Add stable secret to woodpecker agent

woodpecker/agent-secret.yaml

@@ -0,0 +1,16 @@
+---
+# Stable shared agent secret. The Helm chart's built-in
+# woodpecker-default-agent-secret is generated with randAlphaNum at
+# template time, so every ArgoCD render/sync produced a new value and
+# agents started after a sync could no longer authenticate against the
+# running server ("individual agent not found by token").
+apiVersion: codemowers.cloud/v1beta1
+kind: SecretClaim
+metadata:
+  name: woodpecker-agent-secret
+  namespace: woodpecker
+spec:
+  size: 32
+  mapping:
+    - key: WOODPECKER_AGENT_SECRET
+      value: "%(plaintext)s"

woodpecker/kustomization.yaml

@@ -16,6 +16,8 @@ helmCharts:
       env:
         WOODPECKER_BACKEND_K8S_STORAGE_CLASS: woodpecker
         WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 100Mi
+      extraSecretNamesForEnvFrom:
+        - woodpecker-agent-secret
       persistence:
         enabled: false
     server:
@@ -42,9 +44,16 @@ helmCharts:
         WOODPECKER_GITEA_URL: https://git.k-space.ee
         WOODPECKER_HOST: https://woodpecker.k-space.ee
         WOODPECKER_OPEN: true
+      # the chart's built-in woodpecker-default-agent-secret is random on
+      # every template render, breaking agent auth after each ArgoCD sync.
+      # It cannot be disabled (the agent subchart hardcodes the envFrom
+      # reference), so a stable SecretClaim-generated secret is layered
+      # after it: for duplicate keys the last envFrom source wins, making
+      # the random one inert (see agent-secret.yaml)
       extraSecretNamesForEnvFrom:
         - woodpecker-gitea-oauth2
         - mariadb-secrets
+        - woodpecker-agent-secret
       image:
         registry: mirror.gcr.io
       # persistentVolume:
@@ -55,3 +64,4 @@ helmCharts:
 resources:
 - ssh://git@git.k-space.ee/secretspace/kube/woodpecker
 - ./mariadb.yaml
+- ./agent-secret.yaml