Initial commit - production deployment

2026-01-21 17:17:16 +01:00
commit c23d00dd92
2289 changed files with 638440 additions and 0 deletions
--- a/infrastructure/cicd/gitea/IMPLEMENTATION_SUMMARY.md
+++ b/infrastructure/cicd/gitea/IMPLEMENTATION_SUMMARY.md
@@ -0,0 +1,151 @@
+# Gitea Automatic Repository Creation - Implementation Summary
+
+## Overview
+
+This implementation adds automatic repository creation to the Gitea Helm chart configuration for the Bakery-IA project. When Gitea is installed or upgraded via Helm, it will automatically create a `bakery-ia` repository with the specified configuration.
+
+## Changes Made
+
+### 1. Updated Helm Values (`values.yaml`)
+
+Added the `initialRepositories` configuration under the `gitea:` section:
+
+```yaml
+# Initial repositories to create automatically after Gitea installation
+# These will be created with the admin user as owner
+gitea:
+  initialRepositories:
+    - name: bakery-ia
+      description: "Main repository for Bakery IA project - Automatically created by Helm"
+      private: false
+      auto_init: true
+      default_branch: main
+      owner: "{{ .Values.gitea.admin.username }}"
+      # Enable issues, wiki, and other features
+      enable_issues: true
+      enable_wiki: true
+      enable_pull_requests: true
+      enable_projects: true
+```
+
+### 2. Created Setup Script (`setup-gitea-repository.sh`)
+
+A comprehensive bash script that:
+- Checks if Gitea is accessible
+- Verifies if the repository exists (creates it if not)
+- Configures the local Git repository
+- Pushes the existing code to the new Gitea repository
+
+### 3. Created Test Script (`test-repository-creation.sh`)
+
+A test script that verifies:
+- Gitea accessibility
+- Repository existence
+- Repository configuration (issues, wiki, pull requests)
+- Provides detailed repository information
+
+### 4. Created Documentation
+
+- **README.md**: Complete guide on installation, usage, and troubleshooting
+- **IMPLEMENTATION_SUMMARY.md**: This file, summarizing the implementation
+
+## How It Works
+
+### Automatic Repository Creation Flow
+
+1. **Helm Installation**: When `helm install` or `helm upgrade` is executed with the updated values
+2. **Gitea Initialization**: Gitea starts and creates the admin user
+3. **Repository Creation**: Gitea processes the `initialRepositories` configuration and creates the specified repositories
+4. **Completion**: The repository is ready for use immediately after Gitea is fully initialized
+
+### Key Features
+
+- **Automatic**: No manual intervention required after Helm installation
+- **Idempotent**: Safe to run multiple times (won't duplicate repositories)
+- **Configurable**: All repository settings are defined in Helm values
+- **Integrated**: Uses native Gitea Helm chart features
+
+## Usage
+
+### Installation
+
+```bash
+# Install Gitea with automatic repository creation
+helm install gitea gitea/gitea -n gitea \
+  -f infrastructure/cicd/gitea/values.yaml \
+  --set gitea.admin.password=your-secure-password
+```
+
+### Push Existing Code
+
+```bash
+export GITEA_ADMIN_PASSWORD="your-secure-password"
+./infrastructure/cicd/gitea/setup-gitea-repository.sh
+```
+
+### Verify Repository
+
+```bash
+export GITEA_ADMIN_PASSWORD="your-secure-password"
+./infrastructure/cicd/gitea/test-repository-creation.sh
+```
+
+## Repository Configuration
+
+The automatically created repository includes:
+
+| Feature | Enabled | Description |
+|---------|---------|-------------|
+| Name | bakery-ia | Main project repository |
+| Description | Main repository for Bakery IA project | Clear identification |
+| Visibility | Public | Accessible without authentication |
+| Auto Init | Yes | Creates initial README.md |
+| Default Branch | main | Standard branch naming |
+| Issues | Yes | Bug and feature tracking |
+| Wiki | Yes | Project documentation |
+| Pull Requests | Yes | Code review workflow |
+| Projects | Yes | Project management |
+
+## CI/CD Integration
+
+The repository is ready for immediate CI/CD integration:
+
+- **Repository URL**: `https://gitea.bakery-ia.local/bakery-admin/bakery-ia.git`
+- **Clone URL**: `https://gitea.bakery-ia.local/bakery-admin/bakery-ia.git`
+- **SSH URL**: `git@gitea.bakery-ia.local:bakery-admin/bakery-ia.git`
+
+## Benefits
+
+1. **Automation**: Eliminates manual repository creation step
+2. **Consistency**: Ensures all environments have the same repository structure
+3. **Reliability**: Uses Helm's declarative configuration management
+4. **Documentation**: Clear repository purpose and features
+5. **CI/CD Ready**: Repository is immediately available for pipeline configuration
+
+## Troubleshooting
+
+### Repository Not Created
+
+1. **Check Helm Values**: Ensure the `initialRepositories` section is correctly formatted
+2. **Verify Gitea Logs**: `kubectl logs -n gitea -l app.kubernetes.io/name=gitea`
+3. **Manual Creation**: Use the setup script to create the repository manually
+
+### Authentication Issues
+
+1. **Verify Password**: Ensure `GITEA_ADMIN_PASSWORD` is correct
+2. **Check Accessibility**: Confirm Gitea service is running and accessible
+3. **Network Configuration**: Verify ingress and DNS settings
+
+## Future Enhancements
+
+Potential improvements for future iterations:
+
+1. **Multiple Repositories**: Add more repositories for different components
+2. **Webhooks**: Automatically configure webhooks for CI/CD triggers
+3. **Teams and Permissions**: Set up teams and access controls
+4. **Template Repositories**: Create repository templates with standard files
+5. **Backup Configuration**: Add automatic backup configuration
+
+## Conclusion
+
+This implementation provides a robust, automated solution for Gitea repository creation in the Bakery-IA project. It leverages Helm's native capabilities to ensure consistent, reliable repository setup across all environments.
--- a/infrastructure/cicd/gitea/README.md
+++ b/infrastructure/cicd/gitea/README.md
@@ -0,0 +1,188 @@
+# Gitea Configuration for Bakery-IA CI/CD
+
+This directory contains the Helm values and scripts for setting up Gitea as the Git server for the Bakery-IA project.
+
+## Features
+
+- **Automatic Admin User**: Admin user is created automatically from Kubernetes secret
+- **Automatic Repository Creation**: The `bakery-ia` repository is created via a Kubernetes Job after Gitea starts
+- **Registry Support**: Container registry enabled for storing Docker images
+- **Tekton Integration**: Webhook automatically configured if Tekton is installed
+
+## Quick Start
+
+### Development
+
+```bash
+# 1. Setup secrets and init job (uses default dev password)
+./infrastructure/cicd/gitea/setup-admin-secret.sh
+
+# 2. Install Gitea
+helm repo add gitea https://dl.gitea.io/charts
+helm install gitea gitea/gitea -n gitea -f infrastructure/cicd/gitea/values.yaml
+
+# 3. Wait for everything to be ready
+kubectl wait --for=condition=ready pod -n gitea -l app.kubernetes.io/name=gitea --timeout=300s
+
+# 4. Check init job completed
+kubectl logs -n gitea -l app.kubernetes.io/component=init --tail=50
+```
+
+### Production
+
+```bash
+# 1. Generate and export secure password
+export GITEA_ADMIN_PASSWORD=$(openssl rand -base64 32)
+
+# 2. Setup secrets with production flag (requires GITEA_ADMIN_PASSWORD)
+./infrastructure/cicd/gitea/setup-admin-secret.sh --production
+
+# 3. Install Gitea with production values
+helm repo add gitea https://dl.gitea.io/charts
+helm upgrade --install gitea gitea/gitea -n gitea \
+  -f infrastructure/cicd/gitea/values.yaml \
+  -f infrastructure/cicd/gitea/values-prod.yaml
+
+# 4. Wait for everything to be ready
+kubectl wait --for=condition=ready pod -n gitea -l app.kubernetes.io/name=gitea --timeout=300s
+
+# 5. Install Tekton CI/CD (see tekton-helm/README.md for details)
+export TEKTON_WEBHOOK_TOKEN=$(openssl rand -hex 32)
+helm upgrade --install tekton-cicd infrastructure/cicd/tekton-helm \
+  -n tekton-pipelines \
+  -f infrastructure/cicd/tekton-helm/values.yaml \
+  -f infrastructure/cicd/tekton-helm/values-prod.yaml \
+  --set secrets.webhook.token=$TEKTON_WEBHOOK_TOKEN \
+  --set secrets.registry.password=$GITEA_ADMIN_PASSWORD \
+  --set secrets.git.password=$GITEA_ADMIN_PASSWORD
+```
+
+## Files
+
+| File | Description |
+|------|-------------|
+| `values.yaml` | Helm values for Gitea chart |
+| `values-prod.yaml` | Production Helm values |
+| `setup-admin-secret.sh` | Creates secrets and applies init job |
+| `gitea-init-job.yaml` | Kubernetes Job to create initial repository |
+| `setup-gitea-repository.sh` | Helper to push local code to Gitea |
+
+## How It Works
+
+### 1. Admin User Initialization
+
+The Gitea Helm chart automatically creates the admin user on first install. Credentials are read from a Kubernetes secret:
+
+```yaml
+gitea:
+  admin:
+    username: bakery-admin
+    email: admin@bakery-ia.local
+    existingSecret: gitea-admin-secret  # Secret with username/password keys
+    passwordMode: keepUpdated           # Sync password changes from secret
+```
+
+The `setup-admin-secret.sh` script creates this secret before Helm install.
+
+### 2. Repository Initialization
+
+Since the Gitea Helm chart doesn't support automatic repository creation, we use a Kubernetes Job (`gitea-init-job.yaml`) that:
+
+1. Waits for Gitea to be ready
+2. Creates the `bakery-ia` repository via Gitea API
+3. Optionally configures a webhook for Tekton CI/CD
+
+The Job is idempotent - it skips creation if the repository already exists.
+
+## Detailed Installation
+
+### Step 1: Create Secrets
+
+```bash
+# Using default password (for dev environments)
+./infrastructure/cicd/gitea/setup-admin-secret.sh
+
+# Or specify a custom password
+./infrastructure/cicd/gitea/setup-admin-secret.sh "your-secure-password"
+
+# Or use environment variable
+export GITEA_ADMIN_PASSWORD="your-secure-password"
+./infrastructure/cicd/gitea/setup-admin-secret.sh
+```
+
+This creates:
+- `gitea-admin-secret` in `gitea` namespace - used by Gitea for admin credentials
+- `gitea-registry-secret` in `bakery-ia` namespace - used for `imagePullSecrets`
+- Applies `gitea-init-job.yaml` (ConfigMap + Job)
+
+### Step 2: Install Gitea
+
+```bash
+helm repo add gitea https://dl.gitea.io/charts
+helm repo update
+
+helm install gitea gitea/gitea -n gitea \
+  -f infrastructure/cicd/gitea/values.yaml
+```
+
+### Step 3: Verify Installation
+
+```bash
+# Wait for Gitea pod
+kubectl wait --for=condition=ready pod -n gitea -l app.kubernetes.io/name=gitea --timeout=300s
+
+# Check init job logs
+kubectl logs -n gitea job/gitea-init-repo
+
+# Verify repository was created
+curl -u bakery-admin:pvYUkGWJijqc0QfIZEXw \
+  https://gitea.bakery-ia.local/api/v1/repos/bakery-admin/bakery-ia
+```
+
+## CI/CD Integration
+
+Repository URL:
+```
+https://gitea.bakery-ia.local/bakery-admin/bakery-ia.git
+```
+
+Internal cluster URL (for pipelines):
+```
+http://gitea-http.gitea.svc.cluster.local:3000/bakery-admin/bakery-ia.git
+```
+
+## Troubleshooting
+
+### Init Job Failed
+
+```bash
+# Check job status
+kubectl get jobs -n gitea
+
+# View logs
+kubectl logs -n gitea job/gitea-init-repo
+
+# Re-run the job
+kubectl delete job gitea-init-repo -n gitea
+kubectl apply -f infrastructure/cicd/gitea/gitea-init-job.yaml
+```
+
+### Repository Not Created
+
+1. Check if Gitea is ready: `kubectl get pods -n gitea`
+2. Check init job logs: `kubectl logs -n gitea job/gitea-init-repo`
+3. Manually create via API or use `setup-gitea-repository.sh`
+
+### Authentication Issues
+
+1. Verify secret exists: `kubectl get secret gitea-admin-secret -n gitea`
+2. Check credentials: `kubectl get secret gitea-admin-secret -n gitea -o jsonpath='{.data.password}' | base64 -d`
+
+## Upgrading
+
+```bash
+helm upgrade gitea gitea/gitea -n gitea \
+  -f infrastructure/cicd/gitea/values.yaml
+```
+
+Repositories and data are preserved during upgrades (stored in PVC).
--- a/infrastructure/cicd/gitea/gitea-init-job.yaml
+++ b/infrastructure/cicd/gitea/gitea-init-job.yaml
@@ -0,0 +1,176 @@
+# Gitea Initialization Job
+# This Job runs after Gitea is installed to create the initial repository
+# It uses the same admin credentials from gitea-admin-secret
+#
+# Apply after Gitea is ready:
+#   kubectl apply -f gitea-init-job.yaml -n gitea
+#
+# To re-run (if needed):
+#   kubectl delete job gitea-init-repo -n gitea
+#   kubectl apply -f gitea-init-job.yaml -n gitea
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-init-script
+  namespace: gitea
+  labels:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/component: init
+data:
+  init-repo.sh: |
+    #!/bin/sh
+    set -e
+
+    GITEA_URL="http://gitea-http.gitea.svc.cluster.local:3000"
+    REPO_NAME="bakery-ia"
+    MAX_RETRIES=30
+    RETRY_INTERVAL=10
+
+    echo "=== Gitea Repository Initialization ==="
+    echo "Gitea URL: $GITEA_URL"
+    echo "Repository: $REPO_NAME"
+    echo "Admin User: $GITEA_ADMIN_USER"
+
+    # Wait for Gitea to be ready
+    echo ""
+    echo "Waiting for Gitea to be ready..."
+    RETRIES=0
+    until curl -sf "$GITEA_URL/api/v1/version" > /dev/null 2>&1; do
+      RETRIES=$((RETRIES + 1))
+      if [ $RETRIES -ge $MAX_RETRIES ]; then
+        echo "ERROR: Gitea did not become ready after $MAX_RETRIES attempts"
+        exit 1
+      fi
+      echo "  Attempt $RETRIES/$MAX_RETRIES - Gitea not ready, waiting ${RETRY_INTERVAL}s..."
+      sleep $RETRY_INTERVAL
+    done
+    echo "Gitea is ready!"
+
+    # Check if repository already exists
+    echo ""
+    echo "Checking if repository '$REPO_NAME' exists..."
+    HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+      -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+      "$GITEA_URL/api/v1/repos/$GITEA_ADMIN_USER/$REPO_NAME")
+
+    if [ "$HTTP_CODE" = "200" ]; then
+      echo "Repository '$REPO_NAME' already exists. Nothing to do."
+      exit 0
+    fi
+
+    # Create the repository
+    echo "Creating repository '$REPO_NAME'..."
+    RESPONSE=$(curl -s -w "\n%{http_code}" \
+      -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+      -X POST "$GITEA_URL/api/v1/user/repos" \
+      -H "Content-Type: application/json" \
+      -d '{
+        "name": "'"$REPO_NAME"'",
+        "description": "Main repository for Bakery IA project - Automatically created",
+        "private": false,
+        "auto_init": true,
+        "default_branch": "main",
+        "readme": "Default"
+      }')
+
+    HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+    BODY=$(echo "$RESPONSE" | sed '$d')
+
+    if [ "$HTTP_CODE" = "201" ]; then
+      echo "Repository '$REPO_NAME' created successfully!"
+      echo ""
+      echo "Repository URL: $GITEA_URL/$GITEA_ADMIN_USER/$REPO_NAME"
+      echo "Clone URL: $GITEA_URL/$GITEA_ADMIN_USER/$REPO_NAME.git"
+    else
+      echo "ERROR: Failed to create repository (HTTP $HTTP_CODE)"
+      echo "Response: $BODY"
+      exit 1
+    fi
+
+    # Configure webhook for Tekton (optional - if Tekton is installed)
+    echo ""
+    echo "Checking if Tekton EventListener is available..."
+    TEKTON_URL="http://el-bakery-ia-listener.tekton-pipelines.svc.cluster.local:8080"
+    if curl -sf "$TEKTON_URL" > /dev/null 2>&1; then
+      echo "Tekton EventListener found. Creating webhook..."
+      WEBHOOK_RESPONSE=$(curl -s -w "\n%{http_code}" \
+        -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+        -X POST "$GITEA_URL/api/v1/repos/$GITEA_ADMIN_USER/$REPO_NAME/hooks" \
+        -H "Content-Type: application/json" \
+        -d '{
+          "type": "gitea",
+          "config": {
+            "url": "'"$TEKTON_URL"'",
+            "content_type": "json"
+          },
+          "events": ["push"],
+          "active": true
+        }')
+
+      WEBHOOK_CODE=$(echo "$WEBHOOK_RESPONSE" | tail -1)
+      if [ "$WEBHOOK_CODE" = "201" ]; then
+        echo "Webhook created successfully!"
+      else
+        echo "Warning: Could not create webhook (HTTP $WEBHOOK_CODE). You may need to configure it manually."
+      fi
+    else
+      echo "Tekton EventListener not available. Skipping webhook creation."
+    fi
+
+    echo ""
+    echo "=== Initialization Complete ==="
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: gitea-init-repo
+  namespace: gitea
+  labels:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/component: init
+  annotations:
+    # Helm hook annotations (if used with Helm)
+    helm.sh/hook: post-install,post-upgrade
+    helm.sh/hook-weight: "10"
+    helm.sh/hook-delete-policy: before-hook-creation
+spec:
+  ttlSecondsAfterFinished: 300
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gitea
+        app.kubernetes.io/component: init
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: init-repo
+          image: curlimages/curl:8.5.0
+          command: ["/bin/sh", "/scripts/init-repo.sh"]
+          env:
+            - name: GITEA_ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-admin-secret
+                  key: username
+            - name: GITEA_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-admin-secret
+                  key: password
+          volumeMounts:
+            - name: init-script
+              mountPath: /scripts
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 50m
+              memory: 32Mi
+      volumes:
+        - name: init-script
+          configMap:
+            name: gitea-init-script
+            defaultMode: 0755
--- a/infrastructure/cicd/gitea/setup-admin-secret.sh
+++ b/infrastructure/cicd/gitea/setup-admin-secret.sh
@@ -0,0 +1,209 @@
+#!/bin/bash
+# Setup Gitea Admin Secret and Initialize Gitea
+#
+# This script:
+# 1. Creates gitea-admin-secret (gitea namespace) - Used by Gitea Helm chart for admin credentials
+# 2. Creates gitea-registry-secret (bakery-ia namespace) - Used by pods for imagePullSecrets
+# 3. Applies the gitea-init-job.yaml to create the initial repository
+#
+# Usage:
+#   Development:
+#     ./setup-admin-secret.sh                    # Uses default dev password
+#     ./setup-admin-secret.sh [password]         # Uses provided password
+#     ./setup-admin-secret.sh --secrets-only     # Only create secrets, skip init job
+#
+#   Production:
+#     export GITEA_ADMIN_PASSWORD=$(openssl rand -base64 32)
+#     ./setup-admin-secret.sh --production
+#     ./setup-admin-secret.sh --production --secrets-only
+#
+# Environment variables:
+#   GITEA_ADMIN_PASSWORD - Password to use (required for --production)
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KUBECTL="kubectl"
+GITEA_NAMESPACE="gitea"
+BAKERY_NAMESPACE="bakery-ia"
+REGISTRY_HOST="registry.bakery-ia.local"
+ADMIN_USERNAME="bakery-admin"
+# Default password for dev environment only
+# For PRODUCTION: Always set GITEA_ADMIN_PASSWORD environment variable
+# Generate secure password with: openssl rand -base64 32
+DEV_DEFAULT_PASSWORD="pvYUkGWJijqc0QfIZEXw"
+SECRETS_ONLY=false
+IS_PRODUCTION=false
+
+# Check if running in microk8s
+if command -v microk8s &> /dev/null; then
+    KUBECTL="microk8s kubectl"
+fi
+
+# Parse arguments
+for arg in "$@"; do
+    case $arg in
+        --secrets-only)
+            SECRETS_ONLY=true
+            ;;
+        --production)
+            IS_PRODUCTION=true
+            REGISTRY_HOST="registry.bakewise.ai"
+            ;;
+        *)
+            if [ -z "$ADMIN_PASSWORD" ] && [ "$arg" != "--secrets-only" ] && [ "$arg" != "--production" ]; then
+                ADMIN_PASSWORD="$arg"
+            fi
+            ;;
+    esac
+done
+
+# Get password from argument, environment variable, or use default (dev only)
+if [ -z "$ADMIN_PASSWORD" ]; then
+    if [ -n "$GITEA_ADMIN_PASSWORD" ]; then
+        ADMIN_PASSWORD="$GITEA_ADMIN_PASSWORD"
+        echo "Using password from GITEA_ADMIN_PASSWORD environment variable"
+    elif [ "$IS_PRODUCTION" = true ]; then
+        echo "ERROR: Production deployment requires GITEA_ADMIN_PASSWORD environment variable"
+        echo "Generate a secure password with: openssl rand -base64 32"
+        echo ""
+        echo "Usage for production:"
+        echo "  export GITEA_ADMIN_PASSWORD=\$(openssl rand -base64 32)"
+        echo "  ./setup-admin-secret.sh --production"
+        exit 1
+    else
+        ADMIN_PASSWORD="$DEV_DEFAULT_PASSWORD"
+        echo "WARNING: Using default dev password. For production, set GITEA_ADMIN_PASSWORD"
+    fi
+fi
+
+# Validate password strength for production
+if [ "$IS_PRODUCTION" = true ] && [ ${#ADMIN_PASSWORD} -lt 16 ]; then
+    echo "ERROR: Production password must be at least 16 characters"
+    exit 1
+fi
+
+# Create namespaces if they don't exist
+$KUBECTL create namespace "$GITEA_NAMESPACE" --dry-run=client -o yaml | $KUBECTL apply -f -
+$KUBECTL create namespace "$BAKERY_NAMESPACE" --dry-run=client -o yaml | $KUBECTL apply -f -
+
+# 1. Create gitea-admin-secret for Gitea Helm chart
+echo "Creating gitea-admin-secret in $GITEA_NAMESPACE namespace..."
+$KUBECTL create secret generic gitea-admin-secret \
+    --namespace "$GITEA_NAMESPACE" \
+    --from-literal=username="$ADMIN_USERNAME" \
+    --from-literal=password="$ADMIN_PASSWORD" \
+    --dry-run=client -o yaml | $KUBECTL apply -f -
+
+# 2. Create gitea-registry-secret for imagePullSecrets
+echo "Creating gitea-registry-secret in $BAKERY_NAMESPACE namespace..."
+
+# Create Docker config JSON for registry authentication
+# Include both external (ingress) and internal (cluster) registry URLs
+AUTH_BASE64=$(echo -n "${ADMIN_USERNAME}:${ADMIN_PASSWORD}" | base64)
+INTERNAL_REGISTRY_HOST="gitea-http.gitea.svc.cluster.local:3000"
+DOCKER_CONFIG_JSON=$(cat <<EOF
+{
+  "auths": {
+    "${REGISTRY_HOST}": {
+      "username": "${ADMIN_USERNAME}",
+      "password": "${ADMIN_PASSWORD}",
+      "auth": "${AUTH_BASE64}"
+    },
+    "${INTERNAL_REGISTRY_HOST}": {
+      "username": "${ADMIN_USERNAME}",
+      "password": "${ADMIN_PASSWORD}",
+      "auth": "${AUTH_BASE64}"
+    }
+  }
+}
+EOF
+)
+
+# Base64 encode the entire config (use -w0 on Linux, no flag needed on macOS)
+if [[ "$OSTYPE" == "darwin"* ]]; then
+    DOCKER_CONFIG_BASE64=$(echo -n "$DOCKER_CONFIG_JSON" | base64)
+else
+    DOCKER_CONFIG_BASE64=$(echo -n "$DOCKER_CONFIG_JSON" | base64 -w0)
+fi
+
+# Create the registry secret
+cat <<EOF | $KUBECTL apply -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-registry-secret
+  namespace: ${BAKERY_NAMESPACE}
+  labels:
+    app.kubernetes.io/name: bakery-ia
+    app.kubernetes.io/component: registry
+    app.kubernetes.io/managed-by: setup-admin-secret
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: ${DOCKER_CONFIG_BASE64}
+EOF
+
+echo ""
+echo "=========================================="
+echo "Gitea secrets created successfully!"
+echo "=========================================="
+echo ""
+echo "Environment: $([ "$IS_PRODUCTION" = true ] && echo "PRODUCTION" || echo "Development")"
+echo ""
+echo "Credentials:"
+echo "  Username: $ADMIN_USERNAME"
+if [ "$IS_PRODUCTION" = true ]; then
+    echo "  Password: (stored in secret, not displayed for security)"
+else
+    echo "  Password: $ADMIN_PASSWORD"
+fi
+echo ""
+echo "Secrets created:"
+echo "  1. gitea-admin-secret      (namespace: $GITEA_NAMESPACE)  - For Gitea Helm chart"
+echo "  2. gitea-registry-secret   (namespace: $BAKERY_NAMESPACE) - For imagePullSecrets"
+echo ""
+echo "Registry URLs:"
+echo "  External: https://$REGISTRY_HOST"
+echo "  Internal: $INTERNAL_REGISTRY_HOST"
+echo ""
+
+# Apply the init job ConfigMap and Job (but Job won't run until Gitea is installed)
+if [ "$SECRETS_ONLY" = false ]; then
+    INIT_JOB_FILE="$SCRIPT_DIR/gitea-init-job.yaml"
+    if [ -f "$INIT_JOB_FILE" ]; then
+        echo "Applying Gitea initialization resources..."
+        $KUBECTL apply -f "$INIT_JOB_FILE"
+        echo ""
+        echo "Init job will create the 'bakery-ia' repository once Gitea is ready."
+    else
+        echo "Warning: gitea-init-job.yaml not found at $INIT_JOB_FILE"
+    fi
+    echo ""
+fi
+
+echo "Next steps:"
+if [ "$IS_PRODUCTION" = true ]; then
+    echo "  1. Install Gitea for production:"
+    echo "     helm upgrade --install gitea gitea/gitea -n gitea \\"
+    echo "       -f infrastructure/cicd/gitea/values.yaml \\"
+    echo "       -f infrastructure/cicd/gitea/values-prod.yaml"
+    echo ""
+    echo "  2. Install Tekton CI/CD for production:"
+    echo "     export TEKTON_WEBHOOK_TOKEN=\$(openssl rand -hex 32)"
+    echo "     helm upgrade --install tekton-cicd infrastructure/cicd/tekton-helm \\"
+    echo "       -n tekton-pipelines \\"
+    echo "       -f infrastructure/cicd/tekton-helm/values.yaml \\"
+    echo "       -f infrastructure/cicd/tekton-helm/values-prod.yaml \\"
+    echo "       --set secrets.webhook.token=\$TEKTON_WEBHOOK_TOKEN \\"
+    echo "       --set secrets.registry.password=\$GITEA_ADMIN_PASSWORD \\"
+    echo "       --set secrets.git.password=\$GITEA_ADMIN_PASSWORD"
+else
+    echo "  1. Install Gitea (if not already installed):"
+    echo "     helm install gitea gitea/gitea -n gitea -f infrastructure/cicd/gitea/values.yaml"
+fi
+echo ""
+echo "  $([ "$IS_PRODUCTION" = true ] && echo "3" || echo "2"). Wait for Gitea to be ready:"
+echo "     kubectl wait --for=condition=ready pod -n gitea -l app.kubernetes.io/name=gitea --timeout=300s"
+echo ""
+echo "  $([ "$IS_PRODUCTION" = true ] && echo "4" || echo "3"). Check init job status:"
+echo "     kubectl logs -n gitea -l app.kubernetes.io/component=init --tail=50"
--- a/infrastructure/cicd/gitea/setup-gitea-repository.sh
+++ b/infrastructure/cicd/gitea/setup-gitea-repository.sh
@@ -0,0 +1,119 @@
+#!/bin/bash
+# Script to setup and push code to the automatically created Gitea repository
+# This script should be run after Gitea is installed and the repository is created
+
+set -e
+
+echo "=== Gitea Repository Setup Script ==="
+echo "This script will configure the bakery-ia repository in Gitea"
+echo
+
+# Configuration - update these values as needed
+GITEA_URL="https://gitea.bakery-ia.local"
+GITEA_ADMIN_USER="bakery-admin"
+REPO_NAME="bakery-ia"
+LOCAL_DIR="/Users/urtzialfaro/Documents/bakery-ia"
+
+# Check if Gitea admin password is set
+if [ -z "$GITEA_ADMIN_PASSWORD" ]; then
+    echo "Error: GITEA_ADMIN_PASSWORD environment variable is not set"
+    echo "Please set it to the admin password you used during Gitea installation"
+    exit 1
+fi
+
+echo "Checking if Gitea is accessible..."
+if ! curl -s -o /dev/null -w "%{http_code}" "$GITEA_URL" | grep -q "200"; then
+    echo "Error: Cannot access Gitea at $GITEA_URL"
+    echo "Please ensure Gitea is running and accessible"
+    exit 1
+fi
+
+echo "✓ Gitea is accessible"
+
+echo "Checking if repository $REPO_NAME exists..."
+REPO_CHECK=$(curl -s -w "%{http_code}" -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+    "$GITEA_URL/api/v1/repos/$GITEA_ADMIN_USER/$REPO_NAME" | tail -1)
+
+if [ "$REPO_CHECK" != "200" ]; then
+    echo "Repository $REPO_NAME does not exist or is not accessible"
+    echo "Attempting to create it..."
+    
+    CREATE_RESPONSE=$(curl -s -w "%{http_code}" -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+        -X POST "$GITEA_URL/api/v1/user/repos" \
+        -H "Content-Type: application/json" \
+        -d '{
+            "name": "'"$REPO_NAME"'",
+            "description": "Main repository for Bakery IA project",
+            "private": false,
+            "auto_init": true,
+            "default_branch": "main"
+        }')
+    
+    HTTP_CODE=$(echo "$CREATE_RESPONSE" | tail -1)
+    RESPONSE_BODY=$(echo "$CREATE_RESPONSE" | sed '$d')
+    
+    if [ "$HTTP_CODE" != "201" ]; then
+        echo "Error creating repository: HTTP $HTTP_CODE"
+        echo "Response: $RESPONSE_BODY"
+        exit 1
+    fi
+    
+    echo "✓ Repository $REPO_NAME created successfully"
+else
+    echo "✓ Repository $REPO_NAME already exists"
+fi
+
+echo "Configuring Git repository..."
+cd "$LOCAL_DIR"
+
+# Check if this is already a git repository
+if [ ! -d ".git" ]; then
+    echo "Initializing Git repository..."
+    git init
+    git branch -M main
+else
+    echo "Git repository already initialized"
+fi
+
+# Configure Git user if not already set
+if [ -z "$(git config user.name)" ]; then
+    git config user.name "$GITEA_ADMIN_USER"
+    git config user.email "admin@bakery-ia.local"
+    echo "✓ Configured Git user: $GITEA_ADMIN_USER"
+fi
+
+# Set the remote URL
+GIT_REMOTE_URL="$GITEA_URL/$GITEA_ADMIN_USER/$REPO_NAME.git"
+
+if git remote | grep -q "origin"; then
+    CURRENT_REMOTE=$(git remote get-url origin)
+    if [ "$CURRENT_REMOTE" != "$GIT_REMOTE_URL" ]; then
+        echo "Updating remote origin to: $GIT_REMOTE_URL"
+        git remote set-url origin "$GIT_REMOTE_URL"
+    else
+        echo "Remote origin is already set correctly"
+    fi
+else
+    echo "Setting remote origin to: $GIT_REMOTE_URL"
+    git remote add origin "$GIT_REMOTE_URL"
+fi
+
+echo "Checking if there are changes to commit..."
+if [ -n "$(git status --porcelain)" ]; then
+    echo "Committing changes..."
+    git add .
+    git commit -m "Initial commit - Bakery IA project setup"
+    echo "✓ Changes committed"
+else
+    echo "No changes to commit"
+fi
+
+echo "Pushing to Gitea repository..."
+git push --set-upstream origin main
+
+echo "✓ Code pushed successfully to Gitea!"
+
+echo "Repository URL: $GIT_REMOTE_URL"
+echo "You can now configure your CI/CD pipelines to use this repository."
+
+echo "=== Setup Complete ==="
--- a/infrastructure/cicd/gitea/test-repository-creation.sh
+++ b/infrastructure/cicd/gitea/test-repository-creation.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+# Test script to verify that the Gitea repository was created successfully
+
+set -e
+
+echo "=== Gitea Repository Creation Test ==="
+echo
+
+# Configuration - update these values as needed
+GITEA_URL="https://gitea.bakery-ia.local"
+GITEA_ADMIN_USER="bakery-admin"
+REPO_NAME="bakery-ia"
+
+# Check if Gitea admin password is set
+if [ -z "$GITEA_ADMIN_PASSWORD" ]; then
+    echo "Error: GITEA_ADMIN_PASSWORD environment variable is not set"
+    echo "Please set it to the admin password you used during Gitea installation"
+    exit 1
+fi
+
+echo "Testing Gitea accessibility..."
+if ! curl -s -o /dev/null -w "%{http_code}" "$GITEA_URL" | grep -q "200"; then
+    echo "❌ Error: Cannot access Gitea at $GITEA_URL"
+    echo "Please ensure Gitea is running and accessible"
+    exit 1
+fi
+
+echo "✅ Gitea is accessible"
+
+echo "Testing repository existence..."
+REPO_CHECK=$(curl -s -w "%{http_code}" -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+    "$GITEA_URL/api/v1/repos/$GITEA_ADMIN_USER/$REPO_NAME" | tail -1)
+
+if [ "$REPO_CHECK" == "200" ]; then
+    echo "✅ Repository '$REPO_NAME' exists"
+    
+    # Get repository details
+    REPO_DETAILS=$(curl -s -u "$GITEA_ADMIN_USER:$GITEA_ADMIN_PASSWORD" \
+        "$GITEA_URL/api/v1/repos/$GITEA_ADMIN_USER/$REPO_NAME")
+    
+    REPO_DESCRIPTION=$(echo "$REPO_DETAILS" | jq -r '.description')
+    REPO_PRIVATE=$(echo "$REPO_DETAILS" | jq -r '.private')
+    REPO_DEFAULT_BRANCH=$(echo "$REPO_DETAILS" | jq -r '.default_branch')
+    
+    echo "Repository Details:"
+    echo "  - Name: $REPO_NAME"
+    echo "  - Description: $REPO_DESCRIPTION"
+    echo "  - Private: $REPO_PRIVATE"
+    echo "  - Default Branch: $REPO_DEFAULT_BRANCH"
+    echo "  - URL: $GITEA_URL/$GITEA_ADMIN_USER/$REPO_NAME"
+    echo "  - Clone URL: $GITEA_URL/$GITEA_ADMIN_USER/$REPO_NAME.git"
+    
+    # Test if repository has issues enabled
+    if echo "$REPO_DETAILS" | jq -e '.has_issues == true' > /dev/null; then
+        echo "✅ Issues are enabled"
+    else
+        echo "❌ Issues are not enabled"
+    fi
+    
+    # Test if repository has wiki enabled
+    if echo "$REPO_DETAILS" | jq -e '.has_wiki == true' > /dev/null; then
+        echo "✅ Wiki is enabled"
+    else
+        echo "❌ Wiki is not enabled"
+    fi
+    
+    # Test if repository has pull requests enabled
+    if echo "$REPO_DETAILS" | jq -e '.has_pull_requests == true' > /dev/null; then
+        echo "✅ Pull requests are enabled"
+    else
+        echo "❌ Pull requests are not enabled"
+    fi
+    
+    echo
+    echo "✅ All tests passed! Repository is ready for use."
+    
+else
+    echo "❌ Repository '$REPO_NAME' does not exist"
+    echo "Expected HTTP 200, got: $REPO_CHECK"
+    exit 1
+fi
+
+echo
+echo "=== Test Complete ==="
--- a/infrastructure/cicd/gitea/values-prod.yaml
+++ b/infrastructure/cicd/gitea/values-prod.yaml
@@ -0,0 +1,65 @@
+# Gitea Helm values for Production environment
+# This file overrides values.yaml for production deployment
+#
+# Installation:
+#   helm upgrade --install gitea gitea/gitea -n gitea \
+#     -f infrastructure/cicd/gitea/values.yaml \
+#     -f infrastructure/cicd/gitea/values-prod.yaml
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "500m"
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    cert-manager.io/cluster-issuer: "letsencrypt-production"
+  hosts:
+    - host: gitea.bakewise.ai
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: gitea-tls-cert
+      hosts:
+        - gitea.bakewise.ai
+  apiIngress:
+    enabled: true
+    className: nginx
+    annotations:
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      nginx.ingress.kubernetes.io/proxy-body-size: "500m"
+      cert-manager.io/cluster-issuer: "letsencrypt-production"
+    hosts:
+      - host: registry.bakewise.ai
+        paths:
+          - path: /
+            pathType: Prefix
+    tls:
+      - secretName: registry-tls-cert
+        hosts:
+          - registry.bakewise.ai
+
+gitea:
+  admin:
+    email: admin@bakewise.ai
+  config:
+    server:
+      DOMAIN: gitea.bakewise.ai
+      SSH_DOMAIN: gitea.bakewise.ai
+      ROOT_URL: https://gitea.bakewise.ai
+
+# Production resources - adjust based on expected load
+resources:
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+  requests:
+    cpu: 200m
+    memory: 512Mi
+
+# Larger storage for production
+persistence:
+  size: 50Gi
--- a/infrastructure/cicd/gitea/values.yaml
+++ b/infrastructure/cicd/gitea/values.yaml
@@ -0,0 +1,132 @@
+# Gitea Helm values configuration for Bakery-IA CI/CD
+# This configuration sets up Gitea with registry support and appropriate storage
+#
+# Prerequisites:
+#   1. Run setup-admin-secret.sh to create the gitea-admin-secret
+#   2. Apply the post-install job: kubectl apply -f gitea-init-job.yaml
+#
+# Installation:
+#   helm repo add gitea https://dl.gitea.io/charts
+#   helm install gitea gitea/gitea -n gitea -f infrastructure/cicd/gitea/values.yaml
+#
+# NOTE: The namespace is determined by the -n flag during helm install, not in this file.
+
+# Use regular Gitea image instead of rootless to ensure registry functionality
+# Rootless images don't support container registry due to security restrictions
+image:
+  rootless: false
+
+service:
+  http:
+    type: ClusterIP
+    port: 3000
+  ssh:
+    type: ClusterIP
+    port: 2222
+  # NOTE: Gitea's container registry is served on port 3000 (same as HTTP) under /v2/
+  # The registry.PORT in gitea config is NOT used for external access
+  # Registry authentication and API is handled by the main HTTP service
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "500m"
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+  hosts:
+    - host: gitea.bakery-ia.local
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: bakery-dev-tls-cert
+      hosts:
+        - gitea.bakery-ia.local
+        - registry.bakery-ia.local
+
+persistence:
+  enabled: true
+  size: 10Gi
+  # Use standard storage class (works with Kind's default provisioner)
+  # For microk8s: storageClass: "microk8s-hostpath"
+  # For Kind: leave empty or use "standard"
+  storageClass: ""
+
+# =============================================================================
+# ADMIN USER CONFIGURATION
+# =============================================================================
+# The admin user is automatically created on first install.
+# Credentials are read from the 'gitea-admin-secret' Kubernetes secret.
+#
+# Create the secret BEFORE installing Gitea:
+#   ./setup-admin-secret.sh
+#
+# The secret must contain:
+#   - username: admin username (default: bakery-admin)
+#   - password: admin password
+# =============================================================================
+gitea:
+  admin:
+    username: bakery-admin
+    email: admin@bakery-ia.local
+    # Use existing secret for admin credentials (created by setup-admin-secret.sh)
+    existingSecret: gitea-admin-secret
+    # keepUpdated ensures password changes in secret are applied
+    passwordMode: keepUpdated
+
+  config:
+    server:
+      DOMAIN: gitea.bakery-ia.local
+      SSH_DOMAIN: gitea.bakery-ia.local
+      SSH_PORT: 2222
+      # Use HTTPS for external access; TLS termination happens at ingress
+      ROOT_URL: https://gitea.bakery-ia.local
+      HTTP_PORT: 3000
+      # Disable built-in HTTPS since ingress handles TLS
+      PROTOCOL: http
+    repository:
+      ENABLE_PUSH_CREATE_USER: true
+      ENABLE_PUSH_CREATE_ORG: true
+      DEFAULT_BRANCH: main
+    packages:
+      ENABLED: true
+    webhook:
+      ALLOWED_HOST_LIST: "*"
+      # Allow internal cluster URLs for Tekton EventListener
+      SKIP_TLS_VERIFY: true
+    service:
+      DISABLE_REGISTRATION: false
+      REQUIRE_SIGNIN_VIEW: false
+
+# Use embedded SQLite for simpler local development
+# For production, enable postgresql
+postgresql:
+  enabled: false
+
+# Use embedded in-memory cache for local dev
+redis-cluster:
+  enabled: false
+
+# Resource configuration for local development
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 256Mi
+
+# Init containers timeout
+initContainers:
+  resources:
+    limits:
+      cpu: 100m
+      memory: 128Mi
+    requests:
+      cpu: 50m
+      memory: 64Mi
+
+