5 Commits

Author SHA1 Message Date
XoR
bea103a280 fix(test-env): replace Job with initContainer for runner registration
Problem: Job ran on every ArgoCD sync, creating duplicate runners in Gitea.
Solution:
- initContainer gets token + saves to PVC (/data/.registration-token)
- Runner container registers once, persists .runner file in PVC
- Subsequent restarts skip registration (idempotent)
- PVC runner-data (1Gi) persists registration across pod restarts
- Removed register-job.yaml, moved RBAC to rbac.yaml
- Runner waits for DinD before starting
- Stable runner name: test-env-runner
- Labels: edt + ubuntu-latest
2026-03-12 13:29:36 +03:00
XoR
8e06e8a78d fix(test-env): make PG entrypoint idempotent for PVC reuse
Image entrypoint uses set -e + CREATE USER without IF NOT EXISTS.
On PVC reuse the role already exists → entrypoint exits with code 1.
Patch: sed replaces CREATE USER with IF NOT EXISTS variant at startup.
2026-03-12 13:19:23 +03:00
XoR
77d400a562 fix(test-env): remove namespace from kustomization (ArgoCD conflict)
Namespace test-env is shared between test-env and kargo-test-env-pipeline apps.
Having namespace.yaml in both causes ArgoCD OutOfSync conflict.
ArgoCD creates the namespace via syncOptions.CreateNamespace.
2026-03-12 12:37:49 +03:00
Dear XoR
efb2427586 feat(test-env): add 1C test environment (#11)
* feat(test-env): add 1C test environment manifests (#11)

- PostgreSQL 18.x-2.1C StatefulSet with ru_RU.UTF-8 locale init
- 1C server (ragent+crserver+ras) StatefulSet with stable hostname
- Gitea runner Deployment with edt label for apk-ci-ng
- NodePort services for external 1C access (31540-31545)
- Deploy/verify script: dev/deploy-test-env.sh
- config.yaml for ApplicationSet integration
- test-env only in dev cluster (not in prod AppSet)

* fix(test-env): use initContainer for PG data + remove custom entrypoint

PVC mount on /var/lib/postgresql wipes the image's pre-built cluster.
Solution: initContainer copies cluster data from image to PVC on first run.
Removed custom pg-entrypoint.sh ConfigMap — image has its own.

* feat(test-env): DinD sidecar for runner + auto-registration Job

- Add Docker-in-Docker sidecar to gitea-runner Deployment
- Add register-job.yaml: Job that obtains Gitea runner token via API,
  creates Secret, and scales runner to 1
- RBAC: ServiceAccount + Role/ClusterRole for cross-namespace secret access
- Runner labels: edt (for apk-ci-ng), ubuntu-latest

---------

Co-authored-by: XoR <xor@benadis.ru>
2026-03-12 12:33:50 +03:00
XoR
4dd68859d8 feat: SOPS + age encrypted secrets structure
- .sops.yaml with 3 age keys (admin, dev, prod)
- infra/gitea/values/*.enc.yaml — per-env encrypted Helm values
- infra/kargo/values/*.enc.yaml — per-env encrypted Kargo admin secrets
- kargo/credentials/*.enc.yaml — per-env encrypted git credentials (ksops)
- infra/kargo-credentials/ — ArgoCD app for deploying Kargo creds via ksops
- All repoURLs point to deploy-app-kargo-private

Structure from deploy-app-kargo (reference), adapted for SOPS workflow
2026-03-11 10:01:26 +03:00