rockandAdmin Bot
23fff1006a
CI / CI (push) Successful in 3m21s
Closes #54 Replaces ArgoCD Image Updater with webhook-driven promotion. ## What changed | File | Change | |---|---| | `internal/webhook/promoter.go` | NEW — ImagePromoter + promotion table (10 entries) | | `internal/webhook/promoter_test.go` | NEW — 13 tests | | `internal/webhook/forgejo.go` | package event routed to ImagePromoter | | `k8s/rbac.yaml` | NEW — ClusterRole image-promoter + ClusterRoleBinding | | `k8s/deployment.yaml` | REGISTRY_PAT env var | | `k8s/network-policy.yaml` | egress cicd:3000 + default:443 | | `k8s/kustomization.yaml` | rbac.yaml added | ## homelab repo changes needed See comment on issue #54 for exact YAML. --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: #55
29 lines
712 B
YAML
29 lines
712 B
YAML
# RBAC for api-gateway image promotion.
|
|
# Grants the api-gateway ServiceAccount get+patch on ArgoCD Applications
|
|
# so it can update kustomize.images / helm.parameters after a container push.
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: image-promoter
|
|
labels:
|
|
app: api-gateway
|
|
rules:
|
|
- apiGroups: ["argoproj.io"]
|
|
resources: ["applications"]
|
|
verbs: ["get", "patch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: image-promoter-api-gateway
|
|
labels:
|
|
app: api-gateway
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: api-gateway
|
|
namespace: api
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: image-promoter
|
|
apiGroup: rbac.authorization.k8s.io
|