Thore CimbalandClaude Sonnet 5
debf980d5f
Job hung indefinitely on git clone - public-internet reachability to rohana.axion1337.de from inside pods is currently down (related to Issue #41's firewall/private-network findings), and the node-level /etc/hosts workaround only helps containerd's image pulls, not processes running inside pods (they resolve via CoreDNS + their own /etc/hosts, not the node's). hostAliases routes this job's git/API traffic over the private Hetzner network directly - verified working with a real pod. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
71 lines
2.7 KiB
YAML
71 lines
2.7 KiB
YAML
# Automated TURN shared-secret rotation (Issue #38). Generates a new secret, re-encrypts
|
|
# apps/production/coturn-secret.yaml and synapse-turn-secret.yaml using a dedicated,
|
|
# narrowly-scoped age key (see turn-secret-rotation-secret.yaml - it can only decrypt these
|
|
# two files, not the repo's master sops-age key), bumps the checksum/rotated-at annotations
|
|
# so a merge restarts both consumers automatically, and opens a Pull Request rather than
|
|
# pushing straight to main - a human reviews and merges it.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: turn-secret-rotation
|
|
namespace: matrix
|
|
spec:
|
|
schedule: "0 4 1 * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: turn-secret-rotation
|
|
app.kubernetes.io/component: rotation
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
# Public-internet reachability to the Gitea host has been flaky (see Issue #41);
|
|
# both servers share a private Hetzner network. hostAliases (unlike the node-level
|
|
# /etc/hosts fix used for image pulls) is actually honored by in-pod processes.
|
|
hostAliases:
|
|
- ip: "10.0.0.3"
|
|
hostnames:
|
|
- "rohana.axion1337.de"
|
|
containers:
|
|
- name: rotate
|
|
image: rohana.axion1337.de/sorb/axion-secret-rotation:v1
|
|
env:
|
|
- name: GITEA_HOST
|
|
value: "rohana.axion1337.de"
|
|
- name: GITEA_REPO
|
|
value: "sorb/axion1337.chat-gitops"
|
|
- name: GITEA_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: turn-secret-rotation-credentials
|
|
key: gitea-token
|
|
- name: SOPS_AGE_KEY_FILE
|
|
value: /secrets/age/age-key.txt
|
|
- name: GIT_AUTHOR_NAME
|
|
value: "turn-secret-rotation"
|
|
- name: GIT_AUTHOR_EMAIL
|
|
value: "turn-secret-rotation@axion1337.chat"
|
|
volumeMounts:
|
|
- name: age-key
|
|
mountPath: /secrets/age
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: age-key
|
|
secret:
|
|
secretName: turn-secret-rotation-credentials
|
|
items:
|
|
- key: age-key.txt
|
|
path: age-key.txt
|
|
mode: 0400
|