [
|
|
"SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
|
|
"TZDIR=${pkgs.tzdata}/share/zoneinfo"
|
|
];
|
|
User = "65534";
|
|
};
|
|
}
|