feat: implement containerized gitea-runner with encrypted secrets
This commit is contained in:
jv
parent
4d7b9d0216
commit
9c64a79aef
|
|
@ -0,0 +1,41 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: gitea-runner
|
||||||
|
namespace: gitea-runner
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: gitea-runner
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: gitea-runner
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: runner
|
||||||
|
image: gitea/act_runner:latest
|
||||||
|
env:
|
||||||
|
- name: GITEA_INSTANCE_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: gitea-runner-secrets
|
||||||
|
key: GITEA_INSTANCE_URL
|
||||||
|
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: gitea-runner-secrets
|
||||||
|
key: GITEA_REGISTRATION_TOKEN
|
||||||
|
- name: GITEA_RUNNER_NAME
|
||||||
|
value: "k8s-runner"
|
||||||
|
- name: GITEA_RUNNER_LABELS
|
||||||
|
value: "ubuntu-latest:docker://node:18-bullseye,debian-latest:docker://node:18-bullseye"
|
||||||
|
volumeMounts:
|
||||||
|
- name: docker-sock
|
||||||
|
mountPath: /var/run/docker.sock
|
||||||
|
volumes:
|
||||||
|
- name: docker-sock
|
||||||
|
hostPath:
|
||||||
|
path: /var/run/docker.sock
|
||||||
|
type: Socket
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: gitea-runner
|
||||||
|
|
@ -0,0 +1,146 @@
|
||||||
|
Incorrect Usage. flag provided but not defined: -encrypt-file
|
||||||
|
|
||||||
|
NAME:
|
||||||
|
sops - sops - encrypted file editor with AWS KMS, GCP KMS, HuaweiCloud KMS, Azure Key Vault, age, and GPG support
|
||||||
|
|
||||||
|
USAGE:
|
||||||
|
sops is an editor of encrypted files that supports AWS KMS, GCP, HuaweiCloud KMS, AZKV,
|
||||||
|
PGP, and Age
|
||||||
|
|
||||||
|
To encrypt or decrypt a document with AWS KMS, specify the KMS ARN
|
||||||
|
in the -k flag or in the SOPS_KMS_ARN environment variable.
|
||||||
|
(you need valid credentials in ~/.aws/credentials or in your env)
|
||||||
|
|
||||||
|
To encrypt or decrypt a document with GCP KMS, specify the
|
||||||
|
GCP KMS resource ID in the --gcp-kms flag or in the SOPS_GCP_KMS_IDS
|
||||||
|
environment variable.
|
||||||
|
(You need to setup Google application default credentials. See
|
||||||
|
https://developers.google.com/identity/protocols/application-default-credentials)
|
||||||
|
|
||||||
|
To encrypt or decrypt a document with HuaweiCloud KMS, specify the
|
||||||
|
HuaweiCloud KMS key ID (format: region:key-uuid) in the --hckms flag or in the
|
||||||
|
SOPS_HUAWEICLOUD_KMS_IDS environment variable.
|
||||||
|
(You need to setup HuaweiCloud credentials via environment variables:
|
||||||
|
HUAWEICLOUD_SDK_AK, HUAWEICLOUD_SDK_SK, HUAWEICLOUD_SDK_PROJECT_ID, or
|
||||||
|
use credentials file at ~/.huaweicloud/credentials)
|
||||||
|
|
||||||
|
To encrypt or decrypt a document with HashiCorp Vault's Transit Secret
|
||||||
|
Engine, specify the Vault key URI name in the --hc-vault-transit flag
|
||||||
|
or in the SOPS_VAULT_URIS environment variable (for example
|
||||||
|
https://vault.example.org:8200/v1/transit/keys/dev, where
|
||||||
|
'https://vault.example.org:8200' is the vault server, 'transit' the
|
||||||
|
enginePath, and 'dev' is the name of the key).
|
||||||
|
(You need to enable the Transit Secrets Engine in Vault. See
|
||||||
|
https://www.vaultproject.io/docs/secrets/transit/index.html)
|
||||||
|
|
||||||
|
To encrypt or decrypt a document with Azure Key Vault, specify the
|
||||||
|
Azure Key Vault key URL in the --azure-kv flag or in the
|
||||||
|
SOPS_AZURE_KEYVAULT_URL environment variable.
|
||||||
|
(Authentication is based on environment variables, see
|
||||||
|
https://docs.microsoft.com/en-us/go/azure/azure-sdk-go-authorization#use-environment-based-authentication.
|
||||||
|
The user/sp needs the key/encrypt and key/decrypt permissions.)
|
||||||
|
|
||||||
|
To encrypt or decrypt using age, specify the recipient in the -a flag,
|
||||||
|
or in the SOPS_AGE_RECIPIENTS environment variable.
|
||||||
|
|
||||||
|
To encrypt or decrypt using PGP, specify the PGP fingerprint in the
|
||||||
|
-p flag or in the SOPS_PGP_FP environment variable.
|
||||||
|
|
||||||
|
To use multiple KMS or PGP keys, separate them by commas. For example:
|
||||||
|
$ sops -p "10F2...0A, 85D...B3F21" file.yaml
|
||||||
|
|
||||||
|
The -p, -k, --gcp-kms, --hckms, --hc-vault-transit, and --azure-kv flags are only
|
||||||
|
used to encrypt new documents. Editing or decrypting existing documents
|
||||||
|
can be done with "sops file" or "sops decrypt file" respectively. The KMS and
|
||||||
|
PGP keys listed in the encrypted documents are used then. To manage master
|
||||||
|
keys in existing documents, use the "add-{kms,pgp,gcp-kms,hckms,azure-kv,hc-vault-transit}"
|
||||||
|
and "rm-{kms,pgp,gcp-kms,hckms,azure-kv,hc-vault-transit}" flags with --rotate
|
||||||
|
or the updatekeys command.
|
||||||
|
|
||||||
|
To use a different GPG binary than the one in your PATH, set SOPS_GPG_EXEC.
|
||||||
|
|
||||||
|
To select a different editor than the default (vim), set SOPS_EDITOR or
|
||||||
|
EDITOR.
|
||||||
|
|
||||||
|
Note that flags must always be provided before the filename to operate on.
|
||||||
|
Otherwise, they will be ignored.
|
||||||
|
|
||||||
|
For more information, see the README at https://github.com/getsops/sops
|
||||||
|
|
||||||
|
VERSION:
|
||||||
|
3.13.3
|
||||||
|
|
||||||
|
AUTHOR:
|
||||||
|
CNCF Maintainers
|
||||||
|
|
||||||
|
COMMANDS:
|
||||||
|
completion Generate shell completion scripts
|
||||||
|
exec-env execute a command with decrypted values inserted into the environment
|
||||||
|
exec-file execute a command with the decrypted contents as a temporary file
|
||||||
|
publish Publish sops file or directory to a configured destination
|
||||||
|
keyservice start a SOPS key service server
|
||||||
|
filestatus check the status of the file, returning encryption status
|
||||||
|
groups modify the groups on a SOPS file
|
||||||
|
updatekeys update the keys of SOPS files using the config file
|
||||||
|
decrypt decrypt a file, and output the results to stdout. If no filename is provided, stdin will be used.
|
||||||
|
encrypt encrypt a file, and output the results to stdout. If no filename is provided, stdin will be used.
|
||||||
|
rotate generate a new data encryption key and reencrypt all values with the new key
|
||||||
|
edit edit an encrypted file
|
||||||
|
set set a specific key or branch in the input document. value must be a JSON encoded string, for example '/path/to/file ["somekey"][0] {"somevalue":true}', or a path if --value-file is used, or omitted if --value-stdin is used
|
||||||
|
unset unset a specific key or branch in the input document.
|
||||||
|
help, h Shows a list of commands or help for one command
|
||||||
|
|
||||||
|
GLOBAL OPTIONS:
|
||||||
|
--decrypt, -d decrypt a file and output the result to stdout
|
||||||
|
--encrypt, -e encrypt a file and output the result to stdout
|
||||||
|
--rotate, -r generate a new data encryption key and reencrypt all values with the new key
|
||||||
|
--disable-version-check do not check whether the current version is latest during --version [$SOPS_DISABLE_VERSION_CHECK]
|
||||||
|
--check-for-updates do check whether the current version is latest during --version
|
||||||
|
--kms value, -k value comma separated list of KMS ARNs [$SOPS_KMS_ARN]
|
||||||
|
--aws-profile value The AWS profile to use for requests to AWS
|
||||||
|
--gcp-kms value comma separated list of GCP KMS resource IDs [$SOPS_GCP_KMS_IDS]
|
||||||
|
--hckms value comma separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) [$SOPS_HUAWEICLOUD_KMS_IDS]
|
||||||
|
--azure-kv value comma separated list of Azure Key Vault URLs [$SOPS_AZURE_KEYVAULT_URLS]
|
||||||
|
--hc-vault-transit value comma separated list of vault's key URI (e.g. 'https://vault.example.org:8200/v1/transit/keys/dev') [$SOPS_VAULT_URIS]
|
||||||
|
--pgp value, -p value comma separated list of PGP fingerprints [$SOPS_PGP_FP]
|
||||||
|
--age value, -a value comma separated list of age recipients [$SOPS_AGE_RECIPIENTS]
|
||||||
|
--in-place, -i write output back to the same file instead of stdout
|
||||||
|
--extract value extract a specific key or branch from the input document. Decrypt mode only. Example: --extract '["somekey"][0]'
|
||||||
|
--input-type value currently json, yaml, dotenv, ini and binary are supported. If not set, sops will use the file's extension to determine the type
|
||||||
|
--output-type value currently json, yaml, dotenv, ini and binary are supported. If not set, sops will use the input file's extension to determine the output format
|
||||||
|
--show-master-keys, -s display master encryption keys in the file during editing
|
||||||
|
--add-gcp-kms value add the provided comma-separated list of GCP KMS key resource IDs to the list of master keys on the given file
|
||||||
|
--rm-gcp-kms value remove the provided comma-separated list of GCP KMS key resource IDs from the list of master keys on the given file
|
||||||
|
--add-hckms value add the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) to the list of master keys on the given file
|
||||||
|
--rm-hckms value remove the provided comma-separated list of HuaweiCloud KMS key IDs (format: region:key-uuid) from the list of master keys on the given file
|
||||||
|
--add-azure-kv value add the provided comma-separated list of Azure Key Vault key URLs to the list of master keys on the given file
|
||||||
|
--rm-azure-kv value remove the provided comma-separated list of Azure Key Vault key URLs from the list of master keys on the given file
|
||||||
|
--add-kms value add the provided comma-separated list of KMS ARNs to the list of master keys on the given file
|
||||||
|
--rm-kms value remove the provided comma-separated list of KMS ARNs from the list of master keys on the given file
|
||||||
|
--add-hc-vault-transit value add the provided comma-separated list of Vault's URI key to the list of master keys on the given file ( eg. https://vault.example.org:8200/v1/transit/keys/dev)
|
||||||
|
--rm-hc-vault-transit value remove the provided comma-separated list of Vault's URI key from the list of master keys on the given file ( eg. https://vault.example.org:8200/v1/transit/keys/dev)
|
||||||
|
--add-age value add the provided comma-separated list of age recipients fingerprints to the list of master keys on the given file
|
||||||
|
--rm-age value remove the provided comma-separated list of age recipients from the list of master keys on the given file
|
||||||
|
--add-pgp value add the provided comma-separated list of PGP fingerprints to the list of master keys on the given file
|
||||||
|
--rm-pgp value remove the provided comma-separated list of PGP fingerprints from the list of master keys on the given file
|
||||||
|
--ignore-mac ignore Message Authentication Code during decryption
|
||||||
|
--mac-only-encrypted compute MAC only over values which end up encrypted
|
||||||
|
--unencrypted-suffix value override the unencrypted key suffix.
|
||||||
|
--encrypted-suffix value override the encrypted key suffix. When empty, all keys will be encrypted, unless otherwise marked with unencrypted-suffix.
|
||||||
|
--unencrypted-regex value set the unencrypted key regex. When specified, only keys matching the regex will be left unencrypted.
|
||||||
|
--encrypted-regex value set the encrypted key regex. When specified, only keys matching the regex will be encrypted.
|
||||||
|
--unencrypted-comment-regex value set the unencrypted comment suffix. When specified, only keys that have comment matching the regex will be left unencrypted.
|
||||||
|
--encrypted-comment-regex value set the encrypted comment suffix. When specified, only keys that have comment matching the regex will be encrypted.
|
||||||
|
--config value path to sops' config file. If set, sops will not search for the config file recursively. [$SOPS_CONFIG]
|
||||||
|
--encryption-context value comma separated list of KMS encryption context key:value pairs
|
||||||
|
--set value set a specific key or branch in the input document. value must be a json encoded string. (edit mode only). eg. --set '["somekey"][0] {"somevalue":true}'
|
||||||
|
--shamir-secret-sharing-threshold value the number of master keys required to retrieve the data key with shamir (default: 0)
|
||||||
|
--indent value the number of spaces to indent YAML or JSON encoded file (default: 0)
|
||||||
|
--verbose Enable verbose logging output
|
||||||
|
--output value Save the output after encryption or decryption to the file specified
|
||||||
|
--filename-override value Use this filename instead of the provided argument for loading configuration, and for determining input type and output type
|
||||||
|
--decryption-order value comma separated list of decryption key types [$SOPS_DECRYPTION_ORDER]
|
||||||
|
--enable-local-keyservice use local key service [$SOPS_ENABLE_LOCAL_KEYSERVICE]
|
||||||
|
--keyservice value Specify the key services to use in addition to the local one. Can be specified more than once. Syntax: protocol://address. Example: tcp://myserver.com:5000 [$SOPS_KEYSERVICE]
|
||||||
|
--help, -h show help
|
||||||
|
--version, -v print the version
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: gitea-runner-secrets
|
||||||
|
namespace: gitea-runner
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
GITEA_INSTANCE_URL: "https://lab2025.duckdns.org/git/"
|
||||||
|
GITEA_REGISTRATION_TOKEN: "c1ce1b4396109c5c906513a7ea8b29bc63bfbcbd"
|
||||||
Loading…
Reference in New Issue