Erich Blume
f08595a3c0
Includes uv and argocd CLI for auto-deploy workflow. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
# ExternalSecret for Forgejo Runner environment
|
|
#
|
|
# Replaces the manual op inject workflow from secret.yaml.tpl
|
|
#
|
|
# 1Password item: "Forgejo Secrets" in blumeops vault
|
|
# Fields:
|
|
# - runner_reg: Runner registration token
|
|
# - argocd_token: API token for workflow-bot account (for auto-deploying docs)
|
|
#
|
|
# Note: Static values (FORGEJO_URL, RUNNER_NAME, RUNNER_LABELS) are included
|
|
# via template since they don't need to be in 1Password.
|
|
#
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: forgejo-runner-env
|
|
namespace: forgejo-runner
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-blumeops
|
|
target:
|
|
name: forgejo-runner-env
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
FORGEJO_URL: "https://forge.ops.eblu.me"
|
|
RUNNER_NAME: "k8s-runner"
|
|
RUNNER_LABELS: "k8s:docker://registry.ops.eblu.me/blumeops/forgejo-runner:v2.4.0"
|
|
RUNNER_TOKEN: "{{ .runner_token }}"
|
|
ARGOCD_AUTH_TOKEN: "{{ .argocd_token }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: Forgejo Secrets
|
|
property: runner_reg
|
|
- secretKey: argocd_token
|
|
remoteRef:
|
|
key: Forgejo Secrets
|
|
property: argocd_token
|