From 3ca654513f56938bd7993d7974a9a040f1fb7b9a Mon Sep 17 00:00:00 2001
From: Admin Bot <admin@riotpiao.com>
Date: Mon, 28 Sep 2026 12:24:56 +0800
Subject: [PATCH] fix(promoter): correct Forgejo registry service hostname

forgejo-gitea-http.cicd.svc.cluster.local (headless svc, port 3000)
not forgejo-gitea (doesn't exist). Also wire REGISTRY_BASE env var
in deployment.yaml so it can be overridden without code change.
---
 internal/webhook/promoter.go | 15 ++++++++++-----
 k8s/deployment.yaml          |  2 ++
 k8s/network-policy.yaml      | 13 +++++++++----
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/internal/webhook/promoter.go b/internal/webhook/promoter.go
index ba00ed6..672a051 100644
--- a/internal/webhook/promoter.go
+++ b/internal/webhook/promoter.go
@@ -31,7 +31,7 @@ const (
 	argoNamespace   = "argocd"
 	saTokenPath     = "/var/run/secrets/kubernetes.io/serviceaccount/token"
 	saCACertPath    = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
-	defaultRegBase  = "http://forgejo-gitea.cicd.svc.cluster.local:3000"
+	defaultRegBase  = "http://forgejo-gitea-http.cicd.svc.cluster.local:3000"
 	defaultRegUser  = "rock"
 	promoterTimeout = 20 * time.Second
 )
@@ -224,10 +224,15 @@ func (p *ImagePromoter) patchApplication(ctx context.Context, entry promotionEnt
 	case "kustomize":
 		images := getKustomizeImages(app, entry.SourceIndex)
 		newImages := updateImageEntry(images, image, digest)
-		path := fmt.Sprintf("/spec/sources/%d/kustomize/images", entry.SourceIndex)
-		patch = []map[string]any{
-			{"op": "add", "path": path, "value": newImages},
-		}
+		// Patch the full kustomize block (not just /kustomize/images) so the
+		// op succeeds even when the kustomize key is absent from the source.
+		// These apps only use kustomize overrides for image pinning, so
+		// replacing the whole block is safe.
+		patch = []map[string]any{{
+			"op":    "add",
+			"path":  fmt.Sprintf("/spec/sources/%d/kustomize", entry.SourceIndex),
+			"value": map[string]any{"images": newImages},
+		}}
 
 	case "helm":
 		// Helm runners use spec.source (singular). Patch helm parameters
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 4c8ab0f..c3fd2dd 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -101,6 +101,8 @@ spec:
               name: forgejo-registry-pat
               key: pat
               optional: true
+        - name: REGISTRY_BASE
+          value: "http://forgejo-gitea-http.cicd.svc.cluster.local:3000"
         volumeMounts:
         - name: config
           mountPath: /etc/gateway
diff --git a/k8s/network-policy.yaml b/k8s/network-policy.yaml
index 9583bf0..d445622 100644
--- a/k8s/network-policy.yaml
+++ b/k8s/network-policy.yaml
@@ -158,11 +158,16 @@ spec:
     ports:
     - protocol: TCP
       port: 3000
-  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA)
+  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA).
+  # kube-apiserver runs on host network (192.168.1.162/166:6443) — must use ipBlock.
+  # ClusterIP 10.96.0.1:443 also routes there, covered by the 10.96.0.0/12 CIDR.
   - to:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: default
+    - ipBlock:
+        cidr: 10.96.0.0/12
+    - ipBlock:
+        cidr: 192.168.1.0/24
     ports:
     - protocol: TCP
       port: 443
+    - protocol: TCP
+      port: 6443