From 0eeef5078133c6e35ccad6738fbd7fb57bdb83a4 Mon Sep 17 00:00:00 2001
From: Mukul Sharma <mukul.sharma909.ms@gmail.com>
Date: Fri, 4 Sep 2026 20:33:21 +0530
Subject: [PATCH] Add Jenkins API credentials for toolshed's builder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A dedicated Jenkins user with an API token, not the admin account. Needs
Job/Create as well as Build and Read, because builder creates an app's job
on first deploy — which is what guarantees the SCM polling trigger exists
and so that a webhook can ever find it (issue #30).
---
 .../toolshed-jenkins-credentials.yaml         | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 secretstores/toolshed-jenkins-credentials.yaml

diff --git a/secretstores/toolshed-jenkins-credentials.yaml b/secretstores/toolshed-jenkins-credentials.yaml
new file mode 100644
index 0000000..f1c5c23
--- /dev/null
+++ b/secretstores/toolshed-jenkins-credentials.yaml
@@ -0,0 +1,46 @@
+# Jenkins API credentials for toolshed's builder.
+#
+# builder holds these and nothing else — no Kubernetes access, no session
+# signing key. It is the service that talks to an external system over HTTP
+# with long-running operations, so it is also the one most likely to hang or
+# crash; keeping its blast radius to "can drive Jenkins" is deliberate.
+#
+# Use a dedicated Jenkins user rather than the admin account, with an API
+# token rather than a password. Jenkins issues tokens under
+# <user> -> Configure -> API Token -> Add new Token, and shows the value
+# exactly once.
+#
+# The user needs Job/Create as well as Job/Build and Job/Read: builder creates
+# an app's job the first time it deploys, which is what guarantees the SCM
+# polling trigger is present. Without that trigger a webhook can never find
+# the job no matter how exactly the repository URL matches (claude.md issue
+# #30) — creating jobs through the API is what stops that being something a
+# person has to remember.
+#
+#   kubectl -n vault exec -i vault-0 -- sh -lc '
+#     vault login <root-token> >/dev/null &&
+#     vault kv put secret/toolshed/jenkins \
+#       username=<jenkins user> \
+#       token=<api token>'
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: toolshed-jenkins
+  namespace: toolshed
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: toolshed-jenkins
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: toolshed/jenkins
+        property: username
+    - secretKey: token
+      remoteRef:
+        key: toolshed/jenkins
+        property: token