claude-botandClaude Opus 5.5
eb23d3ac6e
- kubernetes/apps/gitea: every object in namespace gitea; applied by a new gitea Flux Kustomization (clusters/homelab/gitea.yaml) instead of apps. gitea-allow-metrics-scrape dropped: the gitea-ns baseline already admits monitoring. - Rotators (flux-git, review-bot) and the Prometheus gitea job use gitea.gitea.svc. - bootstrap.sh waits for the gitea KS. Data: data-gitea-0 is not copied. The PV (reclaimPolicy Retain) is rebound to a PVC gitea/data-gitea-0 pre-created with volumeName, which the new StatefulSet adopts. gitea-tls is pre-issued in the gitea namespace so HTTPS has no certificate gap. Refs #878 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
52 lines
1.8 KiB
YAML
52 lines
1.8 KiB
YAML
# Prometheus scrape and Traefik are admitted by the namespace baseline in
|
|
# infrastructure/network-policies/gitea-ns.yaml.
|
|
#
|
|
# Secret rotation: the flux-git rotator (openbao ns) reaches gitea to mint a new
|
|
# flux PAT. It uses the in-cluster Service (gitea.gitea.svc:3000) — the public
|
|
# gitea.renner.uno name hairpins off the ingress LB from a pod (same failure as
|
|
# pve.renner.uno). Scoped to the gitea pod :3000 and the rotator label; the
|
|
# egress half is rotator-gitea-flux-egress in network-policies/openbao-ns.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-allow-flux-rotator
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": openbao
|
|
app.kubernetes.io/component: secret-rotator
|
|
app.kubernetes.io/name: flux-git
|
|
toPorts:
|
|
- ports:
|
|
- port: "3000"
|
|
protocol: TCP
|
|
---
|
|
# Secret rotation: the review-bot rotator (openbao ns) reaches gitea to mint a
|
|
# new review-bot PAT, same in-cluster Service path as the flux rotator. Scoped
|
|
# to the gitea pod :3000 and the review-bot rotator label; the egress half is
|
|
# rotator-review-bot-egress in network-policies/openbao-ns.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: gitea-allow-review-bot-rotator
|
|
namespace: gitea
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitea
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": openbao
|
|
app.kubernetes.io/component: secret-rotator
|
|
app.kubernetes.io/name: review-bot
|
|
toPorts:
|
|
- ports:
|
|
- port: "3000"
|
|
protocol: TCP
|