50620e6047
Data-driven user onboarding: add a JSON entry to Vault KV k8s_users, apply vault + platform + woodpecker stacks, and everything is auto-generated. Vault stack: namespace creation, per-user Vault policies with secret isolation via identity entities/aliases, K8s deployer roles, CI policy update. Platform stack: domains field in k8s_users type, TLS secrets per user namespace, user domains merged into Cloudflare DNS, user-roles ConfigMap mounted in portal. Woodpecker stack: admin list auto-generated from k8s_users, WOODPECKER_OPEN=true. K8s-portal: dual-track onboarding (general/namespace-owner), namespace-owner dashboard with Vault/kubectl commands, setup script adds Vault+Terraform+Terragrunt, contributing page with CI pipeline template, versioned image tags in CI pipeline. New: stacks/_template/ with copyable stack template for namespace-owners.
49 lines
1.4 KiB
YAML
49 lines
1.4 KiB
YAML
when:
|
|
event: push
|
|
branch: master
|
|
path:
|
|
include:
|
|
- "stacks/platform/modules/k8s-portal/files/**"
|
|
|
|
clone:
|
|
git:
|
|
image: woodpeckerci/plugin-git
|
|
settings:
|
|
attempts: 5
|
|
backoff: 10s
|
|
|
|
steps:
|
|
- name: build-and-push
|
|
image: woodpeckerci/plugin-docker-buildx
|
|
settings:
|
|
username: "viktorbarzin"
|
|
password:
|
|
from_secret: dockerhub-pat
|
|
repo: viktorbarzin/k8s-portal
|
|
dockerfile: stacks/platform/modules/k8s-portal/files/Dockerfile
|
|
context: stacks/platform/modules/k8s-portal/files
|
|
platforms:
|
|
- linux/amd64
|
|
tag: ["${CI_PIPELINE_NUMBER}", "latest"]
|
|
cache_from: "viktorbarzin/k8s-portal:latest"
|
|
cache_to: "type=inline"
|
|
|
|
- name: deploy
|
|
image: bitnami/kubectl:latest
|
|
commands:
|
|
- "kubectl set image deployment/k8s-portal portal=viktorbarzin/k8s-portal:${CI_PIPELINE_NUMBER} -n k8s-portal"
|
|
- "kubectl rollout status deployment/k8s-portal -n k8s-portal --timeout=120s"
|
|
- "echo 'k8s-portal deployed successfully (build ${CI_PIPELINE_NUMBER})'"
|
|
|
|
- name: slack
|
|
image: curlimages/curl
|
|
commands:
|
|
- |
|
|
curl -s -X POST -H 'Content-type: application/json' \
|
|
--data "{\"text\":\"K8s Portal: build #${CI_PIPELINE_NUMBER} ${CI_PIPELINE_STATUS}\"}" \
|
|
"$SLACK_WEBHOOK" || true
|
|
environment:
|
|
SLACK_WEBHOOK:
|
|
from_secret: slack_webhook
|
|
when:
|
|
status: [success, failure]
|