From 9a20c45d645e0c5dae5b842ca6374e4846a5636b Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Tue, 27 Oct 2026 15:57:52 +0100 Subject: [PATCH] feat(deploy): publish on deploy-kit 1.0 Drops observability.alertClass, which 1.0 removed, and wires the Vault client's role as ${identity:vaultRole}, which 1.0 requires of a Process holding a delivery: self grant. Publish Fragment moves to v0.36.0, which validates and packs with deploy-kit 1.0.0. Closes #119 --- .github/workflows/publish.yml | 2 +- deploy/auth.project.yml | 1 - deploy/env/auth-api/base.env | 2 +- 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 57a88d4..aef801c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -207,7 +207,7 @@ jobs: contents: read packages: write id-token: write - uses: JorisJonkers-dev/github-workflows/.github/workflows/publish-fragment.yml@f2180a482b63756affde537233881fa12e65df70 # v0.35.0 + uses: JorisJonkers-dev/github-workflows/.github/workflows/publish-fragment.yml@16d241e44f03c5cc4696d2d0de615717a61ef3c0 # v0.36.0 with: project-file: deploy/auth.project.yml version: ${{ github.ref_name }} diff --git a/deploy/auth.project.yml b/deploy/auth.project.yml index 51229b7..1e06941 100644 --- a/deploy/auth.project.yml +++ b/deploy/auth.project.yml @@ -21,7 +21,6 @@ applications: migration: self observability: - alertClass: page # every forward-auth route depends on it scrape: process: auth-api surface: http diff --git a/deploy/env/auth-api/base.env b/deploy/env/auth-api/base.env index 1386d29..33c72b3 100644 --- a/deploy/env/auth-api/base.env +++ b/deploy/env/auth-api/base.env @@ -31,7 +31,7 @@ SPRING_CONFIG_IMPORT=vault:// VAULT_ENABLED=true VAULT_ADDR=http://vault.data-system.svc.cluster.local:8200 VAULT_AUTHENTICATION=KUBERNETES -VAULT_KUBERNETES_ROLE=auth-api +VAULT_KUBERNETES_ROLE=${identity:vaultRole} VAULT_DB_ENABLED=true AUTH_TRANSIT_ENABLED=true AUTH_TRANSIT_KEY_NAME=auth-api-jwt