Add Kubernetes and Argo CD deployment manifests

.gitea/workflows/publish.yml

@@ -6,7 +6,7 @@ on:
       - "v*.*.*"
 
 env:
-  REGISTRY: git.mancheff.com
+  REGISTRY: 192.168.0.86:3000
   IMAGE_NAME: hiyv-demo/hiyv-nginx
 
 jobs:
@@ -38,15 +38,23 @@ jobs:
             echo "tags=${image}:${version},${image}:${major_minor},${image}:${major},${image}:${GITHUB_SHA},${image}:latest"
           } >> "${GITHUB_OUTPUT}"
 
-      - name: Log in to the Gitea registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
+      - name: Configure Gitea registry credentials
+        shell: bash
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          mkdir -p "${HOME}/.docker"
+          auth="$(printf '%s:%s' "${REGISTRY_USERNAME}" "${REGISTRY_TOKEN}" | base64 | tr -d '\n')"
+          printf '{"auths":{"%s":{"auth":"%s"}}}\n' "${REGISTRY}" "${auth}" > "${HOME}/.docker/config.json"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-config-inline: |
+            [registry."192.168.0.86:3000"]
+              http = true
+              insecure = true
 
       - name: Build and publish
         uses: docker/build-push-action@v6
@@ -55,9 +63,10 @@ jobs:
           push: true
           build-args: |
             COMMIT_ID=${{ github.sha }}
+            NGINX_BASE=${{ env.REGISTRY }}/hiyv-demo/nginx-base:1.28-alpine-amd64
           tags: ${{ steps.tags.outputs.tags }}
           labels: |
             org.opencontainers.image.version=${{ steps.tags.outputs.version }}
             org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.source=https://git.mancheff.com/${{ github.repository }}
           platforms: linux/amd64

Dockerfile

@@ -1,4 +1,5 @@
-FROM nginx:1.28-alpine
+ARG NGINX_BASE=git.mancheff.com/hiyv-demo/nginx-base:1.28-alpine-amd64
+FROM ${NGINX_BASE}
 
 ARG COMMIT_ID=unknown
 

README.md

@@ -6,7 +6,7 @@ Git commit used to build the published container.
 ## Run it
 
 ```sh
-docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.1
+docker run --rm -p 8080:80 git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.3
 ```
 
 Open <http://localhost:8080>. The health endpoint is available at
@@ -32,6 +32,10 @@ The Gitea Actions workflow publishes the following tags for `v1.2.3`:
 The workflow publishes `linux/amd64` images to
 `git.mancheff.com/hiyv-demo/hiyv-nginx`.
 
+The pinned upstream nginx base is mirrored at
+`git.mancheff.com/hiyv-demo/nginx-base:1.28-alpine-amd64` so the self-hosted
+runner does not depend on Docker Hub connectivity during releases.
+
 The repository must define two Actions secrets: `REGISTRY_USERNAME` with the
 Gitea username and `REGISTRY_TOKEN` with a personal access token that has
 package write access. Gitea's automatic job token cannot currently publish OCI
@@ -42,3 +46,31 @@ packages.
 ```sh
 docker build --build-arg COMMIT_ID="$(git rev-parse HEAD)" -t hiyv-nginx:local .
 ```
+
+## Deploy with Argo CD
+
+The Kubernetes manifests in `k8s/` deploy two HIYV replicas and expose them
+through a cluster-internal Service. They use the public Gitea image directly;
+no `imagePullSecrets` are required.
+
+The repository URL is deliberately not hard-coded. Set `HIYV_GIT_REPO` to the
+public Git repository that contains these manifests, make sure the Argo CD CLI
+is authenticated, and run:
+
+```sh
+export HIYV_GIT_REPO='<public Git repository URL>'
+./scripts/create-argocd-application.sh
+```
+
+If `HIYV_GIT_REPO` is unset, the script explains what is missing and exits
+without changing Argo CD. When it is set, the script creates or updates the
+`hiyv` Application with automated sync, pruning, self-healing, and namespace
+creation enabled.
+
+Optional configuration:
+
+- `HIYV_GIT_REVISION` (default: `main`)
+- `HIYV_MANIFEST_PATH` (default: `k8s`)
+- `HIYV_ARGOCD_APP_NAME` (default: `hiyv`)
+- `HIYV_DESTINATION_SERVER` (default: in-cluster Kubernetes API)
+- `HIYV_DESTINATION_NAMESPACE` (default: `hiyv`)

k8s/deployment.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hiyv
+  namespace: hiyv
+  labels:
+    app.kubernetes.io/name: hiyv
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hiyv
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hiyv
+    spec:
+      containers:
+        - name: hiyv
+          image: git.mancheff.com/hiyv-demo/hiyv-nginx:1.0.3
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 250m
+              memory: 128Mi

k8s/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml

k8s/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hiyv
+  labels:
+    app.kubernetes.io/name: hiyv

k8s/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hiyv
+  namespace: hiyv
+  labels:
+    app.kubernetes.io/name: hiyv
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: hiyv
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP

scripts/create-argocd-application.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ -z "${HIYV_GIT_REPO:-}" ]]; then
+  cat <<'EOF'
+HIYV_GIT_REPO is not set, so no Argo CD Application was created.
+
+Set it to the public Git repository containing the Kubernetes manifests, then
+run this script again. For example:
+
+  export HIYV_GIT_REPO='<public Git repository URL>'
+  ./scripts/create-argocd-application.sh
+EOF
+  exit 0
+fi
+
+if ! command -v argocd >/dev/null 2>&1; then
+  echo "The argocd CLI is required and must be available in PATH." >&2
+  exit 1
+fi
+
+app_name="${HIYV_ARGOCD_APP_NAME:-hiyv}"
+revision="${HIYV_GIT_REVISION:-main}"
+manifest_path="${HIYV_MANIFEST_PATH:-k8s}"
+destination_server="${HIYV_DESTINATION_SERVER:-https://kubernetes.default.svc}"
+destination_namespace="${HIYV_DESTINATION_NAMESPACE:-hiyv}"
+
+argocd app create "${app_name}" \
+  --upsert \
+  --repo "${HIYV_GIT_REPO}" \
+  --revision "${revision}" \
+  --path "${manifest_path}" \
+  --dest-server "${destination_server}" \
+  --dest-namespace "${destination_namespace}" \
+  --sync-policy automated \
+  --auto-prune \
+  --self-heal \
+  --sync-option CreateNamespace=true
+
+echo "Argo CD Application '${app_name}' now tracks ${HIYV_GIT_REPO}@${revision}:${manifest_path}."