Erki AasandClaude Opus 4.8
18034b7cd9
Post-breach (CVE-2026-59774) rotation. All three security secrets shared one generated value via the gitea-random SecretClaim, and the file-read exploit leaked it. Split INTERNAL_TOKEN and JWT_SECRET into their own claims (gitea-internal-token, gitea-oauth2-jwt) with fresh distinct values and repoint the StatefulSet at them. INTERNAL_TOKEN is the secret the attacker actually used against the still-internet-reachable /api/internal, so this closes reuse of any saved copy. Rotating JWT_SECRET invalidates gitea-issued OAuth2 and LFS tokens, so the OAuth2 integrations (Woodpecker, tea, credential helpers) need one re-login. SECRET_KEY is deliberately left on gitea-random: rotating it would break the 2 push mirrors (encrypted creds) and must be done in a window that re-enters those credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Gitea
This application is managed by ArgoCD
Should ArgoCD be down manifests here can be applied with:
kustomize build . | kubectl apply -f -
Gitea DOES NOT go through Traefik. It has its own IP because ssh :22 would conflict with kube worker ssh. On its own IP, at the moment it doesn't flirt with Traefik — also has its own certificate.