From f5225b73b94e8108ba9b8090bfa7f0dd47c22d8c Mon Sep 17 00:00:00 2001 From: Amarpreet Minhas Date: Sat, 9 Mar 2024 20:47:20 +0000 Subject: [PATCH] migrate gitea -> forgejo --- helm/forgejo/external-secrets.yaml | 68 ------------------------------ helm/forgejo/install.sh | 38 ----------------- helm/forgejo/istio-ingress.yaml | 65 ---------------------------- helm/forgejo/pvc.yaml | 12 ------ helm/forgejo/values.yaml | 51 ---------------------- helm/gitea/forgejo.sh | 37 ++++++++++++++++ helm/gitea/istio-ingress.yaml | 2 +- 7 files changed, 38 insertions(+), 235 deletions(-) delete mode 100644 helm/forgejo/external-secrets.yaml delete mode 100755 helm/forgejo/install.sh delete mode 100644 helm/forgejo/istio-ingress.yaml delete mode 100644 helm/forgejo/pvc.yaml delete mode 100644 helm/forgejo/values.yaml create mode 100755 helm/gitea/forgejo.sh diff --git a/helm/forgejo/external-secrets.yaml b/helm/forgejo/external-secrets.yaml deleted file mode 100644 index 964b791..0000000 --- a/helm/forgejo/external-secrets.yaml +++ /dev/null @@ -1,68 +0,0 @@ ---- -apiVersion: v1 -kind: Secret -type: kubernetes.io/service-account-token -metadata: - name: serviceaccounttoken - namespace: forgejo - annotations: - kubernetes.io/service-account.name: "forgejo" -... ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: forgejo-tokenreview-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:auth-delegator -subjects: -- kind: ServiceAccount - name: forgejo - namespace: forgejo -... ---- -apiVersion: external-secrets.io/v1beta1 -kind: SecretStore -metadata: - name: forgejo - namespace: forgejo -spec: - provider: - vault: - server: "https://vault.service.masked.name:8200" - path: "kv" - version: "v2" - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUROVENDQWgyZ0F3SUJBZ0lVWXA4eG81dDJsSkZQM1NpRDFmSmlyZ0dVUUowd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF4TUxiV0Z6YTJWa0xtNWhiV1V3SGhjTk1qQXdPREk1TVRreU16RXlXaGNOTXpBdwpPREkzTVRreU16UXlXakFXTVJRd0VnWURWUVFERXd0dFlYTnJaV1F1Ym1GdFpUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNSTdvUitLSHZ2em5mbmFBWERNTzVxcFNUQ0FZQ3lmakZFb2hZSmYKbE9jbkxPTlhiM2Y2c1A1ZDFlbHRMK1VUcTBSVlU1VVAwYU5XN2hxRFRhNDFNUncwSkNEdEI2OHlLZFlxMmhaZgo5N2dBK2xqM01FSlU2UlRBS0xyZzc1R1JoL0FiTkVJZ3d2UHVIS1c2aE1idHdPeU05REZVLy9XM3hwdXNhbFh5ClJNRnpBSGZTRGo5Y2krVXlnVXQ5SElOV2QvU21NR0cvOFBnaGFSaGZFNDR3UkZNcVllemVsaUl0MkpJczQzQlYKN0hxRzBPZXY5V1BlWG1pYVpVWUtRZXRIaVFxUjE0TXhpdjFJR3pDbXd3Tis5YjR0WnRaVGE1OG9NNWRQWGZiYgpsckVMUUU1T3NQYU50TXRFUjNNZ3hvdkROM1ZTQ0dIL08vR3lhRVdWYW5ZNVVGOENBd0VBQWFON01Ia3dEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGQlk4alczZkRWVXAKVVJ0MXByaG1ETWprVmlrZ01COEdBMVVkSXdRWU1CYUFGQlk4alczZkRWVXBVUnQxcHJobURNamtWaWtnTUJZRwpBMVVkRVFRUE1BMkNDMjFoYzJ0bFpDNXVZVzFsTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBV1F6NGQzUXpFClc4TkdBMTZaUGFtbFZ1Yk9MQjVEdFp6MnFyU3JuM0RlT2JMSURTaEluVjNxdFJsRHg5SFlKTFRDQTc1S2V0MEoKTlRzeU1jVHkydHhkNEk4aGdkRjMwWEplRWNpTjl3WjBtS0VlUC9ZS0R3ZThWMlh3V3E0WFlrRGVjaGxXSHBabwpQZldjb0xwckt3VlVJNEh6YXFrTm13Y21NVUk0eEFzQytTTGUxbXJlYnNlS200OW9Pd2RRcy9vUFZMSyswbkVwClJ2RDBhT3ZvaElMSWEvMlp0S2N6dmhCL0wzZm81cGc5RXgvMEpEQmRESEllZE1hYkQzcW44SWRzZStQNURmd2EKSnUyQ3R5YituMVRUUHhSRE14czJjRmJBNWlycisyQVJKZDhqdEdTKzFmeXhvZ2pPV1MxUlI1MjNGK3FJUzNzdQpLaWJHZWwrZ0ZQcHEKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRDB6Q0NBcnVnQXdJQkFnSVVNNTJ1aFhTZVRDaW0xcG16dWNtL2NuSWdOcDh3RFFZSktvWklodmNOQVFFTApCUUF3RmpFVU1CSUdBMVVFQXhNTGJXRnphMlZrTG01aGJXVXdIaGNOTWpBd09ESTVNVGt5TnpBd1doY05NalV3Ck9ESTRNVGt5TnpNd1dqQXRNU3N3S1FZRFZRUURFeUp0WVhOclpXUXVibUZ0WlNCSmJuUmxjbTFsWkdsaGRHVWcKUVhWMGFHOXlhWFI1TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE4THVHbytBcwpJQ1lXZEpqQkNZMHNuRi9YK2pGMXRkY3JRek5pUktFU0ViNWRzRGl5OTc5YnVnQ2JsUFFEUStnNVdHcVhYNHBqClV5WlpFM1p3aE91ZklTbEdLMG93MWFNanFTK3BGbFE4NUtSRC9qVXRMUFJVSnVRRittMll3SWQvTWc2L0I3UWsKZDE2NnVKa054UytNR1pDaTJPWVhlb2l2bk9ZN1EwS2ovMHZJYmM1VnQza0NSVmcybGpMU1Fob0JkKzg1QUhNUgpqZVJqWk1lWUVZRjJIVFZ3cmc0RHJDL3IwME1WdERjTnFzNitNN1laL3J6bnk3M0d2ZkpXZldvQjFDNHBpWmxnCmZ2VWNTREw1SEFoaml1NWNTZUlSN0RUdVZ4N3Q0UG9LNkFxVWtQeWdEdHExWmFMeWJYVDdYNmQwNzJkUjVBWE8KbldGTFBhYUdKOTc5aXdJREFRQUJvNElCQURDQi9UQU9CZ05WSFE4QkFmOEVCQU1DQVFZd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVJa2hWWUJhSzlDY3ZYRzhGTTJqS1ZaMTZvWkF3SHdZRFZSMGpCQmd3CkZvQVVGanlOYmQ4TlZTbFJHM1dtdUdZTXlPUldLU0F3VVFZSUt3WUJCUVVIQVFFRVJUQkRNRUVHQ0NzR0FRVUYKQnpBQ2hqVm9kSFJ3T2k4dmRtRjFiSFF1WTI5c2RXMWlhV0V1YldGemEyVmtMbTVoYldVNk9ESXdNQzkyTVM5dwphMmxmY205dmRDOWpZVEJIQmdOVkhSOEVRREErTUR5Z09xQTRoalpvZEhSd09pOHZkbUYxYkhRdVkyOXNkVzFpCmFXRXViV0Z6YTJWa0xtNWhiV1U2T0RJd01DOTJNUzl3YTJsZmNtOXZkQzlqY213d0RRWUpLb1pJaHZjTkFRRUwKQlFBRGdnRUJBSzZITWdSK2hwd2paQ21mNU5zekRTSHI3ZFlLWlhQNExyY0hQV3M5NG5MTTMzVVo1NzJ1YkdIcwpkS2pSdzhZRDBjbmNyc3lwc1ltRWdSNTdVK0RIa3lzMzk0d2tiN1VPd3kxWnZkNUlJUlhkUDBjRHlsejBRenFNCkFQblFZTitpc21rb2xqaGs5ZXkwUWJvM0NtUGpNK1VRY0F4dVpRdEE0TStyaUMxK2prdWRlMXVZTDBzekM2WTkKNEtldGZ2Yk5rZWRTYVY1eUphUktDQmhSY0M0L0dqcEJHL29kUS81QWZCUEFGalpxaGNJSldCclZZYlRRVkM3OQpoTUExaXdXSlBtVDlMc2pNU1VmeEZUUHp4Um5OWFFpS0Z6NWtUMk9pUzFucWg4YU9jeVU5WUM5Mjhwa2lmTkpWCktva3VEZXpKRk03aWUzZCtFY0JrMVY5bEh3T1dkdG89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - auth: - kubernetes: - mountPath: "k8s-teapot" - role: "forgejo" - secretRef: - name: "serviceaccounttoken" -... ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: forgejo-vault - namespace: forgejo -spec: - secretStoreRef: - name: forgejo - kind: SecretStore - data: - - secretKey: db_pw - remoteRef: - key: git - property: db_pw - - secretKey: username - remoteRef: - key: git - property: username - - secretKey: password - remoteRef: - key: git - property: password -... diff --git a/helm/forgejo/install.sh b/helm/forgejo/install.sh deleted file mode 100755 index 53de17d..0000000 --- a/helm/forgejo/install.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/bash - -CHART_VERSION=4.0.1 -NAMESPACE=forgejo -VAULT_AUTH_NAMESPACE="k8s-teapot" - -helm repo add forgejo oci://codeberg.org/forgejo-contrib/forgejo -helm repo update - -kubectl create ns forgejo -kubectl create serviceaccount -n ${NAMESPACE} forgejo -kubectl apply -n ${NAMESPACE} -f external-secrets.yaml -cat << EOH > forgejo.hcl -path "kv/data/git" { - capabilities = ["read"] -} -EOH -vault policy write forgejo forgejo.hcl -rm forgejo.hcl - -HOST_IP=$(ip addr show eth0 | grep -Po 'inet \K[\d.]+') -TOKEN="$(kubectl get secret serviceaccounttoken -n forgejo -o go-template='{{ .data.token }}' | base64 -d)" - -vault write auth/${VAULT_AUTH_NAMESPACE}/role/fogejo \ - bound_service_account_names=forgejo \ - bound_service_account_namespaces=forgejo \ - policies=forgejo \ - ttl=24h - -vault write auth/${VAULT_AUTH_NAMESPACE}/login role=forgejo jwt=${TOKEN} iss=https://${HOST_IP}:6443 - -helm upgrade --install \ - forgejo \ - forgejo/forgejo \ - -f values.yaml \ - -n ${NAMESPACE} \ - --version ${CHART_VERSION} \ - --cleanup-on-fail diff --git a/helm/forgejo/istio-ingress.yaml b/helm/forgejo/istio-ingress.yaml deleted file mode 100644 index 6554ea9..0000000 --- a/helm/forgejo/istio-ingress.yaml +++ /dev/null @@ -1,65 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name:forgejo-cert - namespace: istio-system -spec: - secretName: forgejo-cert - commonName: ngit.devvul.com - dnsNames: - - ngit.devvul.com - issuerRef: - name: letsencrypt-prod - kind: ClusterIssuer - group: cert-manager.io -... ---- -apiVersion: networking.istio.io/v1beta1 -kind: Gateway -metadata: - name: forgejo-gateway - namespace: forgejo -spec: - selector: - istio: ingressgateway - servers: - - port: - number: 443 - name: https - protocol: HTTPS - tls: - mode: SIMPLE - credentialName: forgejo-cert - hosts: - - ngit.devvul.com - - port: - number: 80 - name: http - protocol: HTTP - tls: - httpsRedirect: true - hosts: - - ngit.devvul.com -... ---- -apiVersion: networking.istio.io/v1beta1 -kind: VirtualService -metadata: - name: forgejo-gateway - namespace: forgejo -spec: - hosts: - - ngit.devvul.com - gateways: - - forgejo-gateway - http: - - match: - - uri: - prefix: / - route: - - destination: - port: - number: 80 - host: forgejo-http -... diff --git a/helm/forgejo/pvc.yaml b/helm/forgejo/pvc.yaml deleted file mode 100644 index e4ddbd8..0000000 --- a/helm/forgejo/pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: data-forgejo-0 - namespace: forgejo -spec: - accessModes: - - ReadWriteOnce - storageClassName: longhorn-encrypted-retain - resources: - requests: - storage: 100Gi diff --git a/helm/forgejo/values.yaml b/helm/forgejo/values.yaml deleted file mode 100644 index cc4f9ef..0000000 --- a/helm/forgejo/values.yaml +++ /dev/null @@ -1,51 +0,0 @@ ---- -service: - http: - port: 80 - -persistence: - enabled: true - existingClaim: data-gitea-0 - storageClass: longhorn-retain - -signing: - enabled: false - -gitea: - config: - server: - ROOT_URL: https://git.devvul.com - DOMAIN: git.devvul.com - database: - DB_TYPE: postgres - HOST: ivyking.minhas.io - NAME: git - USER: git - service: - DISABLE_REGISTRATION: true - additionalConfigFromEnvs: - - name: ENV_TO_INI__DATABASE__PASSWD - valueFrom: - secretKeyRef: - name: gitea-vault - key: db_pw - - admin: - existingSecret: gitea-vault - username: gitea-admin - - metrics: - enabled: true - - APP_NAME: "git.devvul.com" - RUN_MODE: prod - - additionalConfigSources: [] - # - secret: - # secretName: gitea-app-ini-oauth - -memcached: - enabled: false - -postgresql: - enabled: false diff --git a/helm/gitea/forgejo.sh b/helm/gitea/forgejo.sh new file mode 100755 index 0000000..e5c956c --- /dev/null +++ b/helm/gitea/forgejo.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +CHART_VERSION=1.1.2 +NAMESPACE=gitea +VAULT_AUTH_NAMESPACE="k8s-teapot" + +#helm repo add forgejo oci://codeberg.org/forgejo-contrib/forgejo +#helm repo update +#kubectl create ns gitea +#kubectl create serviceaccount -n ${NAMESPACE} gitea +#kubectl apply -n ${NAMESPACE} -f external-secrets.yaml +#cat << EOH > gitea.hcl +#path "kv/data/git" { +# capabilities = ["read"] +#} +#EOH +#vault policy write gitea gitea.hcl +#rm gitea.hcl +# +#HOST_IP=$(ip addr show eth0 | grep -Po 'inet \K[\d.]+') +#TOKEN="$(kubectl get secret serviceaccounttoken -n forgejo -o go-template='{{ .data.token }}' | base64 -d)" +# +#vault write auth/${VAULT_AUTH_NAMESPACE}/role/gitea \ +# bound_service_account_names=gitea \ +# bound_service_account_namespaces=gitea \ +# policies=gitea \ +# ttl=24h +# +#vault write auth/${VAULT_AUTH_NAMESPACE}/login role=gitea jwt=${TOKEN} iss=https://${HOST_IP}:6443 + +helm upgrade --install \ + forgejo \ + oci://codeberg.org/forgejo-contrib/forgejo \ + -f values.yaml \ + -n ${NAMESPACE} \ + --version ${CHART_VERSION} \ + --cleanup-on-fail diff --git a/helm/gitea/istio-ingress.yaml b/helm/gitea/istio-ingress.yaml index 80c9698..867b2c5 100644 --- a/helm/gitea/istio-ingress.yaml +++ b/helm/gitea/istio-ingress.yaml @@ -61,5 +61,5 @@ spec: - destination: port: number: 80 - host: gitea-http + host: forgejo-http ...