feat(webhook): Forgejo package webhook → ArgoCD image promotion (#55)

Closes #54 Replaces ArgoCD Image Updater with webhook-driven promotion. ## What changed | File | Change | |---|---| | `internal/webhook/promoter.go` | NEW — ImagePromoter + promotion table (10 entries) | | `internal/webhook/promoter_test.go` | NEW — 13 tests | | `internal/webhook/forgejo.go` | package event routed to ImagePromoter | | `k8s/rbac.yaml` | NEW — ClusterRole image-promoter + ClusterRoleBinding | | `k8s/deployment.yaml` | REGISTRY_PAT env var | | `k8s/network-policy.yaml` | egress cicd:3000 + default:443 | | `k8s/kustomization.yaml` | rbac.yaml added | ## homelab repo changes needed See comment on issue #54 for exact YAML. --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: #55
2026-09-28 02:45:41 +00:00
parent 50bcd19634
commit 23fff1006a
7 changed files with 968 additions and 9 deletions
@@ -0,0 +1,419 @@
+// Package webhook — ImagePromoter patches ArgoCD Application CRs when a
+// Forgejo container package webhook fires. It replaces ArgoCD Image Updater
+// with a webhook-driven flow:
+//
+//  1. Forgejo fires X-Gitea-Event: package (action: created, type: container)
+//  2. ForgejoHandler calls ImagePromoter.Promote(image, tag)
+//  3. Promoter fetches the digest from Forgejo registry v2 API
+//  4. Promoter patches the ArgoCD Application CR via the k8s API server
+//     using the in-cluster ServiceAccount token.
+//
+// No external dependencies — raw HTTP only.
+package webhook
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+const (
+	k8sAPIHost      = "https://kubernetes.default.svc"
+	argoNamespace   = "argocd"
+	saTokenPath     = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+	saCACertPath    = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+	defaultRegBase  = "http://forgejo-gitea.cicd.svc.cluster.local:3000"
+	defaultRegUser  = "rock"
+	promoterTimeout = 20 * time.Second
+)
+
+// promotionEntry maps a fully-qualified container image to an ArgoCD Application.
+type promotionEntry struct {
+	Image       string // e.g. "forgejo.riotpiao.com/rock/api-gateway"
+	Application string // ArgoCD Application name in namespace argocd
+	SourceIndex int    // index into spec.sources[]; -1 = spec.source (singular, helm)
+	Type        string // "kustomize" or "helm"
+}
+
+// promotionTable is the static image-to-application mapping.
+// Order matters for poimen-toolkit: two images share the same source index.
+var promotionTable = []promotionEntry{
+	{"forgejo.riotpiao.com/rock/api-gateway", "api-gw", 0, "kustomize"},
+	{"forgejo.riotpiao.com/rock/portfolio", "portfolio", 0, "kustomize"},
+	{"forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows", "poimen", 0, "kustomize"},
+	{"forgejo.riotpiao.com/riotpiao-poimen/poimen-memory", "poimen", 1, "kustomize"},
+	// sourceIndex 2 in poimen is a non-container source (chart/config repo) — not promoted.
+	{"forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend", "poimen", 3, "kustomize"},
+	{"forgejo.riotpiao.com/riotpiao-poimen/poimen-toolkit-controller", "poimen-toolkit", 0, "kustomize"},
+	{"forgejo.riotpiao.com/riotpiao-poimen/pi-worker", "poimen-toolkit", 0, "kustomize"},
+	{"forgejo.riotpiao.com/rock/forgejo-runner-golang", "forgejo-runner-golang", -1, "helm"},
+	{"forgejo.riotpiao.com/rock/forgejo-runner-node", "forgejo-runner-node", -1, "helm"},
+	{"forgejo.riotpiao.com/rock/forgejo-runner-rust", "forgejo-runner-rust", -1, "helm"},
+}
+
+// ImagePromoter fetches digests and patches ArgoCD Applications.
+type ImagePromoter struct {
+	registryBase string
+	registryUser string
+	registryPAT  string
+	k8sHost      string       // k8s API server base URL; defaults to k8sAPIHost
+	k8sClient    *http.Client // mTLS with SA CA cert
+	regClient    *http.Client // plain HTTP to internal Forgejo
+}
+
+// NewImagePromoter builds an ImagePromoter from environment and in-cluster SA files.
+// Returns nil (not an error) when REGISTRY_PAT is empty — promoter is disabled.
+func NewImagePromoter() *ImagePromoter {
+	pat := os.Getenv("REGISTRY_PAT")
+	if pat == "" {
+		return nil
+	}
+
+	regBase := os.Getenv("REGISTRY_BASE")
+	if regBase == "" {
+		regBase = defaultRegBase
+	}
+	regUser := os.Getenv("REGISTRY_USER")
+	if regUser == "" {
+		regUser = defaultRegUser
+	}
+
+	caCert, _ := os.ReadFile(saCACertPath)
+	return &ImagePromoter{
+		registryBase: regBase,
+		registryUser: regUser,
+		registryPAT:  pat,
+		k8sClient:    buildK8sClient(caCert),
+		regClient:    &http.Client{Timeout: promoterTimeout},
+	}
+}
+
+// buildK8sClient creates an HTTP client that trusts the in-cluster CA cert.
+func buildK8sClient(caCert []byte) *http.Client {
+	transport := &http.Transport{}
+	if len(caCert) > 0 {
+		pool := x509.NewCertPool()
+		pool.AppendCertsFromPEM(caCert)
+		transport.TLSClientConfig = &tls.Config{RootCAs: pool}
+	} else {
+		log.Printf("image-promoter: WARNING SA CA cert not found at %s — using InsecureSkipVerify (dev mode only)", saCACertPath)
+		transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec
+	}
+	return &http.Client{Timeout: promoterTimeout, Transport: transport}
+}
+
+// saToken reads the current in-cluster ServiceAccount token.
+// Re-reads on every call to handle token rotation.
+func saToken() string {
+	b, err := os.ReadFile(saTokenPath)
+	if err != nil {
+		log.Printf("image-promoter: WARNING failed to read SA token %s: %v", saTokenPath, err)
+		return ""
+	}
+	return strings.TrimSpace(string(b))
+}
+
+// Promote fetches the digest for image:tag and patches the corresponding
+// ArgoCD Application CR. Returns an error if the image is unknown.
+// Retries up to 3 times on k8s 409 Conflict (optimistic concurrency for apps
+// like poimen-toolkit that share a source index across multiple images).
+func (p *ImagePromoter) Promote(ctx context.Context, image, tag string) error {
+	entry := lookupEntry(image)
+	if entry == nil {
+		return fmt.Errorf("image %q not in promotion table — skipping", image)
+	}
+
+	// Parse owner/name from "forgejo.riotpiao.com/owner/name"
+	withoutHost := strings.TrimPrefix(image, "forgejo.riotpiao.com/")
+	parts := strings.SplitN(withoutHost, "/", 2)
+	if len(parts) != 2 {
+		return fmt.Errorf("cannot parse owner/name from image %q", image)
+	}
+	owner, name := parts[0], parts[1]
+
+	digest, err := p.fetchDigest(ctx, owner, name, tag)
+	if err != nil {
+		return fmt.Errorf("fetch digest for %s:%s: %w", image, tag, err)
+	}
+
+	log.Printf("image-promoter: digest %s → %s application=%s sourceIndex=%d",
+		image, digest, entry.Application, entry.SourceIndex)
+
+	// Retry on 409 Conflict: concurrent promotions for the same (app, sourceIndex)
+	// (e.g. poimen-toolkit-controller and pi-worker) can race on the same source slot.
+	for attempt := 1; attempt <= 3; attempt++ {
+		err = p.patchApplication(ctx, *entry, image, digest)
+		if err == nil {
+			return nil
+		}
+		if !strings.Contains(err.Error(), "409") || attempt == 3 {
+			return err
+		}
+		log.Printf("image-promoter: 409 conflict on PATCH %s (attempt %d/3), retrying",
+			entry.Application, attempt)
+		select {
+		case <-time.After(time.Duration(attempt) * 150 * time.Millisecond):
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+	return err
+}
+
+// lookupEntry returns the promotion entry for the given image, or nil if not found.
+func lookupEntry(image string) *promotionEntry {
+	for i := range promotionTable {
+		if promotionTable[i].Image == image {
+			return &promotionTable[i]
+		}
+	}
+	return nil
+}
+
+// fetchDigest queries the Forgejo OCI registry v2 API for the manifest digest.
+// Uses HTTP Basic auth with the configured PAT.
+func (p *ImagePromoter) fetchDigest(ctx context.Context, owner, name, tag string) (string, error) {
+	url := fmt.Sprintf("%s/v2/%s/%s/manifests/%s", p.registryBase, owner, name, tag)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodHead, url, nil)
+	if err != nil {
+		return "", fmt.Errorf("build request: %w", err)
+	}
+	req.SetBasicAuth(p.registryUser, p.registryPAT)
+	req.Header.Add("Accept", "application/vnd.docker.distribution.manifest.v2+json")
+	req.Header.Add("Accept", "application/vnd.oci.image.manifest.v1+json")
+
+	resp, err := p.regClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("http: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("registry returned %d for %s/%s:%s", resp.StatusCode, owner, name, tag)
+	}
+
+	digest := resp.Header.Get("Docker-Content-Digest")
+	if digest == "" {
+		return "", fmt.Errorf("Docker-Content-Digest header missing from registry response")
+	}
+	return digest, nil
+}
+
+// patchApplication performs a read-modify-write on the ArgoCD Application CR.
+// It reads the current spec to preserve existing image entries, updates the
+// relevant entry, then sends a JSON Patch to the k8s API server.
+func (p *ImagePromoter) patchApplication(ctx context.Context, entry promotionEntry, image, digest string) error {
+	app, err := p.getApplication(ctx, entry.Application)
+	if err != nil {
+		return fmt.Errorf("get application %s: %w", entry.Application, err)
+	}
+
+	var patch []map[string]any
+
+	switch entry.Type {
+	case "kustomize":
+		images := getKustomizeImages(app, entry.SourceIndex)
+		newImages := updateImageEntry(images, image, digest)
+		path := fmt.Sprintf("/spec/sources/%d/kustomize/images", entry.SourceIndex)
+		patch = []map[string]any{
+			{"op": "add", "path": path, "value": newImages},
+		}
+
+	case "helm":
+		// Helm runners use spec.source (singular). Patch helm parameters
+		// to set runner.image.repository and runner.image.tag with digest.
+		existing := getHelmParameters(app)
+		updates := []map[string]string{
+			{"name": "runner.image.repository", "value": image},
+			{"name": "runner.image.tag", "value": "latest@" + digest},
+		}
+		merged := mergeHelmParams(existing, updates)
+		patch = []map[string]any{
+			// "add" works whether parameters key exists or not (replace fails on absent key)
+			{"op": "add", "path": "/spec/source/helm/parameters", "value": merged},
+		}
+
+	default:
+		return fmt.Errorf("unknown promotion type %q for %s", entry.Type, entry.Application)
+	}
+
+	return p.applyJSONPatch(ctx, entry.Application, patch)
+}
+
+// k8sBase returns the configured k8s host or the default in-cluster address.
+func (p *ImagePromoter) k8sBase() string {
+	if p.k8sHost != "" {
+		return p.k8sHost
+	}
+	return k8sAPIHost
+}
+
+// getApplication fetches the current ArgoCD Application CR from the k8s API.
+func (p *ImagePromoter) getApplication(ctx context.Context, name string) (map[string]any, error) {
+	url := fmt.Sprintf("%s/apis/argoproj.io/v1alpha1/namespaces/%s/applications/%s",
+		p.k8sBase(), argoNamespace, name)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("build request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+saToken())
+
+	resp, err := p.k8sClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("http: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return nil, fmt.Errorf("k8s GET returned %d: %s", resp.StatusCode, body)
+	}
+
+	var app map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&app); err != nil {
+		return nil, fmt.Errorf("decode: %w", err)
+	}
+	return app, nil
+}
+
+// applyJSONPatch sends RFC 6902 JSON Patch to the ArgoCD Application.
+func (p *ImagePromoter) applyJSONPatch(ctx context.Context, appName string, patch []map[string]any) error {
+	patchBytes, err := json.Marshal(patch)
+	if err != nil {
+		return fmt.Errorf("marshal patch: %w", err)
+	}
+
+	url := fmt.Sprintf("%s/apis/argoproj.io/v1alpha1/namespaces/%s/applications/%s",
+		p.k8sBase(), argoNamespace, appName)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPatch, url, bytes.NewReader(patchBytes))
+	if err != nil {
+		return fmt.Errorf("build request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json-patch+json")
+	req.Header.Set("Authorization", "Bearer "+saToken())
+
+	resp, err := p.k8sClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("http: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return fmt.Errorf("k8s PATCH returned %d: %s", resp.StatusCode, body)
+	}
+	return nil
+}
+
+// ── spec helpers ─────────────────────────────────────────────────────────────
+
+// getKustomizeImages extracts spec.sources[N].kustomize.images.
+// Returns nil if the path does not exist.
+func getKustomizeImages(app map[string]any, sourceIndex int) []string {
+	spec, _ := app["spec"].(map[string]any)
+	sources, _ := spec["sources"].([]any)
+	if sourceIndex < 0 || sourceIndex >= len(sources) {
+		return nil
+	}
+	src, _ := sources[sourceIndex].(map[string]any)
+	kust, _ := src["kustomize"].(map[string]any)
+	return toStringSlice(kust["images"])
+}
+
+// getHelmParameters extracts spec.source.helm.parameters.
+func getHelmParameters(app map[string]any) []map[string]string {
+	spec, _ := app["spec"].(map[string]any)
+	source, _ := spec["source"].(map[string]any)
+	helm, _ := source["helm"].(map[string]any)
+	raw, _ := helm["parameters"].([]any)
+
+	params := make([]map[string]string, 0, len(raw))
+	for _, item := range raw {
+		m, ok := item.(map[string]any)
+		if !ok {
+			continue
+		}
+		p := map[string]string{}
+		if n, ok := m["name"].(string); ok {
+			p["name"] = n
+		}
+		if v, ok := m["value"].(string); ok {
+			p["value"] = v
+		}
+		params = append(params, p)
+	}
+	return params
+}
+
+// updateImageEntry replaces the entry for image in the images slice, or appends
+// if not present. The new entry format is "{image}@{digest}".
+// Matching is by image name (prefix before ':' or '@').
+func updateImageEntry(images []string, image, digest string) []string {
+	newEntry := image + "@" + digest
+	for i, img := range images {
+		// Strip tag/digest suffix to get the bare name
+		bare := img
+		if idx := strings.IndexAny(img, ":@"); idx >= 0 {
+			bare = img[:idx]
+		}
+		if bare == image {
+			result := make([]string, len(images))
+			copy(result, images)
+			result[i] = newEntry
+			return result
+		}
+	}
+	return append(images, newEntry)
+}
+
+// mergeHelmParams merges update params into existing, preserving unrelated params.
+func mergeHelmParams(existing, updates []map[string]string) []map[string]string {
+	idx := make(map[string]string, len(updates))
+	for _, u := range updates {
+		idx[u["name"]] = u["value"]
+	}
+
+	result := make([]map[string]string, 0, len(existing)+len(updates))
+	replaced := make(map[string]bool)
+	for _, p := range existing {
+		if val, ok := idx[p["name"]]; ok {
+			result = append(result, map[string]string{"name": p["name"], "value": val})
+			replaced[p["name"]] = true
+		} else {
+			result = append(result, p)
+		}
+	}
+	for _, u := range updates {
+		if !replaced[u["name"]] {
+			result = append(result, u)
+		}
+	}
+	return result
+}
+
+// toStringSlice converts []any to []string, skipping non-strings.
+func toStringSlice(v any) []string {
+	arr, ok := v.([]any)
+	if !ok {
+		return nil
+	}
+	result := make([]string, 0, len(arr))
+	for _, item := range arr {
+		if s, ok := item.(string); ok {
+			result = append(result, s)
+		}
+	}
+	return result
+}