ad3637303f
- gitea-push eventsource (:12000/push) + gitea-deploy sensor (filter ref main/master -> submit fxhnt-cockpit, commit-sha from body.after). Pods NOT part-of:foxhunt (stay default-allow, matching working workflow-trigger pattern). - gitea netpol: egress 12000 namespace-wide (eventsource not part-of -> can't target by label) - gitea values: webhook.ALLOWED_HOST_LIST=private (Gitea blocked delivery to in-cluster 10.32.x) Verified: push to fxhnt master auto-fires a cockpit build+deploy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
866 B
YAML
29 lines
866 B
YAML
# Gitea push webhook → Argo Events. Replaces the old gitlab-push eventsource (Phase 2B).
|
|
# Gitea posts to gitea-push-eventsource-svc:12000/push on push to the fxhnt repo.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: EventSource
|
|
metadata:
|
|
name: gitea-push
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/name: gitea-push
|
|
app.kubernetes.io/part-of: foxhunt
|
|
spec:
|
|
template:
|
|
# NOTE: pod is intentionally NOT part-of:foxhunt — that label triggers default-deny-all. The working
|
|
# workflow-trigger/gitlab-push eventsource pods have no part-of, so they stay default-allow.
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: gitea-push
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: platform
|
|
service:
|
|
ports:
|
|
- port: 12000
|
|
targetPort: 12000
|
|
webhook:
|
|
push:
|
|
port: "12000"
|
|
endpoint: /push
|
|
method: POST
|