homelab-k3s/.gitignore at f89e312b05734c55c1c1c5fbe7bcb944d068ff82 - homelab-k3s - Gitea: Git with a cup of tea

jason/homelab-k3s

jasonwitty 96e1825629 Add Gitea Actions deploy pipeline + deployer RBAC

- .gitea/workflows/deploy.yaml: PRs run a server-side dry-run; pushes to
  main apply the kustomization and wait for all rollouts. Modeled on
  socktop-webterm's pipeline; uses the same KUBECONFIG secret convention
  and gitea-deployer ServiceAccount.
- rbac/gitea-deployer.yaml: ClusterRole/Binding (admin bootstrap, outside
  the root kustomization) — repo resource kinds only, no secrets access,
  no delete verbs, no RBAC escalation. Applied to the cluster 2026-07-26.
- One-time env->secretKeyRef migration executed against the cluster;
  README updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-26 02:37:49 -07:00

5 lines

126 B

Plaintext

Raw Blame History

 # Real secrets never go in git — only *.example.yaml templates do.
 apps/**/secret.yaml
 *.secret.yaml
 .deploy-kubeconfig.b64