sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ rename contour gitea secret to sops age key contour

Browse Source
This commit is contained in:
Kochetkov S 2026-08-04 13:48:47 +03:00
parent 12e406acad
commit 7c0e2dddfc
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
.gitea/workflows/terraform.yml
View File

@ -5,8 +5,8 @@ name: Terraform Terragrunt (contour)
# runner contract:
# vars: INFRA_ENV, RUNNER_LABEL, RUNNER_IMAGE
# secrets: TF_STATE_S3_ENDPOINT, TF_STATE_S3_BUCKET, S3_ACCESS_KEY, S3_SECRET_KEY,
# VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY, KUBECONFIG_B64 (external runner
# only), KUBE_CONTEXT (external runner only)
# VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY_CONTOUR, KUBECONFIG_B64 (external
# runner only), KUBE_CONTEXT (external runner only)
# Infra-service admin creds are NOT passed as secrets — they are read from Vault
# at run time (see the "Run ... stacks" step) so the single source of truth stays
# in the contour Vault.
@ -87,7 +87,7 @@ jobs:
# SOPS_AGE_KEY only reaches this step, not the whole job - the rest
# (checkout, kubeconfig, terragrunt run) never sees it.
env:
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY_CONTOUR }}
run: |
if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
@ -144,7 +144,7 @@ jobs:
# SOPS_AGE_KEY only reaches this step, not the whole job - the rest
# (checkout, kubeconfig, terragrunt run) never sees it.
env:
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY_CONTOUR }}
run: |
if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml
@ -202,7 +202,7 @@ jobs:
# SOPS_AGE_KEY only reaches this step, not the whole job - the rest
# (checkout, kubeconfig, terragrunt run) never sees it.
env:
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY_CONTOUR }}
run: |
if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi
sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml