Fix resources isues 30

infrastructure/cicd/gitea/values-prod.yaml

@@ -44,6 +44,33 @@ gitea:
       SSH_DOMAIN: gitea.bakewise.ai
       ROOT_URL: https://gitea.bakewise.ai
 
+    # =============================================================================
+    # PACKAGE/REGISTRY RETENTION POLICY
+    # =============================================================================
+    # Automatic cleanup of old container images and packages
+    # This prevents the registry from growing indefinitely
+    packages:
+      ENABLED: true
+      # Limit container image versions to prevent storage bloat
+      # 0 = unlimited (default), set a reasonable limit for CI/CD
+      LIMIT_TOTAL_OWNER_SIZE: 10737418240  # 10GB per owner/organization
+      LIMIT_SIZE_CONTAINER: 2147483648      # 2GB per container image
+
+    # Cron job for automatic package cleanup
+    cron:
+      ENABLED: true
+    "cron.cleanup_packages":
+      ENABLED: true
+      # Run daily at 3 AM
+      SCHEDULE: "0 3 * * *"
+      # Keep packages newer than this (in hours) - 168h = 7 days
+      OLDER_THAN: 168h
+      # Number of versions to keep per package (0 = disabled)
+      # This keeps the last 5 versions regardless of age
+      NUMBER_TO_KEEP: 5
+      # Also clean up unreferenced blobs
+      REMOVE_UNUSED_ARTIFACTS: true
+
 # Production resources - adjust based on expected load
 resources:
   limits:

infrastructure/cicd/gitea/values.yaml

@@ -93,6 +93,8 @@ gitea:
       DEFAULT_BRANCH: main
     packages:
       ENABLED: true
+      # Retention policy is configured in values-prod.yaml for production
+      # See: LIMIT_TOTAL_OWNER_SIZE, LIMIT_SIZE_CONTAINER, cron.cleanup_packages
     webhook:
       ALLOWED_HOST_LIST: "*"
       # Allow internal cluster URLs for Tekton EventListener

infrastructure/cicd/tekton-helm/templates/task-kaniko-build.yaml

@@ -158,7 +158,8 @@ spec:
               --build-arg="BASE_REGISTRY=$(params.base-registry)" \
               --build-arg="PYTHON_IMAGE=$(params.python-image)" \
               --cache=true \
-              --cache-repo="$(params.registry)/cache"
+              --cache-repo="$(params.registry)/cache" \
+              --cache-ttl=168h
 
             echo "Successfully built: $(params.registry)/$service:$(params.git-revision)"
           fi

infrastructure/cicd/tekton-helm/templates/trigger-template.yaml

@@ -41,6 +41,9 @@ spec:
           # Track the source commit
           bakery-ia.io/git-revision: $(tt.params.git-revision)
           bakery-ia.io/git-branch: $(tt.params.git-branch)
+          # Automatic cleanup: delete PipelineRun after completion
+          # Default: 1 hour (3600 seconds). Configure via values.yaml
+          tekton.dev/pipelinerunDeletionPropagation: "foreground"
       spec:
         pipelineRef:
           name: bakery-ia-ci

infrastructure/cicd/tekton-helm/values.yaml

@@ -93,6 +93,20 @@ serviceAccounts:
   pipeline:
     name: "tekton-pipeline-sa"
 
+# Cleanup and retention configuration
+cleanup:
+  # PipelineRun retention (requires Tekton Pipelines >= v0.52.0)
+  # Set to 0 to disable automatic cleanup
+  pipelineRuns:
+    # Keep last N successful PipelineRuns per Pipeline
+    keepSuccessful: 3
+    # Keep last N failed PipelineRuns per Pipeline
+    keepFailed: 5
+  # TaskRun retention
+  taskRuns:
+    keepSuccessful: 3
+    keepFailed: 5
+
 # Labels to apply to resources
 labels:
   app: