k.rennerandClaude Opus 4.7
b4975fabbb
The rebuild-k8s pipeline previously SOPS-encrypted talosconfig and kubeconfig and pushed them back to master. The git push raced with concurrent commits and forced workstation users to `git pull --rebase` after every rebuild. Replace the transport with Garage's k8s-secrets bucket (s3://k8s-secrets/cluster-access/), reusing the existing secrets-key that the install-garage-synology playbook already provisions. SOPS encryption is unchanged — only the storage layer moves. - New scripts/ci/fetch-kubeconfig.sh helper: 9 CI steps that previously inlined `sops -d kubernetes/access/kubeconfig.sops` now call this. - scripts/import-cluster-access.sh rewritten to pull both files from Garage; no more git fetch/checkout. - export-access step uploads via aws s3 cp; gitea_token + git config removed. - All consuming Woodpecker steps gain garage_secrets_key_id / garage_secrets_secret_key from_secret env vars, and bump to ci-k8s:2026-05-01 (the tag with aws-cli baked in). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
28 lines
1.0 KiB
Bash
Executable File
28 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch kubeconfig.sops from Garage and decrypt to ~/.kube/config.
|
|
# Used by every Woodpecker step that needs cluster access.
|
|
#
|
|
# Required env (typically from_secret in the calling pipeline):
|
|
# GARAGE_SECRETS_KEY_ID, GARAGE_SECRETS_SECRET_KEY — secrets-key creds for k8s-secrets
|
|
# SOPS_AGE_KEY — age private key (Flux/CI keyring)
|
|
set -euo pipefail
|
|
|
|
: "${GARAGE_SECRETS_KEY_ID:?GARAGE_SECRETS_KEY_ID not set}"
|
|
: "${GARAGE_SECRETS_SECRET_KEY:?GARAGE_SECRETS_SECRET_KEY not set}"
|
|
: "${SOPS_AGE_KEY:?SOPS_AGE_KEY not set}"
|
|
|
|
mkdir -p ~/.config/sops/age ~/.kube
|
|
echo "$SOPS_AGE_KEY" > ~/.config/sops/age/keys.txt
|
|
|
|
TMP=$(mktemp)
|
|
trap 'rm -f "$TMP"' EXIT
|
|
|
|
AWS_ACCESS_KEY_ID="$GARAGE_SECRETS_KEY_ID" \
|
|
AWS_SECRET_ACCESS_KEY="$GARAGE_SECRETS_SECRET_KEY" \
|
|
AWS_DEFAULT_REGION=garage \
|
|
aws --endpoint-url https://s3.nas-1.renner.uno \
|
|
s3 cp s3://k8s-secrets/cluster-access/kubeconfig.sops "$TMP"
|
|
|
|
sops -d --input-type binary --output-type binary "$TMP" > ~/.kube/config
|
|
chmod 600 ~/.kube/config
|