Open
Conversation
ferruhcihan
requested review from
Ani1357,
CasLubbers,
ElderMatt,
j-zimnowoda and
merll
as code owners
Contributor
|
Comparison of Helm chart templating output: @@ spec.template.spec.containers.apl-gitea-operator.image @@
! ± value change
- linode/apl-tasks:main
+ linode/apl-tasks:APL-523
@@ (root level) @@
# v1/Secret/apl-gitea-operator/apl-gitea-operator-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- giteaPassword: Z2l0UGFzc3dvcmRGb3JUZXN0aW5n
- oidcClientId: b3RvbWk=
- oidcClientSecret: c29tc2VjcmV0dmFsdWU=
- oidcEndpoint: aHR0cHM6Ly9rZXljbG9hay5kZXYubGlub2RlLWFwbC5uZXQvcmVhbG1zL290b21p
- kind: Secret
- metadata:
- name: apl-gitea-operator-secret
- namespace: apl-gitea-operator
- labels:
- app: raw
- app.kubernetes.io/instance: apl-gitea-operator-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/apl-gitea-operator/apl-gitea-operator-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: apl-gitea-operator-secret
+ namespace: apl-gitea-operator
+ labels:
+ app: raw
+ app.kubernetes.io/instance: apl-gitea-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: git_password
+ secretKey: gitPassword
+ - remoteRef:
+ key: keycloak-secrets
+ property: idp_clientSecret
+ secretKey: keycloakClientSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: apl-gitea-operator-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ giteaPassword: "{{ .gitPassword | toString }}"
+ oidcClientId: otomi
+ oidcClientSecret: "{{ .keycloakClientSecret | toString }}"
+ oidcEndpoint: "https://keycloak.dev.linode-apl.net/realms/otomi"
@@ spec.template.spec.containers.apl-harbor-operator.image @@
! ± value change
- linode/apl-tasks:main
+ linode/apl-tasks:APL-523
@@ (root level) @@
# v1/Secret/apl-harbor-operator/apl-harbor-operator-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- harborPassword: aGFyYm9yc29tZXNlY3JldHZhbHVl
- harborUser: YWRtaW4=
- oidcClientId: b3RvbWk=
- oidcClientSecret: c29tc2VjcmV0dmFsdWU=
- oidcEndpoint: aHR0cHM6Ly9rZXljbG9hay5kZXYubGlub2RlLWFwbC5uZXQvcmVhbG1zL290b21p
- kind: Secret
- metadata:
- name: apl-harbor-operator-secret
- namespace: apl-harbor-operator
- labels:
- app: raw
- app.kubernetes.io/instance: apl-harbor-operator-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/apl-harbor-operator/apl-harbor-operator-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: apl-harbor-operator-secret
+ namespace: apl-harbor-operator
+ labels:
+ app: raw
+ app.kubernetes.io/instance: apl-harbor-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: adminPassword
+ secretKey: harborAdminPassword
+ - remoteRef:
+ key: keycloak-secrets
+ property: idp_clientSecret
+ secretKey: keycloakClientSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: apl-harbor-operator-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ harborPassword: "{{ .harborAdminPassword | toString }}"
+ harborUser: admin
+ oidcClientId: otomi
+ oidcClientSecret: "{{ .keycloakClientSecret | toString }}"
+ oidcEndpoint: "https://keycloak.dev.linode-apl.net/realms/otomi"
@@ spec.template.spec.containers.apl-keycloak-operator.image @@
! ± value change
- linode/apl-tasks:main
+ linode/apl-tasks:APL-523
@@ (root level) @@
# v1/Secret/apl-keycloak-operator/apl-keycloak-operator-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- KEYCLOAK_ADMIN: b3RvbWktYWRtaW4=
- KEYCLOAK_ADMIN_PASSWORD: YmxhZGlibGE=
- KEYCLOAK_CLIENT_SECRET: c29tc2VjcmV0dmFsdWU=
- USERS: W3siZW1haWwiOiJwbGF0Zm9ybS1hZG1pbkBkZXYubGlub2RlLWFwbC5uZXQiLCJmaXJzdE5hbWUiOiJwbGF0Zm9ybSIsImdyb3VwcyI6WyJwbGF0Zm9ybS1hZG1pbiJdLCJpbml0aWFsUGFzc3dvcmQiOiIwMkxEV0IjcXprbmtlRjhmKm0lJSIsImxhc3ROYW1lIjoiYWRtaW4ifSx7ImVtYWlsIjoicGxhdGZvcm1AYWRtaW4uY29tIiwiZmlyc3ROYW1lIjoicGxhdGZvcm0iLCJncm91cHMiOlsicGxhdGZvcm0tYWRtaW4iLCJ0ZWFtLWFkbWluIl0sImluaXRpYWxQYXNzd29yZCI6InBsYXRmb3JtLWFkbWluLXBhc3N3b3JkIiwibGFzdE5hbWUiOiJhZG1pbiJ9LHsiZW1haWwiOiJ0ZWFtQGFkbWluLmNvbSIsImZpcnN0TmFtZSI6InRlYW0iLCJncm91cHMiOlsidGVhbS1hZG1pbiIsInRlYW0tZGVtbyJdLCJpbml0aWFsUGFzc3dvcmQiOiJ0ZWFtLWFkbWluLXBhc3N3b3JkIiwibGFzdE5hbWUiOiJhZG1pbiJ9LHsiZW1haWwiOiJ0ZWFtQG1lbWJlci5jb20iLCJmaXJzdE5hbWUiOiJ0ZWFtIiwiZ3JvdXBzIjpbInRlYW0tZGVtbyJdLCJpbml0aWFsUGFzc3dvcmQiOiJ0ZWFtLW1lbWJlci1wYXNzd29yZCIsImxhc3ROYW1lIjoibWVtYmVyIn1d
- kind: Secret
- metadata:
- name: apl-keycloak-operator-secret
- namespace: apl-keycloak-operator
- labels:
- app: raw
- app.kubernetes.io/instance: apl-keycloak-operator-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/apl-keycloak-operator/apl-keycloak-operator-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: apl-keycloak-operator-secret
+ namespace: apl-keycloak-operator
+ labels:
+ app: raw
+ app.kubernetes.io/instance: apl-keycloak-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: adminPassword
+ secretKey: adminPassword
+ - remoteRef:
+ key: keycloak-secrets
+ property: idp_clientSecret
+ secretKey: idpClientSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: apl-keycloak-operator-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ KEYCLOAK_ADMIN: otomi-admin
+ KEYCLOAK_ADMIN_PASSWORD: "{{ .adminPassword | toString }}"
+ KEYCLOAK_CLIENT_SECRET: "{{ .idpClientSecret | toString }}"
@@ spec.template.spec.containers.apl-operator.envFrom @@
! - two list entries removed:
- - secretRef:
- name: apl-sops-secrets
- - secretRef:
- name: apl-git-credentials
! + two list entries added:
+ - secretRef:
+ name: apl-sops-secrets
+ optional: true
+ - secretRef:
+ name: apl-git-credentials
+ optional: true
@@ stringData @@
# v1/Secret/apl-git-credentials
! - one map entry removed:
- password: gitPasswordForTesting
@@ (root level) @@
! - one map entry removed:
- # Setting a blank data again will wipe admin password/key/cert
- data:
- oidc.clientSecret: c29tc2VjcmV0dmFsdWU=
@@ (root level) @@
# v1/Secret/argocd/argocd-repo-creds-gitea
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- url: aHR0cHM6Ly9naXRlYS5kZXYubGlub2RlLWFwbC5uZXQ=
- password: Z2l0UGFzc3dvcmRGb3JUZXN0aW5n
- type: Z2l0
- username: b3RvbWktYWRtaW4=
- kind: Secret
- metadata:
- name: argocd-repo-creds-gitea
- namespace: argocd
- labels:
- app: raw
- app.kubernetes.io/instance: argocd-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- argocd.argoproj.io/secret-type: repo-creds
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/argocd/argocd-repo-creds-gitea-internal
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- url: aHR0cDovL2dpdGVhLWh0dHAuZ2l0ZWEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9vdG9taS92YWx1ZXMuZ2l0
- password: Z2l0UGFzc3dvcmRGb3JUZXN0aW5n
- type: Z2l0
- username: b3RvbWktYWRtaW4=
- kind: Secret
- metadata:
- name: argocd-repo-creds-gitea-internal
- namespace: argocd
- labels:
- app: raw
- app.kubernetes.io/instance: argocd-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- argocd.argoproj.io/secret-type: repo-creds
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/argocd/argocd-repo-creds-gitea
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: argocd-repo-creds-gitea
+ namespace: argocd
+ labels:
+ app: raw
+ app.kubernetes.io/instance: argocd-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: git_password
+ secretKey: gitPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: argocd-repo-creds-gitea
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ url: "https://gitea.dev.linode-apl.net"
+ password: "{{ .gitPassword | toString }}"
+ type: git
+ username: otomi-admin
+ metadata:
+ labels:
+ argocd.argoproj.io/secret-type: repo-creds
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/argocd/argocd-repo-creds-gitea-internal
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: argocd-repo-creds-gitea-internal
+ namespace: argocd
+ labels:
+ app: raw
+ app.kubernetes.io/instance: argocd-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: git_password
+ secretKey: gitPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: argocd-repo-creds-gitea-internal
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ url: "http://gitea-http.gitea.svc.cluster.local:3000/otomi/values.git"
+ password: "{{ .gitPassword | toString }}"
+ type: git
+ username: otomi-admin
+ metadata:
+ labels:
+ argocd.argoproj.io/secret-type: repo-creds
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/argocd/argocd-oidc-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: argocd-oidc-secret
+ namespace: argocd
+ labels:
+ app: raw
+ app.kubernetes.io/instance: argocd-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: keycloak-secrets
+ property: idp_clientSecret
+ secretKey: oidc.clientSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: argocd-secret
+ creationPolicy: Merge
@@ (root level) @@
# v1/Secret/external-dns
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- secret: eHZ4dnh2eHZ4dnh2eHZ4dnh2eHZ4dnh2eA==
- kind: Secret
- metadata:
- name: external-dns
- labels:
- app: raw
- app.kubernetes.io/instance: cert-manager-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/external-dns
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: external-dns
+ labels:
+ app: raw
+ app.kubernetes.io/instance: cert-manager-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: dns-secrets
+ property: provider_linode_apiToken
+ secretKey: secret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: external-dns
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ secret: "{{ .secret | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/custom-ca
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: custom-ca
+ labels:
+ app: raw
+ app.kubernetes.io/instance: cert-manager-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: cert-manager-secrets
+ property: customRootCAKey
+ secretKey: customRootCAKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: custom-ca
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ tls.crt: |
+ -----BEGIN CERTIFICATE-----
+ MIIDdDCCAlygAwIBAgIBATANBgkqhkiG9w0BAQUFADBuMRUwEwYDVQQDEwxyZWRr
+ dWJlcy5jb20xCzAJBgNVBAYTAk5MMRAwDgYDVQQIEwdVdHJlY2h0MRAwDgYDVQQH
+ EwdVdHJlY2h0MQ4wDAYDVQQKEwVPdG9taTEUMBIGA1UECxMLU2VsZi1TaWduZWQw
+ HhcNMjExMTAzMTAxOTAyWhcNMzExMTAzMTAxOTAyWjBuMRUwEwYDVQQDEwxyZWRr
+ dWJlcy5jb20xCzAJBgNVBAYTAk5MMRAwDgYDVQQIEwdVdHJlY2h0MRAwDgYDVQQH
+ EwdVdHJlY2h0MQ4wDAYDVQQKEwVPdG9taTEUMBIGA1UECxMLU2VsZi1TaWduZWQw
+ ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD4quPwHrharZhmqVQx/75N
+ M7Vp3ZmSd3gR2u8Dc1PkmEa6W9CiheVAB5KCzdN5sWaOlFKTy5sHg/zvyYZjvNGX
+ xaHCa4i6OyRgiTOC4NCrxuN5010G0vAxYaM1aIFcqObXuLcaK6miOybDLRfDxoHl
+ g/TKqdiPOMEb2ZgphFxL7oYXjkobOggH+wzwwMIc/1nA3eBjEPsIkQehmb0R0Kxw
+ K5VHPCvbPQb3USVqUs+NmsuCxmqkTtI32WqR0IuNAVqjaD9oNqcsKBgUOPYLYXM8
+ xsTzIn0QPysJIKUCRn1quHwvCQc1RnQBB8UG6iJboVdRe0GNS13vu5ikhoCb0oyV
+ AgMBAAGjHTAbMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgL0MA0GCSqGSIb3DQEB
+ BQUAA4IBAQBJWHPGnTqXME/MGwG2nAG/JqiCQ0ZOOyKgwN97wrQIlbra2BaUT1K4
+ tMDOjZlft1Luipg/IkzzMXt4eAmqGMxLIweqbve6aLm8KTpHkLdxLm3VPnhK8zzg
+ ysRRRjtkMo9KUOSvrS2dFsY+fQnbGUzpRcK8RrzM6CpgIaf29neP1xLUWQuUsy5y
+ yKCb6OQ9vaJBf/uvz73rQq0ym4Kx0FCFssshaja6lbz/jqCJmppdZE5pe5jvMVVv
+ ae5UQLbva0JyLY8Rc1vSY/epIHMLrV90GEagSkF/ejgF3uh8cliLuUYFAFyU8TnN
+ FWG+enMJfR04aWjp8M3MQ1IoCPVxoXxI
+ -----END CERTIFICATE-----
+
+ tls.key: "{{ .customRootCAKey | toString }}"
@@ (root level) @@
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- LINODE_TOKEN: eHZ4dnh2eHZ4dnh2eHZ4dnh2eHZ4dnh2eA==
- kind: Secret
- metadata:
- name: linode-dns-api-token
- labels:
- app: raw
- app.kubernetes.io/instance: external-dns-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: linode-dns-api-token
+ labels:
+ app: raw
+ app.kubernetes.io/instance: external-dns-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: dns-secrets
+ property: provider_linode_apiToken
+ secretKey: apiToken
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: linode-dns-api-token
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ LINODE_TOKEN: "{{ .apiToken | toString }}"
@@ stringData.mailer @@
# v1/Secret/gitea/gitea-inline-config
! ± value change in multiline text (one insert, one deletion)
FROM=no-reply@doma.in
HELO_HOSTNAME=doma.in
IS_TLS_ENABLED=true
MAILER_TYPE=smtp
- PASSWD=somesecretvalue
+ PASSWD=placeholder-overridden-by-env
SUBJECT_PREFIX=Otomi[Gitea]:
USER=no-reply@doma.in
enabled=true
@@ spec.template.spec.initContainers.init-app-ini.env @@
! + one list entry added:
+ - name: GITEA__MAILER__PASSWD
+ valueFrom:
+ secretKeyRef:
+ name: gitea-smtp-secret
+ key: password
@@ (root level) @@
# v1/Secret/gitea-admin-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- password: Z2l0UGFzc3dvcmRGb3JUZXN0aW5n
- username: b3RvbWktYWRtaW4=
- kind: Secret
- metadata:
- name: gitea-admin-secret
- labels:
- app: raw
- app.kubernetes.io/instance: gitea-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/linode-creds
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- S3_STORAGE_ACCOUNT: c29tZWFjY2Vzc0tleUlk
- S3_STORAGE_KEY: c29tZXNlY3JldHZhbHVl
- kind: Secret
- metadata:
- name: linode-creds
- labels:
- app: raw
- app.kubernetes.io/instance: gitea-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/gitea-admin-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: gitea-admin-secret
+ labels:
+ app: raw
+ app.kubernetes.io/instance: gitea-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: git_password
+ secretKey: git_password
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: gitea-admin-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ password: "{{ .git_password | toString }}"
+ username: otomi-admin
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/linode-creds
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: linode-creds
+ labels:
+ app: raw
+ app.kubernetes.io/instance: gitea-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: obj-storage-secrets
+ property: provider_linode_secretAccessKey
+ secretKey: secretAccessKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: linode-creds
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ S3_STORAGE_ACCOUNT: someaccessKeyId
+ S3_STORAGE_KEY: "{{ .secretAccessKey | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/gitea-smtp-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: gitea-smtp-secret
+ labels:
+ app: raw
+ app.kubernetes.io/instance: gitea-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: smtp-secrets
+ property: auth_password
+ secretKey: authPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: gitea-smtp-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ password: "{{ .authPassword | toString }}"
@@ (root level) @@
! - one document removed:
- ---
- type: kubernetes.io/basic-auth
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- kind: Secret
- data:
- password: cG9zdGdyZXNxbFBhc3N3b3Jk
- username: Z2l0ZWE=
- metadata:
- name: gitea-db-secret
- labels:
- app: raw
- app.kubernetes.io/instance: gitea-db-secret-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: gitea-db-secret
+ labels:
+ app: raw
+ app.kubernetes.io/instance: gitea-db-secret-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: gitea-secrets
+ property: postgresqlPassword
+ secretKey: postgresqlPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: gitea-db-secret
+ creationPolicy: Owner
+ template:
+ type: kubernetes.io/basic-auth
+ data:
+ password: "{{ .postgresqlPassword | toString }}"
+ username: gitea
@@ spec.template.spec.containers.core.env @@
! + one list entry added:
+ - name: CSRF_KEY
+ valueFrom:
+ secretKeyRef:
+ name: harbor-core-xsrf-secret
+ key: CSRF_KEY
@@ data @@
! ± type change from map to <nil>
- CSRF_KEY: dHhTMnNIUUdxaUptbWhGZjE1b0NVZkY1QmdiY2hJc2k=
+ <nil>
@@ (root level) @@
# v1/Secret/harbor-admin-password
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- HARBOR_ADMIN_PASSWORD: aGFyYm9yc29tZXNlY3JldHZhbHVl
- kind: Secret
- metadata:
- name: harbor-admin-password
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/harbor-registry-credentials
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- REGISTRY_HTPASSWD: YWRtaW46JDJhJDEwJHpYd0g4eTRzbkRBdFY0bVptZ3l5bE9xZlgyQU9QTmFVTDVlNnlQbTJFcVB5eTJHMk9Rc1g2
- REGISTRY_PASSWD: VEptVHc2Mks5eTRmWjgzd2d0MHhtWHpMd3hwVEhvSjQ=
- kind: Secret
- metadata:
- name: harbor-registry-credentials
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/harbor-secret-key
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- secretKey: c29tZXNlY3JldHZhbHVl
- kind: Secret
- metadata:
- name: harbor-secret-key
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/harbor-core-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- secret: dlFGTW05UWswcFRVRjNNSw==
- kind: Secret
- metadata:
- name: harbor-core-secret
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/harbor-jobservice-secret
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- JOBSERVICE_SECRET: Q2ZwYW5Ja2NHV3ozd0dMTw==
- kind: Secret
- metadata:
- name: harbor-jobservice-secret
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/harbor-registry-http
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- REGISTRY_HTTP_SECRET: UGpIR0VkbVBocm1OckVrag==
- kind: Secret
- metadata:
- name: harbor-registry-http
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/linode-creds
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- S3_STORAGE_ACCOUNT: c29tZWFjY2Vzc0tleUlk
- S3_STORAGE_KEY: c29tZXNlY3JldHZhbHVl
- kind: Secret
- metadata:
- name: linode-creds
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/registry-storage-credentials
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- REGISTRY_STORAGE_S3_ACCESSKEY: c29tZWFjY2Vzc0tleUlk
- REGISTRY_STORAGE_S3_SECRETKEY: c29tZXNlY3JldHZhbHVl
- kind: Secret
- metadata:
- name: registry-storage-credentials
- labels:
- app: raw
- app.kubernetes.io/instance: harbor-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-admin-password
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-admin-password
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: adminPassword
+ secretKey: adminPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-admin-password
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ HARBOR_ADMIN_PASSWORD: "{{ .adminPassword | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-registry-credentials
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-registry-credentials
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: harbor-secrets
+ property: registry_credentials_password
+ secretKey: password
+ - remoteRef:
+ key: harbor-secrets
+ property: registry_credentials_htpasswd
+ secretKey: htpasswd
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-registry-credentials
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ REGISTRY_HTPASSWD: "{{ .htpasswd | toString }}"
+ REGISTRY_PASSWD: "{{ .password | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-secret-key
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-secret-key
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: harbor-secrets
+ property: secretKey
+ secretKey: secretKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-secret-key
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ secretKey: "{{ .secretKey | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-core-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-core-secret
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: harbor-secrets
+ property: core_secret
+ secretKey: coreSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-core-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ secret: "{{ .coreSecret | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-core-xsrf-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-core-xsrf-secret
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: harbor-secrets
+ property: core_xsrfKey
+ secretKey: xsrfKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-core-xsrf-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ CSRF_KEY: "{{ .xsrfKey | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-jobservice-secret
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-jobservice-secret
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: harbor-secrets
+ property: jobservice_secret
+ secretKey: jobserviceSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-jobservice-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ JOBSERVICE_SECRET: "{{ .jobserviceSecret | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/harbor-registry-http
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: harbor-registry-http
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: harbor-secrets
+ property: registry_secret
+ secretKey: registrySecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: harbor-registry-http
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ REGISTRY_HTTP_SECRET: "{{ .registrySecret | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/linode-creds
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: linode-creds
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: obj-storage-secrets
+ property: provider_linode_secretAccessKey
+ secretKey: secretAccessKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: linode-creds
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ S3_STORAGE_ACCOUNT: someaccessKeyId
+ S3_STORAGE_KEY: "{{ .secretAccessKey | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/registry-storage-credentials
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: registry-storage-credentials
+ labels:
+ app: raw
+ app.kubernetes.io/instance: harbor-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: obj-storage-secrets
+ property: provider_linode_secretAccessKey
+ secretKey: secretAccessKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: registry-storage-credentials
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ REGISTRY_STORAGE_S3_ACCESSKEY: someaccessKeyId
+ REGISTRY_STORAGE_S3_SECRETKEY: "{{ .secretAccessKey | toString }}"
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/ingress-nginx-platform-secrets-reader
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: ingress-nginx-platform-secrets-reader
+ labels:
+ app: raw
+ app.kubernetes.io/component: controller
+ app.kubernetes.io/instance: ingress-nginx-platform
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ rules:
+ - resources:
+ - secrets
+ apiGroups:
+ -
+ verbs:
+ - get
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRole/ingress-nginx-net-a-secrets-reader
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRole
+ metadata:
+ name: ingress-nginx-net-a-secrets-reader
+ labels:
+ app: raw
+ app.kubernetes.io/component: controller
+ app.kubernetes.io/instance: ingress-nginx-net-a
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ rules:
+ - resources:
+ - secrets
+ apiGroups:
+ -
+ verbs:
+ - get
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRoleBinding/ingress-nginx-platform-secrets-reader
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+ name: ingress-nginx-platform-secrets-reader
+ labels:
+ app: raw
+ app.kubernetes.io/component: controller
+ app.kubernetes.io/instance: ingress-nginx-platform
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ roleRef:
+ name: ingress-nginx-platform-secrets-reader
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ subjects:
+ - name: ingress-nginx-platform
+ kind: ServiceAccount
+ namespace: ingress
@@ (root level) @@
# rbac.authorization.k8s.io/v1/ClusterRoleBinding/ingress-nginx-net-a-secrets-reader
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: rbac.authorization.k8s.io/v1
+ kind: ClusterRoleBinding
+ metadata:
+ name: ingress-nginx-net-a-secrets-reader
+ labels:
+ app: raw
+ app.kubernetes.io/component: controller
+ app.kubernetes.io/instance: ingress-nginx-net-a
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ roleRef:
+ name: ingress-nginx-net-a-secrets-reader
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ subjects:
+ - name: ingress-nginx-net-a
+ kind: ServiceAccount
+ namespace: ingress
@@ rules @@
! - one list entry removed:
- - resources:
- - configmaps
- - endpoints
- - namespaces
- - nodes
- - pods
- - secrets
- apiGroups:
- -
- verbs:
- - list
- - watch
! + one list entry added:
+ - resources:
+ - configmaps
+ - endpoints
+ - namespaces
+ - nodes
+ - pods
+ - secrets
+ apiGroups:
+ -
+ verbs:
+ - get
+ - list
+ - watch
@@ rules @@
! - one list entry removed:
- - resources:
- - configmaps
- - endpoints
- - namespaces
- - nodes
- - pods
- - secrets
- apiGroups:
- -
- verbs:
- - list
- - watch
! + one list entry added:
+ - resources:
+ - configmaps
+ - endpoints
+ - namespaces
+ - nodes
+ - pods
+ - secrets
+ apiGroups:
+ -
+ verbs:
+ - get
+ - list
+ - watch
@@ spec.template.spec.containers.oauth2-proxy.env.OAUTH2_PROXY_REDIS_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- oauth2-proxy-redis-access
+ oauth2-proxy-redis-password
@@ spec.template.spec.containers.oauth2-proxy.env.OAUTH2_PROXY_REDIS_PASSWORD.valueFrom.secretKeyRef.key @@
! ± value change
- redis-password
+ password
@@ (root level) @@
# v1/Secret/oauth2-proxy-client-access
! - one document removed:
- ---
- type: Opaque
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- kind: Secret
- data:
- client-id: b3RvbWk=
- client-secret: c29tc2VjcmV0dmFsdWU=
- cookie-secret: Z2todWd4SnNQamhiQ3liSA==
- metadata:
- name: oauth2-proxy-client-access
- labels:
- app: raw
- app.kubernetes.io/instance: oauth2-proxy-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/oauth2-proxy-redis-password
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: oauth2-proxy-redis-password
+ labels:
+ app: raw
+ app.kubernetes.io/instance: oauth2-proxy-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: oauth2-proxy-redis-secrets
+ property: password
+ secretKey: password
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: oauth2-proxy-redis-password
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ password: "{{ .password | toString }}"
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/oauth2-proxy-client-access
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: oauth2-proxy-client-access
+ labels:
+ app: raw
+ app.kubernetes.io/instance: oauth2-proxy-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: keycloak-secrets
+ property: idp_clientSecret
+ secretKey: clientSecret
+ - remoteRef:
+ key: oauth2-proxy-secrets
+ property: config_cookieSecret
+ secretKey: cookieSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: oauth2-proxy-client-access
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ client-id: otomi
+ client-secret: "{{ .clientSecret | toString }}"
+ cookie-secret: "{{ .cookieSecret | toString }}"
@@ spec.template.spec.initContainers.init-container-theme-copy.image @@
! ± value change
- docker.io/linode/apl-console:main
+ docker.io/linode/apl-console:APL-523
@@ (root level) @@
# v1/Secret/keycloak/keycloak-initial-admin
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- password: YmxhZGlibGE=
- username: b3RvbWktYWRtaW4=
- kind: Secret
- metadata:
- name: keycloak-initial-admin
- namespace: keycloak
- labels:
- app: raw
- app.kubernetes.io/instance: keycloak-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/linode-creds
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- S3_STORAGE_ACCOUNT: c29tZWFjY2Vzc0tleUlk
- S3_STORAGE_KEY: c29tZXNlY3JldHZhbHVl
- kind: Secret
- metadata:
- name: linode-creds
- labels:
- app: raw
- app.kubernetes.io/instance: keycloak-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/keycloak/keycloak-initial-admin
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: keycloak-initial-admin
+ namespace: keycloak
+ labels:
+ app: raw
+ app.kubernetes.io/instance: keycloak-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: adminPassword
+ secretKey: adminPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: keycloak-initial-admin
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ password: "{{ .adminPassword | toString }}"
+ username: otomi-admin
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/linode-creds
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: linode-creds
+ labels:
+ app: raw
+ app.kubernetes.io/instance: keycloak-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: obj-storage-secrets
+ property: provider_linode_secretAccessKey
+ secretKey: secretAccessKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: linode-creds
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ S3_STORAGE_ACCOUNT: someaccessKeyId
+ S3_STORAGE_KEY: "{{ .secretAccessKey | toString }}"
@@ (root level) @@
# v1/Secret/reverse-proxy-auth-config
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- authn.yaml: dXNlcnM6CiAgLSB1c2VybmFtZTogb3RvbWktYWRtaW4KICAgIHBhc3N3b3JkOiAic29tZXNlY3JldHZhbHVlIgogICAgb3JnaWQ6IGFkbWlucwogIC0gdXNlcm5hbWU6IGFkbWluCiAgICBwYXNzd29yZDogIllUcm5rZFVzS1BjR0FUZmciCiAgICBvcmdpZDogYWRtaW4KICAtIHVzZXJuYW1lOiBkZW1vCiAgICBwYXNzd29yZDogInNvbWVzZWNyZXR2YWx1ZSIKICAgIG9yZ2lkOiBkZW1vCiAgLSB1c2VybmFtZTogZGV2CiAgICBwYXNzd29yZDogIklrZFVzS1BjR0FkYW5qYXMiCiAgICBvcmdpZDogZGV2Cg==
- kind: Secret
- metadata:
- name: reverse-proxy-auth-config
- labels:
- app: loki
- app.kubernetes.io/instance: loki-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# v1/Secret/loki-s3-linode-credentials
! - one document removed:
- ---
- type: Opaque
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- kind: Secret
- data:
- AWS_ACCESS_KEY_ID: c29tZWFjY2Vzc0tleUlk
- AWS_SECRET_ACCESS_KEY: c29tZXNlY3JldHZhbHVl
- metadata:
- name: loki-s3-linode-credentials
- labels:
- app: loki
- app.kubernetes.io/instance: loki-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/reverse-proxy-auth-config
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: reverse-proxy-auth-config
+ labels:
+ app: loki
+ app.kubernetes.io/instance: loki-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: loki-secrets
+ property: adminPassword
+ secretKey: adminPassword
+ - remoteRef:
+ key: team-admin-settings-secrets
+ property: settings_password
+ secretKey: team_admin_password
+ - remoteRef:
+ key: team-demo-settings-secrets
+ property: settings_password
+ secretKey: team_demo_password
+ - remoteRef:
+ key: team-dev-settings-secrets
+ property: settings_password
+ secretKey: team_dev_password
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: reverse-proxy-auth-config
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ authn.yaml: |
+ {{ $adminPassword := .adminPassword | toString }}
+ users:
+ - username: otomi-admin
+ password: "{{ $adminPassword }}"
+ orgid: admins
+ - username: admin
+ password: "{{ .team_admin_password | toString }}"
+ orgid: admin
+ - username: demo
+ password: "{{ .team_demo_password | toString }}"
+ orgid: demo
+ - username: dev
+ password: "{{ .team_dev_password | toString }}"
+ orgid: dev
@@ (root level) @@
# external-secrets.io/v1beta1/ExternalSecret/loki-s3-linode-credentials
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: loki-s3-linode-credentials
+ labels:
+ app: loki
+ app.kubernetes.io/instance: loki-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: obj-storage-secrets
+ property: provider_linode_secretAccessKey
+ secretKey: secretAccessKey
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: loki-s3-linode-credentials
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ AWS_ACCESS_KEY_ID: someaccessKeyId
+ AWS_SECRET_ACCESS_KEY: "{{ .secretAccessKey | toString }}"
@@ spec @@
! + one map entry added:
+ configSecret: alertmanager-platform-config
@@ (root level) @@
! - one document removed:
- ---
- # Source: raw/templates/resources.yaml
- apiVersion: v1
- data:
- password: YmxhbGFsYWxhbGFs
- username: dGVzdGFjY291bnQ=
- kind: Secret
- metadata:
- name: prometheus-remote-write-basic-auth
- labels:
- app: prometheus
- app.kubernetes.io/instance: prometheus-operator-artifacts
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/name: raw
- app.kubernetes.io/part-of: otomi
- app.kubernetes.io/version: 0.2.3
- helm.sh/chart: raw-0.2.3
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: grafana-admin-secret
+ namespace: monitoring
+ labels:
+ app: raw
+ app.kubernetes.io/instance: prometheus-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: otomi-platform-secrets
+ property: adminPassword
+ secretKey: adminPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: grafana-admin-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ admin-password: "{{ .adminPassword | toString }}"
+ admin-user: otomi-admin
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: grafana-oidc-secret
+ namespace: monitoring
+ labels:
+ app: raw
+ app.kubernetes.io/instance: prometheus-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: keycloak-secrets
+ property: idp_clientSecret
+ secretKey: clientSecret
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: grafana-oidc-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ client_id: otomi
+ client_secret: "{{ .clientSecret | toString }}"
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: grafana-loki-datasource-secret
+ namespace: monitoring
+ labels:
+ app: raw
+ app.kubernetes.io/instance: prometheus-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: loki-secrets
+ property: adminPassword
+ secretKey: adminPassword
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: grafana-loki-datasource-secret
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ password: "{{ .adminPassword | toString }}"
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: prometheus-remote-write-basic-auth
+ labels:
+ app: prometheus
+ app.kubernetes.io/instance: prometheus-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: prometheus-secrets
+ property: remoteWrite_rwConfig_basicAuth_password
+ secretKey: password
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: prometheus-remote-write-basic-auth
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ password: "{{ .password | toString }}"
+ username: testaccount
@@ (root level) @@
! + one document added:
+ ---
+ # Source: raw/templates/resources.yaml
+ apiVersion: external-secrets.io/v1beta1
+ kind: ExternalSecret
+ metadata:
+ name: alertmanager-platform-config
+ namespace: monitoring
+ labels:
+ app: raw
+ app.kubernetes.io/instance: prometheus-operator-artifacts
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: raw
+ app.kubernetes.io/part-of: otomi
+ app.kubernetes.io/version: 0.2.3
+ helm.sh/chart: raw-0.2.3
+ spec:
+ data:
+ - remoteRef:
+ key: alerts-secrets
+ property: slack_url
+ secretKey: slackUrl
+ refreshInterval: 1h
+ secretStoreRef:
+ name: core-secrets-store
+ kind: ClusterSecretStore
+ target:
+ name: alertmanager-platform-config
+ creationPolicy: Owner
+ template:
+ type: Opaque
+ data:
+ alertmanager.yaml: |
+
+ global:
+ slack_api_url: {{ .slackUrl | toString }}
+ route:
+ receiver: "null"
+ group_by: [alertname]
+ group_interval: 5m
+ repeat_interval: 3h
+ routes:
+ - match:
+ alertname: Watchdog
+ receiver: "null"
+ - match:
+ alertname: CPUThrottlingHigh
+ receiver: default
+ - match:
+ severity: critical
+ receiver: critical
+ receivers:
+ - name: "null"
+ - name: default
+ slack_configs:
+ - channel: "#mon-otomi"
+ send_resolved: true
+ color: '{{ if eq .Status "firing" }}danger{{ else }}good{{ end }}'
+ title: '[{{ .Status | toUpper }}{{ if eq .Status "firing" }}:{{ .Alerts.Firing | len }}{{ end }}] Notification for cluster "akamai/linode/demo"'
+ pretext: '{{ .CommonAnnotations.summary }}'
+ text: |-
+ {{ range .Alerts }}
+ {{- if .Annotations.summary }} *Alert:* {{ .Annotations.summary }} - {{ .Labels.severity }}{{- end }}
+ *Description:* {{ .Annotations.description }}{{ .Annotations.message }}
+ *Graph:* <{{ .GeneratorURL }}|:chart_with_upwards_trend:>{{ if or .Annotations.runbook .Annotations.runbook_url }} *Runbook:* <{{ .Annotations.runbook }}{{ .Annotations.runbook_url }}|:spiral_note_pad:>{{ end }}
+ *Details:*
+ {{ range .Labels.SortedPairs }} • *{{ .Name }}:* {{ .Value }}
+ {{ end }}
+ {{ end }}
+
+ fallback: '{{ template "slack.default.fallback" . }}'
+ icon_emoji: '{{ template "slack.default.iconemoji" . }}'
+ icon_url: '{{ template "slack.default.iconurl" . }}'
+
+ webhook_configs:
+ - url: "http://prometheus-msteams:2000/low_priority_channel"
+ send_resolved: true
+ - name: critical
+ slack_configs:
+ - channel: "#mon-otomi-crit"
+ color: '{{ if eq .Status "firing" }}danger{{ else }}good{{ end }}'
+ title: '[{{ .Status | toUpper }}{{ if eq .Status "firing" }}:{{ .Alerts.Firing | len }}{{ end }}] Notification for cluster "akamai/linode/demo"'
+ pretext: '{{ .CommonAnnotations.summary }}'
+ text: |-
+ {{ range .Alerts }}
+ {{- if .Annotations.summary }} *Alert:* {{ .Annotations.summary }} - {{ .Labels.severity }}{{- end }}
+ *Description:* {{ .Annotations.description }}{{ .Annotations.message }}
+ *Graph:* <{{ .GeneratorURL }}|:chart_with_upwards_trend:>{{ if or .Annotations.runbook .Annotations.runbook_url }} *Runbook:* <{{ .Annotations.runbook }}{{ .Annotations.runbook_url }}|:spiral_note_pad:>{{ end }}
+ *Details:*
+ {{ range .Labels.SortedPairs }} • *{{ .Name }}:* {{ .Value }}
+ {{ end }}
+ {{ end }}
+
+ fallback: '{{ template "slack.default.fallback" . }}'
+ icon_emoji: '{{ template "slack.default.iconemoji" . }}'
+ icon_url: '{{ template "slack.default.iconurl" . }}'
+
+ webhook_configs:
+ - url: "http://prometheus-msteams:800/high_priority_channel"
+ send_resolved: true
@@ spec.template.spec.containers.otomi-operator.image @@
! ± value change
- linode/apl-tasks:main
+ linode/apl-tasks:APL-523
@@ data.VERSIONS @@
! ± value change in multiline text (one insert, one deletion)
- {"api":"main","console":"main","consoleLogin":"main","core":"main","specVersion":53,"tasks":"main","tools":"main"}
+ {"api":"APL-523","console":"APL-523","consoleLogin":"APL-523","core":"main","specVersion":53,"tasks":"APL-523","tools":"main"}
@@ spec.template.spec.containers.otomi-api.image @@
! ± value change
- docker.io/linode/apl-api:main
+ docker.io/linode/apl-api:APL-523
@@ spec.template.spec.containers.otomi-api.envFrom @@
! + one list entry added:
+ - secretRef:
+ name: otomi-api-git-credentials
@@ spec.template.spec.containers.otomi-api-tools.envFrom @@
! + one list entry added:
+ - secretRef:
+ name: otomi-api-git-credentials
@@ data @@
! - four map entries removed:
- AZURE_CLIENT_ID: c29tZXNlY3JldHZhbHVl
- AZURE_CLIENT_SECRET: c29tZXNlY3JldHZhbHVl
- AZURE_TENANT_ID: c29tZXNlY3JldHZhbHVl
- GIT_PASSWORD: Z2l0UGFzc3dvcmRGb3JUZXN0aW5n
@@ spec.template.spec.containers.otomi-console.image @@
! ± value change
- docker.io/linode/apl-console:main
+ docker.io/linode/apl-console:APL-523
@@ data.grafana.ini @@
! ± value change in multiline text (one insert, one deletion)
[analytics]
check_for_plugin_updates = false
check_for_updates = false
feedback_links_enabled = false
[one line unchanged)]
[auth.generic_oauth]
allow_sign_up = true
api_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/userinfo
auth_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/auth
- client_id = otomi
- client_secret = somsecretvalue
+ client_id = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
+ client_secret = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
email_attribute_path = email
enabled = true
login_attribute_path = username
name = OAuth
[24 lines unchanged)]
[users]
allow_sign_up = false
auto_assign_org = true
auto_assign_org_role = Viewer
@@ spec.template.metadata.annotations @@
! - one map entry removed:
- checksum/secret: 39fed6fcd79dea7281c5af6db19749091255d4deea90773a6fced91c69363562
@@ spec.template.spec.containers.demo-po-grafana-sc-dashboard.env.REQ_USERNAME.valueFrom.secretKeyRef.name @@
! ± value change
- demo-po-grafana
+ team-demo-grafana-admin
@@ spec.template.spec.containers.demo-po-grafana-sc-dashboard.env.REQ_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- demo-po-grafana
+ team-demo-grafana-admin
@@ spec.template.spec.containers.demo-po-grafana-sc-datasources.env.REQ_USERNAME.valueFrom.secretKeyRef.name @@
! ± value change
- demo-po-grafana
+ team-demo-grafana-admin
@@ spec.template.spec.containers.demo-po-grafana-sc-datasources.env.REQ_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- demo-po-grafana
+ team-demo-grafana-admin
@@ spec.template.spec.containers.grafana.env @@
! + three list entries added:
+ - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+ valueFrom:
+ secretKeyRef:
+ name: grafana-oidc-secret
+ key: client_id
+ - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+ valueFrom:
+ secretKeyRef:
+ name: grafana-oidc-secret
+ key: client_secret
+ - name: GF_LOKI_BASIC_AUTH_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: grafana-loki-datasource-secret
+ key: password
@@ spec.template.spec.containers.grafana.env.GF_SECURITY_ADMIN_USER.valueFrom.secretKeyRef.name @@
! ± value change
- demo-po-grafana
+ team-demo-grafana-admin
@@ spec.template.spec.containers.grafana.env.GF_SECURITY_ADMIN_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- demo-po-grafana
+ team-demo-grafana-admin
@@ spec @@
! + one map entry added:
+ configSecret: alertmanager-team-demo-config
@@ data.datasource.yaml @@
! ± value change in multiline text (one insert, one deletion)
apiVersion: 1
datasources:
- access: proxy
editable: false
[nine lines unchanged)]
basicAuthUser: demo
editable: false
name: Loki
secureJsonData:
- basicAuthPassword: somesecretvalue
+ basicAuthPassword: $__env{GF_LOKI_BASIC_AUTH_PASSWORD}
type: loki
uid: loki
url: http://loki-query-frontend-headless.monitoring:3101
@@ data.grafana.ini @@
! ± value change in multiline text (one insert, one deletion)
[analytics]
check_for_plugin_updates = false
check_for_updates = false
feedback_links_enabled = false
[one line unchanged)]
[auth.generic_oauth]
allow_sign_up = true
api_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/userinfo
auth_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/auth
- client_id = otomi
- client_secret = somsecretvalue
+ client_id = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
+ client_secret = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
email_attribute_path = email
enabled = true
login_attribute_path = username
name = OAuth
[24 lines unchanged)]
[users]
allow_sign_up = false
auto_assign_org = true
auto_assign_org_role = Viewer
@@ spec.template.metadata.annotations @@
! - one map entry removed:
- checksum/secret: 8b2c3f1f6d107d2335c616e981c0e92ea3b6e1df2ddcf021ae30811cc7672fc9
@@ spec.template.spec.containers.dev-po-grafana-sc-dashboard.env.REQ_USERNAME.valueFrom.secretKeyRef.name @@
! ± value change
- dev-po-grafana
+ team-dev-grafana-admin
@@ spec.template.spec.containers.dev-po-grafana-sc-dashboard.env.REQ_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- dev-po-grafana
+ team-dev-grafana-admin
@@ spec.template.spec.containers.dev-po-grafana-sc-datasources.env.REQ_USERNAME.valueFrom.secretKeyRef.name @@
! ± value change
- dev-po-grafana
+ team-dev-grafana-admin
@@ spec.template.spec.containers.dev-po-grafana-sc-datasources.env.REQ_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- dev-po-grafana
+ team-dev-grafana-admin
@@ spec.template.spec.containers.grafana.env @@
! + three list entries added:
+ - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+ valueFrom:
+ secretKeyRef:
+ name: grafana-oidc-secret
+ key: client_id
+ - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+ valueFrom:
+ secretKeyRef:
+ name: grafana-oidc-secret
+ key: client_secret
+ - name: GF_LOKI_BASIC_AUTH_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: grafana-loki-datasource-secret
+ key: password
@@ spec.template.spec.containers.grafana.env.GF_SECURITY_ADMIN_USER.valueFrom.secretKeyRef.name @@
! ± value change
- dev-po-grafana
+ team-dev-grafana-admin
@@ spec.template.spec.containers.grafana.env.GF_SECURITY_ADMIN_PASSWORD.valueFrom.secretKeyRef.name @@
! ± value change
- dev-po-grafana
+ team-dev-grafana-admin
@@ spec @@
! + one map entry added:
+ configSecret: alertmanager-team-dev-config
@@ data.datasource.yaml @@
! ± value change in multiline text (one insert, one deletion)
apiVersion: 1
datasources:
- access: proxy
editable: false
[nine lines unchanged)]
basicAuthUser: dev
editable: false
name: Loki
secureJsonData:
- basicAuthPassword: IkdUsKPcGAdanjas
+ basicAuthPassword: $__env{GF_LOKI_BASIC_AUTH_PASSWORD}
type: loki
uid: loki
url: http://loki-query-frontend-headless.monitoring:3101
@@ (root level) @@
! - one map entry removed:
- users:
- - name: bc2fe5b1-835c-4998-ad64-e15d90062b16
- email: platform-admin@dev.linode-apl.net
- firstName: platform
- lastName: admin
- isPlatformAdmin: true
- isTeamAdmin: false
- initialPassword: "02LDWB#qzknkeF8f*m%%"
- - name: a83e20b7-474a-4262-a3ad-b09813364ece
- email: platform@admin.com
- firstName: platform
- initialPassword: platform-admin-password
- isPlatformAdmin: true
- isTeamAdmin: true
- lastName: admin
- - name: 23d63558-49ed-48ba-bc28-8037a7236ddf
- email: team@admin.com
- firstName: team
- initialPassword: team-admin-password
- isPlatformAdmin: false
- isTeamAdmin: true
- lastName: admin
- teams:
- - demo
- - name: 9a3a478b-a747-4b4a-be69-a9abf1979df2
- email: team@member.com
- firstName: team
- initialPassword: team-member-password
- isPlatformAdmin: false
- isTeamAdmin: false
- lastName: member
- teams:
- - demo
|
CasLubbers
requested changes
Mar 10, 2026
Contributor
CasLubbers
left a comment
CasLubbers
left a comment
There was a problem hiding this comment.
Really impressive with the work you did! It was/is thought review
| - name: RECONCILE_INTERVAL_MS | ||
| value: {{ .Values.operator.reconcileIntervalMs | default "300000" | quote }} | ||
| {{- if hasKey $kms "sops" }} | ||
| envFrom: |
Contributor
There was a problem hiding this comment.
Should we also delete the sops-secrets.yaml file in the chart/ directory?
| optional: true | ||
| - secretRef: | ||
| name: apl-git-credentials | ||
| optional: true |
Contributor
There was a problem hiding this comment.
This one is not optional
| envFrom: | ||
| - secretRef: | ||
| name: apl-sops-secrets | ||
| optional: true |
Contributor
There was a problem hiding this comment.
Should we also align this with the chart/ directory and remove this secretRef? I think we can also remove the apl-sops-secret in the charts/ then.
| @@ -0,0 +1,31 @@ | |||
| ## External Secrets Operator values | |||
Contributor
There was a problem hiding this comment.
We should add external-secrets in the chart/chart-index/chart.yaml
| - namespaces | ||
| {{- end}} | ||
| verbs: | ||
| - get |
Contributor
There was a problem hiding this comment.
We should not edit any charts. Do you really need this change in the nginx-ingress chart?
| branch: otomiGit?.branch, | ||
| email: otomiGit?.email, | ||
| }) | ||
| private async setupSopsEnvironment(): Promise<void> { |
Contributor
There was a problem hiding this comment.
This can be removed right? We do not need any sops related code.
| } | ||
|
|
||
| private async updateInstallationStatus(status: string, attempt: number): Promise<void> { | ||
| private async updateInstallationStatus(status: string, attempt: number, error?: string): Promise<void> { |
Contributor
There was a problem hiding this comment.
Why add the error? We decided to remove it in a ticket recently.
| } | ||
|
|
||
| // Set up SOPS environment if applicable (no-op when SealedSecrets + ESO is in use) | ||
| await installer.setEnvAndCreateSecrets() |
Contributor
There was a problem hiding this comment.
If possible we should remove this.
| await installer.setEnvAndCreateSecrets() | ||
|
|
||
| // Start trace collection in background (runs for 30 minutes from ConfigMap creation) | ||
| runTraceCollectionLoop().catch((error) => { |
Contributor
There was a problem hiding this comment.
You can remove this here. We already run it in the reconcileInstall()
| email: {{ $v.otomi.git.email | default "pipeline@cluster.local" | quote }} | ||
| username: {{ $v.otomi.git.username | default "otomi-admin" | quote }} | ||
| # Password intentionally empty — operator reads git credentials from K8s secret (apl-git-credentials) | ||
| password: "" |
Contributor
There was a problem hiding this comment.
I think we should adjust the apl-operator chart in charts/ to remove the apl-git-credentials secret in there. And only have it managed by the sealedsecrets. But we can do that later.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📌 Summary
PRs: apl-api | apl-tasks
🔍 Reviewer Notes
🧹 Checklist