.gitea/workflows/kubernetes-deploy.yaml ran on every push to every branch and deployed nothing (the kubectl apply step was commented out). Along the way it wrote credentials to the job log:
the raw Vault AppRole login response, which contains the Vault client token
the Vault secret response, which contains the Kanidm API token
the Kanidm token-exchange response body, which contains the Kubernetes OIDC token
two full environment dumps
It also configured kubectl with --insecure-skip-tls-verify=true.
Changes
Deleted the workflow. Deployment is already handled by gitops-update.yaml.
Updated docs/by-claude-opus/deployment.md and the README tree to describe the gitops flow instead.
Marked T1 done in the cleanup task list; CHANGELOG entry added.
Follow-up outside this repo
Rotate the Vault AppRole secret and the Kanidm API token.
Delete old job logs of "Deploy to K8s"; they still contain the leaked values.
Remove the now-unused repo secrets VAULT_ROLE_ID, VAULT_SECRET_ID and K8S_CA_CERT.
## Why
`.gitea/workflows/kubernetes-deploy.yaml` ran on every push to every branch and deployed nothing (the `kubectl apply` step was commented out). Along the way it wrote credentials to the job log:
- the raw Vault AppRole login response, which contains the Vault client token
- the Vault secret response, which contains the Kanidm API token
- the Kanidm token-exchange response body, which contains the Kubernetes OIDC token
- two full environment dumps
It also configured kubectl with `--insecure-skip-tls-verify=true`.
## Changes
- Deleted the workflow. Deployment is already handled by `gitops-update.yaml`.
- Updated `docs/by-claude-opus/deployment.md` and the README tree to describe the gitops flow instead.
- Marked T1 done in the cleanup task list; CHANGELOG entry added.
## Follow-up outside this repo
- Rotate the Vault AppRole secret and the Kanidm API token.
- Delete old job logs of "Deploy to K8s"; they still contain the leaked values.
- Remove the now-unused repo secrets `VAULT_ROLE_ID`, `VAULT_SECRET_ID` and `K8S_CA_CERT`.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The workflow ran on every push to every branch and deployed nothing.
It echoed the raw Vault login response, the Kanidm API token response
and the OIDC token response to the job log, dumped the environment,
and configured kubectl with --insecure-skip-tls-verify.
Deployment is handled by gitops-update.yaml. Docs updated to describe
that flow; T1 marked done in the cleanup task list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kacerr
merged commit 14cdbeac21 into main2026-10-08 11:49:02 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
.gitea/workflows/kubernetes-deploy.yamlran on every push to every branch and deployed nothing (thekubectl applystep was commented out). Along the way it wrote credentials to the job log:It also configured kubectl with
--insecure-skip-tls-verify=true.Changes
gitops-update.yaml.docs/by-claude-opus/deployment.mdand the README tree to describe the gitops flow instead.Follow-up outside this repo
VAULT_ROLE_ID,VAULT_SECRET_IDandK8S_CA_CERT.🤖 Generated with Claude Code