Thore CimbalandClaude Sonnet 5
947eaab71c
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Closes issue #38's automation half (architecture fix + first rotation already landed in earlier commits this session). Monthly CronJob (rohana.axion1337.de/sorb/axion-secret-rotation:v1 - alpine + git/sops/ jq/age) that: - generates a new secret - re-encrypts coturn-secret.yaml and synapse-turn-secret.yaml using the scoped rotation-only age key (added as an additional recipient in an earlier commit) - never touches the repo's master sops-age key - bumps the turn-secret-checksum (HelmRelease annotation) and rotated-at (coturn Deployment annotation) so merging actually restarts both consumers, reusing the existing checksum-annotation pattern already in this repo rather than inventing a new mechanism - opens a Pull Request rather than pushing straight to main - a human reviews and merges, keeping a checkpoint before production picks up new credentials while still automating the tedious coordination work Needs a Gitea PAT (repo write scope) filled into turn-secret-rotation-secret.yaml's gitea-token key before first use. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
# Automated TURN shared-secret rotation (Issue #38). Generates a new secret, re-encrypts
|
|
# apps/production/coturn-secret.yaml and synapse-turn-secret.yaml using a dedicated,
|
|
# narrowly-scoped age key (see turn-secret-rotation-secret.yaml - it can only decrypt these
|
|
# two files, not the repo's master sops-age key), bumps the checksum/rotated-at annotations
|
|
# so a merge restarts both consumers automatically, and opens a Pull Request rather than
|
|
# pushing straight to main - a human reviews and merges it.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: turn-secret-rotation
|
|
namespace: matrix
|
|
spec:
|
|
schedule: "0 4 1 * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: turn-secret-rotation
|
|
app.kubernetes.io/component: rotation
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: rotate
|
|
image: rohana.axion1337.de/sorb/axion-secret-rotation:v1
|
|
env:
|
|
- name: GITEA_HOST
|
|
value: "rohana.axion1337.de"
|
|
- name: GITEA_REPO
|
|
value: "sorb/axion1337.chat-gitops"
|
|
- name: GITEA_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: turn-secret-rotation-credentials
|
|
key: gitea-token
|
|
- name: SOPS_AGE_KEY_FILE
|
|
value: /secrets/age/age-key.txt
|
|
- name: GIT_AUTHOR_NAME
|
|
value: "turn-secret-rotation"
|
|
- name: GIT_AUTHOR_EMAIL
|
|
value: "turn-secret-rotation@axion1337.chat"
|
|
volumeMounts:
|
|
- name: age-key
|
|
mountPath: /secrets/age
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: age-key
|
|
secret:
|
|
secretName: turn-secret-rotation-credentials
|
|
items:
|
|
- key: age-key.txt
|
|
path: age-key.txt
|
|
mode: 0400
|