From 5b4e3b0ee82ba79aebd5afea330fb28f193df7ae Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Wed, 13 May 2026 07:58:22 +0200 Subject: [PATCH] shelly-manager: valid-base64 placeholders so flux stays healthy pre-credentials MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous placeholder string contained underscores — not valid base64 — which the API server rejects on Secret create, making the infrastructure / apps Kustomizations report unhealthy until the real token is filled in. Using base64 of `{"auths":{}}` instead lets the Secret apply cleanly; only the pod-level pull (or image-reflector tag listing) fails until you encrypt real credentials in. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../apps/shelly-manager/registry-secret.sops.yaml | 15 ++++++++++----- .../image-automation/gitea-registry.sops.yaml | 10 +++++++--- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/kubernetes/apps/shelly-manager/registry-secret.sops.yaml b/kubernetes/apps/shelly-manager/registry-secret.sops.yaml index 137596a8..f6be0bdc 100644 --- a/kubernetes/apps/shelly-manager/registry-secret.sops.yaml +++ b/kubernetes/apps/shelly-manager/registry-secret.sops.yaml @@ -1,8 +1,12 @@ -# PLACEHOLDER — must be SOPS-encrypted before flux reconciles it. -# Steps to populate: -# 1. Mint a gitea token for user `k.renner` with packages:read scope at +# PLACEHOLDER — must be SOPS-encrypted with real credentials before +# the Deployment can pull. The empty-auths value below is valid base64 +# so the Secret applies cleanly (Flux stays healthy) but won't grant +# any pulls until replaced — the resulting pod ImagePullBackOff is the +# signal to populate real creds. +# Steps: +# 1. Mint a gitea token for user `k.renner` with packages:read at # https://gitea.renner.uno/user/settings/applications -# 2. Replace REPLACE_WITH_BASE64_DOCKERCONFIG below with: +# 2. Replace `.dockerconfigjson` below with the real base64: # printf '{"auths":{"gitea.renner.uno":{"username":"k.renner","password":"","auth":""}}}' | base64 -w0 # 3. sops -e -i kubernetes/apps/shelly-manager/registry-secret.sops.yaml apiVersion: v1 @@ -12,4 +16,5 @@ metadata: namespace: apps type: kubernetes.io/dockerconfigjson data: - .dockerconfigjson: REPLACE_WITH_BASE64_DOCKERCONFIG + # base64 of `{"auths":{}}` — placeholder, replace before pushing. + .dockerconfigjson: eyJhdXRocyI6e319 diff --git a/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml b/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml index dc1447e8..be99227a 100644 --- a/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml +++ b/kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml @@ -1,10 +1,13 @@ -# PLACEHOLDER — must be SOPS-encrypted before flux reconciles it. +# PLACEHOLDER — must be SOPS-encrypted with real credentials before +# image-reflector can list tags. The empty-auths value below is valid +# base64 so the Secret applies cleanly (infrastructure stays healthy) +# but won't grant any registry access until replaced. # Same token as kubernetes/apps/shelly-manager/registry-secret.sops.yaml, # but in the flux-system namespace so image-reflector-controller can # list tags on the private gitea registry. # Steps: # 1. Use the same gitea token you minted for the apps-ns secret. -# 2. Replace REPLACE_WITH_BASE64_DOCKERCONFIG with: +# 2. Replace `.dockerconfigjson` below with the real base64: # printf '{"auths":{"gitea.renner.uno":{"username":"k.renner","password":"","auth":""}}}' | base64 -w0 # 3. sops -e -i kubernetes/infrastructure/image-automation/gitea-registry.sops.yaml apiVersion: v1 @@ -14,4 +17,5 @@ metadata: namespace: flux-system type: kubernetes.io/dockerconfigjson data: - .dockerconfigjson: REPLACE_WITH_BASE64_DOCKERCONFIG + # base64 of `{"auths":{}}` — placeholder, replace before pushing. + .dockerconfigjson: eyJhdXRocyI6e319