CD: grant the deployer SA reach into the eco-app namespace #345

New issue

Closed

opened 2026-06-15 18:49:03 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-15 18:49:03 +00:00

Owner

Infra-side of deploy#12: eco-app joins atlas on the CD path. Add a namespace-scoped Role deployer + RoleBinding for the deployer SA in coilysiren-eco-app, mirroring the atlas Role plus the resource kinds eco-app's main.yml declares that atlas's static site never does - the external-secrets CRs, and the namespaced roles/rolebindings scoping the tailnet sidecar's ts-state Secret. Scoped to the one namespace; the runner applies the ExternalSecret CRs but never sees secret material (external-secrets operator reads SSM). Lands in deploy/forgejo-runner-deploy.yml + docs/cd-runner.md.

Infra-side of [deploy#12](https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/12): eco-app joins atlas on the CD path. Add a namespace-scoped `Role deployer` + `RoleBinding` for the deployer SA in `coilysiren-eco-app`, mirroring the atlas Role plus the resource kinds eco-app's main.yml declares that atlas's static site never does - the external-secrets CRs, and the namespaced roles/rolebindings scoping the tailnet sidecar's ts-state Secret. Scoped to the one namespace; the runner applies the ExternalSecret CRs but never sees secret material (external-secrets operator reads SSM). Lands in `deploy/forgejo-runner-deploy.yml` + `docs/cd-runner.md`.

coilysiren referenced this issue from a commit

2026-06-15 18:50:09 +00:00

feat(cd): grant the deployer SA reach into the eco-app namespace

coilysiren closed this issue

2026-06-15 18:50:09 +00:00

coilysiren referenced this issue

2026-06-15 19:02:08 +00:00

CD: apply deploy/ cluster manifests on push to main (kill the manual kubectl apply) #346