Add stable secret to woodpecker agent

woodpecker/kustomization.yaml

@@ -16,6 +16,8 @@ helmCharts:
       env:
         WOODPECKER_BACKEND_K8S_STORAGE_CLASS: woodpecker
         WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 100Mi
+      extraSecretNamesForEnvFrom:
+        - woodpecker-agent-secret
       persistence:
         enabled: false
     server:
@@ -42,9 +44,16 @@ helmCharts:
         WOODPECKER_GITEA_URL: https://git.k-space.ee
         WOODPECKER_HOST: https://woodpecker.k-space.ee
         WOODPECKER_OPEN: true
+      # the chart's built-in woodpecker-default-agent-secret is random on
+      # every template render, breaking agent auth after each ArgoCD sync.
+      # It cannot be disabled (the agent subchart hardcodes the envFrom
+      # reference), so a stable SecretClaim-generated secret is layered
+      # after it: for duplicate keys the last envFrom source wins, making
+      # the random one inert (see agent-secret.yaml)
       extraSecretNamesForEnvFrom:
         - woodpecker-gitea-oauth2
         - mariadb-secrets
+        - woodpecker-agent-secret
       image:
         registry: mirror.gcr.io
       # persistentVolume:
@@ -55,3 +64,4 @@ helmCharts:
 resources:
 - ssh://git@git.k-space.ee/secretspace/kube/woodpecker
 - ./mariadb.yaml
+- ./agent-secret.yaml