konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

shelly-manager: valid-base64 placeholders so flux stays healthy pre-credentials

Browse Source 
The previous placeholder string contained underscores — not valid base64 — which the API
server rejects on Secret create, making the infrastructure / apps Kustomizations report
unhealthy until the real token is filled in. Using base64 of `{"auths":{}}` instead lets
the Secret apply cleanly; only the pod-level pull (or image-reflector tag listing) fails
until you encrypt real credentials in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
k.renner
2026-05-13 07:58:22 +02:00
co-authored by Claude Opus 4.7
parent e9268ad9e2
commit 5b4e3b0ee8
2 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kubernetes/apps/shelly-manager/registry-secret.sops.yaml
+10 -5
View File
@@ -1,8 +1,12 @@
# PLACEHOLDER — must be SOPS-encrypted before flux reconciles it.
# Steps to populate:
# 1. Mint a gitea token for user `k.renner` with packages:read scope at
# PLACEHOLDER — must be SOPS-encrypted with real credentials before
# the Deployment can pull. The empty-auths value below is valid base64
# so the Secret applies cleanly (Flux stays healthy) but won't grant
# any pulls until replaced — the resulting pod ImagePullBackOff is the
# signal to populate real creds.
# Steps:
# 1. Mint a gitea token for user `k.renner` with packages:read at
# https://gitea.renner.uno/user/settings/applications
# 2. Replace REPLACE_WITH_BASE64_DOCKERCONFIG below with:
# 2. Replace `.dockerconfigjson` below with the real base64:
# printf '{"auths":{"gitea.renner.uno":{"username":"k.renner","password":"<token>","auth":"<b64 k.renner:token>"}}}' | base64 -w0
# 3. sops -e -i kubernetes/apps/shelly-manager/registry-secret.sops.yaml
apiVersion: v1
@@ -12,4 +16,5 @@ metadata:
namespace: apps
type: kubernetes.io/dockerconfigjson
data:
.dockerconfigjson: REPLACE_WITH_BASE64_DOCKERCONFIG
# base64 of `{"auths":{}}` — placeholder, replace before pushing.
.dockerconfigjson: eyJhdXRocyI6e319
kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml
+7 -3
View File
@@ -1,10 +1,13 @@
# PLACEHOLDER — must be SOPS-encrypted before flux reconciles it.
# PLACEHOLDER — must be SOPS-encrypted with real credentials before
# image-reflector can list tags. The empty-auths value below is valid
# base64 so the Secret applies cleanly (infrastructure stays healthy)
# but won't grant any registry access until replaced.
# Same token as kubernetes/apps/shelly-manager/registry-secret.sops.yaml,
# but in the flux-system namespace so image-reflector-controller can
# list tags on the private gitea registry.
# Steps:
# 1. Use the same gitea token you minted for the apps-ns secret.
# 2. Replace REPLACE_WITH_BASE64_DOCKERCONFIG with:
# 2. Replace `.dockerconfigjson` below with the real base64:
# printf '{"auths":{"gitea.renner.uno":{"username":"k.renner","password":"<token>","auth":"<b64 k.renner:token>"}}}' | base64 -w0
# 3. sops -e -i kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml
apiVersion: v1
@@ -14,4 +17,5 @@ metadata:
namespace: flux-system
type: kubernetes.io/dockerconfigjson
data:
.dockerconfigjson: REPLACE_WITH_BASE64_DOCKERCONFIG
# base64 of `{"auths":{}}` — placeholder, replace before pushing.
.dockerconfigjson: eyJhdXRocyI6e319