Kubernetes (kustomize)
Plain manifests in deploy/,
assembled with the kustomize built into kubectl. They produce the same
hardened setup as the Helm chart.
| File | Purpose |
|---|---|
namespace.yaml | forgemirror namespace, Pod Security Standard restricted enforced |
configmap.yaml | forgemirror.yaml without secrets |
secret.example.yaml | Template for the credentials. Not applied by kustomize, so secrets stay out of git |
deployment.yaml | One replica, Recreate, non-root, read-only root filesystem, probes |
service.yaml | ClusterIP service on port 80 |
Configure
Edit deploy/configmap.yaml (targets, filter, timeouts). In
kustomization.yaml, pin the image tag or a digest instead of latest.
Create the Secret
kubectl create namespace forgemirror
kubectl -n forgemirror create secret generic forgemirror \
--from-literal=webhook-secret="$(openssl rand -hex 32)" \
--from-literal=source-token=<forgejo-token> \
--from-literal=github-token=<github-token>Apply
kubectl apply -k deploy/
kubectl -n forgemirror rollout status deployment/forgemirrorWebhook URL: http://forgemirror.forgemirror.svc.cluster.local/webhook
mise run deploy:check validates the rendered manifests against the
Kubernetes API schemas, and runs forgemirror validate on the embedded
configuration. CI runs the same check on every change.
Default ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
name: forgemirror
data:
# Non-secret settings only. Secrets are read from files mounted from the
# forgemirror Secret (see deployment.yaml and secret.example.yaml).
forgemirror.yaml: |
server:
listen_address: ":8080"
# Keep below terminationGracePeriodSeconds in deployment.yaml.
shutdown_timeout: 60s
log:
level: info
format: json
webhook:
secret_file: /run/secrets/forgemirror/webhook-secret
source:
token_file: /run/secrets/forgemirror/source-token
mirror:
timeout: 10m
max_concurrent: 4
work_dir: /work
filter:
exclude_private: true
targets:
- name: github
url: "https://github.com/acme/{{ .Name }}.git"
token_file: /run/secrets/forgemirror/github-token
Last updated on