diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index ed2c94c..df35f4c 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -16,6 +16,7 @@ | workplan | RAPPS-WP-0016 | active | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md | | workplan | RAPPS-WP-0017 | finished | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md | | workplan | RAPPS-WP-0018 | active | — | workplans/RAPPS-WP-0018-wave2-resource-right-sizing.md | +| workplan | RAPPS-WP-0019 | active | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md | | task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | @@ -53,3 +54,8 @@ | task | RAPPS-WP-0017-T02 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md | | task | RAPPS-WP-0017-T03 | done | — | workplans/RAPPS-WP-0017-reuse-private-reader-release.md | | task | RAPPS-WP-0018-T01 | wait | — | workplans/RAPPS-WP-0018-wave2-resource-right-sizing.md | +| task | RAPPS-WP-0019-T01 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md | +| task | RAPPS-WP-0019-T02 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md | +| task | RAPPS-WP-0019-T03 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md | +| task | RAPPS-WP-0019-T04 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md | +| task | RAPPS-WP-0019-T05 | todo | — | workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md | diff --git a/workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md b/workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md new file mode 100644 index 0000000..5352299 --- /dev/null +++ b/workplans/RAPPS-WP-0019-product-neutral-forge-object-names.md @@ -0,0 +1,137 @@ +--- +id: RAPPS-WP-0019 +type: workplan +title: "Product-neutral forge object names (forgejo-gitea-* → forge-*)" +domain: infotech +repo: railiance-apps +status: active +flavor: refactoring +owner: railiance-apps +created: "2026-10-21" +updated: "2026-10-21" +related: [FORGE-WP-0011, CUST-WP-0071] +--- + +# Product-neutral forge object names + +Founder decision, 2026-10-21: the legacy "gitea" terminology should leave live +objects. The upstream Helm chart is called `gitea`, so the Forgejo objects were +named `forgejo-gitea*` and the pods were labelled `app.kubernetes.io/name: gitea`. +The founder also preferred the product-neutral word **forge**. + +**Scope:** object names and pod labels: +- Deployment `forge`; +- Services `forge-http` and `forge-ssh`; +- chart Secrets `forge*`; +- pod label `app.kubernetes.io/name: forge`. + +**Out of scope, kept on purpose:** +- the data volume `gitea-shared-storage` (renaming needs a data copy); +- the container names `gitea`/`configure-gitea` (hard-coded in the chart); +- the Helm release, the namespace `forgejo` and the host `forgejo.coulomb.social`. + Changing these is a separate, later decision. + +Leftovers from the coulombcore Gitea era (`railiance-bootstrap`/`railiance-cluster` +`gitea-ssh-nodeport.yaml`, `railiance-forge/manifests/gitea-ingress.yaml`, `gitea-db`) +are not live. They are listed for cleanup in T05. + +## Stage A: decouple the consumer NetworkPolicies + +```task +id: RAPPS-WP-0019-T01 +status: todo +priority: high +``` + +core-hub, issue-core and sbom-nexus allow egress to the forge by selecting +`app.kubernetes.io/instance: forgejo` plus `app.kubernetes.io/name: gitea`. Drop the +`name` label. `instance=forgejo` still selects only the forge server pod (the +runner has no instance label), and it stays valid before and after the rename. + +Diffs against live (2026-10-21) show exactly that one line per consumer: + +| Consumer | Source | Deploy path | +|---|---|---| +| core-hub | rapp-core-hub `helm/core-hub/templates/networkpolicy.yaml` | `make deploy` (Helm; the full release diff is only this line) | +| sbom-nexus | rapp-sbom-nexus `manifests/runtime.yaml` | server-side apply of the rendered `sbom-nexus-runtime` NetworkPolicy with field manager `rapp-sbom-nexus` | +| issue-core | rapp-issue-core `manifests/30-runtime.yaml` | push, pin the new revision in railiance-platform `argocd/railiance01/applications/issue-core.application.yaml`, manual ArgoCD sync (no other manifest change since `186c817`) | + +Verify: each consumer still reaches `http://forgejo-gitea-http.forgejo.svc:3000`. + +## Stage B: cutover (attended, about 3 minutes of forge downtime) + +```task +id: RAPPS-WP-0019-T02 +status: todo +priority: high +depends_on: [RAPPS-WP-0019-T01] +``` + +Source: `helm/forgejo-values.yaml` (`fullnameOverride: forge`, `nameOverride: forge`, +explicit `persistence.claimName: gitea-shared-storage`), +`manifests/forgejo-ingress.yaml` (backend `forge-http`), +`manifests/forgejo-ssh-nodeport.yaml` (selector `forge`), +`manifests/forgejo-compat-http-service.yaml` (temporary alias). + +1. Pre-check: no running Actions job. Record Helm revision 10 and Deployment revision 15. +2. `kubectl -n forgejo scale deployment/forgejo-gitea --replicas=0` and wait until + no forge pod is left. Helm creates the new Deployment before it deletes the old + one, so this prevents two pods mounting one volume. +3. Founder: the final `helm upgrade --install forgejo gitea-charts/gitea` step of + `make forgejo-deploy`, the same command as on 2026-10-21. Do not run + `make forgejo-deploy` itself: its `eso-deploy` dependency would upgrade ESO. +4. Apply the Ingress, the SSH NodePort and the compatibility Service manifests. +5. Verify: + - Deployment `forge` is Ready and the old `forgejo-gitea*` objects are gone; + - `/api/healthz` returns 200; + - `git ls-remote` works over HTTPS and over SSH port 30022; + - the sign-in source is unchanged and the redirect still uses S256 PKCE; + - core-hub, issue-core and sbom-nexus reach the forge; + - the runner still polls. + +Rollback: +1. `kubectl -n forgejo scale deployment/forge --replicas=0`. +2. `helm rollback forgejo 10`, the known-good revision from 2026-10-21. **Never use revision 9.** +3. Re-apply the previous Ingress and NodePort manifests from git, and delete the + compatibility Service. + +## Stage C: consumers move to forge-http, then remove the alias + +```task +id: RAPPS-WP-0019-T03 +status: todo +priority: medium +depends_on: [RAPPS-WP-0019-T02] +``` + +Change the in-cluster URLs `forgejo-gitea-http.forgejo.svc` to `forge-http.forgejo.svc`: +- rapp-core-hub `helm/core-hub/values.yaml` (`forgejoBaseURL`); +- rapp-issue-core `manifests/10-config.yaml`; +- rapp-sbom-nexus `manifests/runtime.yaml`. + +Deploy each through its own path. When no consumer uses the old name, delete +`manifests/forgejo-compat-http-service.yaml` and the live Service. + +## Tooling and docs wording + +```task +id: RAPPS-WP-0019-T04 +status: todo +priority: low +depends_on: [RAPPS-WP-0019-T02] +``` + +railiance-forge `Makefile` (`GITEA_HTTP_SERVICE`) and +`tools/observe_forge_resources.py` (`deploy/forgejo-gitea`); runbooks and docs that +name `forgejo-gitea`. Prefer "forge" wherever the concrete product is not meant. + +## Retire Gitea-era leftovers + +```task +id: RAPPS-WP-0019-T05 +status: todo +priority: low +``` + +Review and remove or archive the non-live Gitea-era manifests named above, once +their owners confirm.