claude-botandClaude Opus 5.5
76a82f7d28
The sidecar took its git remote, Gitea API base and token from a URL with an embedded PAT stored on the config PVC. That state was invisible to git, unrotated, and would break on the repo transfer to konairius: the live -> main PR is opened with an API POST, and Gitea API writes do not survive the old-path redirect (seen with the wiki on notes). - ha-config-sync: dedicated Gitea account, write collaborator on homeassistant. CronJob openbao/ha-config-sync-secret-rotate (quarterly) mints its write:repository PAT, verifies pull+push on homeassistant and stores it at infrastructure/ha-config-sync#token. Policy/role applied and the path seeded on 2026-10-18. Netpol halves gitea-allow-ha-config-sync-rotator and rotator-ha-config-sync-egress. - ExternalSecret home-assistant-config-sync-gitea, mounted as a file (not subPath) so a rotation lands in place without restarting Home Assistant. - config-sync.sh: GITEA_URL/GITEA_REPO/GITEA_USER/GITEA_TOKEN_FILE from the manifest; the remote is reset to the credential-free URL on every start; git gets the token as an http.extraHeader through GIT_CONFIG_* env, re-read every loop; the PR call uses the same token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
119 lines
3.8 KiB
YAML
119 lines
3.8 KiB
YAML
# Prometheus scrape and Traefik are admitted by the namespace baseline in
|
|
# infrastructure/network-policies/gitea-ns.yaml.
|
|
#
|
|
# Secret rotation: the flux-git rotator (openbao ns) reaches gitea to mint a new
|
|
# flux PAT. It uses the in-cluster Service (gitea.gitea.svc:3000) — the public
|
|
# gitea.renner.uno name hairpins off the ingress LB from a pod (same failure as
|
|
# pve.renner.uno). Scoped to the gitea pod :3000 and the rotator label; the
|
|
# egress half is rotator-gitea-flux-egress in network-policies/openbao-ns.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-allow-flux-rotator
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": openbao
|
|
app.kubernetes.io/component: secret-rotator
|
|
app.kubernetes.io/name: flux-git
|
|
toPorts:
|
|
- ports:
|
|
- port: "3000"
|
|
protocol: TCP
|
|
---
|
|
# Secret rotation: the review-bot rotator (openbao ns) reaches gitea to mint a
|
|
# new review-bot PAT, same in-cluster Service path as the flux rotator. Scoped
|
|
# to the gitea pod :3000 and the review-bot rotator label; the egress half is
|
|
# rotator-review-bot-egress in network-policies/openbao-ns.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-allow-review-bot-rotator
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": openbao
|
|
app.kubernetes.io/component: secret-rotator
|
|
app.kubernetes.io/name: review-bot
|
|
toPorts:
|
|
- ports:
|
|
- port: "3000"
|
|
protocol: TCP
|
|
---
|
|
# Secret rotation: the registry-bot rotator mints registry-bot's PAT. Egress half:
|
|
# rotator-registry-bot-egress in network-policies/openbao-ns.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-allow-registry-bot-rotator
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": openbao
|
|
app.kubernetes.io/component: secret-rotator
|
|
app.kubernetes.io/name: registry-bot
|
|
toPorts:
|
|
- ports:
|
|
- port: "3000"
|
|
protocol: TCP
|
|
---
|
|
# Secret rotation: the ha-config-sync rotator mints ha-config-sync's PAT. Egress
|
|
# half: rotator-ha-config-sync-egress in network-policies/openbao-ns.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-allow-ha-config-sync-rotator
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": openbao
|
|
app.kubernetes.io/component: secret-rotator
|
|
app.kubernetes.io/name: ha-config-sync
|
|
toPorts:
|
|
- ports:
|
|
- port: "3000"
|
|
protocol: TCP
|
|
---
|
|
# Package retention CronJob (package-retention.yaml, REN-1203). It lists pods
|
|
# to find the running image tags. The namespace baseline does not open the API
|
|
# server: `kube-apiserver` is its own entity in Cilium; port is the post-DNAT
|
|
# 6443. Its
|
|
# Gitea calls go to the in-cluster Service, which the baseline already allows
|
|
# inside the namespace.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-package-retention-kube-apiserver
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea-package-retention
|
|
egress:
|
|
- toEntities:
|
|
- kube-apiserver
|
|
toPorts:
|
|
- ports:
|
|
- port: "6443"
|
|
protocol: TCP
|