wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(security): isolate workload database identities
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m25s
Details
CD Pipeline / build-and-deploy (push) Successful in 6m42s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m50s
Details

Browse Source
This commit is contained in:
ogt
2026-07-11 04:20:08 +08:00
parent eb976bdbd2
commit 262c9c8a7e
11 changed files with 1062 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
k8s/awoooi-prod/06-deployment-api.yaml
View File

@@ -71,11 +71,86 @@ spec:
envFrom:
- configMapRef:
name: awoooi-config
- secretRef:
name: awoooi-secrets
# 2026-04-12 ogt: env 優先於 envFrom — 覆蓋 configmap 特定值
# 說明: Kubernetes env: 優先於 envFrom:，用於 live-patch 後需同步回 Git
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: awoooi-api-db
key: DATABASE_URL
- name: REDIS_URL
valueFrom:
secretKeyRef:
name: awoooi-secrets
key: REDIS_URL
optional: true
- name: GEMINI_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: GEMINI_API_KEY, optional: true}
- name: CLAUDE_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: CLAUDE_API_KEY, optional: true}
- name: ANTHROPIC_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: ANTHROPIC_API_KEY, optional: true}
- name: NVIDIA_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: NVIDIA_API_KEY, optional: true}
- name: OPENCLAW_TG_BOT_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_TG_BOT_TOKEN, optional: true}
- name: OPENCLAW_TG_CHAT_ID
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_TG_CHAT_ID, optional: true}
- name: OPENCLAW_TG_USER_WHITELIST
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_TG_USER_WHITELIST, optional: true}
- name: SRE_GROUP_CHAT_ID
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SRE_GROUP_CHAT_ID, optional: true}
- name: WEBHOOK_HMAC_SECRET
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: WEBHOOK_HMAC_SECRET, optional: true}
- name: AWOOOP_OPERATOR_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: AWOOOP_OPERATOR_API_KEY, optional: true}
- name: JWT_SECRET
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: JWT_SECRET, optional: true}
- name: JWT_ALGORITHM
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: JWT_ALGORITHM, optional: true}
- name: LANGFUSE_PUBLIC_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: LANGFUSE_PUBLIC_KEY, optional: true}
- name: LANGFUSE_SECRET_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: LANGFUSE_SECRET_KEY, optional: true}
- name: SENTRY_DSN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SENTRY_DSN, optional: true}
- name: SENTRY_AUTH_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SENTRY_AUTH_TOKEN, optional: true}
- name: ARGOCD_API_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: ARGOCD_API_TOKEN, optional: true}
- name: GITEA_API_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: GITEA_API_TOKEN, optional: true}
- name: GITEA_WEBHOOK_SECRET
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: GITEA_WEBHOOK_SECRET, optional: true}
- name: NEMOTRON_BOT_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: NEMOTRON_BOT_TOKEN, optional: true}
- name: OPENCLAW_BOT_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_BOT_TOKEN, optional: true}
- name: SMTP_HOST
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SMTP_HOST, optional: true}
- name: AWOOOI_BUILD_COMMIT_SHA
# 2026-06-29 Codex: CD rewrites this to the deployed image tag so
# production deploy readback does not rely on a stale static snapshot.

2
k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml
View File

@@ -43,7 +43,7 @@ spec:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: awoooi-secrets
name: awoooi-broker-db
key: DATABASE_URL
- name: OPENCLAW_TG_BOT_TOKEN
valueFrom:

76
k8s/awoooi-prod/08-deployment-worker.yaml
View File

@@ -76,9 +76,81 @@ spec:
envFrom:
- configMapRef:
name: awoooi-config
- secretRef:
name: awoooi-secrets
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: awoooi-worker-db
key: DATABASE_URL
- name: REDIS_URL
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: REDIS_URL, optional: true}
- name: GEMINI_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: GEMINI_API_KEY, optional: true}
- name: CLAUDE_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: CLAUDE_API_KEY, optional: true}
- name: ANTHROPIC_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: ANTHROPIC_API_KEY, optional: true}
- name: NVIDIA_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: NVIDIA_API_KEY, optional: true}
- name: OPENCLAW_TG_BOT_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_TG_BOT_TOKEN, optional: true}
- name: OPENCLAW_TG_CHAT_ID
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_TG_CHAT_ID, optional: true}
- name: OPENCLAW_TG_USER_WHITELIST
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_TG_USER_WHITELIST, optional: true}
- name: SRE_GROUP_CHAT_ID
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SRE_GROUP_CHAT_ID, optional: true}
- name: WEBHOOK_HMAC_SECRET
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: WEBHOOK_HMAC_SECRET, optional: true}
- name: AWOOOP_OPERATOR_API_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: AWOOOP_OPERATOR_API_KEY, optional: true}
- name: JWT_SECRET
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: JWT_SECRET, optional: true}
- name: JWT_ALGORITHM
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: JWT_ALGORITHM, optional: true}
- name: LANGFUSE_PUBLIC_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: LANGFUSE_PUBLIC_KEY, optional: true}
- name: LANGFUSE_SECRET_KEY
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: LANGFUSE_SECRET_KEY, optional: true}
- name: SENTRY_DSN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SENTRY_DSN, optional: true}
- name: SENTRY_AUTH_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SENTRY_AUTH_TOKEN, optional: true}
- name: ARGOCD_API_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: ARGOCD_API_TOKEN, optional: true}
- name: GITEA_API_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: GITEA_API_TOKEN, optional: true}
- name: GITEA_WEBHOOK_SECRET
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: GITEA_WEBHOOK_SECRET, optional: true}
- name: NEMOTRON_BOT_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: NEMOTRON_BOT_TOKEN, optional: true}
- name: OPENCLAW_BOT_TOKEN
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: OPENCLAW_BOT_TOKEN, optional: true}
- name: SMTP_HOST
valueFrom:
secretKeyRef: {name: awoooi-secrets, key: SMTP_HOST, optional: true}
- name: WORKER_MODE
value: "true"
- name: CONSUMER_GROUP