Admin Bot
1a122b0046
CI / CI (pull_request) Successful in 2m11s
Replaces ArgoCD Image Updater with a webhook-driven approach.
When Forgejo fires X-Gitea-Event: package (action: created, type: container):
1. Extract image owner+name+version from payload
2. Look up in static promotion table (10 images \u2192 ArgoCD apps)
3. Fetch digest from Forgejo registry v2 API (Basic auth, REGISTRY_PAT)
4. Read-modify-write ArgoCD Application CR via k8s API (in-cluster SA token)
- kustomize: JSON Patch /spec/sources[N]/kustomize/images
- helm: JSON Patch /spec/source/helm/parameters (runner.image.*)
5. Send Gotify notification with promotion result
Key design:
- Raw http.Client only \u2014 no client-go dependency
- context.Context propagated through all outbound calls
- Retry up to 3x on 409 Conflict (concurrent poimen-toolkit promotions)
- Request ID per invocation for log correlation
- Promotion table covers: api-gw, portfolio, poimen (3 sources), poimen-toolkit (2 images), forgejo-runner-{golang,node,rust}
RBAC: ClusterRole image-promoter (get+patch applications.argoproj.io) bound to api-gateway SA
NetworkPolicy: egress to cicd:3000 (registry) + default:443 (k8s API)
Deployment: REGISTRY_PAT from forgejo-registry-pat secret
13 tests in promoter_test.go, all pass
Closes #54
29 lines
713 B
YAML
29 lines
713 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: api
|
|
|
|
resources:
|
|
- serviceaccount.yaml
|
|
- service.yaml
|
|
- deployment.yaml
|
|
- network-policy.yaml
|
|
- gateway-config-secret.yaml
|
|
- rbac.yaml
|
|
|
|
# The deployed image tag lives here and nowhere else. CI publishes
|
|
# forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.
|
|
# ArgoCD auto-syncs when the latest image is available.
|
|
images:
|
|
- name: forgejo.riotpiao.com/rock/api-gateway
|
|
newTag: latest
|
|
|
|
commonLabels:
|
|
app: api-gateway
|
|
managed-by: argocd
|
|
|
|
commonAnnotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
# Wave 2 ensures the gateway is ready before anything that depends on it
|
|
# Kong remains on wave 7 unchanged
|