Root-causes today's Gitea outage. The official Gitea Helm chart
(dl.gitea.com/charts, gitea/helm-gitea) always builds Gitea's own [database]
config directly from the plaintext postgresql.global.postgresql.auth.password
value, confirmed from templates/gitea/config.yaml:
{{- $_ := set .Values.gitea.config.database "PASSWD" .Values.postgresql.global.postgresql.auth.password -}}
`existingSecret` only affects the bundled postgresql subchart's own credential
provisioning -- it has no effect on what Gitea itself connects with. Removing
the plaintext field in the earlier Stage 1 "secret hygiene" commit made this
silently fall back to the chart's built-in default password ("gitea", 5
chars), which got re-baked into the persisted app.ini on every pod restart
regardless of what the live Postgres role's real password was -- hence the
repeating CrashLoopBackOff no amount of Postgres-side fixing could resolve.
Restores a plaintext password (the value already live on Postgres from this
incident's recovery), with a comment explaining why, so this doesn't get
"cleaned up" back into the same breakage later. Removes the now-nonfunctional
manifests/gitea/gitea-postgres-secret.sh and its .env.example entry. Getting
this fully off plaintext would need a Config Management Plugin or similar --
not attempted here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Everything is committed locally on main; nothing has been pushed. See the
session summary for the specific items that still need your input or action
before any of this goes live (secret rotation values, Authentik chart
version, push go-ahead, live storage/Grafana decisions, router archive review).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Marks Stages 1-4 and part of Stage 6 done in the tracker. Records three things
discovered via read-only kubectl checks during this session that weren't in
the original audit: Grafana/Loki's static PVs are orphaned (dynamically
provisioned via local-path instead), Finding #24 (GPU passthrough) is actually
working and doesn't need fixing, and live node hostnames differ cosmetically
from ansible/inventory.yaml's aliases.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
