f94f96a704
hermes-webui-image had no authenticationToken, so there was no supported non-interactive route to trigger it -- only an interactively-authenticated Jenkins UI build worked. Give it an independently-scoped, create-only Vault token (kv/atlas/hermes/developer-jenkins-webui, seeded by a dedicated hermes-jenkins-webui-token-seed identity) mirroring the proven hermes-agent-image lane exactly, never sharing state or capability with the agent token. Adds jenkins_webui_image_build_trigger.py as the coordinator's supported trigger route for future approved releases.
19 lines
650 B
YAML
19 lines
650 B
YAML
# services/vault-hermes-jenkins-token-seed/kustomization.yaml
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: vault
|
|
resources:
|
|
- serviceaccount.yaml
|
|
- job.yaml
|
|
- serviceaccount-webui.yaml
|
|
- job-webui.yaml
|
|
generatorOptions:
|
|
disableNameSuffixHash: true
|
|
configMapGenerator:
|
|
- name: vault-hermes-jenkins-token-seed-script
|
|
files:
|
|
- vault_hermes_jenkins_build_token_ensure.sh=scripts/vault_hermes_jenkins_build_token_ensure.sh
|
|
- name: vault-hermes-jenkins-webui-token-seed-script
|
|
files:
|
|
- vault_hermes_jenkins_webui_build_token_ensure.sh=scripts/vault_hermes_jenkins_webui_build_token_ensure.sh
|