From d40bc682ce0b9fd3a192a01c8ab2e433922ce5f7 Mon Sep 17 00:00:00 2001 From: Nguyen Minh Phuc Date: Wed, 22 Jul 2026 06:17:32 +0000 Subject: [PATCH] runbook: the Gitea webhook now covers the broken poll [skip ci] Registered as gogs type on all three ArgoCD-tracked repos, secret shared with argocd-secret's webhook.gogs.secret. Records how to read a failed delivery from both ends, and that a drifted secret fails validation silently -- which looks exactly like having no webhook. --- RUNBOOK.md | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-) diff --git a/RUNBOOK.md b/RUNBOOK.md index 76f4f75..e4048d8 100644 --- a/RUNBOOK.md +++ b/RUNBOOK.md @@ -564,12 +564,33 @@ noticed.** Every "auto-sync" observed on 2026-07-22 happened within seconds of a restart, i.e. it was the startup refresh, not the poll. Do not read a successful deploy straight after a restart as evidence that polling works. -There is also **no Gitea webhook configured** (`GET /api/v1/repos/gitea_admin/svcforge/hooks` -returns `[]`, and `argocd-secret` has no `webhook.gitea.secret`), so nothing covers for the -broken poll. Wiring one is the fix worth making regardless — it turns a 2-3 minute poll into -an instant push, and it does not depend on the behaviour above being repaired. +**A webhook now covers for it** (added 2026-07-22, `oci-k8s` `--tags argocd,gitea`). Gitea +POSTs every push to `https://argocd.oci-oci.duckdns.org/api/webhook`, so a commit refreshes +ArgoCD in under a second instead of waiting for a poll that never comes. -Until then, a deploy needs a nudge: +It is registered as Gitea's **`gogs`** type, which looks wrong and is not: ArgoCD's webhook +handler dispatches on the `X-Gogs-Event` header and ships no Gitea parser. Gitea forked from +Gogs and still emits that wire format on request. The shared secret lives in +`argocd-secret` as `webhook.gogs.secret` and in Ansible as `argocd_webhook_secret`; both +sides must match or every delivery fails signature validation *silently*, which looks +identical to having no webhook at all. + +Check a delivery when a push does not deploy: + +```bash +# Gitea's own record of the last attempt, including the response ArgoCD gave +curl -s -u "$USER:$PASS" \ + https://gitea.oci-oci.duckdns.org/api/v1/repos/gitea_admin/svcforge/hooks | jq '.[].id' + +# ArgoCD's side +kubectl -n argocd logs deploy/argocd-server --tail=200 | grep -i webhook +``` + +`Unknown webhook event` means the hook type is wrong (it must be `gogs`). A 400 on signature +means the secrets have drifted — re-run `03_install_addons.yml --tags argocd,gitea`, which +rewrites both ends from the same variable. + +Manual nudge, still valid if the webhook is ever down: ```bash kubectl -n argocd annotate application svcforge argocd.argoproj.io/refresh=normal --overwrite