From 091c5cd089b02e33526251d3718aac2026acf69a Mon Sep 17 00:00:00 2001 From: agent-company Date: Tue, 26 May 2026 15:03:05 +0000 Subject: [PATCH] docs: add secrets-checklist.md with kubectl commands for all required secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes leeworks-agents/api-company#43 Creates docs/secrets-checklist.md containing: - Human operator checklist (7 checkboxes) - Exact kubectl create secret commands for all required secrets - Source of each secret value (Gitea admin UI, Slack, etc.) - Which issues are unblocked by each secret - Dependency order diagram Secrets covered: 1. gitea-leeworks-agents-token (flux-system) → unblocks Flux GitRepo auth (#2) 2. gitea-runner-token (gitea-runner) → unblocks act-runner (#3) 3. grafana-admin (monitoring) → unblocks Grafana (#7) 4. gatus-slack-webhook (monitoring) → unblocks Gatus alerts (#8) 5. GITEA_TOKEN Actions secret (per repo) → unblocks CI image push 6. Gitea packages enable + DNS → unblocks registry (#4) 7. Flux source in Talos repo → unblocks GitOps (#2) --- docs/secrets-checklist.md | 167 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 167 insertions(+) create mode 100644 docs/secrets-checklist.md diff --git a/docs/secrets-checklist.md b/docs/secrets-checklist.md new file mode 100644 index 0000000..4fabf10 --- /dev/null +++ b/docs/secrets-checklist.md @@ -0,0 +1,167 @@ +# Kubernetes Secrets Checklist + +All infrastructure blockers reduce to creating six Kubernetes secrets and one Gitea Actions secret. +Follow this list top-to-bottom; each step unblocks the next. + +**Human operator only** — the agent cannot log into Gitea's admin panel or run `kubectl` in the cluster. + +--- + +## Checklist + +- [ ] 1. `gitea-leeworks-agents-token` (flux-system) — unblocks Flux GitRepository auth +- [ ] 2. `gitea-runner-token` (gitea-runner) — unblocks Gitea Actions runner registration +- [ ] 3. `grafana-admin` (monitoring) — unblocks Grafana login +- [ ] 4. `gatus-slack-webhook` (monitoring) — unblocks Gatus alert notifications +- [ ] 5. `GITEA_TOKEN` in each API repo's Actions Secrets — unblocks CI image push +- [ ] 6. Gitea packages enabled + DNS record for `registry.leeworks.dev` — unblocks image push to registry +- [ ] 7. Add api-company Flux source + kustomization to 0xWheatyz/Talos — unblocks all GitOps reconciliation + +--- + +## Secret Details + +### 1. `gitea-leeworks-agents-token` + +| Field | Value | +|-----------|-------| +| Name | `gitea-leeworks-agents-token` | +| Namespace | `flux-system` | +| Purpose | Flux `GitRepository` authenticates to Gitea over HTTPS to pull `leeworks-agents/api-company` | +| Source | Gitea web UI → User Settings → Applications → Generate Token (scopes: `read:repository`) | +| Unblocks | Issue #2 (Flux GitRepository + Kustomization for api-company) | + +```bash +kubectl create secret generic gitea-leeworks-agents-token \ + -n flux-system \ + --from-literal=username=leeworks-agents \ + --from-literal=password= +``` + +--- + +### 2. `gitea-runner-token` + +| Field | Value | +|-----------|-------| +| Name | `gitea-runner-token` | +| Namespace | `gitea-runner` | +| Purpose | The `gitea-act-runner` HelmRelease reads this token to register the runner with Gitea | +| Source | Gitea Admin Panel → Site Administration → Actions → Runners → **Create new Runner** — copy registration token | +| Unblocks | Issue #3 (gitea-act-runner Flux deployment) | + +```bash +kubectl create secret generic gitea-runner-token \ + -n gitea-runner \ + --from-literal=token= +``` + +After creating the secret, Flux reconciles the `gitea-act-runner` HelmRelease and the runner appears as **Online** in Gitea Admin → Actions → Runners. + +--- + +### 3. `grafana-admin` + +| Field | Value | +|-----------|-------| +| Name | `grafana-admin` | +| Namespace | `monitoring` | +| Purpose | Sets the Grafana `admin` user password on first boot | +| Source | Choose a strong password and store it in a password manager | +| Unblocks | Issue #7 (Prometheus + Grafana HelmRelease) | + +```bash +kubectl create secret generic grafana-admin \ + -n monitoring \ + --from-literal=admin-password= +``` + +Grafana will be accessible at `https://grafana.leeworks.dev` (login: `admin` / ``). + +--- + +### 4. `gatus-slack-webhook` + +| Field | Value | +|-----------|-------| +| Name | `gatus-slack-webhook` | +| Namespace | `monitoring` | +| Purpose | Gatus posts downtime alerts to a Slack channel via incoming webhook | +| Source | Slack → Your workspace → Apps → Incoming Webhooks → Add to Slack → copy webhook URL | +| Unblocks | Issue #8 (Gatus status page at `status.leeworks.dev`) | + +```bash +kubectl create secret generic gatus-slack-webhook \ + -n monitoring \ + --from-literal=url=https://hooks.slack.com/services/YOUR/WEBHOOK/URL +``` + +--- + +### 5. `GITEA_TOKEN` — Gitea Actions Secret (per repo) + +| Field | Value | +|----------|-------| +| Name | `GITEA_TOKEN` | +| Scope | Gitea Actions Secret — set in each repo's Settings, **not** a Kubernetes secret | +| Purpose | CI workflows use this token to push container images to `registry.leeworks.dev` | +| Source | Same token as step 1, or a dedicated CI token with `write:packages` scope | +| Unblocks | CI pipelines for all three API repos | + +Set in Gitea web UI for **each** of these repos: +- `leeworks-agents/api-company` +- `leeworks-agents/zip-enrichment` +- `leeworks-agents/holidays` +- `leeworks-agents/air-quality` + +Path: **Repo → Settings → Actions → Secrets → Add Secret** +- Name: `GITEA_TOKEN` +- Value: `` + +--- + +### 6. Enable Gitea Packages + DNS for `registry.leeworks.dev` + +This is a Gitea instance configuration step, not a Kubernetes secret. + +| Step | Action | +|------|--------| +| 6a | Enable packages in Gitea `app.ini`: set `[packages] ENABLED = true` then restart Gitea | +| 6b | Add DNS A record: `registry.leeworks.dev` → cluster ingress IP | + +Find cluster ingress IP: +```bash +kubectl get svc -n ingress-nginx +``` + +See `docs/registry.md` for context on why the Gitea built-in registry was chosen. + +Unblocks: Issue #4 (container registry), and transitively all CI image-push workflows. + +--- + +### 7. Add api-company Flux Source + Kustomization to 0xWheatyz/Talos + +Reference manifests are already committed at `flux/api-company-source/` in this repo. +The operator must copy them into the Talos cluster repo so FluxCD picks them up: + +``` +0xWheatyz/Talos:testing1/first-cluster/cluster/flux/api-company-source/ +``` + +Unblocks: Issue #2 (Flux reconciliation of all `flux/` manifests in this repo). + +--- + +## Dependency Order + +``` +7 (Flux wiring) → all flux/ resources reconcile +1 (gitea-leeworks-token) → Flux can pull this repo over HTTPS +2 (gitea-runner-token) → runner online → CI runs +3 (grafana-admin) → Grafana login works +4 (gatus-slack-webhook) → Gatus alerting works +5 + 6 (GITEA_TOKEN + registry packages) → CI pushes images → API services deploy +``` + +Once all seven items are complete, the full stack (runner, registry, Prometheus, Grafana, Gatus, docs-site, three API services) reconciles automatically via FluxCD with no further manual steps.