From 37abad9a04e13902009497a11353968eb5bc4005 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 10 Sep 2026 05:32:46 +0000 Subject: [PATCH] =?UTF-8?q?feat(gitops):=20staged=20=E6=8E=A5=E7=AE=A1=20G?= =?UTF-8?q?itea=20Helm=20release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 10 +++++---- apps/gitea/README.md | 20 ++++++++++++++++++ apps/gitea/helmrelease.yaml | 32 +++++++++++++++++++++++++++++ apps/gitea/helmrepository.yaml | 8 ++++++++ apps/gitea/kustomization.yaml | 18 ++++++++++++++++ clusters/homelab/README.md | 5 +++-- clusters/homelab/apps/gitea.yaml | 13 ++++++++++++ clusters/homelab/kustomization.yaml | 1 + 8 files changed, 101 insertions(+), 6 deletions(-) create mode 100644 apps/gitea/README.md create mode 100644 apps/gitea/helmrelease.yaml create mode 100644 apps/gitea/helmrepository.yaml create mode 100644 apps/gitea/kustomization.yaml create mode 100644 clusters/homelab/apps/gitea.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 0919d59..456e222 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,11 +25,13 @@ What changed in this homelab, when, and why. Newest first. | Helm migration | 选定 `gitea-actions` 作为第一个 Flux HelmRelease adoption：它不承载 Git、入口、DNS、证书、数据库或 secrets controller。live StatefulSet 与 Git 都使用 regular DinD，但 Helm 保存的 release values/manifest 仍是失败的 rootless 配置；接管先固定 chart `0.1.1` 并验证 live Pod spec 不变，升级另开 PR | | Helm adoption stage | 为 `gitea-actions` 加入固定 chart `0.1.1` 的 HelmRepository、values ConfigMap 和 `suspend: true` HelmRelease；第一阶段只让 Flux 登记对象，确认 source 与固定 chart render 后再解除 suspend，失败策略使用 `RetryOnFailure` 以避免回滚到 stored rootless manifest | | Helm adoption activate | 第一阶段合并后 Flux source 与子 Kustomization 均 Ready，Helm release 仍为 revision 1，runner Pod 未 rollout；再次确认固定 chart 的完整 render 对 live 集群为零差异后，第二阶段移除 `suspend`，允许 Flux 修正 Helm 存储状态并开始 drift detection | +| Gitea adoption stage | 开始用 Flux 接管关键 `gitea` release：固定现有 chart `12.5.3`，以 `suspend: true` 登记 HelmRelease、source、values ConfigMap 和现有 HTTPRoute，子 Kustomization 保持 `prune: false`；现有 OIDC Secret 继续只引用不覆盖，其尚未进入 OpenBao/ESO 的缺口独立跟踪 | -`Carried forward`: complete the `gitea-actions` HelmRelease activation, then -upgrade Gitea and add credential-free PR plan output before ordering the -remaining Helm migrations by dependency and blast radius. Root Flux prune -remains disabled until brownfield ownership is audited. +`Carried forward`: complete the two-stage zero-change `gitea` HelmRelease +adoption, migrate its remaining manual OIDC Secret to OpenBao/ESO, then upgrade +Gitea and add credential-free PR plan output before ordering the remaining Helm +migrations by dependency and blast radius. Root Flux prune remains disabled +until brownfield ownership is audited. ## 2026-09-09 diff --git a/apps/gitea/README.md b/apps/gitea/README.md new file mode 100644 index 0000000..400db1a --- /dev/null +++ b/apps/gitea/README.md @@ -0,0 +1,20 @@ +# Gitea + +Gitea 使用外部 CloudNativePG 数据库和现有 `gitea-shared-storage` RWO PVC，入口由 +Envoy Gateway HTTPRoute 提供。Helm chart 自带的无 class Ingress 暂时保留以确保 +首次接管零变化；清理该 Ingress 与升级 chart 必须使用后续独立 PR。 + +## Flux 接管 + +现有 release 是 `gitea-12.5.3`（Gitea `1.25.5`）。接管分为两个 PR：第一阶段创建 +固定版本且 `suspend: true` 的 HelmRelease，只让 Flux 登记对象；确认 source Ready +并重新验证完整 chart render 后，第二阶段才解除 suspend。子 Kustomization 和集群 +root 均保持 `prune: false`。 + +数据库密码已经由 External Secrets Operator 从 OpenBao 投射到 `gitea-db`。OIDC +client secret 仍是历史手工 Secret `gitea-oidc-secret`，本次接管只引用、不覆盖它； +将剩余 Secret 迁移到 OpenBao 是独立的后续工作。 + +Gitea 是 Flux GitRepository 的上游。升级或重启期间 Git source 暂时不可用不会删除 +已经应用的资源；Gitea 恢复后 Flux 会继续同步。任何会改变 Pod template、数据库迁移 +或 PVC identity 的变更都不得与首次接管合并。 diff --git a/apps/gitea/helmrelease.yaml b/apps/gitea/helmrelease.yaml new file mode 100644 index 0000000..31cf790 --- /dev/null +++ b/apps/gitea/helmrelease.yaml @@ -0,0 +1,32 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: gitea + namespace: gitea +spec: + chart: + spec: + chart: gitea + interval: 1h + sourceRef: + kind: HelmRepository + name: gitea-charts + version: 12.5.3 + driftDetection: + mode: enabled + install: + strategy: + name: RetryOnFailure + retryInterval: 5m + interval: 30m + releaseName: gitea + suspend: true + targetNamespace: gitea + timeout: 15m + upgrade: + strategy: + name: RetryOnFailure + retryInterval: 5m + valuesFrom: + - kind: ConfigMap + name: gitea-values diff --git a/apps/gitea/helmrepository.yaml b/apps/gitea/helmrepository.yaml new file mode 100644 index 0000000..23cf1f0 --- /dev/null +++ b/apps/gitea/helmrepository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: gitea-charts + namespace: gitea +spec: + interval: 1h + url: https://dl.gitea.com/charts/ diff --git a/apps/gitea/kustomization.yaml b/apps/gitea/kustomization.yaml new file mode 100644 index 0000000..7905351 --- /dev/null +++ b/apps/gitea/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +generatorOptions: + disableNameSuffixHash: true + annotations: + reconcile.fluxcd.io/watch: Enabled + +configMapGenerator: + - name: gitea-values + namespace: gitea + files: + - values.yaml=gitea-values.yaml + +resources: + - helmrepository.yaml + - helmrelease.yaml + - httproute.yaml diff --git a/clusters/homelab/README.md b/clusters/homelab/README.md index 11d9c42..e2e5407 100644 --- a/clusters/homelab/README.md +++ b/clusters/homelab/README.md @@ -43,5 +43,6 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations - `http-echo` 的专用测试 ConfigMap 已在 `prune: true` 生效后重新纳管，并由下一 revision 自动删除； - `http-echo` 保持 `prune: true`，root 保持 `prune: false`； -- 下一个接管对象是现有 `gitea-actions` Helm release，先使用相同 chart/version - 完成零变化 adoption，再通过独立 PR 升级。 +- `gitea-actions` 已由 Flux HelmRelease 接管且首次 reconcile 未触发 runner rollout； +- 下一个接管对象是现有 `gitea` Helm release，先固定 chart `12.5.3` 并分两阶段完成 + 零变化 adoption，再通过独立 PR 升级 Gitea。 diff --git a/clusters/homelab/apps/gitea.yaml b/clusters/homelab/apps/gitea.yaml new file mode 100644 index 0000000..ad94d08 --- /dev/null +++ b/clusters/homelab/apps/gitea.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: gitea + namespace: flux-system +spec: + interval: 10m + path: ./apps/gitea + prune: false + sourceRef: + kind: GitRepository + name: flux-system + wait: false diff --git a/clusters/homelab/kustomization.yaml b/clusters/homelab/kustomization.yaml index b8af640..d6205d0 100644 --- a/clusters/homelab/kustomization.yaml +++ b/clusters/homelab/kustomization.yaml @@ -3,5 +3,6 @@ kind: Kustomization resources: - flux-system - namespaces/gitops-canary.yaml + - apps/gitea.yaml - apps/gitea-actions.yaml - apps/http-echo.yaml -- 2.54.0