rock
1e84f13009
- Added Image Updater annotations to forgejo-runner Applications
- Image Updater now automatically tracks new images in Forgejo registry
- Update strategy: newest-build (latest commit SHA)
- Tag filter: commits (7-char SHA), latest, and v* releases
- Helm values track repository + tag separately for automatic updates
- Write-back via git (commits image updates to main branch)
Build and push custom runner images:
docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
-t forgejo.riotpiao.com/rock/forgejo-runner-golang:latest .
docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
-t forgejo.riotpiao.com/rock/forgejo-runner-rust:latest .
docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
-t forgejo.riotpiao.com/rock/forgejo-runner-node:latest .
docker login forgejo.riotpiao.com
docker push forgejo.riotpiao.com/rock/forgejo-runner-golang:latest
docker push forgejo.riotpiao.com/rock/forgejo-runner-rust:latest
docker push forgejo.riotpiao.com/rock/forgejo-runner-node:latest
Image Updater will then:
1. Detect new images in registry
2. Update values.yaml automatically
3. Commit changes to git
4. ArgoCD syncs the new image tags
237 lines
8.0 KiB
YAML
237 lines
8.0 KiB
YAML
# Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
|
|
# runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
|
|
# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: vault
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://helm.releases.hashicorp.com
|
|
chart: vault
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/infra/iam/vault-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: iam
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: authentik
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://charts.goauthentik.io
|
|
chart: authentik
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/infra/iam/authentik-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: iam
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: iam-jobs
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/iam
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: iam
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
|
|
# under Argo, because values changes there were inert — a proxy-body-size fix
|
|
# sat committed while the live Ingress kept nginx's 1m default and rejected
|
|
# every OCI push with 413.
|
|
#
|
|
# Wave 3: after databases (wave 2) — Forgejo needs CNPG and Redis up first.
|
|
#
|
|
# Retiring the Helm release: Argo adopts the existing objects on first sync.
|
|
# Delete the release secrets afterwards so helm stops claiming ownership:
|
|
# kubectl -n cicd delete secret -l owner=helm,name=forgejo
|
|
#
|
|
# automated sync is deliberately absent. This chart owns the Forgejo PVC and
|
|
# the git forge itself; the first sync is manual so its diff can be read before
|
|
# anything is applied. Turn on automated+selfHeal once that diff is clean.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://dl.gitea.com/charts/
|
|
chart: gitea
|
|
targetRevision: 12.7.0
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
# Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
|
|
# so the pod rolls when that Secret changes. The chart does not render it, so
|
|
# Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
|
|
# would fight over the field and Recreate the forge each round.
|
|
ignoreDifferences:
|
|
- group: apps
|
|
kind: Deployment
|
|
name: forgejo-gitea
|
|
jqPathExpressions:
|
|
- '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
|
|
syncPolicy:
|
|
syncOptions:
|
|
# Adopt the objects the bootstrap Helm release already created rather
|
|
# than failing on "already exists".
|
|
- ServerSideApply=true
|
|
---
|
|
# Forgejo runners (local chart, one instance per language), replacing the
|
|
# single generic "docker"-labeled runner. Each instance is a full standalone
|
|
# Deployment with its own dind sidecar, own PVCs (registration + layer
|
|
# cache) and own registered label -- there is no shared generic runner
|
|
# anymore, so each instance also builds and pushes images for the repos it
|
|
# serves (the chart's ConfigMap/NetworkPolicy fixes for that -- valid_volumes,
|
|
# network: host, egress to ingress-nginx -- apply identically to all three).
|
|
#
|
|
# `values.yaml` is the chart's default and doubles as the golang instance's
|
|
# config; node and rust layer a small values-<lang>.yaml override on top for
|
|
# just runner.name/runner.labels. All three share one runner-token Secret
|
|
# (Forgejo registration tokens are reusable across multiple runners, unlike
|
|
# GitHub's one-time tokens) -- if that assumption is ever wrong, registration
|
|
# will fail loudly in the register initContainer's logs, not silently.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo-runner-golang
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-golang
|
|
argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
|
|
argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
|
|
argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
|
|
argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
|
|
argocd-image-updater.argoproj.io/write-back-method: git
|
|
argocd-image-updater.argoproj.io/git-branch: main
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/forgejo-runner
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo-runner-node
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-node
|
|
argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
|
|
argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
|
|
argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
|
|
argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
|
|
argocd-image-updater.argoproj.io/write-back-method: git
|
|
argocd-image-updater.argoproj.io/git-branch: main
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/forgejo-runner
|
|
helm:
|
|
valueFiles:
|
|
- values-node.yaml
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo-runner-rust
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-rust
|
|
argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
|
|
argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
|
|
argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
|
|
argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
|
|
argocd-image-updater.argoproj.io/write-back-method: git
|
|
argocd-image-updater.argoproj.io/git-branch: main
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/forgejo-runner
|
|
helm:
|
|
valueFiles:
|
|
- values-rust.yaml
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|