cluster

commit 6818fe643af5659d5a02fdd82ae0d0f938c08918
parent 18da216b1cb6a878653491de5847cc8cb7ec8899
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed, 31 May 2023 23:17:22 +0200

Try fixing dns issues

Diffstat:
A
apps/production/secrets/certmanager.yaml
 | 
28
++++++++++++++++++++++++++++
M
apps/production/secrets/woodpecker-secret.yaml
 | 
18
+++++++++---------
M
clusters/production/apps.yaml
 | 
22
----------------------
M
clusters/production/infrastructure.yaml
 | 
22
++++++++++++++++++++++
M
infrastructure/configs/cluster-issuers.yaml
 | 
4
++++

5 files changed, 63 insertions(+), 31 deletions(-)
diff --git a/apps/production/secrets/certmanager.yaml b/apps/production/secrets/certmanager.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-api-token
+    namespace: cert-manger
+type: Opaque
+stringData:
+    api-token: ENC[AES256_GCM,data:bjXypnqtB3kad9bkMuquYSDA5ICqFtZM/9n6vqXzkJj70NrUuFekKg==,iv:lQczgbF3NfAaNXC+jHIgowQ6+ars1rwnXAF0BwzjiS4=,tag:AxZ4HsojTZK7k6N7aNEy5g==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHZDBoMndhL1N3cGpmaWww
+            V3NHMVFBTUxVQWNrVEVoVlVSd2dXYzVLVWpnCmFUTlBOd1dRV1NmY2hNWkdoejdG
+            di9OeWtFVDFLNWxYcENJVFlVL2JKTlEKLS0tIDZYd1NWZUFmTFRsVDFaVnNaQytH
+            RStDN3ZUOUFMeTRFdEJRNVZzbENKTE0KSevQN53eG3UN77HTzLxGFjP25UUEVUfv
+            xGqa2UdT3fElMGWpaTX9kJfympzRRoUmMw0KU/EwQqu2bWxAvPs8lw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-31T21:15:54Z"
+    mac: ENC[AES256_GCM,data:GdzrDsXULeyYYfOOIM1b4xtL8zOUfxdKyU3E80Jn8PVFSD21go4+PTgKHTnWiJNiqb3WJe+NUMdFBd2XxItYb0uoT6JerAZGOwhXWQJeES3fPcLS+plMyLkdzk1quRYbhyR+fetDRFz4mtGfDGV3nMznd5X+cor06kwAKw2vSt4=,iv:kxuJFY+Otw7YVGi/5xQ4s9m3PDuWl9PbbDogokde1NU=,tag:qzwzlns5fOaNn8YMvLsFIA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
+    version: 3.7.3
diff --git a/apps/production/secrets/woodpecker-secret.yaml b/apps/production/secrets/woodpecker-secret.yaml
@@ -5,7 +5,7 @@ metadata:
     namespace: woodpecker
 type: Opaque
 stringData:
-    WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:0uzbxKPDdHcZrWVWAnI7lFTvBbBQyGvgsU4RhlzDg/SwHn8umjzZPDlFw6ZW0OnDJ4fXktYYYOZyzPyaUbD1zA==,iv:OyVwjPf+DGbmitTdQTbqgzjwIDT3Ln+8qygSo1gA4nY=,tag:JXdULurqyVuPer3P+gneWw==,type:str]
+    WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:ThkvMTOAuwaYeCuUlXtqxtCwJlL5586tf55AbQAQLDlZy83g+VJUfIyVpRlZoouuQL7j4jxUVizbIfWEWKiByQ==,iv:w75hw/WzqRaIH52cxcKdfCwA+V90de7uHyKPVixgvTM=,tag:KDeZ9QXun/2cBViLJUE6mg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -15,14 +15,14 @@ sops:
         - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpQzJEdHpFK3UzdGF6RkZq
-            YTRsSnMwN2dQamEwVjJuOHVqbEdiR1JjQWh3ClpnYW1UVlFkVEhPSko0RkxhMEpF
-            WE9tLzRROGFpU3lacEZrNHJGa2lnL3MKLS0tIGFtbld3UFRPVkhISy9OTnRsc2tB
-            dC9SNENzM053eHhOckFhYWltRHRxWWcKT4nPu3NcLmxNm2lSjJvSYYtMXnBXI7KP
-            XKO4DxdIHnDA9dHivDevlEyVu0HNXuVnXdCIPf0s4hp33rxjWJBmsQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRldFb1JNTk44Y2dOSndR
+            ZGs1RkFWbElKcmdYNFQzYzVDWnhRcTM0cGlFCnh5SHZMaVdINi9GVEFzQjM3b1cy
+            VW5tYUNsN0NRd1BIYTMwaHJhczA2TkUKLS0tIGtMeEZUaFlhcE1HTHVSbkx1TVFy
+            eEVGcFZWaTZDOE5OVDV5OXV3RjlHQ00KJ4pUuWYpvAiAN/yWIvsJ+ObNFHTHAVJW
+            zGoAguL6s1U8glTHeR7Q1opI1RpOEnAlpS/oS5n6aglmx5QIkAYKHw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-19T17:12:51Z"
-    mac: ENC[AES256_GCM,data:cDIlX2ATGUhMnRgRcrkNE94gofmJQ0cLZR85v8NjT8xlIYwAbN4cZGYZSaLlm0MFJbiL5j2a2Ywn1q16aeYPxxKj+LQw5f8Mc4V6CwkPc0oKvvx8ZQ1wa24Y4QbzLbb3VX4S3nVO7ywtb8TYga7g/r+06TX37ielDMbBndauruQ=,iv:fAm4p+BXjZiPL2adTVlX0nm1z2O5dqduUmz8o1RXtqc=,tag:CvPd+dXmIZg4ZkZYa7XAmQ==,type:str]
+    lastmodified: "2023-05-31T21:14:06Z"
+    mac: ENC[AES256_GCM,data:/PRPDdc7zhkmXLT1kWtJP6Kjq436Ji00kGRBSddtjaR2D1YyI69QD0DhKuy9URSIkpk6joIdhPxpzU/qBimxR1T3Thfhwaka/J/uRcO1NTRJUEMws+2JFJuLzLH8v3nPnof6GD3BpBbLrjnrFADQDBdTqKUPIiA3UPm9depMojE=,iv:ZqUHRU/6sVRR16eHi0muJycoPkldmmJjSyhRhOtrFWE=,tag:bKYdT2V0tMFK2Cof5AnOwg==,type:str]
     pgp: []
-    encrypted_regex: ^(data|stringData)$
+    encrypted_regex: ^(data|stringData|password|registration_shared_secret|shared_secret)$
     version: 3.7.3
diff --git a/clusters/production/apps.yaml b/clusters/production/apps.yaml
@@ -23,28 +23,6 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
-  name: apps-secrets
-  namespace: flux-system
-spec:
-  interval: 10m0s
-  dependsOn:
-    - name: infra-configs
-    - name: apps-namespaces
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./apps/production/secrets
-  prune: false
-  wait: true
-  timeout: 5m0s
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
   name: apps
   namespace: flux-system
 spec:
diff --git a/clusters/production/infrastructure.yaml b/clusters/production/infrastructure.yaml
@@ -43,10 +43,32 @@ spec:
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:
+  name: apps-secrets
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  dependsOn:
+    - name: apps-namespaces
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./apps/production/secrets
+  prune: false
+  wait: true
+  timeout: 5m0s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
   name: infra-configs
   namespace: flux-system
 spec:
   dependsOn:
+    - name: apps-secrets
     - name: infra-controllers
   interval: 1h
   retryInterval: 1m
diff --git a/infrastructure/configs/cluster-issuers.yaml b/infrastructure/configs/cluster-issuers.yaml
@@ -19,6 +19,10 @@ spec:
             tsigSecretSecretRef:
               key: tsig-secret
               name: tsig-secret
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer