284313f908
Some checks are pending
Bidi Control Character Guard / bidi-control-guard (push) Waiting to run
Circular Dependency Check / Check for new circular dependencies (push) Waiting to run
Citus Migration Smoke / Combined migrations on single-node Citus (push) Waiting to run
E2E Fresh Install Tests / fresh-install-e2e (push) Waiting to run
ext-v2 guardrails / Run ext-v2 guard and ESLint (push) Waiting to run
Integration Tests / Check for relevant changes (push) Waiting to run
Integration Tests / ${{ (github.event_name == 'schedule' || github.event.inputs.suite == 'full') && 'Full integration suite' || 'Tier-1 integration subset' }} (push) Blocked by required conditions
Mobile checks / Mobile lint + typecheck (push) Waiting to run
Mobile checks / Mobile unit tests (push) Waiting to run
Mobile checks / Mobile dependency audit (report) (push) Waiting to run
Mobile checks / Mobile reproducibility checks (push) Waiting to run
Secrets guard (env backups) / Ensure no tracked env backup files (push) Waiting to run
Temporal Readiness / fast-readiness (push) Waiting to run
Temporal Readiness / docker-parity (push) Waiting to run
TypeScript Type Check / Nx affected typecheck (push) Waiting to run
Unit Tests / Skipped-test budget (push) Waiting to run
Unit Tests / Nx affected unit tests (push) Waiting to run
Unit Tests / Server unit coverage (informational) (push) Waiting to run
Validate Tenant Management Schema / Check for relevant changes (push) Waiting to run
Validate Tenant Management Schema / Validate Tenant Management Schema (push) Blocked by required conditions
EE Workflows Build Guard / ee-workflows-build-guard (push) Waiting to run
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz Source: /opt/alga-psa on psa.joliet.tech
97 lines
3.2 KiB
YAML
97 lines
3.2 KiB
YAML
{{- if .Values.devEnv.enabled }}
|
|
{{- $fullname := include "sebastian.fullname" . }}
|
|
{{- $jobName := printf "%s-harbor-creds" $fullname | trunc 63 | trimSuffix "-" }}
|
|
{{- $shortName := printf "harbor-creds-%s" (substr 0 8 ($fullname | sha256sum)) | trunc 63 | trimSuffix "-" }}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ $jobName }}
|
|
namespace: {{ .Values.devEnv.namespace }}
|
|
labels:
|
|
{{- include "sebastian.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: harbor-credentials
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "-15" # After namespace creation (-20) but before other secrets (-10)
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: {{ $shortName }}
|
|
labels:
|
|
{{- include "sebastian.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: harbor-credentials
|
|
spec:
|
|
serviceAccountName: {{ printf "%s-harbor-sa" $fullname | trunc 63 | trimSuffix "-" }}
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: copy-credentials
|
|
image: alpine/k8s:1.28.3
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
echo "Copying harbor-credentials from msp namespace..."
|
|
kubectl get secret harbor-credentials -n msp -o yaml | \
|
|
sed 's/namespace: msp/namespace: {{ .Values.devEnv.namespace }}/' | \
|
|
kubectl apply -f -
|
|
echo "Harbor credentials copied successfully"
|
|
|
|
---
|
|
{{- $saName := printf "%s-harbor-sa" $fullname | trunc 63 | trimSuffix "-" }}
|
|
{{- $roleName := printf "%s-harbor-role" $fullname | trunc 63 | trimSuffix "-" }}
|
|
{{- $bindingName := printf "%s-harbor-bind" $fullname | trunc 63 | trimSuffix "-" }}
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ $saName }}
|
|
namespace: {{ .Values.devEnv.namespace }}
|
|
labels:
|
|
{{- include "sebastian.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: harbor-credentials
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "-18"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: {{ $roleName }}
|
|
labels:
|
|
{{- include "sebastian.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: harbor-credentials
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "-18"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "create", "apply", "patch"]
|
|
- apiGroups: [""]
|
|
resources: ["namespaces"]
|
|
verbs: ["get"]
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: {{ $bindingName }}
|
|
labels:
|
|
{{- include "sebastian.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: harbor-credentials
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "-18"
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ $saName }}
|
|
namespace: {{ .Values.devEnv.namespace }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ $roleName }}
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }} |