weebo-forgejo
Manage what lives inside your Forgejo — users, organizations, repositories, credentials — as Kubernetes resources.
weebo-forgejo is a Kubernetes operator for an existing Forgejo (v16 or later). Instead of clicking through the Forgejo admin UI, you describe users, organizations, teams, repositories, webhooks, SSH keys, OAuth2 applications and access tokens as YAML, apply it to your cluster, and the operator makes Forgejo match — and keeps it that way.
Forgejo itself is not deployed by this operator: keep installing it with its own Helm chart, and point the operator at it.
What it does for you
- Your YAML is the source of truth. A change made by hand in the Forgejo UI is put back on the next pass, and nothing is sent to Forgejo when it already matches.
- It never takes over by surprise. If a name is already used in Forgejo
by something the operator didn't create, it reports the clash
(
ForgejoObjectAlreadyExists) instead of silently adopting it. Existing objects are brought in on purpose, with the importer. - Credentials land in Secrets, not in chat. Generated passwords, SSH keys, OAuth2 client secrets and access tokens are written to Kubernetes Secrets and/or Vault, ready to mount.
- Teams stay in their lane. A namespace allow-list decides which namespace may create what, in which organization, on whose behalf — checked when you apply, and again before every change.
New to the vocabulary (CR, reconcile, drift…)? Read Concepts first.
Guides
Install
Helm chart, prerequisites, what gets deployed, upgrade and uninstall.
Connect a Forgejo
Admin token, the ForgejoInstance, and where secrets are written.
Users, OIDC and teams
Local, SSO and bot accounts, organizations and team membership.
Repositories
Create, mirror and protect repositories; webhooks and deploy keys.
Credentials
OAuth2 applications and access tokens, delivered to Secrets or Vault.
The allow-list
Limit which namespace may manage which organizations and users.
Monitoring & troubleshooting
Status, reason codes, deletion, metrics and ArgoCD.
Migrate an existing Forgejo
Bring objects that already exist under management with the importer.