chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(gitea): read Helm admin credentials from Deployment env vars, not secret

Browse Source 
The Gitea Helm chart (gitea-12.5.3) stores GITEA_ADMIN_USERNAME and
GITEA_ADMIN_PASSWORD as plain values in the configure-gitea init container
spec — not in a k8s Secret with key 'admin-password'.  The previous code
looked for a non-existent secretKeyRef and returned empty, causing the
REST API bootstrap path to fail.

Now reads credentials via:
  kubectl get deployment gitea ... env[?(@.name=="GITEA_ADMIN_PASSWORD")].value

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-05-09 19:14:21 -07:00
parent 5fba20b651
commit 6de7218ec7
1 changed files with 24 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
etc/init_knoe_users.sh
View File

@ -898,22 +898,34 @@ gitea_api_token() {
}
# gitea_helm_admin_token [token_name]
# Reads the Helm bootstrap admin password from the k8s secret created by the
# Gitea Helm chart ({release}-gitea, key admin-password) and exchanges it for
# a REST API token. This works even when the gitea admin CLI is broken (e.g.
# wrong DB hostname in app.ini) because the request goes through the running
# web server which has the correct GITEA__database__HOST env var.
# Reads the Helm bootstrap admin credentials from the Gitea Deployment's
# configure-gitea init container environment variables (GITEA_ADMIN_USERNAME /
# GITEA_ADMIN_PASSWORD). The Helm chart stores these as plain values in the
# pod spec — there is no k8s Secret holding the admin password.
#
# This works even when the gitea admin CLI is broken (e.g. wrong DB hostname
# in app.ini) because the request goes through the running web server which
# has the correct GITEA__database__HOST env var.
# Prints the token sha1 to stdout; returns 1 on failure.
gitea_helm_admin_token() {
local token_name="${1:-knoe-installer-helm}"
local secret="${GITEA_HELM_RELEASE:-gitea}"
local admin_user="${GITEA_HELM_ADMIN_USER:-gitea_admin}"
local release="${GITEA_HELM_RELEASE:-gitea}"
local admin_pw
admin_pw=$(kubectl -n "$GITEA_NAMESPACE" get secret "$secret" \
-o jsonpath='{.data.admin-password}' 2>/dev/null | b64_decode || true)
if [[ -z "$admin_pw" ]]; then
warn " Gitea: Helm admin secret '${secret}' not found or empty in namespace ${GITEA_NAMESPACE}"
# Extract credentials from the configure-gitea init container env block.
# The Helm chart renders them as plain values (not secretKeyRefs).
local admin_user admin_pw
admin_user=$(kubectl -n "$GITEA_NAMESPACE" get deployment "$release" \
-o jsonpath='{.spec.template.spec.initContainers[?(@.name=="configure-gitea")].env[?(@.name=="GITEA_ADMIN_USERNAME")].value}' \
2>/dev/null || true)
admin_pw=$(kubectl -n "$GITEA_NAMESPACE" get deployment "$release" \
-o jsonpath='{.spec.template.spec.initContainers[?(@.name=="configure-gitea")].env[?(@.name=="GITEA_ADMIN_PASSWORD")].value}' \
2>/dev/null || true)
# Fall back to env-var override (useful for testing / manual bootstrap)
admin_user="${GITEA_HELM_ADMIN_USER:-${admin_user}}"
if [[ -z "$admin_user" || -z "$admin_pw" ]]; then
warn " Gitea: could not read Helm admin credentials from Deployment '${release}' (namespace ${GITEA_NAMESPACE})"
return 1
fi