From b81a2d64d0c01c569c9d6b18433d75b963814b5c Mon Sep 17 00:00:00 2001
From: Claude <claude@localhost.local>
Date: Fri, 6 Nov 2026 13:05:10 -0500
Subject: [PATCH] Pin valkey/postgresql resources; harden runner token step

The live valkey and postgresql StatefulSets had memory limits raised by
hand (8Gi and 2Gi). A helm upgrade reverts those to the bitnami 192Mi
preset, and valkey then OOMs loading its ~3.3GB dataset. Move the limits
into role defaults so upgrades keep them.

Generate the runner token with kubectl exec against the deployment after
waiting for its rollout, with retries, instead of kubernetes.core.k8s_exec
(the control plane's kubernetes python client is too old for it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 defaults/main.yml  | 21 +++++++++++++++++++++
 tasks/actions.yaml | 23 ++++++++---------------
 tasks/gitea.yaml   |  4 ++++
 3 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 86f6cba..6807ef6 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -6,6 +6,27 @@
 # 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
 gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
 
+# Resources for chart subcharts. These match the limits previously set by
+# hand on the live StatefulSets; the bitnami default presets (192Mi) OOM.
+gitea_valkey_resources:
+  requests:
+    cpu: 100m
+    memory: 1Gi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 8Gi
+    ephemeral-storage: 4Gi
+gitea_postgresql_resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 2Gi
+    ephemeral-storage: 2Gi
+
 # Gitea Actions runner (gitea/actions chart)
 gitea_actions_enabled: true
 gitea_actions_chart_version: 0.1.2
diff --git a/tasks/actions.yaml b/tasks/actions.yaml
index 38dcf43..8222188 100644
--- a/tasks/actions.yaml
+++ b/tasks/actions.yaml
@@ -10,24 +10,17 @@
 - name: generate and store a runner registration token
   when: runner_token_secret.resources | length == 0
   block:
-    - name: find a running gitea pod
-      kubernetes.core.k8s_info:
-        kind: Pod
-        namespace: gitea
-        label_selectors:
-          - app.kubernetes.io/name=gitea
-          - app.kubernetes.io/instance=gitea
-        field_selectors:
-          - status.phase=Running
-      register: gitea_pods
+    - name: wait for the gitea deployment to finish rolling out
+      command: kubectl -n gitea rollout status deployment/gitea --timeout=600s
+      changed_when: false
 
     - name: generate instance-level runner registration token
-      kubernetes.core.k8s_exec:
-        namespace: gitea
-        pod: "{{ gitea_pods.resources[0].metadata.name }}"
-        container: gitea
-        command: gitea actions generate-runner-token
+      command: kubectl -n gitea exec deployment/gitea -c gitea -- gitea actions generate-runner-token
       register: runner_token
+      retries: 10
+      delay: 15
+      until: runner_token.rc == 0 and (runner_token.stdout | trim | length) > 0
+      changed_when: false
       no_log: true
 
     - name: store runner registration token
diff --git a/tasks/gitea.yaml b/tasks/gitea.yaml
index 31cb8ba..4fe5865 100644
--- a/tasks/gitea.yaml
+++ b/tasks/gitea.yaml
@@ -96,6 +96,9 @@
             DEFAULT_THEME: catppuccin-blue-auto
       valkey:
         enabled: true
+        primary:
+          # The chart's default preset (192Mi) cannot load the existing dataset.
+          resources: "{{ gitea_valkey_resources }}"
       valkey-cluster:
         enabled: false
         replica:
@@ -120,6 +123,7 @@
               password: "{{ gitea_admin_password }}"
               database: gitea
         primary:
+          resources: "{{ gitea_postgresql_resources }}"
           persistence:
             enabled: true
             size: 2Ti