Pin valkey/postgresql resources; harden runner token step

The live valkey and postgresql StatefulSets had memory limits raised by
hand (8Gi and 2Gi). A helm upgrade reverts those to the bitnami 192Mi
preset, and valkey then OOMs loading its ~3.3GB dataset. Move the limits
into role defaults so upgrades keep them.

Generate the runner token with kubectl exec against the deployment after
waiting for its rollout, with retries, instead of kubernetes.core.k8s_exec
(the control plane's kubernetes python client is too old for it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -6,6 +6,27 @@
 # 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
 gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
 
+# Resources for chart subcharts. These match the limits previously set by
+# hand on the live StatefulSets; the bitnami default presets (192Mi) OOM.
+gitea_valkey_resources:
+  requests:
+    cpu: 100m
+    memory: 1Gi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 8Gi
+    ephemeral-storage: 4Gi
+gitea_postgresql_resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 2Gi
+    ephemeral-storage: 2Gi
+
 # Gitea Actions runner (gitea/actions chart)
 gitea_actions_enabled: true
 gitea_actions_chart_version: 0.1.2

tasks/actions.yaml

@@ -10,24 +10,17 @@
 - name: generate and store a runner registration token
   when: runner_token_secret.resources | length == 0
   block:
-    - name: find a running gitea pod
-      kubernetes.core.k8s_info:
-        kind: Pod
-        namespace: gitea
-        label_selectors:
-          - app.kubernetes.io/name=gitea
-          - app.kubernetes.io/instance=gitea
-        field_selectors:
-          - status.phase=Running
-      register: gitea_pods
+    - name: wait for the gitea deployment to finish rolling out
+      command: kubectl -n gitea rollout status deployment/gitea --timeout=600s
+      changed_when: false
 
     - name: generate instance-level runner registration token
-      kubernetes.core.k8s_exec:
-        namespace: gitea
-        pod: "{{ gitea_pods.resources[0].metadata.name }}"
-        container: gitea
-        command: gitea actions generate-runner-token
+      command: kubectl -n gitea exec deployment/gitea -c gitea -- gitea actions generate-runner-token
       register: runner_token
+      retries: 10
+      delay: 15
+      until: runner_token.rc == 0 and (runner_token.stdout | trim | length) > 0
+      changed_when: false
       no_log: true
 
     - name: store runner registration token

tasks/gitea.yaml

@@ -96,6 +96,9 @@
             DEFAULT_THEME: catppuccin-blue-auto
       valkey:
         enabled: true
+        primary:
+          # The chart's default preset (192Mi) cannot load the existing dataset.
+          resources: "{{ gitea_valkey_resources }}"
       valkey-cluster:
         enabled: false
         replica:
@@ -120,6 +123,7 @@
               password: "{{ gitea_admin_password }}"
               database: gitea
         primary:
+          resources: "{{ gitea_postgresql_resources }}"
           persistence:
             enabled: true
             size: 2Ti