Merge branch 'main' of work:paasup/dip-catalog

charts/gitea/CUSTOM-README.md

@@ -216,3 +216,36 @@ postgresql:
     # storageClass: ""           # 생성할 볼륨의 storageClass를 설정한다.
 ```
 
+
+## 6. Infisical 서비스 연동
+
+``` yaml
+---
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: infisicalsecret-git # 고유한 이름으로 사용자 정의
+  namespace: infisical
+  labels:
+    label-to-be-passed-to-managed-secret: test-git-secret # 고유한 이름으로 사용자 정의 (아래 annotations값과 동일)
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "test-git-secret" # 고유한 이름으로 사용자 정의 (위의 label값과 동일)
+spec:
+  hostAPI: http://infisical-infisical-standalone-infisical.infisical.svc.cluster.local:8080/api # Infisical API
+  resyncInterval: 10
+  authentication:
+    kubernetesAuth:
+      identityId: 5ffaf885-7df2-4c75-a3a5-292a996aa3d7 # Infisical에서 생성한 값
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      secretsScope:
+        projectSlug: project1-9j-pp # 프로젝트 GET 
+        envSlug: dev # 프로젝트 GET
+        secretsPath: "/system/gitea" # 시크릿의 경로정의
+        recursive: true
+  managedSecretReference:
+    secretName: gitea-user-secret # 생성할 시크릿 이름(values.yaml와 특정 이름으로 맞추면 변경하지 않아도됨)
+    secretNamespace: test-git # Gitea가 배포될 네임스페이스 (네임스페이스가 사전에 생성되어 있어야함)
+    creationPolicy: "Orphan" ## Owner | Orphan
+```

charts/gitea/custom-values.yaml

@@ -17,7 +17,7 @@ global:
 #         host: gitea.example.org
 #       secretName: platform
 
-# # 사설 인증서를 사용 시 아래 내용 추가 
+# # 사설 인증서를 사용 시 아래 내용 추가
 # extraVolumes:
 #  - name: gitea-tls
 #    secret:
@@ -27,8 +27,8 @@ global:
 ingress:
   enabled: true
   annotations:
-    cert-manager.io/cluster-issuer: "selfsigned-issuer" 
-    cert-manager.io/duration: 8760h  
+    cert-manager.io/cluster-issuer: "selfsigned-issuer"
+    cert-manager.io/duration: 8760h
     cert-manager.io/renew-before: 720h
     konghq.com/protocols: https
     konghq.com/https-redirect-status-code: "301"
@@ -43,21 +43,21 @@ ingress:
         host: gitea.example.org
       secretName: gitea-tls-secret
 
-# 사설 인증서를 사용 시 아래 내용 추가 
+# 사설 인증서를 사용 시 아래 내용 추가
 extraVolumes:
- - name: gitea-tls
-   secret:
-     secretName: gitea-tls-secret
+  - name: gitea-tls
+    secret:
+      secretName: gitea-tls-secret
 
 extraContainerVolumeMounts:
   - name: gitea-tls
     mountPath: /etc/ssl/certs/ca.crt
-    subPath: ca.crt  
+    subPath: ca.crt
 
 # lifecycleHooks:
 #   postStart:
 #     exec:
-#       command: 
+#       command:
 #       - "/bin/sh"
 #       -  "-c"
 #       - |
@@ -71,16 +71,15 @@ extraContainerVolumeMounts:
 #         REALM=paasup
 #         if [[ -z "${AUTH_ID}" ]]; then
 #           echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
-#           gitea admin auth add-oauth --auto-discover-url "${KEYCLOAK_URL}/auth/realms/${REALM}/.well-known/openid-configuration" --key "${KEYCLOAK_CLIENT_ID}" --name "keycloak" --provider "openidConnect" --secret "{$KEYCLOAK_SECRET}" 
+#           gitea admin auth add-oauth --auto-discover-url "${KEYCLOAK_URL}/auth/realms/${REALM}/.well-known/openid-configuration" --key "${KEYCLOAK_CLIENT_ID}" --name "keycloak" --provider "openidConnect" --secret "{$KEYCLOAK_SECRET}"
 #           echo '...installed.'
 #         else
 #           echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
-#           gitea admin auth update-oauth --id "${AUTH_ID}" --auto-discover-url "${KEYCLOAK_URL}/auth/realms/${REALM}/.well-known/openid-configuration" --key"${KEYCLOAK_CLIENT_ID}" --name "keycloak" --provider "openidConnect" --secret "{$KEYCLOAK_SECRET}" 
+#           gitea admin auth update-oauth --id "${AUTH_ID}" --auto-discover-url "${KEYCLOAK_URL}/auth/realms/${REALM}/.well-known/openid-configuration" --key"${KEYCLOAK_CLIENT_ID}" --name "keycloak" --provider "openidConnect" --secret "{$KEYCLOAK_SECRET}"
 #           echo '...sync settings done.'
 #         fi
 #         EOF
 
-
 ## pod 설정
 replicaCount: 1
 
@@ -103,10 +102,9 @@ persistence:
 
 ## 같은 네임스페이스에 postgresql 배포 가정
 gitea:
-  admin:   
-    username: sudouser
-    password: password
-    email: "sudouser@cro.com"
+  admin:
+    existingSecret: gitea-user-secret
+    email: "tech@paasup.io"
   config:
     APP_NAME: paasup git
     RUN_MODE: prod
@@ -131,4 +129,3 @@ gitea:
       DEFAULT_ALLOW_CREATE_ORGANIZATION: true
     repository:
       DEFAULT_BRANCH: master
-

charts/gitea/infisical-secret.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: infisicalsecret-git
+  namespace: infisical
+  labels:
+    label-to-be-passed-to-managed-secret: test-git-secret
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "test-git-secret"
+spec:
+  hostAPI: http://infisical-infisical-standalone-infisical.infisical.svc.cluster.local:8080/api
+  resyncInterval: 10
+  authentication:
+    kubernetesAuth:
+      identityId: 5ffaf885-7df2-4c75-a3a5-292a996aa3d7
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      secretsScope:
+        projectSlug: project1-9j-pp
+        envSlug: dev
+        secretsPath: "/system/gitea"
+        recursive: true
+  managedSecretReference:
+    secretName: test-git-secret
+    secretNamespace: test-git
+    creationPolicy: "Orphan" ## Owner | Orphan