feat: manage Gitea with Argo CD

README.md

@@ -76,12 +76,13 @@ Gitea is reachable from the host after
 | `opencost` | OpenCost chart | `opencost` | Uses the in-cluster Prometheus service |
 | `prometheus` | kube-prometheus manifests | `monitoring` | Owns the monitoring stack except Grafana resources |
 | `grafana` | kube-prometheus manifests | `monitoring` | Owns only the `grafana-*` manifests |
+| `gitea` | Gitea chart | `gitea` | Adopts the bootstrap release and serves `gitea.greenkube.cloud` |
 | `vpa` | Fairwinds chart | `vpa` | Vertical Pod Autoscaler in recommendation mode (updater disabled) |
 | `demo-app` | this repo | `demo` | Annotated workload used to exercise rightsizing and the PR bot |
 
-ArgoCD adopts the existing ingress-nginx release and manages OpenCost,
-kube-prometheus, Grafana and VPA. ArgoCD itself, Gitea and cert-manager remain
-bootstrap components. The `prometheus` and `grafana` Applications use the same
+ArgoCD adopts the existing ingress-nginx and Gitea releases and manages
+OpenCost, kube-prometheus, Grafana and VPA. ArgoCD itself and cert-manager
+remain bootstrap components. The `prometheus` and `grafana` Applications use the same
 pinned kube-prometheus source revision but select disjoint manifest sets.
 
 ## GreenKube source annotations

bootstrap/bootstrap.sh

@@ -185,6 +185,12 @@ EOF
       --wait --timeout 10m
   fi
   kubectl -n "${GITEA_NAMESPACE}" rollout status deployment/gitea --timeout=10m
+  local admin_password
+  admin_password="$(gitea_admin_password)"
+  kubectl -n "${GITEA_NAMESPACE}" create secret generic gitea-admin-credentials \
+    --from-literal=username=gitea-admin \
+    --from-literal="password=${admin_password}" \
+    --dry-run=client -o yaml | kubectl apply -f -
 }
 
 GITEA_PF_PID=""

clusters/minikube/apps/60-gitea.yaml

@@ -0,0 +1,32 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gitea
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: local-k8s
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: platform
+  sources:
+    - repoURL: https://dl.gitea.com/charts/
+      chart: gitea
+      targetRevision: 12.7.0
+      helm:
+        releaseName: gitea
+        valueFiles:
+          - $values/clusters/minikube/values/gitea.yaml
+    - repoURL: http://gitea-http.gitea.svc.cluster.local:3000/greenkube/local-k8s.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: gitea
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

clusters/minikube/manifests/ingresses/ingresses.yaml

@@ -2,6 +2,36 @@
 # with Prune=false so removing an entry cannot delete a live ingress.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
+metadata:
+  name: gitea-ingress
+  namespace: gitea
+  labels:
+    app.kubernetes.io/part-of: local-k8s
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - gitea.greenkube.cloud
+      secretName: gitea-tls
+  rules:
+    - host: gitea.greenkube.cloud
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
   name: argocd-ingress
   namespace: argocd

clusters/minikube/project.yaml

@@ -13,6 +13,7 @@ spec:
     - https://kubernetes.github.io/ingress-nginx
     - https://opencost.github.io/opencost-helm-chart
     - https://github.com/prometheus-operator/kube-prometheus.git
+    - https://dl.gitea.com/charts/
   destinations:
     - namespace: "*"
       server: https://kubernetes.default.svc

clusters/minikube/values/gitea.yaml

@@ -0,0 +1,23 @@
+gitea:
+  admin:
+    existingSecret: gitea-admin-credentials
+    username: gitea-admin
+    email: admin@greenkube.local
+    passwordMode: initialOnlyNoReset
+  config:
+    database:
+      DB_TYPE: sqlite3
+    server:
+      DOMAIN: gitea.greenkube.cloud
+      ROOT_URL: https://gitea.greenkube.cloud/
+postgresql:
+  enabled: false
+postgresql-ha:
+  enabled: false
+valkey:
+  enabled: false
+valkey-cluster:
+  enabled: false
+persistence:
+  enabled: true
+  size: 2Gi