feat(flux): read the cluster's GitOps state from the chain, not Codeberg #772
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/codeberg-delivery-retire"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
The cluster's GitOps state, the Forgejo seed and the recovery job now read the chain's first tier —
https://code.packet.town/sean/<repo>.git, a public push-mirror copy binjovi configures — instead of Codeberg. Nothing on the cluster writes there.GitRepository/flux-system(bothgotk-sync.yaml),platform-seanfarm,openbao-operator-source(tagv0.12.32),forgejo-operatorresource source (tagv0.6.36): URL →code.packet.town, nosecretRef.repository-bootstrap.shmigrates a seeded repository from the copy, credential-free;mirror-recovery.yamlrecoversgitea-typed sources from the copy and passes no credential; theforgejonamespacecodeberg-tokenExternalSecret is removed.flux-webhook: the four Codeberg Receivers are removed (binjovi requests every reconcile it needs).argocd: the two Codeberg repo-creds ExternalSecrets are removed (every Application sourcescode.sean.farm).scripts/flux-bootstrap.sh:flux install+ GitRepository + Kustomization against the copy, read-only and credential-free (flux bootstrap gitwould commit into it).CODEBERG_TOKENis optional; it only feeds the secret the retiring Codeberg mirrors still push with.Order
binjovi #1794 (mirror-source deployer, accepts both shapes) is in production before this merges; binjovi-plans #326 switches the two flux targets to
mirror_urlright after this deploys. Until then the deployer still pushes Codebergmain(harmless) and Flux already follows Forgejomainthrough the chain.Verified
bash tests/check.shgreen.git ls-remoteshows every referenced tag on the copies (openbao-operator v0.12.32,forgejo-operator v0.6.36);sean/seanfarmandsean/platform-seanfarmmainoncode.packet.townequal Forgejomain.Still on Codeberg after this
Container images and packages the cluster pulls (crossplane provider/function packages and image,
pipeline-tools:v8,zfs-exporter, the forgejo-operator image, the tester images) and the 43 push mirrors. Next two retirements.https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
Flux, the Forgejo seed and the recovery job all read Codeberg. They now read the first off-cluster tier of the chain, code.packet.town, a public push-mirror copy of every sean/* repository that binjovi configures and a rebuild cannot destroy. Nothing on the cluster writes there. - GitRepository flux-system (both gotk-sync.yaml copies) and platform-seanfarm: url -> https://code.packet.town/sean/<repo>.git, no secretRef. Forgejo main is the deploy pointer; binjovi's deployer waits for the copy to show the released revision and Flux fetches it. - openbao-operator-source (tag v0.12.32) and forgejo-operator resource source (tag v0.6.36): the same copies carry every tag; no secretRef. - forgejo-users/repository-bootstrap.sh seeds a repository with a source by migrating from the copy, credential-free; the codeberg-token volume and the auth fields in the migrate payload are gone. - forgejo-app/mirror-recovery.yaml recovers a gitea-typed importSource from the copy instead of Codeberg and passes no credential to the inner git. The codeberg-token ExternalSecret in namespace forgejo goes with it. - flux-webhook: the four Codeberg Receivers are removed. Nothing on Codeberg calls us any more; binjovi requests every reconcile it needs and the sources keep their interval. - argocd: the two Codeberg repo-creds ExternalSecrets are removed. Every Application sources code.sean.farm. - scripts/flux-bootstrap.sh installs Flux read-only: `flux install` plus the GitRepository and Kustomization against the copy, credential-free. `flux bootstrap git` would have committed into the copy. CODEBERG_TOKEN is optional and only feeds the codeberg-token secret the retiring Codeberg mirrors still push with. Codeberg is now neither backup nor delivery source. It still holds container images and packages the cluster pulls (crossplane, pipeline-tools v8, zfs-exporter, the forgejo-operator image, the tester images) and receives the 43 push mirrors; those are the next two retirements. Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6