chemavxandClaude Opus 5
60235a75c9
Renderizador determinista JSON->MP4 para Shorts. API interna sin Ingress, en shortsmith-svc:8080; la cola es por proceso y la SQLite va en RWO, de ahí la replica unica con estrategia Recreate. Los recursos van medidos, no estimados, y la tabla con las cifras queda en el propio manifiesto: el pico son 522 MB de anon y lo pone entero el encode, no el render. Ojo al comentario sobre por que los workers salen del limite de CPU y no del request. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
28 lines
1.0 KiB
YAML
28 lines
1.0 KiB
YAML
apiVersion: secrets.infisical.com/v1beta1
|
|
kind: InfisicalStaticSecret
|
|
metadata:
|
|
name: gitea-registry
|
|
namespace: shortsmith
|
|
spec:
|
|
# References the SHARED auth layer in infisical-operator (cross-namespace).
|
|
infisicalAuthRef:
|
|
name: infisical-auth
|
|
namespace: infisical-operator
|
|
sources:
|
|
- projectId: 17e98e9d-70f5-43d1-8382-7da818dfcdd0 # project "homelab"
|
|
environmentSlug: prod
|
|
secretPath: /registry
|
|
syncOptions:
|
|
refreshInterval: 60s
|
|
targets:
|
|
- kind: Secret
|
|
name: gitea-registry-infisical
|
|
namespace: shortsmith
|
|
creationPolicy: Owner
|
|
secretType: kubernetes.io/dockerconfigjson
|
|
template:
|
|
engineVersion: v1
|
|
data:
|
|
# Reconstruct the docker pull-secret blob from the two discrete /registry fields.
|
|
.dockerconfigjson: '{"auths":{"git.chemavx.xyz":{"username":"{{ .GITEA_REGISTRY_USERNAME.Value }}","password":"{{ .GITEA_REGISTRY_TOKEN.Value }}","auth":"{{ printf "%s:%s" .GITEA_REGISTRY_USERNAME.Value .GITEA_REGISTRY_TOKEN.Value | encodeBase64 }}"}}}'
|