Story Crater Bot
b0ce2fb67c
- Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit SHA stamped via VERSION build arg. - .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the runner declares only the "docker" label. Verify job on every push; image build and push gated to main. - Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran. - deployment.yaml: image from the Forgejo registry, forgejo-registry pull secret, runAsUser 65532 to match distroless nonroot. - kustomization.yaml: pin the tag in one place. Promoting a build is a one-line newTag bump, never :latest.
30 lines
775 B
YAML
30 lines
775 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: api
|
|
|
|
resources:
|
|
- rbac.yaml
|
|
- service.yaml
|
|
- deployment.yaml
|
|
- network-policy.yaml
|
|
- configmap.yaml
|
|
|
|
# The deployed image tag lives here and nowhere else. CI publishes
|
|
# forgejo.riotpiao.com/rock/api-gateway:<commit-sha>; promoting a build is a
|
|
# one-line commit bumping newTag, which Argo then syncs (G7).
|
|
#
|
|
# kustomize edit set image forgejo.riotpiao.com/rock/api-gateway=:<sha>
|
|
images:
|
|
- name: forgejo.riotpiao.com/rock/api-gateway
|
|
newTag: REPLACE_WITH_FIRST_BUILD_SHA
|
|
|
|
commonLabels:
|
|
app: api-gateway
|
|
managed-by: argocd
|
|
|
|
commonAnnotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
# Wave 2 ensures the gateway is ready before anything that depends on it
|
|
# Kong remains on wave 7 unchanged
|