encrypt just the pull secret and merge it in

12 months ago · 2aa0960b00
parent 54261d6089
commit 2aa0960b00
2 changed files with 82 additions and 54 deletions
--- a/env/beta/image-pull-secret.yaml
+++ b/env/beta/image-pull-secret.yaml
@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: bh-registry
+type: kubernetes.io/dockerconfigjson
+stringData:
+    .dockerconfigjson: ENC[AES256_GCM,data:4K5pv9g2Pusdn1I0HiUrtImSWenISuB6BgS1Py7jmKrXj1PIYy0XdSWU0oqDK593iDdC6uZhC4JRjUilI0Fs3ktjd3tlUDXabqCAfsLdInaKyUbG6JhrnGwVx5Oo9v1ZWWuILb5hRhTyk6hdlASkVckXUaX+r6Eo9ciMGSoyPAWksUQx/kt7elLckKAE6lpy+7nn91ZkeDNn4+WknyCkbJqgN+FEiF1e7hiS3KKSdDylntHiXxPIGfP5yRr7Da+8Q7tjiOLh0e0NnAeERpiE3bVpXqZU3ZQetLCa4szg,iv:1T17J5eHKmb0uWuKo2iGuRn4qW56xkmnTlkeSrXNCUk=,tag:fOzEkDDknAbVVSXLAw5iUQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1d5vst0g82v6xml29ydsrxefmf3vclgm6dj3npw6mefa7yu9xueaqztjqlg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTViswR2JQRFJWeElqaHBX
+            alRoRVFKeHM1SlVXaUZHalJjam5ZamsreTFNCkdXWmx6aE1iZ3ZBbnMrVS9pQzhi
+            bkNTeldDQmdrNWtBT3dyakxtYnZGMWcKLS0tIEtxS210eGFlMlhodEdqQ2R6YkI2
+            cUNGbUdOdzJpSHAybkY1Y1ZkRVRyK2sKjkRn5IUfgz1SoHKbrkyowLeqrsIFWILd
+            572KkWjg2LLkUTh0AzpFz8nM/XF8DAphkdMbGLNqT2dSZ3v8Fz8Qgw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2023-05-27T02:20:27Z"
+    mac: ENC[AES256_GCM,data:BAqauGGLuVw0jZ7BDL0HpxemXMHf5ZQb3q8UKbPoqsBmzH958x4oeaKoifwSkedYc9v5F3LJDs/v3RXsZX4mgekwuOtCLtl8Ua+uYx4fue+Qf8lhxPPVhFHhXUKoua29OTkide+6CWc2BNviafk4zuJAr+JH9tNvjMyWXhV7lPM=,iv:pGX+oph31m8iCqlyne9LJ52PdRYhNkurGcV7eY9IoXU=,tag:9x7zyVs7hDNVswhHP1mf1A==,type:str]
+    pgp: []
+    encrypted_regex: ^(stringData)
+    version: 3.7.3
--- a/env/beta/kustomization.yaml
+++ b/env/beta/kustomization.yaml
@ -1,59 +1,60 @@
 resources:
-    - ../base
+  - ../base
 commonLabels:
-    environment: beta
+  environment: beta
 nameSuffix: -beta
 namespace: barretthousen-beta
+
+patchesStrategicMerge:
+  - image-pull-secret.yaml
+
 patches:
-    - target:
-        kind: ENC[AES256_GCM,data:Pcm5CkBC7g==,iv:37bmXxHRYtjQDdiHLgICvJRsvh9dbGrCuhp9e5P2qng=,tag:OSacFHpaP/zO6m7SErnlUg==,type:str]
-        name: ENC[AES256_GCM,data:Ut6cGfk=,iv:ngHNDoxh5fi2PlkyTsUBvc35hsDfGqVJ80264t+Gt44=,tag:kxIRk6+KiwU4xxXvyweA5A==,type:str]
-      patch: ENC[AES256_GCM,data:IsQFDyzS/Uy2+SexQ9OHdeHhniYmHex4jJjV7ZjBXivOs0a+iZJpjF8aZ3y8ti6ZVJGI3Oiv02mVbwqGi9zAoMm8+EWhqqFa03jtSVLq,iv:+LCP+zVUJQg7UOJcwkb5XSP5VWwYIy+P6u3rBmcwvx4=,tag:Dy7OW2SJrZJs4MaVTA8+Gg==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:ruTX0/4IHQ==,iv:nKC9ej+O9lt0KpP5CT2kiudP7uaAKBiV00kZUGW+aTQ=,tag:7x0R6owBnly1rkWRB0dsUw==,type:str]
-        name: ENC[AES256_GCM,data:t0Ps,iv:jwJacK6heDMebojAUkHCE92N2zN2t58/1KfCyH5L6no=,tag:KJGb6OB7Xstj5CSNkRIHJw==,type:str]
-      patch: ENC[AES256_GCM,data:ze+U2pci2/tkReGWKVf/SNFwgmy+MvIYfGH8Drlm7bAxUBsCx0LtjqrAYppzV8jXe2Td8+6EW+fAZnA3wvRvzaYIy05qkZgn,iv:TPrF1jezsP0jE200VrbVVqN6iLUfZzbZhIZkzezl6EY=,tag:H5RnrwrK8uNZQJWJUs4sWg==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:bgNrCmYh/S6Uuw==,iv:kfMlt2UxdpMUVxtyKThDVlALWdY6oE+x0FsPTP56vVs=,tag:WsJYqe7xBtsqxB2rCwErEg==,type:str]
-        name: ENC[AES256_GCM,data:nVBDhKQjoQ==,iv:4qLS+PaEGvoebFuHG/S7wTo0IyiN0hI51VHsRRKFdeQ=,tag:jAqwPj6RL6WvfmavDTCseQ==,type:str]
-      patch: ENC[AES256_GCM,data:Hfyym0AiJPiCsovwdBzMCJ/rOS/5Vvws0uzLbjLaH0uBgOZ/9vKgMALJLCbaxVWLMY2NXtjJMbZeMw46NVbcCkWugXqguuIC4PjLuF8JDmLF8hwlstEtkfFtWJQ2PwCie0Nu0ppmgaipqLim5Ku68qVOHlyuBQ==,iv:DUQwreLlThyKM+2fQgInj/tEwrZNXUn+VkNzE/qRb7M=,tag:DAU/8EcexJcQTpJAgqEadg==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:9wjEQHOdURbdlA==,iv:P4kv7Ya19UKEd5e4TF07CneI7MlmBitGekRsj8MwDPw=,tag:rwLtFJTdI1xDW+EZlbaq8A==,type:str]
-        name: ENC[AES256_GCM,data:kNFx+z5G,iv:bdsXRe6mAYhR/IvLrQKFa+1LA4GUSRIRmwmKZeGCeIc=,tag:raP6/CAt4WYqZVDK/0kKwQ==,type:str]
-      patch: ENC[AES256_GCM,data:ATCIv/DORygzQM2giSrSdlt4dlGwzeEdI0H0vRg3t2upVjBTOu+or8jpev5kJAK2RPJvCkcpMeJoeWoEPaKGnWhSYwtNenWKu4KXmSU76p3TxFJP7tfY0Tdt1d3GrajTFMWicuh8H9OhaRlQ1VsgyQ5Ua64G,iv:azvxakFrtu4/7JSAGFpSUm2ehyVECmLVr/s3uIgc8kA=,tag:fVx2yIoRBv6yyxYP1lsLDQ==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:/xSf3/iy/qUPTQ==,iv:+S1sxU1n+dfRqO3y23RMpJ29/OmWxSL4J2BTM8yy1LE=,tag:BXRCxeJN2sCM7Vd2/N06Vg==,type:str]
-        name: ENC[AES256_GCM,data:jAxHZv10cgNnXYM=,iv:UIdEQAseR6NpVnMs1/wAnymo0Tx1Cly4KUZJ1FH7Dpw=,tag:5UWbOXGoKNsJOL2/e0+fvg==,type:str]
-      patch: ENC[AES256_GCM,data:ztVXRxCkPYSvbqpJp8PYshUhIrqwHOAHRtpyHGEWAoaub8Pm/vNA1Kgat+SCKNdtUEEf3Uqv67wBBCcv0BOuv2ft28ljfvsi9vu2y8zKuBGxoMYsv7zbhytJJ6nTuBqd0QGOU6ZdzFNuqAAy0NUg9gyi0mUdUD48PLQ=,iv:gmG2fM9rKcuOZ09gybufwNA/WrR9qJl5WW/HouPYpwA=,tag:CzVZX50QC6t3apsbWsGFOw==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:flyZvabBf2S+4g==,iv:uFbeuM+3PeZXc/Y1zN8C/2+4kRsZfL/QCE4eqeyNRTU=,tag:MChHG53/RhAsLcwUzcsPkg==,type:str]
-        name: ENC[AES256_GCM,data:xN93hUIjYc1bwbWL,iv:oecj2GbwPeUpbcNUxg7OqYJMAwguGjlXSL3/V2/imG0=,tag:h+JFvGPGS2ubhoZyxHslVg==,type:str]
-      patch: ENC[AES256_GCM,data:N0kar7qHWBs2M4vMWV2g3leZeUfKHHIcoqTqQU+v6SEPfiv2XSOAvlS8pYO3BDtnvkuIP6Ce3Cymr91ABWP7Vzu47j+qq+Q5xTvf5BXHe3xiG7beCocfOGZse1zIUi2oRw7zrd6jEBPeLy7VO2pc/QCYN57ynUoLhLu1,iv:kQSJSsHN7Nit8bP8n+VlQc5hZmDBwlm0BauXwVC7wis=,tag:Dq9Tv60BWF18OsSw3pfsag==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:xRVOLCrcVcK2vA==,iv:KOV7D1xrBEQLzPQ/QWpLdfcFylsqdW/c2j/Tj4+VkaE=,tag:h4fZXwN80R5QwBaNTlySNQ==,type:str]
-        name: ENC[AES256_GCM,data:9PWQ35S4PbghTg==,iv:fP/9djuLzcMResyYm0km5xAenZjmO7vNojVhJZHF3Zc=,tag:OVcoQ4H+qJA1LFYLgKyU/w==,type:str]
-      patch: ENC[AES256_GCM,data:y6FvflreC+X7P9Lf6z3qFx338GWwwM/3nPqTRW/89ZDG/d5ShJQo7U6GmJPE5h54K2flsfht3PyOEwdz/ySqIa0dGk0/5MN8ijEBBKqXVAba7HIlXe/hODiDAEmSQTowm8VTBs/q2uwsE1qnsc3hAYN8yBv6iTZb,iv:ohHkVXzFUfUsSm5CfwYMm3tsvebxCgTAsfDNWC7pnaQ=,tag:H1HI2wxUxnDtRyChXfn0ig==,type:str]
-    - target:
-        kind: ENC[AES256_GCM,data:52gX/0Wl,iv:QRIl7KKkg2NYKNttllf4GW4tuGelpOz/tm2UKrY0A/s=,tag:TO2rgJCmNOsLtSb1qSatqA==,type:str]
-        name: ENC[AES256_GCM,data:XECWmUE8W5j+2cY=,iv:7Tlk9rv5qDmNA14lZlXmNVwt8odE26smTo8/H2qC6mg=,tag:DwIVOdXGOiiuOU03tfI7lA==,type:str]
-      patch: ENC[AES256_GCM,data:gEGomIxxbpM0yuNHfpy0Vq3GOBlkU/RqN5On/G2Ue15yA30HvAcZK8UFoakapJ205qxbkzol900yPa8FAhVI4t8uerZp4TncVt1gusRwlQy0bU9Xu11wNeqowvJCnZc8CJvEsWrLfVs8DeBh2GKKbL3NgvU49C2yDrf802voFuCeXulAmMGR9luYmZhTKd+lQRqOFa76ny2POgFtwWb6j6bdHxag/Zk/RTx49srwPLfqf8c4xAeCE0omJ0YK+gIEIl4TUujEXafVolCFvk3UqwN1zcES9DmrOFSz5e58zYgFE5+kfhKw8ZvLvOu31nck9V4L6sYMGfOYz84KcirfR0rNSbPvbCn2+w==,iv:dXah9DbZhCGSfjYjKvhzncJwvbaABzTZvIedimLRNwI=,tag:lDr0+XE/gcQlzrVhnM36Yg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1d5vst0g82v6xml29ydsrxefmf3vclgm6dj3npw6mefa7yu9xueaqztjqlg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2U2sxV252emxYdEg0aGFZ
-            TDBEZmg4aitqRVk1eG5DYXI5OERHT1h1OEVvCnloaHltS3VuK0tpRk5kenhER3dV
-            MithaHBRa3grMkhuOGlYUGlLTEZBbzgKLS0tIDBUQzBxcGo2YTA1a29ad3d2bE1I
-            SjNNR2ZMWmRUYXRoSXJPUEJZZmNxTVUKvWXhqFLSjYkaeWW4CDxgxtWTjZZCfBWj
-            RTAjZGM9lZpLaJFT6GNpZvU69fnxVXMnA0H4Ra1iUw+9ZUDJkxD5Jg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-05-27T02:08:56Z"
-    mac: ENC[AES256_GCM,data:/OqTGNb7sc/IHiA/ielKxTxkS+IahHbsT5CDBO4Q3973lXZvXEtAug1Lku2XEXSGhMo58zsovz5t1vfneSppV45xix9ABAGloFzPtvvCi2uw3SgSl1qySl43oj2Zpk8KhQU6FW+5Un/4ZyuuTydPDmKITtH31rGtFd9dkIDIXpI=,iv:+zeaiMd7OZidhtJEADLhisjujFzW1UDWbrMUgLv8i48=,tag:VITfwvz6JWfyC/FX1RxNJg==,type:str]
-    pgp: []
-    encrypted_regex: ^(patches)
-    version: 3.7.3
+  - target:
+      kind: Ingress
+      name: admin
+    patch: |-
+      - op: replace
+        path: /spec/rules/0/host
+        value: admin.beta.barretthousen.com
+  - target:
+      kind: Ingress
+      name: web
+    patch: |-
+      - op: replace
+        path: /spec/rules/0/host
+        value: beta.barretthousen.com
+  - target:
+      kind: Deployment
+      name: catalog
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: git.vdhsn.com/barretthousen/service-catalog:beta
+  - target:
+      kind: Deployment
+      name: runner
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: git.vdhsn.com/barretthousen/service-runner:beta
+  - target:
+      kind: Deployment
+      name: proxy-admin
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: git.vdhsn.com/barretthousen/service-proxy-admin:beta
+  - target:
+      kind: Deployment
+      name: proxy-client
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: git.vdhsn.com/barretthousen/service-proxy-client:beta
+  - target:
+      kind: Deployment
+      name: web-client
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/image
+        value: git.vdhsn.com/barretthousen/client-web-client:beta