81 lines
2.6 KiB
YAML
81 lines
2.6 KiB
YAML
---
|
|
# gitea-runner-secret — neural-platform org runner token
|
|
#
|
|
# GITEA_INSTANCE_URL stays as the in-cluster URL — the act_runner daemon
|
|
# polls it constantly and we don't want every poll to hit Cloudflare Access.
|
|
# Build containers, however, need the public URL because they run with
|
|
# network: host and can't resolve gitea.git.svc.cluster.local. The
|
|
# git-cf-access-init.sh entrypoint in the ci-base image rewrites the
|
|
# in-cluster URL to https://git.neuralplatform.ai with the CF Access
|
|
# headers from CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET below.
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: gitea-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-05-04-cf-access"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: gitea-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
|
|
CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: runner_token
|
|
- secretKey: cf_access_client_id
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_id
|
|
- secretKey: cf_access_client_secret
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_secret
|
|
---
|
|
# neuron-technologies-runner-secret — neuron-technologies org runner token
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: neuron-technologies-runner-secret
|
|
namespace: ci
|
|
annotations:
|
|
force-sync: "2026-05-04-cf-access"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: neuron-technologies-runner-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
|
|
CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
|
|
CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
|
|
data:
|
|
- secretKey: runner_token
|
|
remoteRef:
|
|
key: secret/data/gitea
|
|
property: neuron_technologies_runner_token
|
|
- secretKey: cf_access_client_id
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_id
|
|
- secretKey: cf_access_client_secret
|
|
remoteRef:
|
|
key: secret/data/gitea-runner-cf-access
|
|
property: client_secret
|