Merge branch 'feature/git/gitea' into develop

Author: codejsha

git/gitea/all.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+trap 'echo "${BASH_SOURCE[0]}: line ${LINENO}: status ${?}: user ${USER}: func ${FUNCNAME[0]}"' ERR
+set -o errexit
+set -o errtrace
+
+export VAULT_ADDR="https://vault.example.com"
+export VAULT_TOKEN="$(cat ${HOME}/.vault/root_token.txt)"
+export VAULT_CACERT="${HOME}/.vault/ca.crt"
+
+cd helm
+./helm-install-gitea.sh
+cd ..
+
+kubectl apply --filename gitea-namespace.yaml
+
+cd istio
+kubectl apply --filename gitea-traffic-management.yaml
+cd ..
+
+cd vault
+bash ./create-kubernetes-role.sh
+bash ./create-pki-role.sh
+kubectl apply --filename issuer-serviceaccount.yaml
+bash ./create-issuer.sh
+kubectl apply --filename gitea-certificate.yaml
+cd ..

git/gitea/gitea-namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+  labels:
+    istio-injection: enabled

git/gitea/vault/create-issuer.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+trap 'echo "${BASH_SOURCE[0]}: line ${LINENO}: status ${?}: user ${USER}: func ${FUNCNAME[0]}"' ERR
+set -o errexit
+set -o errtrace
+
+NAMESPACE="gitea"
+
+export GITEA_ISSUER_SECRET_REF="$(kubectl get secrets --namespace ${NAMESPACE} --output=json | jq -r '.items[].metadata | select(.name|startswith("gitea-issuer-secret")).name')"
+export BASE64_ENCODED_CABUNDLE="$(kubectl get secrets vault-ha-tls --namespace vault --output jsonpath='{.data.kubernetes-ca\.crt}')"
+
+envsubst < ./issuer.yaml > ./issuer-temp.yaml
+kubectl apply --namespace ${NAMESPACE} --filename ./issuer-temp.yaml

git/gitea/vault/issuer-serviceaccount.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: gitea-issuer
+  namespace: gitea
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-issuer-secret
+  namespace: gitea
+  annotations:
+    kubernetes.io/service-account.name: gitea-issuer
+type: kubernetes.io/service-account-token

git/gitea/vault/vault-issuer.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: gitea-issuer
+spec:
+  vault:
+    server: http://my-vault.vault.svc.cluster.local:8200
+    path: pki/sign/gitea
+    auth:
+      kubernetes:
+        mountPath: /v1/auth/kubernetes
+        role: gitea-issuer
+        secretRef:
+          name: ${GITEA_ISSUER_SECRET_REF}
+          key: token