Add new infra architecture 9

infrastructure/cicd/gitea/setup-admin-secret.sh

@@ -1,8 +1,11 @@
 #!/bin/bash
 # Setup Gitea Admin Secret
 #
-# This script creates the Kubernetes secret required for Gitea admin credentials.
-# Run this BEFORE installing Gitea with Helm.
+# This script creates TWO Kubernetes secrets:
+# 1. gitea-admin-secret (gitea namespace) - Used by Gitea Helm chart for admin credentials
+# 2. gitea-registry-secret (bakery-ia namespace) - Used by pods for imagePullSecrets
+#
+# Both secrets use the SAME credentials, ensuring consistency.
 #
 # Usage:
 #   ./setup-admin-secret.sh [password]
@@ -12,7 +15,10 @@
 set -e
 
 KUBECTL="kubectl"
-NAMESPACE="gitea"
+GITEA_NAMESPACE="gitea"
+BAKERY_NAMESPACE="bakery-ia"
+REGISTRY_HOST="registry.bakery-ia.local"
+ADMIN_USERNAME="bakery-admin"
 
 # Check if running in microk8s
 if command -v microk8s &> /dev/null; then
@@ -27,22 +33,73 @@ else
     echo "Generated admin password: $ADMIN_PASSWORD"
 fi
 
-# Create namespace if it doesn't exist
-$KUBECTL create namespace "$NAMESPACE" --dry-run=client -o yaml | $KUBECTL apply -f -
+# Create namespaces if they don't exist
+$KUBECTL create namespace "$GITEA_NAMESPACE" --dry-run=client -o yaml | $KUBECTL apply -f -
+$KUBECTL create namespace "$BAKERY_NAMESPACE" --dry-run=client -o yaml | $KUBECTL apply -f -
 
-# Create the secret
+# 1. Create gitea-admin-secret for Gitea Helm chart
+echo "Creating gitea-admin-secret in $GITEA_NAMESPACE namespace..."
 $KUBECTL create secret generic gitea-admin-secret \
-    --namespace "$NAMESPACE" \
-    --from-literal=username=bakery-admin \
+    --namespace "$GITEA_NAMESPACE" \
+    --from-literal=username="$ADMIN_USERNAME" \
     --from-literal=password="$ADMIN_PASSWORD" \
     --dry-run=client -o yaml | $KUBECTL apply -f -
 
+# 2. Create gitea-registry-secret for imagePullSecrets
+echo "Creating gitea-registry-secret in $BAKERY_NAMESPACE namespace..."
+
+# Create Docker config JSON for registry authentication
+AUTH_BASE64=$(echo -n "${ADMIN_USERNAME}:${ADMIN_PASSWORD}" | base64)
+DOCKER_CONFIG_JSON=$(cat <<EOF
+{
+  "auths": {
+    "${REGISTRY_HOST}": {
+      "username": "${ADMIN_USERNAME}",
+      "password": "${ADMIN_PASSWORD}",
+      "auth": "${AUTH_BASE64}"
+    }
+  }
+}
+EOF
+)
+
+# Base64 encode the entire config (use -w0 on Linux, no flag needed on macOS)
+if [[ "$OSTYPE" == "darwin"* ]]; then
+    DOCKER_CONFIG_BASE64=$(echo -n "$DOCKER_CONFIG_JSON" | base64)
+else
+    DOCKER_CONFIG_BASE64=$(echo -n "$DOCKER_CONFIG_JSON" | base64 -w0)
+fi
+
+# Create the registry secret
+cat <<EOF | $KUBECTL apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-registry-secret
+  namespace: ${BAKERY_NAMESPACE}
+  labels:
+    app.kubernetes.io/name: bakery-ia
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/managed-by: setup-admin-secret
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: ${DOCKER_CONFIG_BASE64}
+EOF
+
 echo ""
-echo "Gitea admin secret created successfully!"
+echo "=========================================="
+echo "Gitea secrets created successfully!"
+echo "=========================================="
 echo ""
-echo "Admin credentials:"
-echo "  Username: bakery-admin"
+echo "Credentials (same for both secrets):"
+echo "  Username: $ADMIN_USERNAME"
 echo "  Password: $ADMIN_PASSWORD"
 echo ""
+echo "Secrets created:"
+echo "  1. gitea-admin-secret      (namespace: $GITEA_NAMESPACE)  - For Gitea Helm chart"
+echo "  2. gitea-registry-secret   (namespace: $BAKERY_NAMESPACE) - For imagePullSecrets"
+echo ""
+echo "Registry URL: https://$REGISTRY_HOST"
+echo ""
 echo "Now install Gitea with:"
 echo "  helm install gitea gitea/gitea -n gitea -f infrastructure/cicd/gitea/values.yaml"