riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(webhook): Forgejo package webhook → ArgoCD image promotion #54

New Issue
Closed
opened 2026-09-28 02:19:49 +00:00 by rock · 1 comment
rock commented 2026-09-28 02:19:49 +00:00
Owner
Copy Link
Copy Source

Replace ArgoCD Image Updater with webhook-driven image promotion.

When Forgejo fires package webhook (X-Gitea-Event: package, action: created, type: container):

  1. Extract image owner+name from payload
  2. Look up in promotion config → ArgoCD app + source index + type
  3. Query Forgejo registry v2 API for digest (REGISTRY_PAT)
  4. Patch ArgoCD Application CR via raw k8s HTTP API (in-cluster SA token)

See full spec in task description.

Replace ArgoCD Image Updater with webhook-driven image promotion. When Forgejo fires `package` webhook (X-Gitea-Event: package, action: created, type: container): 1. Extract image owner+name from payload 2. Look up in promotion config → ArgoCD app + source index + type 3. Query Forgejo registry v2 API for digest (REGISTRY_PAT) 4. Patch ArgoCD Application CR via raw k8s HTTP API (in-cluster SA token) See full spec in task description.
rock commented 2026-09-28 02:42:43 +00:00
Author
Owner
Copy Link
Copy Source

Harness cycle complete — PR #55

Reviewer: SIGN-OFF ✅

Changes needed in homelab repo

1. Create secret forgejo-registry-pat in api namespace

kubectl create secret generic forgejo-registry-pat \
  --from-literal=pat=<your-forgejo-pat> \
  -n api

The PAT needs read access to the Forgejo container registry (all orgs/namespaces: rock and riotpiao-poimen).

2. Apply RBAC (already in PR #55 k8s/rbac.yaml)

The ArgoCD sync will apply ClusterRole: image-promoter + ClusterRoleBinding: image-promoter-api-gateway. No manual action needed once PR merges.

3. Verify ArgoCD Application CRs have existing kustomize.images entries

The promoter does read-modify-write — if spec.sources[N].kustomize.images is empty (new app), first promotion will append the entry. Should work for both new and existing apps.

4. Remove ArgoCD Image Updater from homelab repo

ArgoCD Image Updater annotations on Applications can be removed once PR #55 is deployed and first promotion fires successfully.

5. Network policy

Egress rules added in k8s/network-policy.yaml:

  • cicd:3000 — Forgejo registry v2 API for digest fetch
  • default:443 — kubernetes API server for ArgoCD Application patching

6. Env var

REGISTRY_PAT loaded from secret forgejo-registry-pat key pat (optional: true, so startup is unaffected if secret is absent)

PR: #55

## Harness cycle complete — PR #55 **Reviewer**: SIGN-OFF ✅ --- ## Changes needed in homelab repo ### 1. Create secret `forgejo-registry-pat` in `api` namespace ```bash kubectl create secret generic forgejo-registry-pat \ --from-literal=pat=<your-forgejo-pat> \ -n api ``` The PAT needs read access to the Forgejo container registry (all orgs/namespaces: `rock` and `riotpiao-poimen`). ### 2. Apply RBAC (already in PR #55 k8s/rbac.yaml) The ArgoCD sync will apply `ClusterRole: image-promoter` + `ClusterRoleBinding: image-promoter-api-gateway`. No manual action needed once PR merges. ### 3. Verify ArgoCD Application CRs have existing kustomize.images entries The promoter does read-modify-write — if `spec.sources[N].kustomize.images` is empty (new app), first promotion will append the entry. Should work for both new and existing apps. ### 4. Remove ArgoCD Image Updater from homelab repo ArgoCD Image Updater annotations on Applications can be removed once PR #55 is deployed and first promotion fires successfully. ### 5. Network policy Egress rules added in `k8s/network-policy.yaml`: - `cicd:3000` — Forgejo registry v2 API for digest fetch - `default:443` — kubernetes API server for ArgoCD Application patching ### 6. Env var `REGISTRY_PAT` loaded from secret `forgejo-registry-pat` key `pat` (optional: true, so startup is unaffected if secret is absent) --- **PR**: https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend/pulls/55
rock closed this issue 2026-09-28 02:45:44 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#54