- ExternalSecret manifests sync kv/jenkins/{harbor,gitea}-credentials
from Vault → K8s secrets in jenkins namespace
- Jenkins values: additionalExistingSecrets mounts both secrets
- JCasC configScript creates harbor-credentials + gitea-credentials
pipeline credentials from mounted secret env vars
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>