commit 35c23a72bbb8fdc87d3b21860c6ee6a6f95710bd
parent b320dfbe2bd2e754c21f6e55b57bf6015ffb1ecb
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 9 Apr 2026 23:01:08 +0200
fix the rest of the jenkins setup
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
4 files changed, 68 insertions(+), 0 deletions(-)
diff --git a/apps/talos_cluster/jenkins/cosign-secret.yaml b/apps/talos_cluster/jenkins/cosign-secret.yaml
@@ -0,0 +1,32 @@
+# IMPORTANT: This file must be SOPS-encrypted before committing.
+# Fill in the values from the COSIGN_PRIVATE_KEY and COSIGN_PASSWORD GitHub secrets,
+# then run:
+# ./encrypt.sh apps/talos_cluster/image-builder/cosign-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+ name: cosign-signing-key
+ namespace: jenkins
+stringData:
+ cosign.key: ENC[AES256_GCM,data:tk4jgp+50k5Z7UwjENjjYf+su8MY7bvrYGxA6fd06CDlFWlCtXBjMujElUfxjoXQzVW2POn/JCvmLy86VuRu84pALO5fMWI0VYhVzlGOf/La7X71YngzCaQnrEVp6bO5HaCUPDPnugF9DzOQBGL/o8/SwrL8VFhilam+IUfPVK0Smm6A8PJtDFau+Wtpu6CP0keaHPwzX9cY1MPI0cyV+AOptcASsJHE8WCDB5zMGoXjz3gVxqi+eyo8dASrIB9YAEH0lyjItOCFwiMbYfhC3rLtFc44Q8mgRTUsMXdonA5gUi0N77W2xaewUuWdoYJY/mAcX+xKe/KtoIsNYvkWi93Y5OGv8ZBvFSvL7xz4lAL3AZGvs5JMG8mpV/inrVINC1J94CLHk2Ourymd4u2XuDkuzjJnmE2VnjfrXXo4kXBIyC55RhnvdCOjUc0GhMPk88o6HN8olV52rx9OYDumsIYyIFPH9GzsrI7tcVBzg8AWX/xL6SopMb59ngc4qAzf2r7GIlACzz5GZhfZtjGXClk1DVecLSEywEftkjAZ4t9YGl6MJPwfnjRxXHNS5t4WgJ0nodqK3w5qOJqnaiYnKDY24ok1Yuv4Y6mA/FfMvjy+hu7nj/IoJZ+QlULVDtcx2RK/hIbRzyGSYT/jj4GIlUyKpRPwm7ki1OouNNnNuDVvCp6F67M7olFxWjkxS+iT3lm0g2nSiJe4ngm0EwKQG2RBDe7SVJTcasm0R40QvbFqPBVLVhdLDTKW980t/TVqUMTgbb3WjlPV1Sju21sgrbYTXQlc5mki+118V1u62uq8JLfio5Lv6h3V/sws6o5UPf3+Y7hu+MtNE8Bhw9+aT21hLFA+8RK8RvjSZIo=,iv:qpsioAEH7IGBMoWWtMFh/Wneaw0GUEF3TLM8oXThDQc=,tag:r9fx8qzSfomQhyV86CV4IA==,type:str]
+ cosign.password: ENC[AES256_GCM,data:dgTshbPNKflUT02XXhIwzUF38mUCbTcvObqu4PBwA9Wc+wja/jeXCzun,iv:5jH3fTYhoFYQU9V8F044T04vsuTDX6F6WNR5xkcPYWo=,tag:YCmzB4NKeUJF+54VLCt3rg==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBValVFOUtWMGc4c3RuV1Y0
+ cFhpRUY3MlhlM2wvb1p0SHlXc1YxVnlNRTFzCjhzSEtCRXJ6aEdvM3ZsVVEvWFlR
+ cGxDaWE4RG9IOVFxU1pEREowMk1OeG8KLS0tIEZNcWhJYU5JMFlhc1k0a3c1Q3FV
+ SS9XTnRobGwwS0JaTkIvTUZ1ZnEyQXMKXmF+q+AC4hO+2LDZn9u6PBkAeGPK67uI
+ 3vDmtzjJQpcpwqTEJF6wWuWJ1L1IwXyCUDJe37yH7StHiQDkM7U3Lg==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-04-03T14:30:19Z"
+ mac: ENC[AES256_GCM,data:nXHEKbokj5TZ8X4RIEAlZ+bP7EB8ky5tugQOwlm78zFOUUbwwyJWmkn5/ZuHqqletWW7qFO2oadfAPfhiKFtQEFFrn7r5TNY0sdhSPJ06BUY7n/vfb8Wc/iZJdVjS1vsLdlDzMxIga8SyDMyGUxDgc1ao2cOMKzh3j3MwwSfTSw=,iv:yGFxliqf0vLWT4X9L8GxmCE/+1eL/ywmtfBH7UMSAD0=,tag:wZvJNZXDq4hbJ7Td4kvOfQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/jenkins/kustomization.yaml b/apps/talos_cluster/jenkins/kustomization.yaml
@@ -8,4 +8,6 @@ resources:
- namespace.yaml
- helm-repository.yaml
- operator-release.yaml
+ - registry-secret.yaml
+ - cosign-secret.yaml
- jenkins-instance.yaml
diff --git a/apps/talos_cluster/jenkins/registry-secret.yaml b/apps/talos_cluster/jenkins/registry-secret.yaml
@@ -0,0 +1,33 @@
+# IMPORTANT: This file must be SOPS-encrypted before committing.
+# Fill in the placeholder values, then run:
+# ./encrypt.sh apps/talos_cluster/image-builder/registry-secret.yaml
+#
+# Generate the auth value with:
+# echo -n "USERNAME:PASSWORD" | base64
+apiVersion: v1
+kind: Secret
+metadata:
+ name: registry-credentials
+ namespace: jenkins
+stringData:
+ dockerconfig.json: ENC[AES256_GCM,data:npOvF06b+ByAIYCbw8h7GXAIeerlzd+RvsoCwQHnEs4BZE81O089yZqETJ9SWnoVx6/IBUqlbo2FNGki6VYFOB4mjA9fqqrP0R/WEQ7eXa+VHlwgM8Z/lNT0IKf3SCyz9Inpd4WougbgNIag4Oa+8kk+Kss4ouNcSqJiUqkcS37SEksu48xxLrcu4wzWPF0xI1t09x8JH/pnL4MRVZ+ey1IKj9gEknl0DRNxJJgjiEnD,iv:IcwMs2Jis/SmHyLcYJLe5g1MW33nLBLJGEsHQu4chZU=,tag:D4EvKMcPmu8oNbI4nCjBwQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQzdQK21LdVZUei9rRzEx
+ RjUxcERVSXRPMDhBdFNHcHkxUyt1Yno5ZHc0ClVCOUxZWkwrbmdPS0VVNWJuV3M2
+ ZGpjaTdZZ0xnNHN6OStlSlBSV3hYTTQKLS0tICtOZlFua2JMQ0ladXBiUXE0eWs3
+ NEFBTFNaQmRwQUhOT2NXb0dpUlphdlUKCh4AjN7+pkhnPehzc8FhNCIcLurRidSO
+ h7nLeIgVg7391aIqSAGRDBIUmT/sNnZVMzjvSkRDCFnhoTEGrp/4PQ==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2026-03-29T11:16:38Z"
+ mac: ENC[AES256_GCM,data:MIQJG6H6cZKKPx6r/vqEfjATr9rcZC0NGSI68ZLCfJ0E1xrrbscR9ka5WLMR6stSFSdJcvD5vXbWdsfXnL7lg7scg26f0ZwnoYr3sQEifNnLHjvh+K+2np6kmTg1m+SqbEWherVd6x818tKItVNPySY1XRO+G3uEFYoO7QMNDjM=,iv:yh8mKWpHYjZ/pmiUvm6m7j+YgdgTG/FzRd42VMTxTp8=,tag:hUXS4+FVd0uoUjXoWAoHyQ==,type:str]
+ pgp: []
+ encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
+ version: 3.9.1
diff --git a/apps/talos_cluster/kustomization.yaml b/apps/talos_cluster/kustomization.yaml
@@ -44,3 +44,4 @@ resources:
- ./image-policies
- ./matrix-backup
#- ./proxmox-ccm
+ - ./jenkins
