gitea: enforce keycloak auth source via init container

services/gitea/deployment.yaml

@@ -21,6 +21,68 @@ spec:
       labels:
         app: gitea
     spec:
+      initContainers:
+        - name: configure-oidc
+          image: gitea/gitea:1.23
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+          env:
+            - name: CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-oidc
+                  key: client_id
+            - name: CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-oidc
+                  key: client_secret
+            - name: DISCOVERY_URL
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-oidc
+                  key: openid_auto_discovery_url
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              APPINI=/data/gitea/conf/app.ini
+              BIN=/usr/local/bin/gitea
+
+              list="$($BIN -c "$APPINI" admin auth list)"
+              id=$(echo "$list" | awk '$2=="keycloak"{print $1}')
+
+              if [ -n "$id" ]; then
+                echo "Updating existing auth source id=$id"
+                $BIN -c "$APPINI" admin auth update-oauth \
+                  --id "$id" \
+                  --name keycloak \
+                  --provider openidConnect \
+                  --key "$CLIENT_ID" \
+                  --secret "$CLIENT_SECRET" \
+                  --auto-discover-url "$DISCOVERY_URL" \
+                  --scopes "openid profile email" \
+                  --group-claim-name groups \
+                  --admin-group admin \
+                  --skip-local-2fa
+              else
+                echo "Creating keycloak auth source"
+                $BIN -c "$APPINI" admin auth add-oauth \
+                  --name keycloak \
+                  --provider openidConnect \
+                  --key "$CLIENT_ID" \
+                  --secret "$CLIENT_SECRET" \
+                  --auto-discover-url "$DISCOVERY_URL" \
+                  --scopes "openid profile email" \
+                  --group-claim-name groups \
+                  --admin-group admin \
+                  --skip-local-2fa
+              fi
+          volumeMounts:
+            - name: gitea-data
+              mountPath: /data
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
       affinity: