Usage on kup6s-pages

Private Repositories

Mon, 01 Jan 0001 00:00:00 +0000

Private Repositories#

For private repositories, you need to:

Grant the syncer access to secrets in your namespace
Create a secret with your Git credentials
Reference the secret in your StaticSite

Step 1: Grant Syncer Access (RBAC)#

The syncer does not have cluster-wide secret access. You must grant it access to read secrets in your namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
 name: pages-syncer-secrets
 namespace: pages  # Your namespace
rules:
 - apiGroups: [""]
 resources: ["secrets"]
 verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
 name: pages-syncer-secrets
 namespace: pages  # Your namespace
roleRef:
 apiGroup: rbac.authorization.k8s.io
 kind: Role
 name: pages-syncer-secrets
subjects:
 - kind: ServiceAccount
 name: kup6s-pages-syncer # Syncer ServiceAccount (adjust if using custom release name)
 namespace: kup6s-pages  # Syncer namespace

Step 2: Create a Secret#

Create a Secret with your deploy token:

Custom Domains

Mon, 01 Jan 0001 00:00:00 +0000

Custom Domains#

Each StaticSite can have its own custom domain with automatic TLS certificates.

Basic Custom Domain#

apiVersion: pages.kup6s.com/v1beta1
kind: StaticSite
metadata:
 name: company-site
 namespace: pages
spec:
 repo: https://github.com/company/website.git
 domain: www.company.com

The operator automatically:

Creates a Traefik IngressRoute for Host(www.company.com)
Creates a cert-manager Certificate
Configures TLS termination

DNS Configuration#

Point your domain to the cluster’s Traefik load balancer IP:

www.company.com. A 203.0.113.10

Or use a CNAME if your load balancer has a hostname:

Path Prefix

Mon, 01 Jan 0001 00:00:00 +0000

Path Prefix#

Serve multiple repositories under different paths of the same domain.

Use Case#

You want to serve archived content or versioned documentation under paths like:

https://www.example.com/2019/
https://www.example.com/2020/
https://www.example.com/v1/docs/

Configuration#

apiVersion: pages.kup6s.com/v1beta1
kind: StaticSite
metadata:
 name: archive-2019
 namespace: pages
spec:
 repo: https://github.com/org/archive-2019.git
 domain: www.example.com
 pathPrefix: /2019
---
apiVersion: pages.kup6s.com/v1beta1
kind: StaticSite
metadata:
 name: archive-2020
 namespace: pages
spec:
 repo: https://github.com/org/archive-2020.git
 domain: www.example.com
 pathPrefix: /2020

How It Works#

Both sites share the same TLS certificate (one per domain)
Traefik routes based on path prefix before the host match
Requests to https://www.example.com/2019/page.html serve from archive-2019 repo
Requests to https://www.example.com/2020/page.html serve from archive-2020 repo

Requirements#

pathPrefix requires a custom domain to be set
Path prefixes must be unique per domain
The prefix is stripped before serving (so /2019/index.html serves index.html from the repo)

Root Path#

To serve a “main” site at the root while having prefixed sub-sites, create a site without pathPrefix:

Webhooks

Mon, 01 Jan 0001 00:00:00 +0000

Webhooks#

For instant deployments on push, configure webhooks in your Git provider.

Enable Webhook Ingress#

Enable webhooks in your Helm values. A webhook secret is required for HMAC signature validation:

webhook:
 enabled: true
 domain: "webhook.pages.example.com"
 clusterIssuer: "letsencrypt-prod"
 # Required: set a secret for HMAC validation
 secret: "your-webhook-secret-here"
 # Or reference an existing secret:
 # secretRef:
 # name: "my-webhook-secret"
 # key: "webhook-secret"

This creates the IngressRoute and Certificate automatically. The same secret must be configured in your Git provider’s webhook settings.