Mukul SharmaandClaude Opus 5
9c67afd5e0
Adds nine Applications — external-secrets, harbor, jenkins, postgresql, redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing the cluster to the homelab's full set. Every nameOverride is pinned, which is load-bearing rather than cosmetic in at least three cases: external-secrets (its service account name is what vault-backend's serviceAccountRef and Vault's auth role bind to), victoria-metrics-single (its Service renders as <release>-server, the address vmagent and Grafana both hardcode) and harbor (the pipeline refers to its object names). extra-manifests gains the ClusterIssuer that makes cert-manager useful here: a CA issuer over the registry-ca Secret, which is created by hand from terraform output because the CA's private key exists only in Terraform state and nothing can reconcile it from git. Two homelab-only things removed rather than left to confuse: the Tailscale Harbor Ingress, and the homelab cluster's own entry point and values file, which have no meaning in a GCP-only repo. app-of-secretstores and app-of-extra-manifests now point at this cluster's Gitea over cluster DNS, and harbor-robot-dockerconfig is keyed to this cluster's registry hostname — docker matches stored credentials by exact host, so the homelab's would have silently pushed unauthenticated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
48 lines
2.0 KiB
YAML
48 lines
2.0 KiB
YAML
# Docker registry credentials for Jenkins to push to Harbor, as a proper
|
|
# kubernetes.io/dockerconfigjson secret (not a plain Opaque one) so it can
|
|
# be mounted straight at ~/.docker/config.json in the build container —
|
|
# docker push/pull read that format natively, no explicit `docker login`
|
|
# step needed in the pipeline itself.
|
|
#
|
|
# Vault-backed, same pattern as everything else. Put the robot account's
|
|
# credentials in first (create it in the Harbor UI: your CI project ->
|
|
# Robot Accounts -> New Robot Account, scoped to push+pull on that one
|
|
# project — Harbor shows the secret once, copy it immediately):
|
|
# kubectl -n vault exec -i vault-0 -- vault kv put secret/harbor/jenkins-robot \
|
|
# username='robot$<project>+<robot-name>' \
|
|
# password='<the generated secret>'
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: harbor-robot-dockerconfig
|
|
namespace: jenkins
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: harbor-robot-dockerconfig
|
|
creationPolicy: Owner
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
# Keyed by exact registry hostname — docker matches credentials
|
|
# against the host portion of the image reference, so this must be
|
|
# the same hostname the pipeline pushes to, the node pool was told
|
|
# to trust, and Harbor's own externalURL uses. On GKE that is the
|
|
# Contour ingress host, never harbor-core.harbor.svc.cluster.local:
|
|
# cluster DNS resolves from a pod but not from the node's containerd
|
|
# doing the actual image pull.
|
|
.dockerconfigjson: |
|
|
{"auths":{"harbor.35.238.248.203.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: harbor/jenkins-robot
|
|
property: username
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: harbor/jenkins-robot
|
|
property: password
|