Kubernetes operator · Forgejo v16+

weebo-forgejo

Manage the inside of an existing Forgejo — users, organizations, repositories, webhooks, keys, OAuth2 applications and access tokens — as Kubernetes custom resources, with GitOps-friendly status and a namespace allow-list.

Get started Read the docs View on GitHub

1 · Install the chart

helm install weebo-forgejo \
  oci://ghcr.io/batleforc/charts/weebo-forgejo \
  --namespace weebo-forgejo --create-namespace

2 · Declare a repository

apiVersion: forgejo.weebo.io/v1alpha1
kind: ForgejoRepository
metadata:
  name: platform-api
  namespace: team-platform
spec:
  organizationRef: { name: platform }
  name: platform-api
  private: true

Declare Forgejo

Users, organizations, teams, repositories, webhooks, deploy keys and branch protection are Kubernetes resources. Apply YAML, and the operator keeps Forgejo in line with it.

Quickstart

Hand out credentials

OAuth2 applications and access tokens are minted by the operator and written straight into Secrets (or Vault), rotated on request, never pasted by hand.

Credentials guide

Fence namespaces

An allow-list says which namespaces may manage which organizations. It is enforced by an admission webhook, before anything reaches Forgejo.

Allow-list guide