unkinben
e8d46d08f2
Stand up the forge on k8s to replace the Puppet VM. Deployed HA-shaped to match what the VM already runs (multi-replica on shared storage + external DB/cache): official Gitea chart 12.6.0 (app 1.26.2) at 2 replicas on RWX CephFS, CNPG Postgres with S3 backup, standalone Valkey for cache/session/queue, Authentik OIDC, Actions disabled and the container registry moved to artifactapi. Serves a temporary git2.k8s.syd1.au.unkin.net host; cutover is staged (see the doc). - add apps/base/gitea (namespace, CNPG cluster+backup+pooler, Valkey, VaultAuth, VaultStaticSecrets, Gateway, HTTPRoute) - add apps/overlays/au-syd1/gitea (chart 12.6.0 via helm-through-kustomize + values, drop the chart test Pod) - register gitea in the platform ApplicationSet and AppProject - add docs/gitea-migration.md staged cutover plan Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
91 lines
2.5 KiB
YAML
91 lines
2.5 KiB
YAML
---
|
|
# Postgres for the k8s Gitea (replaces the Patroni-shared DB the VM uses). Gitea
|
|
# already runs on Postgres, so cutover is a plain pg dump/restore (no engine
|
|
# conversion). App-user creds come from the postgres-credentials Vault secret.
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: gitea-postgres
|
|
namespace: gitea
|
|
spec:
|
|
affinity:
|
|
podAntiAffinityType: preferred
|
|
backup:
|
|
# 30-day retention. Enforced by CNPG against the object store on each
|
|
# successful base backup.
|
|
retentionPolicy: 30d
|
|
barmanObjectStore:
|
|
# Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
|
|
destinationPath: s3://cnpg-gitea
|
|
endpointURL: https://s3.ceph.unkin.net
|
|
# radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
|
|
# every namespace as the vault-ca-cert Secret).
|
|
endpointCA:
|
|
name: vault-ca-cert
|
|
key: ca.crt
|
|
# Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: cnpg-gitea-backup-s3
|
|
key: AWS_ACCESS_KEY_ID
|
|
secretAccessKey:
|
|
name: cnpg-gitea-backup-s3
|
|
key: AWS_SECRET_ACCESS_KEY
|
|
# Path prefix within the bucket; keep stable across restores (see docs).
|
|
serverName: gitea
|
|
data:
|
|
compression: bzip2
|
|
jobs: 2
|
|
wal:
|
|
compression: zstd
|
|
maxParallel: 2
|
|
bootstrap:
|
|
initdb:
|
|
database: gitea
|
|
encoding: UTF8
|
|
localeCType: C
|
|
localeCollate: C
|
|
owner: gitea
|
|
secret:
|
|
name: postgres-credentials
|
|
enablePDB: true
|
|
enableSuperuserAccess: false
|
|
failoverDelay: 0
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
|
|
instances: 2
|
|
logLevel: info
|
|
monitoring:
|
|
customQueriesConfigMap:
|
|
- key: queries
|
|
name: cnpg-default-monitoring
|
|
disableDefaultQueries: false
|
|
enablePodMonitor: false
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "200"
|
|
shared_buffers: 256MB
|
|
primaryUpdateMethod: restart
|
|
primaryUpdateStrategy: unsupervised
|
|
replicationSlots:
|
|
highAvailability:
|
|
enabled: true
|
|
slotPrefix: _cnpg_
|
|
synchronizeReplicas:
|
|
enabled: true
|
|
updateInterval: 30
|
|
resources:
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
smartShutdownTimeout: 180
|
|
startDelay: 3600
|
|
stopDelay: 1800
|
|
storage:
|
|
resizeInUseVolumes: true
|
|
size: 20Gi
|
|
storageClass: cephrbd-fast-delete
|
|
switchoverDelay: 3600
|