From 7c0e2dddfc46460d771bf883762270bd655d4b08 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Tue, 4 Aug 2026 13:48:47 +0300 Subject: [PATCH] ++ rename contour gitea secret to sops age key contour --- .gitea/workflows/terraform.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/terraform.yml b/.gitea/workflows/terraform.yml index eede994..5260ea0 100644 --- a/.gitea/workflows/terraform.yml +++ b/.gitea/workflows/terraform.yml @@ -5,8 +5,8 @@ name: Terraform Terragrunt (contour) # runner contract: # vars: INFRA_ENV, RUNNER_LABEL, RUNNER_IMAGE # secrets: TF_STATE_S3_ENDPOINT, TF_STATE_S3_BUCKET, S3_ACCESS_KEY, S3_SECRET_KEY, -# VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY, KUBECONFIG_B64 (external runner -# only), KUBE_CONTEXT (external runner only) +# VAULT_ADDR, VAULT_TOKEN, SOPS_AGE_KEY_CONTOUR, KUBECONFIG_B64 (external +# runner only), KUBE_CONTEXT (external runner only) # Infra-service admin creds are NOT passed as secrets — they are read from Vault # at run time (see the "Run ... stacks" step) so the single source of truth stays # in the contour Vault. @@ -87,7 +87,7 @@ jobs: # SOPS_AGE_KEY only reaches this step, not the whole job - the rest # (checkout, kubeconfig, terragrunt run) never sees it. env: - SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} + SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY_CONTOUR }} run: | if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml @@ -144,7 +144,7 @@ jobs: # SOPS_AGE_KEY only reaches this step, not the whole job - the rest # (checkout, kubeconfig, terragrunt run) never sees it. env: - SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} + SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY_CONTOUR }} run: | if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml @@ -202,7 +202,7 @@ jobs: # SOPS_AGE_KEY only reaches this step, not the whole job - the rest # (checkout, kubeconfig, terragrunt run) never sees it. env: - SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }} + SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY_CONTOUR }} run: | if ! command -v sops >/dev/null 2>&1; then apk add --no-cache sops || (apk add --no-cache curl && curl -fsSL https://github.com/getsops/sops/releases/download/v3.9.0/sops-v3.9.0.linux.amd64 -o /usr/local/bin/sops && chmod +x /usr/local/bin/sops); fi sops --decrypt infrastructure-secrets.yaml > /tmp/infra-secret-values.yaml