CI vault secrets & Kubernetes (#2)

* Define secrets that use vault plugin

* Fix drone linting issue

* Persist .kube folder as volume between build steps

* Split Build and Publish into separate pipelines

* Only run publish pipeline when triggered by main

* Import .kube/config from vault

* echo env variables contents into kube config file

* drone-vault not working, curl with token instead

* Removed all secrets, look to org secrets

* Kubernetes file

* Import dockerconfig from vault and apply as kubernetes secret

.drone.yml

@@ -1,7 +1,7 @@
 ---
 kind: pipeline
 type: docker
-name: Build and publish
+name: Build
 
 platform:
   os: linux
@@ -15,6 +15,16 @@ steps:
       - make install
       - make build
 
+---
+kind: pipeline
+type: docker
+name: Publish
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
   - name: Build and publish docker image
     image: plugins/docker
     settings:
@@ -24,19 +34,83 @@ steps:
       username:
         from_secret: GITHUB_USERNAME
       password:
-        from_secret: GITHUB_PASSWORD
+        from_secret: GHCR_UPLOAD_TOKEN
       tags: latest
-    when:
-      event:
-        include:
-          - push
-        exclude:
-          - pull_request
-      branch:
-        - main
+
+trigger:
+  event:
+    include:
+      - push
+    exclude:
+      - pull_request
+  branch:
+    - main
+
+depends_on:
+  - Build
+
+---
+kind: pipeline
+type: docker
+name: Deploy
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+  - name: Prepare kubernetes environment
+    image: alpine/k8s:1.25.15
+    commands:
+      - mkdir -p /root/.kube
+      - 'curl -s
+        -H "X-Vault-Token: $VAULT_TOKEN"
+        $VAULT_HOST/v1/schleppe/data/kazan/${DRONE_REPO_NAME}
+        | jq -r ".data.data.KUBE_CONFIG" > /root/.kube/config'
+      - 'curl -s
+        -H "X-Vault-Token: $VAULT_TOKEN"
+        $VAULT_HOST/v1/schleppe/data/kazan/${DRONE_REPO_NAME}
+        | jq -r ".data | .data | .[\"ghcr-login-secret\"]" > /root/.kube/dockerconfig.json'
+    environment:
+      VAULT_TOKEN:
+        from_secret: VAULT_TOKEN
+      VAULT_HOST:
+        from_secret: VAULT_HOST
+    volumes:
+    - name: kube-config
+      path: /root/.kube
+
+  - name: Deploy to kubernetes
+    image: alpine/k8s:1.25.15
+    commands:
+      - export DOCKER_CONFIG_BASE64=$(cat /root/.kube/dockerconfig.json | tr -d "\n" | base64 -w 0)
+      - export IMAGE="ghcr.io/kevinmidboe/${DRONE_REPO_NAME}:${DRONE_COMMIT_SHA}"
+      - cat .kubernetes/*.yml
+        | envsubst
+        | kubectl --kubeconfig=/root/.kube/config apply -f -
+    volumes:
+    - name: kube-config
+      path: /root/.kube
+
+trigger:
+  event:
+    include:
+      - push
+    exclude:
+      - pull_request
+  branch:
+    - main
+
+depends_on:
+  - Build
+  - Publish
+
+volumes:
+- name: kube-config
+  temp: {}
 
 ---
 kind: signature
-hmac: 46d4d087047afb6e18032e1fea13ba964589d86aaf012343821804612baf5678
+hmac: cb65389bbc13b392c364cf85f3863195049ce8cb515c5a378472e0b0b3c68483
 
 ...