80 lines
2.0 KiB
YAML
80 lines
2.0 KiB
YAML
# CI/CD Secrets Template for Tekton Pipelines
|
|
#
|
|
# DO NOT commit this file with actual credentials!
|
|
# Use the generate-secrets.sh script to create secrets safely.
|
|
#
|
|
# For production, use one of these approaches:
|
|
# 1. Sealed Secrets: kubeseal < secrets.yaml > sealed-secrets.yaml
|
|
# 2. External Secrets Operator: Configure with your secret store
|
|
# 3. Manual creation: kubectl create secret ... (see generate-secrets.sh)
|
|
|
|
---
|
|
# Secret for Gitea webhook validation
|
|
# Used by EventListener to validate incoming webhooks
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-webhook-secret
|
|
namespace: tekton-pipelines
|
|
labels:
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
|
app.kubernetes.io/component: triggers
|
|
type: Opaque
|
|
stringData:
|
|
# Generate with: openssl rand -hex 32
|
|
secretToken: "${WEBHOOK_SECRET_TOKEN}"
|
|
|
|
---
|
|
# Secret for Gitea container registry credentials
|
|
# Used by Kaniko to push images to Gitea registry
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-registry-credentials
|
|
namespace: tekton-pipelines
|
|
labels:
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
|
app.kubernetes.io/component: build
|
|
type: kubernetes.io/dockerconfigjson
|
|
stringData:
|
|
.dockerconfigjson: |
|
|
{
|
|
"auths": {
|
|
"${REGISTRY_URL}": {
|
|
"username": "${GITEA_USERNAME}",
|
|
"password": "${GITEA_PASSWORD}"
|
|
}
|
|
}
|
|
}
|
|
|
|
---
|
|
# Secret for Git credentials (used by pipeline to push GitOps updates)
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-git-credentials
|
|
namespace: tekton-pipelines
|
|
labels:
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
|
app.kubernetes.io/component: gitops
|
|
type: Opaque
|
|
stringData:
|
|
username: "${GITEA_USERNAME}"
|
|
password: "${GITEA_PASSWORD}"
|
|
|
|
---
|
|
# Secret for Flux GitRepository access
|
|
# Used by Flux to pull from Gitea repository
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: gitea-credentials
|
|
namespace: flux-system
|
|
labels:
|
|
app.kubernetes.io/name: bakery-ia-cicd
|
|
app.kubernetes.io/component: flux
|
|
type: Opaque
|
|
stringData:
|
|
username: "${GITEA_USERNAME}"
|
|
password: "${GITEA_PASSWORD}"
|