rock
b6e317b34c
Adds the pi coding-agent sandbox's cluster side: - `k8s/infra/poimen/pi-agent-workspace-pv.yaml` — static hostPath PV + PVC for the sandbox /workspace (Longhorn cannot attach new volumes in this cluster; this gives real persistence and survived a pod delete/recreate test: marker file + 38 KB session.jsonl intact, the session answered from its own history afterwards). - `k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml` — the sandbox's API-key Secret, SOPS-encrypted (recipient from .sops.yaml, payload only: `encrypted_regex ^(data|stringData)$`), registered in the ksops generator. Round-trip verified against the live Secret. - `terraform/files/coredns/Corefile` — `rewrite name pi.riotpiao.com ingress-nginx-controller...` so the hostname resolves in-cluster. Note: the keys currently in that Secret are the ones leaked earlier and must be rotated; re-encrypt with `sops -e -i` after rotating.Reviewed-on: #54 Co-authored-by: rock <[email protected]>
37 lines
1.0 KiB
YAML
37 lines
1.0 KiB
YAML
apiVersion: viaduct.ai/v1
|
|
kind: ksops
|
|
metadata:
|
|
name: sops-secret-generator
|
|
annotations:
|
|
config.kubernetes.io/function: |
|
|
exec:
|
|
path: ksops
|
|
files:
|
|
- agent-pod-models.enc.yaml
|
|
- agent-pod-ssh-key.enc.yaml
|
|
- authentik-secrets.enc.yaml
|
|
- cloudflare-secrets.enc.yaml
|
|
- forgejo-registry-pat.enc.yaml
|
|
- forgejo-registry-pat-api.enc.yaml
|
|
- forgejo-registry-pull.enc.yaml
|
|
- forgejo-runner-token.enc.yaml
|
|
- forgejo-secrets.enc.yaml
|
|
- grafana-oidc-secrets.enc.yaml
|
|
- grafana-secrets.enc.yaml
|
|
- homarr-auth-oidc.enc.yaml
|
|
- homarr-db-encryption.enc.yaml
|
|
- homarr-secrets.enc.yaml
|
|
- homelab-ca-secrets.enc.yaml
|
|
- loki-secrets.enc.yaml
|
|
- minio-secrets.enc.yaml
|
|
- paperless-secrets.enc.yaml
|
|
- vault-secrets.enc.yaml
|
|
- vault-unseal-keys.enc.yaml
|
|
- portfolio-secrets.enc.yaml
|
|
- gotify-admin-secrets.enc.yaml
|
|
- gotify-tokens-secrets.enc.yaml
|
|
- gotify-smtp-secrets.enc.yaml
|
|
- forgejo-smtp-secrets.enc.yaml
|
|
- paperless-ai-secrets.enc.yaml
|
|
- pi-sandbox-secrets.enc.yaml
|