Erich Blume
f0ac04fb8a
All checks were successful
Build Container / build (push) Successful in 1m56s
## Summary - Temporarily revert composite action to `docker build` so we can build the runner image (chicken-and-egg: current runner v2.5.0 doesn't have buildx) - Bump runner label to `v2.5.1` so after sync the new runner image (with buildx) gets used ## Deployment plan 1. Merge this PR 2. Tag `forgejo-runner-v2.5.1` — builds with legacy `docker build` (one last time) 3. Sync forgejo-runner in ArgoCD to pick up the v2.5.1 label 4. Follow-up PR: switch action back to `docker buildx build` 5. Tag `nettest-v0.12.0` to verify buildx works end-to-end Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/148
34 lines
994 B
YAML
34 lines
994 B
YAML
# ExternalSecret for Forgejo Runner environment
|
|
#
|
|
# Replaces the manual op inject workflow from secret.yaml.tpl
|
|
#
|
|
# 1Password item: "Forgejo Secrets" in blumeops vault
|
|
# Field: runner_reg (runner registration token)
|
|
#
|
|
# Note: Static values (FORGEJO_URL, RUNNER_NAME, RUNNER_LABELS) are included
|
|
# via template since they don't need to be in 1Password.
|
|
#
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: forgejo-runner-env
|
|
namespace: forgejo-runner
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-blumeops
|
|
target:
|
|
name: forgejo-runner-env
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
FORGEJO_URL: "https://forge.ops.eblu.me"
|
|
RUNNER_NAME: "k8s-runner"
|
|
RUNNER_LABELS: "k8s:docker://registry.ops.eblu.me/blumeops/forgejo-runner:v2.5.1"
|
|
RUNNER_TOKEN: "{{ .runner_token }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: Forgejo Secrets
|
|
property: runner_reg
|