Template defaults

flux/gitrepository-secret.yaml.example

@@ -0,0 +1,25 @@
+# Shape of the k8s-platform-git-auth Secret that gitrepository.yaml's
+# secretRef points at — created directly via `kubectl create secret`
+# (never written to a real file, real key material never committed):
+#
+#   kubectl create secret generic k8s-platform-git-auth \
+#     -n flux-system \
+#     --from-file=identity=$HOME/.ssh/id_rsa \
+#     --from-file=identity.pub=$HOME/.ssh/id_rsa.pub \
+#     --from-file=known_hosts=<(ssh-keyscan -p 2222 gitea.sttlab.eu)
+apiVersion: v1
+kind: Secret
+metadata:
+  name: k8s-platform-git-auth
+  namespace: flux-system
+type: Opaque
+stringData:
+  identity: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    PLACEHOLDER
+    -----END OPENSSH PRIVATE KEY-----
+  identity.pub: ssh-rsa PLACEHOLDER
+  known_hosts: |
+    [gitea.sttlab.eu]:2222 ssh-ed25519 PLACEHOLDER
+    [gitea.sttlab.eu]:2222 ssh-rsa PLACEHOLDER
+    [gitea.sttlab.eu]:2222 ecdsa-sha2-nistp256 PLACEHOLDER

flux/gitrepository.yaml

@@ -1,9 +1,5 @@
-# Not applied yet: url is a PLACEHOLDER, this repo has no git remote (see
-# ../../STATUS.md). Once it does, this object is what makes source-controller
-# actually clone it — nothing else does.
-#
 # Bootstrap step, same category as installing the Flux Operator itself
-# (see ../README.md): this file must be applied manually once
+# (see ../README.md): this file was applied manually once
 # (`kubectl apply -f gitrepository.yaml`), because nothing can apply it
 # automatically before it exists — Flux can't fetch the object that tells it
 # where to fetch from. After that one-time apply, since this file lives
@@ -12,9 +8,14 @@
 # would keep it (and everything else here) self-managing going forward —
 # not scaffolded yet, out of scope for this file.
 #
+# secretRef -> k8s-platform-git-auth: SSH identity/known_hosts, created
+# directly via `kubectl create secret` (never written to a file), backed by
+# ~/.ssh/id_rsa (fingerprint SHA256:+BneVyWyJgOlDvISQ597e9YTXmd3GPpN9XHcItgQGKk,
+# already an authorized key on this Gitea account).
+#
 # Any other repo's Kustomization (e.g. dataplane-catalog's
-# flux-kustomization.yaml) can reference this SAME GitRepository by name —
-# one GitRepository per source repo, not per consumer.
+# kustomization.yaml) can reference this SAME GitRepository by name — one
+# GitRepository per source repo, not per consumer.
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata:
@@ -22,6 +23,8 @@ metadata:
   namespace: flux-system
 spec:
   interval: 5m
-  url: PLACEHOLDER # e.g. https://github.com/<org>/k8s-platform
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-k8s-platform.git
+  secretRef:
+    name: k8s-platform-git-auth
   ref:
     branch: main