Mukul Sharma
0eeef50781
A dedicated Jenkins user with an API token, not the admin account. Needs Job/Create as well as Build and Read, because builder creates an app's job on first deploy — which is what guarantees the SCM polling trigger exists and so that a webhook can ever find it (issue #30).
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
# Jenkins API credentials for toolshed's builder.
|
|
#
|
|
# builder holds these and nothing else — no Kubernetes access, no session
|
|
# signing key. It is the service that talks to an external system over HTTP
|
|
# with long-running operations, so it is also the one most likely to hang or
|
|
# crash; keeping its blast radius to "can drive Jenkins" is deliberate.
|
|
#
|
|
# Use a dedicated Jenkins user rather than the admin account, with an API
|
|
# token rather than a password. Jenkins issues tokens under
|
|
# <user> -> Configure -> API Token -> Add new Token, and shows the value
|
|
# exactly once.
|
|
#
|
|
# The user needs Job/Create as well as Job/Build and Job/Read: builder creates
|
|
# an app's job the first time it deploys, which is what guarantees the SCM
|
|
# polling trigger is present. Without that trigger a webhook can never find
|
|
# the job no matter how exactly the repository URL matches (claude.md issue
|
|
# #30) — creating jobs through the API is what stops that being something a
|
|
# person has to remember.
|
|
#
|
|
# kubectl -n vault exec -i vault-0 -- sh -lc '
|
|
# vault login <root-token> >/dev/null &&
|
|
# vault kv put secret/toolshed/jenkins \
|
|
# username=<jenkins user> \
|
|
# token=<api token>'
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: toolshed-jenkins
|
|
namespace: toolshed
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: toolshed-jenkins
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: toolshed/jenkins
|
|
property: username
|
|
- secretKey: token
|
|
remoteRef:
|
|
key: toolshed/jenkins
|
|
property: token
|