45a9948682
PR #26 added the git-clone initContainer but still trusted the GIT_REPO_URL secret verbatim. That secret historically contains gitea.rogi.casa, which 526s through Cloudflare, so the clone still fails with 'Not a git repository'. Normalize the host to git.rogi.casa at runtime (sed) so the clone works regardless of the secret's stale host. Directly addresses the subdomain bug.
125 lines
4.2 KiB
YAML
125 lines
4.2 KiB
YAML
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: myorg-git-sync
|
|
namespace: myorg-assistant
|
|
labels:
|
|
app: myorg-assistant
|
|
job: git-sync
|
|
spec:
|
|
# Run every 15 minutes
|
|
schedule: "*/15 * * * *"
|
|
timeZone: "Europe/Madrid"
|
|
successfulJobsHistoryLimit: 1
|
|
failedJobsHistoryLimit: 2
|
|
concurrencyPolicy: Forbid
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: myorg-assistant
|
|
job: git-sync
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
imagePullSecrets:
|
|
- name: gitea-registry
|
|
initContainers:
|
|
- name: git-clone
|
|
image: alpine/git:latest
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
# Normalize the repo URL host to the correct Gitea subdomain.
|
|
# The GIT_REPO_URL secret historically contained gitea.rogi.casa,
|
|
# which 526s through Cloudflare; the working subdomain is git.rogi.casa.
|
|
export GIT_REPO_URL="$(echo "${GIT_REPO_URL}" | sed -E 's#https?://[^/@]+@?gitea\.rogi\.casa#https://'"${GIT_USERNAME}"':'"${GIT_TOKEN}"'@git.rogi.casa#')"
|
|
if [ ! -d /data/myorg/.git ]; then
|
|
echo "Cloning repository..."
|
|
git clone ${GIT_REPO_URL} /data/myorg
|
|
cd /data/myorg
|
|
git config user.name "${GIT_USERNAME}"
|
|
git config user.email "${GIT_USERNAME}@rogi.casa"
|
|
git config credential.helper store
|
|
echo "https://${GIT_USERNAME}:${GIT_TOKEN}@git.rogi.casa" > ~/.git-credentials
|
|
else
|
|
echo "Repository already exists, skipping clone."
|
|
fi
|
|
env:
|
|
- name: GIT_REPO_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: GIT_REPO_URL
|
|
- name: GIT_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: GIT_USERNAME
|
|
- name: GIT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: GIT_TOKEN
|
|
volumeMounts:
|
|
- name: myorg-data
|
|
mountPath: /data/myorg
|
|
containers:
|
|
- name: git-sync
|
|
image: git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
|
|
imagePullPolicy: Always
|
|
command:
|
|
- python
|
|
- -c
|
|
- "from src.scheduler.jobs import run_job; import sys; run_job(sys.argv[1])"
|
|
- git-sync
|
|
env:
|
|
- name: MYORG_REPO_PATH
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: myorg-assistant-config
|
|
key: MYORG_REPO_PATH
|
|
- name: GIT_BRANCH
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: myorg-assistant-config
|
|
key: GIT_BRANCH
|
|
- name: GIT_REPO_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: GIT_REPO_URL
|
|
- name: GIT_USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: GIT_USERNAME
|
|
- name: GIT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: GIT_TOKEN
|
|
- name: DISCORD_BOT_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: DISCORD_BOT_TOKEN
|
|
- name: LITELLM_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: LITELLM_API_KEY
|
|
- name: WEB_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: myorg-assistant-secret
|
|
key: WEB_SECRET_KEY
|
|
volumeMounts:
|
|
- name: myorg-data
|
|
mountPath: /data/myorg
|
|
volumes:
|
|
- name: myorg-data
|
|
persistentVolumeClaim:
|
|
claimName: myorg-assistant-pvc
|