Add new infra architecture

infrastructure/cicd/tekton/secrets/secrets-template.yaml

@@ -0,0 +1,79 @@
+# CI/CD Secrets Template for Tekton Pipelines
+#
+# DO NOT commit this file with actual credentials!
+# Use the generate-secrets.sh script to create secrets safely.
+#
+# For production, use one of these approaches:
+# 1. Sealed Secrets: kubeseal < secrets.yaml > sealed-secrets.yaml
+# 2. External Secrets Operator: Configure with your secret store
+# 3. Manual creation: kubectl create secret ... (see generate-secrets.sh)
+
+---
+# Secret for Gitea webhook validation
+# Used by EventListener to validate incoming webhooks
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-webhook-secret
+  namespace: tekton-pipelines
+  labels:
+    app.kubernetes.io/name: bakery-ia-cicd
+    app.kubernetes.io/component: triggers
+type: Opaque
+stringData:
+  # Generate with: openssl rand -hex 32
+  secretToken: "${WEBHOOK_SECRET_TOKEN}"
+
+---
+# Secret for Gitea container registry credentials
+# Used by Kaniko to push images to Gitea registry
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-registry-credentials
+  namespace: tekton-pipelines
+  labels:
+    app.kubernetes.io/name: bakery-ia-cicd
+    app.kubernetes.io/component: build
+type: kubernetes.io/dockerconfigjson
+stringData:
+  .dockerconfigjson: |
+    {
+      "auths": {
+        "${REGISTRY_URL}": {
+          "username": "${GITEA_USERNAME}",
+          "password": "${GITEA_PASSWORD}"
+        }
+      }
+    }
+
+---
+# Secret for Git credentials (used by pipeline to push GitOps updates)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-git-credentials
+  namespace: tekton-pipelines
+  labels:
+    app.kubernetes.io/name: bakery-ia-cicd
+    app.kubernetes.io/component: gitops
+type: Opaque
+stringData:
+  username: "${GITEA_USERNAME}"
+  password: "${GITEA_PASSWORD}"
+
+---
+# Secret for Flux GitRepository access
+# Used by Flux to pull from Gitea repository
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-credentials
+  namespace: flux-system
+  labels:
+    app.kubernetes.io/name: bakery-ia-cicd
+    app.kubernetes.io/component: flux
+type: Opaque
+stringData:
+  username: "${GITEA_USERNAME}"
+  password: "${GITEA_PASSWORD}"