99 lines
2.7 KiB
YAML
99 lines
2.7 KiB
YAML
|
# CI/CD Secrets for Tekton Pipelines
|
||
|
|
#
|
||
|
|
# WARNING: This file contains EXAMPLE values only!
|
||
|
|
# DO NOT use these values in production.
|
||
|
|
#
|
||
|
|
# To create actual secrets, use ONE of these methods:
|
||
|
|
#
|
||
|
|
# Method 1 (Recommended): Use the generate-secrets.sh script
|
||
|
|
# ./generate-secrets.sh --gitea-user <username> --gitea-password <password>
|
||
|
|
#
|
||
|
|
# Method 2: Create secrets manually with kubectl
|
||
|
|
# kubectl create secret generic gitea-webhook-secret \
|
||
|
|
# --namespace tekton-pipelines \
|
||
|
|
# --from-literal=secretToken="$(openssl rand -hex 32)"
|
||
|
|
#
|
||
|
|
# Method 3: Use Sealed Secrets for GitOps
|
||
|
|
# kubeseal < secrets-template.yaml > sealed-secrets.yaml
|
||
|
|
#
|
||
|
|
# Method 4: Use External Secrets Operator
|
||
|
|
# Configure ESO to pull from your secret store (Vault, AWS SM, etc.)
|
||
|
|
|
||
|
|
---
|
||
|
|
# Example Secret for Gitea webhook validation
|
||
|
|
# Used by EventListener to validate incoming webhooks
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Secret
|
||
|
|
metadata:
|
||
|
|
name: gitea-webhook-secret
|
||
|
|
namespace: tekton-pipelines
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
||
|
|
app.kubernetes.io/component: triggers
|
||
|
|
annotations:
|
||
|
|
note: "EXAMPLE - Replace with actual secret using generate-secrets.sh"
|
||
|
|
type: Opaque
|
||
|
|
stringData:
|
||
|
|
# Generate with: openssl rand -hex 32
|
||
|
|
secretToken: "example-webhook-token-do-not-use-in-production"
|
||
|
|
|
||
|
|
---
|
||
|
|
# Example Secret for Gitea container registry credentials
|
||
|
|
# Used by Kaniko to push images to Gitea registry
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Secret
|
||
|
|
metadata:
|
||
|
|
name: gitea-registry-credentials
|
||
|
|
namespace: tekton-pipelines
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
||
|
|
app.kubernetes.io/component: build
|
||
|
|
annotations:
|
||
|
|
note: "EXAMPLE - Replace with actual secret using generate-secrets.sh"
|
||
|
|
type: kubernetes.io/dockerconfigjson
|
||
|
|
stringData:
|
||
|
|
.dockerconfigjson: |
|
||
|
|
{
|
||
|
|
"auths": {
|
||
|
|
"gitea.bakery-ia.local:5000": {
|
||
|
|
"username": "example-user",
|
||
|
|
"password": "example-password"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
---
|
||
|
|
# Example Secret for Git credentials (used by pipeline to push GitOps updates)
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Secret
|
||
|
|
metadata:
|
||
|
|
name: gitea-git-credentials
|
||
|
|
namespace: tekton-pipelines
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
||
|
|
app.kubernetes.io/component: gitops
|
||
|
|
annotations:
|
||
|
|
note: "EXAMPLE - Replace with actual secret using generate-secrets.sh"
|
||
|
|
type: Opaque
|
||
|
|
stringData:
|
||
|
|
username: "example-user"
|
||
|
|
password: "example-password"
|
||
|
|
|
||
|
|
---
|
||
|
|
# Example Secret for Flux GitRepository access
|
||
|
|
# Used by Flux to pull from Gitea repository
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Secret
|
||
|
|
metadata:
|
||
|
|
name: gitea-credentials
|
||
|
|
namespace: flux-system
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
||
|
|
app.kubernetes.io/component: flux
|
||
|
|
annotations:
|
||
|
|
note: "EXAMPLE - Replace with actual secret using generate-secrets.sh"
|
||
|
|
type: Opaque
|
||
|
|
stringData:
|
||
|
|
username: "example-user"
|
||
|
|
password: "example-password"
|