ae8d6a6cf3
This is using haproxy-ingress to support forwarding SSH on port 22 Since we're using cert-manager with ingress to get Let's Encrypt certs, we're not using the Let's Encrypt functionality that's part of Gitea. To run this we need to change the config file, have Gitea run on port 3000 as HTTP and disable all the Let's Encrypt config keys. Currently the gitea-ingress.yaml uses the letsencrypt-staging ClusterIssuer This has been tested on a local Kubernetes cluster using Docker for Mac
112 lines
2.8 KiB
YAML
112 lines
2.8 KiB
YAML
apiVersion: extensions/v1beta1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-server
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
name: gitea-server
|
|
app: gitea
|
|
spec:
|
|
initContainers:
|
|
- name: init-config
|
|
# This is a busybox image with our gitea customizations saved to
|
|
# /custom, built using ./script/build_customizations_image from the
|
|
# root of the repo
|
|
image: eu.gcr.io/fluted-magpie-218106/gitea_custom:0.1
|
|
command: [
|
|
'sh', '-c',
|
|
'mkdir -p /data/gitea/conf && mkdir -p /data/gitea/https && cp /root/conf/app.ini /data/gitea/conf/app.ini && chown 1000:1000 /data/gitea/conf/app.ini && chmod 660 /data/gitea/conf/app.ini && cp /root/conf/*.pem /data/gitea/https && chmod 600 /data/gitea/https/*.pem && cp -R /custom/* /data/gitea && chown -R 1000:1000 /data/gitea'
|
|
]
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: gitea-server-data
|
|
- mountPath: /root/conf
|
|
name: config
|
|
containers:
|
|
- name: gitea-server
|
|
image: gitea/gitea:1.8.1
|
|
ports:
|
|
- containerPort: 3000
|
|
- containerPort: 22
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
scheme: HTTP
|
|
initialDelaySeconds: 30
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 3000
|
|
scheme: HTTP
|
|
initialDelaySeconds: 30
|
|
timeoutSeconds: 5
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: gitea-server-data
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: gitea-server-data
|
|
persistentVolumeClaim:
|
|
claimName: gitea-server-data
|
|
- name: config
|
|
secret:
|
|
secretName: gitea-config
|
|
items:
|
|
- key: app.ini
|
|
path: app.ini
|
|
mode: 256
|
|
- key: cert.pem
|
|
path: cert.pem
|
|
mode: 256
|
|
- key: key.pem
|
|
path: key.pem
|
|
mode: 256
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: gitea-server-data
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-server
|
|
labels:
|
|
name: gitea-server
|
|
app: gitea
|
|
spec:
|
|
type: LoadBalancer
|
|
# preserves the client source IP
|
|
externalTrafficPolicy: Local
|
|
ports:
|
|
- name: "ssh"
|
|
port: 22
|
|
targetPort: 22
|
|
- name: "http"
|
|
port: 80
|
|
targetPort: 3000
|
|
selector:
|
|
name: gitea-server
|