Merge branch 'main' into APL-535

Author: ferruhcihan

.env.sample

@@ -8,24 +8,11 @@ DISABLE_SYNC=1
 # ENV_DIR=''
 
 # KMS access from here on
-# Google (paste json key here without newlines nor spaces and double quotes escaped)
-GCLOUD_SERVICE_KEY="\"some\":\"key\""
-# Azure:
-AZURE_TENANT_ID=''
-AZURE_CLIENT_ID=''
-AZURE_CLIENT_SECRET=''
-# AWS:
-AWS_DEFAULT_REGION=''
-AWS_REGION=''
-AWS_ACCESS_KEY_ID=''
-AWS_SECRET_ACCESS_KEY=''
-# AGE:
 SOPS_AGE_KEY=''
 
 OTOMI_CHARTS_URL='https://github.com/linode/apl-charts.git'
 
-
 RETRIES=6
 RANDOM=false
 MIN_TIMEOUT=10000
-FACTOR=1
+FACTOR=1

charts/team-ns/templates/rbac.yaml

@@ -220,6 +220,18 @@ rules:
   resources: ["secrets"]
   verbs: ["get", "watch", "list", "delete", "create", "update"]
 ---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: apl-gitea-operator-team-{{ $v.teamId }}-trigger-template-pipeline-watcher
+rules:
+  - apiGroups: ["tekton.dev"]
+    resources: ["pipelines"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["triggers.tekton.dev"]
+    resources: ["triggertemplates"]
+    verbs: ["watch", "list", "get"]
+---
 # RoleBinding for the above Role in team namespace
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -234,4 +246,17 @@ roleRef:
   kind: Role
   name: apl-gitea-operator-service-account
   apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: apl-gitea-operator-team-{{ $v.teamId }}-trigger-template-pipeline-binding
+subjects:
+  - kind: ServiceAccount
+    namespace: apl-gitea-operator
+    name: apl-gitea-operator
+roleRef:
+  kind: ClusterRole
+  name: apl-gitea-operator-team-{{ $v.teamId }}-trigger-template-pipeline-watcher
+  apiGroup: rbac.authorization.k8s.io
 ---

values/otomi-api/otomi-api.gotmpl

@@ -5,7 +5,7 @@
 {{- $cm := $v.apps | get "cert-manager" }}
 {{- $d := $v.apps.drone }}
 {{- $sops := $v | get "kms.sops" dict }}
-{{- $giteaValuesUrl := printf "gitea.%s/otomi/values" $v.cluster.domainSuffix }}
+{{- $giteaValuesUrl := "http://gitea-http.gitea.svc.cluster.local:3000/otomi/values" }}
 {{- $helmChartCatalog := printf "https://gitea.%s/otomi/charts.git" $v.cluster.domainSuffix }}
 {{- $defaultPlatformAdminEmail := printf "platform-admin@%s" $v.cluster.domainSuffix }}
 {{- $sopsEnv := tpl (readFile "../../helmfile.d/snippets/sops-env.gotmpl") $sops }}