feat(webhook): Forgejo package webhook → ArgoCD image promotion (#55)

Closes #54 Replaces ArgoCD Image Updater with webhook-driven promotion. ## What changed | File | Change | |---|---| | `internal/webhook/promoter.go` | NEW — ImagePromoter + promotion table (10 entries) | | `internal/webhook/promoter_test.go` | NEW — 13 tests | | `internal/webhook/forgejo.go` | package event routed to ImagePromoter | | `k8s/rbac.yaml` | NEW — ClusterRole image-promoter + ClusterRoleBinding | | `k8s/deployment.yaml` | REGISTRY_PAT env var | | `k8s/network-policy.yaml` | egress cicd:3000 + default:443 | | `k8s/kustomization.yaml` | rbac.yaml added | ## homelab repo changes needed See comment on issue #54 for exact YAML. --------- Co-authored-by: Admin Bot <[email protected]> Reviewed-on: #55
2026-09-28 02:45:41 +00:00
parent 50bcd19634
commit 23fff1006a
7 changed files with 968 additions and 9 deletions
@@ -150,3 +150,19 @@ spec:
      port: 80
    - protocol: TCP
      port: 9000
+  # Allow to Forgejo registry v2 API (image digest lookup for promotion)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: cicd
+    ports:
+    - protocol: TCP
+      port: 3000
+  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA)
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: default
+    ports:
+    - protocol: TCP
+      port: 443