macanhhuy
d6dddbbc91
Build + push image / build-and-push (push) Successful in 1m8s
Replace eu.gcr.io/vnc-development image refs with gitea.saas.vnc.biz/vnciac, swap gcr-json-key pull secret for gitea-registry, and update CI/deploy docs from GitLab CI to Gitea Actions.
66 lines
2.5 KiB
YAML
66 lines
2.5 KiB
YAML
# =============================================================================
|
|
# WARNING — UNSAFE EXAMPLE — DO NOT USE AS-IS IN PRODUCTION
|
|
# =============================================================================
|
|
#
|
|
# This file deploys the `prosody-secrets` Secret (consumed by the prosody
|
|
# Helm chart's `secretEnv`) through ArgoCD using PLAINTEXT stringData.
|
|
#
|
|
# Storing raw credentials in Git is unsafe. Committing real secrets here would
|
|
# leak them to anyone with repo access and into the full git history. This
|
|
# example exists only to show the wiring.
|
|
#
|
|
# Provide the Secret in a secure manner instead, e.g.:
|
|
#
|
|
# * Sealed Secrets — commit a SealedSecret (Bitnami); the controller
|
|
# decrypts it in-cluster. Replace the Secret below with a
|
|
# SealedSecret produced by `kubeseal`.
|
|
# * External Secrets Operator — reference an external vault (AWS Secrets
|
|
# Manager, HashiCorp Vault, or the self-hosted Infisical)
|
|
# via a SecretStore + ExternalSecret; no secret material in Git.
|
|
# * SOPS / age-encrypted manifests decrypted by ArgoCD's KSOPS plugin.
|
|
#
|
|
# The keys below MUST match `secretEnv.keys` in argo/prosody.yaml:
|
|
# prosodyDBpass, fcmApiKey, fileShareSecret, avatarUploadPass
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: prosody-secrets
|
|
namespace: prosody
|
|
labels:
|
|
app.kubernetes.io/name: prosody
|
|
app.kubernetes.io/managed-by: argocd.argoproj.io
|
|
type: Opaque
|
|
stringData:
|
|
prosodyDBpass: "REPLACE_WITH_REAL_DB_PASSWORD"
|
|
fcmApiKey: "REPLACE_WITH_REAL_FCM_API_KEY"
|
|
fileShareSecret: "REPLACE_WITH_REAL_FILESHARE_SECRET"
|
|
avatarUploadPass: "REPLACE_WITH_REAL_AVATAR_UPLOAD_PASSWORD"
|
|
---
|
|
# ArgoCD Application that syncs the Secret above into the prosody namespace.
|
|
# Point `path` at the directory in your GitOps repo that holds the (sealed /
|
|
# encrypted) Secret manifest. This example assumes the Secret lives next to a
|
|
# copy of this file in `charts/prosody-secrets`.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: prosody-secrets
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: prosody
|
|
project: default
|
|
source:
|
|
path: charts/prosody-secrets
|
|
repoURL: https://gitea.saas.vnc.biz/VNC/vnctalk-prosody.git
|
|
targetRevision: HEAD
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=false
|