Will Anderson
872a834989
Vault: - Annotate vault-helm-gke Service with cloud.google.com/neg exposed_ports to create container-native NEGs (k8s1-bfbeff02-vault-...) in 3 zones - Add vault-api-from-lb-gke firewall rule allowing GCP health check ranges (130.211.0.0/22, 35.191.0.0/16) to reach GKE pod IPs on port 8200 - Replace GCE instance group backends in google_compute_backend_service.vault with GKE NEG backends (RATE balancing mode, 100 req/endpoint) - GCP Global HTTPS LB frontend unchanged — DNS stays at 34.54.164.21 - vault.neuralplatform.ai now terminates at GKE pods (all 3 NEGs HEALTHY) Gitea: - Change GKE Gitea Service from ClusterIP to LoadBalancer (external IP: 34.31.145.131) - Add Cloudflare DNS A record for git.neuralplatform.ai → 34.31.145.131 (proxied) - Remove git.neuralplatform.ai route from Legion Cloudflare tunnel config - Add Cloudflare config rule: flexible SSL for git.neuralplatform.ai (origin serves HTTP/3000, CF proxies HTTPS termination) - Scale Legion Gitea deployment to 0 replicas (PVC preserved) - git.neuralplatform.ai now serves from GKE Gitea pod
105 lines
2.9 KiB
YAML
105 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea
|
|
namespace: git
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
replicas: 0 # Scaled down — Gitea has been migrated to GKE. DNS now points at GKE LB.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: gitea
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
containers:
|
|
- name: gitea
|
|
image: gitea/gitea:1.25.5
|
|
ports:
|
|
- name: http
|
|
containerPort: 3000
|
|
- name: ssh
|
|
containerPort: 22
|
|
env:
|
|
- name: GITEA__database__DB_TYPE
|
|
value: postgres
|
|
- name: GITEA__database__HOST
|
|
value: postgres-postgresql.platform.svc.cluster.local:5432
|
|
- name: GITEA__database__NAME
|
|
value: gitea
|
|
- name: GITEA__database__USER
|
|
value: gitea
|
|
- name: GITEA__database__PASSWD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: gitea-db
|
|
key: password
|
|
- name: GITEA__server__DOMAIN
|
|
value: git.neuralplatform.ai
|
|
- name: GITEA__server__ROOT_URL
|
|
value: https://git.neuralplatform.ai
|
|
- name: GITEA__server__SSH_DOMAIN
|
|
value: git.neuralplatform.ai
|
|
- name: GITEA__server__SSH_PORT
|
|
value: "30022"
|
|
- name: GITEA__server__START_SSH_SERVER
|
|
value: "false"
|
|
- name: GITEA__service__DISABLE_REGISTRATION
|
|
value: "true"
|
|
- name: GITEA__service__REQUIRE_SIGNIN_VIEW
|
|
value: "false"
|
|
- name: GITEA__security__INSTALL_LOCK
|
|
value: "true"
|
|
- name: GITEA__packages__ENABLED
|
|
value: "true"
|
|
- name: GITEA__webhook__ALLOWED_HOST_LIST
|
|
value: 192.168.0.0/24,10.0.0.0/8
|
|
- name: GITEA__actions__DEFAULT_ACTIONS_URL
|
|
value: https://code.forgejo.org
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
- name: custom-css
|
|
mountPath: /data/gitea/custom/public/assets/css/custom.css
|
|
subPath: custom.css
|
|
- name: custom-css
|
|
mountPath: /data/gitea/custom/templates/custom/header.tmpl
|
|
subPath: header.tmpl
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: 500m
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: gitea-data
|
|
- name: custom-css
|
|
configMap:
|
|
name: gitea-custom-css
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea
|
|
namespace: git
|
|
spec:
|
|
selector:
|
|
app: gitea
|
|
ports:
|
|
- name: http
|
|
port: 3000
|
|
targetPort: 3000
|
|
- name: ssh
|
|
port: 22
|
|
targetPort: 22
|
|
nodePort: 30022
|
|
type: NodePort
|