Celes Renata
390cb0b4bf
ci/woodpecker/push/test Pipeline was successful
ci/woodpecker/push/build-2 Pipeline failed
ci/woodpecker/push/build-3 Pipeline failed
ci/woodpecker/push/build-1 Pipeline failed
ci/woodpecker/push/finalize unknown status
Build and Push / lint-and-test (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.adapters.broker_adapter name:broker-adapter]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.aggregation.worker name:aggregation]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.extractor.worker name:extractor]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.ingestion.worker name:ingestion]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.lake_publisher.worker name:lake-publisher]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.parser.worker name:parser]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.recommendation.worker name:recommendation]) (push) Has been cancelled
Build and Push / build-services (map[cmd:python -m services.scheduler.app name:scheduler]) (push) Has been cancelled
Build and Push / build-services (map[cmd:uvicorn services.api.app:app --host 0.0.0.0 --port 8000 name:query-api]) (push) Has been cancelled
Build and Push / build-services (map[cmd:uvicorn services.risk.app:app --host 0.0.0.0 --port 8000 name:risk]) (push) Has been cancelled
Build and Push / build-services (map[cmd:uvicorn services.symbol_registry.app:app --host 0.0.0.0 --port 8000 name:symbol-registry]) (push) Has been cancelled
Build and Push / build-services (map[cmd:uvicorn services.trading.app:app --host 0.0.0.0 --port 8000 name:trading-engine]) (push) Has been cancelled
Build and Push / build-dashboard (push) Has been cancelled
Build and Push / build-superset (push) Has been cancelled
Build and Push / integration-test (push) Has been cancelled
Build and Push / beta-gate (push) Has been cancelled
SSL filtering is off on the proxy. The proxy env vars were causing Docker login failures (proxy intercepting Harbor auth) and pip hash mismatches (proxy caching stale packages). Keep only the CA cert mount for any remaining TLS needs.
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: woodpecker-proxy-ca
|
|
annotations:
|
|
policies.kyverno.io/title: "Woodpecker Proxy CA Injection"
|
|
policies.kyverno.io/category: "Networking"
|
|
policies.kyverno.io/subject: "Pod"
|
|
spec:
|
|
rules:
|
|
- name: inject-ca-cert
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaces:
|
|
- woodpecker
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: server
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: agent
|
|
mutate:
|
|
patchStrategicMerge:
|
|
spec:
|
|
containers:
|
|
- (name): "*"
|
|
env:
|
|
- name: SSL_CERT_FILE
|
|
value: "/etc/ssl/certs/proxy-ca.crt"
|
|
volumeMounts:
|
|
- name: proxy-ca
|
|
mountPath: /etc/ssl/certs/proxy-ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
volumes:
|
|
- name: proxy-ca
|
|
configMap:
|
|
name: proxy-ca-cert
|