feat(catalog): add SD env/envFrom/lifecycle; retire gitea bootstrap patch
Extend the ServiceDefinition contract with optional per-container `env`, `envFrom`, and `lifecycle` fields (k8s EnvVar / EnvFromSource / Lifecycle shapes) so headless-install / DB-backed apps configure themselves through the SD instead of a supplementary kustomize patch. - schema: bump 1.1.0 -> 1.2.0; add optional env/envFrom/lifecycle to the container kind (literal + secretKeyRef/configMapKeyRef; secretRef/ configMapRef; postStart/preStop exec via $defs/execHandler). Existing fields unchanged; all fields optional -> absent renders byte-identical. - render.py: emit env/envFrom/lifecycle verbatim onto the Deployment app container when present; --selftest coverage for the new fields. - catalog/gitea.yaml: fold the headless-install env (INSTALL_LOCK, fixed SECRET_KEY via secretKeyRef, DOMAIN/ROOT_URL, actions, break-glass admin creds) + the idempotent postStart break-glass admin bootstrap inline. - apps/gitea.yaml: re-rendered with env/lifecycle inline (effective pod spec provably equivalent to base+patch). - DELETE apps/gitea-bootstrap-patch.yaml + drop it from apps/kustomization patches. gitea-bootstrap-secret.sops.yaml kept (still sourced by the env). Proves the renderer feature by retiring the known TODO; unblocks env + DB onboarding for nextcloud/semaphore/unifi/minecraft. All other rendered apps byte-identical. Gates: selftest PASS, l0 17/17 + schema, l1 goldens, lint. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed
1 parent
b871877c1b
commit
c8dd4f3f9d
6 files changed
+278
-107
No files matched your search
@@ -1,101 +0,0 @@
|
||||
---
|
||||
# Gitea headless-install bootstrap patch (WS-APPS, Phase 6).
|
||||
#
|
||||
# WHY THIS IS A SUPPLEMENTARY MANIFEST (renderer follow-up):
|
||||
# The ServiceDefinition schema/renderer (catalog/render.py) does not yet express per-container
|
||||
# `env`, `envFrom`, `lifecycle`, or `initContainers`. Gitea needs all three to come up INSTALLED
|
||||
# without the interactive web wizard and with a persistent SECRET_KEY. Rather than widen the
|
||||
# renderer contract for a single app (out of scope for this task), this is a minimal, Gitea-only
|
||||
# kustomize strategic-merge patch layered onto the rendered apps/gitea.yaml Deployment. It is
|
||||
# fully GitOps-reconciled (Flux applies it), so nothing here is a manual pod hack Flux would revert.
|
||||
# TODO(renderer): fold generic `env`/`envFrom`/`lifecycle` support into the ServiceDefinition
|
||||
# schema + render.py, then delete this patch.
|
||||
#
|
||||
# WHAT IT DOES:
|
||||
# - GITEA__security__INSTALL_LOCK=true -> skip the first-run web installer (headless install).
|
||||
# - GITEA__security__SECRET_KEY (from the gitea-bootstrap SOPS Secret) -> a FIXED, persistent
|
||||
# SECRET_KEY. It must NOT regenerate per restart or previously-encrypted data breaks; sourcing
|
||||
# it from a committed SOPS secret pins it across pod restarts/reschedules.
|
||||
# - GITEA__server__ROOT_URL / __DOMAIN -> correct public clone/redirect URLs for the git host
|
||||
# that TLS-terminates at the shared Gateway (gitea.home.keithjackson.dev).
|
||||
# - GITEA__actions__ENABLED=true -> turn on Gitea Actions explicitly (Phase 6 CI/CD, WS-GITOSS).
|
||||
# Gitea 1.21+ defaults Actions ON, but pinning it here makes the CI merge gate a declared,
|
||||
# reviewable property of the deployment rather than an implicit upstream default that a future
|
||||
# version bump could flip. The in-cluster act_runner (ns gitea-actions) registers against it.
|
||||
# - GITEA__actions__DEFAULT_ACTIONS_URL=github -> resolve `uses: <org>/<action>@ref` (e.g.
|
||||
# actions/checkout) from github.com. The cluster HAS internet egress (LE/Cloudflare/ghcr already
|
||||
# in use), so github-sourced actions work. A fully self-hosted/air-gapped value would require
|
||||
# mirroring each action repo into this Gitea first; the cluster is not air-gapped, so `github`
|
||||
# is the pragmatic, working choice (WS-GITOSS Phase-6 note).
|
||||
# - A postStart lifecycle hook creates a BREAK-GLASS local admin idempotently (only if absent),
|
||||
# so an IdP outage never locks the operator out of recovery tools (docs/15 availability caveat).
|
||||
# All state (repos, SQLite DB, app.ini, INTERNAL_TOKEN) lands on the /data Longhorn PVC.
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea
|
||||
namespace: gitea
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: gitea
|
||||
env:
|
||||
- name: GITEA__security__INSTALL_LOCK
|
||||
value: "true"
|
||||
- name: GITEA__security__SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-bootstrap
|
||||
key: secret-key
|
||||
- name: GITEA__server__DOMAIN
|
||||
value: gitea.home.keithjackson.dev
|
||||
- name: GITEA__server__ROOT_URL
|
||||
value: https://gitea.home.keithjackson.dev/
|
||||
- name: GITEA__actions__ENABLED
|
||||
value: "true"
|
||||
- name: GITEA__actions__DEFAULT_ACTIONS_URL
|
||||
value: github
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-bootstrap
|
||||
key: admin-username
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-bootstrap
|
||||
key: admin-password
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
# Idempotent break-glass admin bootstrap. Runs alongside the gitea entrypoint
|
||||
# (which, with INSTALL_LOCK=true, headless-installs + migrates the DB on first
|
||||
# boot). Waits for the DB, then creates the admin only if it does not exist.
|
||||
set -u
|
||||
export HOME=/data/git
|
||||
i=0
|
||||
until su-exec git gitea admin user list >/dev/null 2>&1; do
|
||||
i=$((i + 1))
|
||||
[ "$i" -ge 150 ] && { echo "[gitea-bootstrap] DB not ready after wait; skipping" >&2; exit 0; }
|
||||
sleep 2
|
||||
done
|
||||
if su-exec git gitea admin user list --admin 2>/dev/null | awk 'NR>1{print $2}' | grep -qx "$GITEA_ADMIN_USERNAME"; then
|
||||
echo "[gitea-bootstrap] admin '$GITEA_ADMIN_USERNAME' already present"
|
||||
exit 0
|
||||
fi
|
||||
n=0
|
||||
until su-exec git gitea admin user create \
|
||||
--username "$GITEA_ADMIN_USERNAME" \
|
||||
--password "$GITEA_ADMIN_PASSWORD" \
|
||||
--email "[email protected]" \
|
||||
--admin --must-change-password=false; do
|
||||
n=$((n + 1))
|
||||
[ "$n" -ge 10 ] && { echo "[gitea-bootstrap] admin create failed after retries" >&2; exit 0; }
|
||||
sleep 3
|
||||
done
|
||||
echo "[gitea-bootstrap] created break-glass admin '$GITEA_ADMIN_USERNAME'"
|
||||
@@ -81,9 +81,42 @@ spec:
|
||||
image: gitea/gitea:1.24.3
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
env:
|
||||
- name: GITEA__security__INSTALL_LOCK
|
||||
value: 'true'
|
||||
- name: GITEA__security__SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-bootstrap
|
||||
key: secret-key
|
||||
- name: GITEA__server__DOMAIN
|
||||
value: gitea.home.keithjackson.dev
|
||||
- name: GITEA__server__ROOT_URL
|
||||
value: https://gitea.home.keithjackson.dev/
|
||||
- name: GITEA__actions__ENABLED
|
||||
value: 'true'
|
||||
- name: GITEA__actions__DEFAULT_ACTIONS_URL
|
||||
value: github
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-bootstrap
|
||||
key: admin-username
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-bootstrap
|
||||
key: admin-password
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
lifecycle:
|
||||
postStart:
|
||||
exec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- "# Idempotent break-glass admin bootstrap. Runs alongside the gitea entrypoint\n# (which, with INSTALL_LOCK=true, headless-installs + migrates the DB on first\n# boot). Waits for the DB, then creates the admin only if it does not exist.\nset -u\nexport HOME=/data/git\ni=0\nuntil su-exec git gitea admin user list >/dev/null 2>&1; do\n i=$((i + 1))\n [ \"$i\" -ge 150 ] && { echo \"[gitea-bootstrap] DB not ready after wait; skipping\" >&2; exit 0; }\n sleep 2\ndone\nif su-exec git gitea admin user list --admin 2>/dev/null | awk 'NR>1{print $2}' | grep -qx \"$GITEA_ADMIN_USERNAME\"; then\n echo \"[gitea-bootstrap] admin '$GITEA_ADMIN_USERNAME' already present\"\n exit 0\nfi\nn=0\nuntil su-exec git gitea admin user create \\\n --username \"$GITEA_ADMIN_USERNAME\" \\\n --password \"$GITEA_ADMIN_PASSWORD\" \\\n --email \"[email protected]\" \\\n --admin --must-change-password=false; do\n n=$((n + 1))\n [ \"$n\" -ge 10 ] && { echo \"[gitea-bootstrap] admin create failed after retries\" >&2; exit 0; }\n sleep 3\ndone\necho \"[gitea-bootstrap] created break-glass admin '$GITEA_ADMIN_USERNAME'\"\n"
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -17,7 +17,8 @@ resources:
|
||||
- qbittorrent.yaml
|
||||
- jackett.yaml
|
||||
- seerr.yaml
|
||||
# Gitea-only supplementary patch: headless-install env + break-glass admin postStart hook.
|
||||
# The renderer does not yet emit env/lifecycle (renderer follow-up); see gitea-bootstrap-patch.yaml.
|
||||
patches:
|
||||
- path: gitea-bootstrap-patch.yaml
|
||||
# Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
|
||||
# ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
|
||||
# apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.
|
||||
# gitea-bootstrap-secret.sops.yaml is KEPT — the env still sources the fixed SECRET_KEY + admin
|
||||
# creds from it via secretKeyRef.
|
||||
Reference in new issue
Block a user