feat(gitea): refactor configuration to use structured app_config and add TLS support

2025-05-09 22:21:33 +02:00
parent 9de7d52192
commit 17a54f6792
13 changed files with 487 additions and 206 deletions
@@ -0,0 +1,46 @@
+resource "kubernetes_role" "gitea_ssh_access" {
+  metadata {
+    name      = "gitea-ssh-access"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["pods", "pods/log"]
+    verbs      = ["get", "list"]
+  }
+  rule {
+    api_groups = [""]
+    resources  = ["pods/exec"]
+    verbs      = ["create"]
+  }
+}
+
+resource "kubernetes_role_binding" "gitea_ssh_access" {
+  metadata {
+    name      = "gitea-ssh-access"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role.gitea_ssh_access.metadata[0].name
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = kubernetes_service_account.gitea_service_account.metadata[0].name
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+}
+
+resource "kubernetes_secret" "gitea_access_token" {
+  metadata {
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name
+    }
+    name      = "git-token"
+    namespace = kubernetes_namespace.gitea.metadata[0].name
+  }
+
+  type                           = "kubernetes.io/service-account-token"
+  wait_for_service_account_token = true
+}