Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,671 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+readonly EXPECTED_KUSTOMIZE_VERSION="v5.8.1"
+readonly EXPECTED_HELM_VERSION="v3.19.4"
+readonly TARGET_KUBERNETES_VERSION="1.36.2"
+readonly CNPG_CHART_NAME="cloudnative-pg"
+readonly CNPG_CHART_VERSION="0.29.0"
+readonly CNPG_CHART_REPOSITORY="https://cloudnative-pg.github.io/charts"
+readonly EXPECTED_CNPG_CHART_SHA256="668e065ff53508d58238788fd35b355a925060843629a951df0e6a9362e6d32f"
+readonly GITEA_CHART_NAME="gitea"
+readonly GITEA_CHART_VERSION="12.7.0"
+readonly GITEA_CHART_REPOSITORY="https://dl.gitea.com/charts/"
+readonly EXPECTED_GITEA_CHART_SHA256="5881ef9c59400bee2d5547e77c4cd0efb925143c2f5d93fb4f38446db76b0167"
+readonly REPOSITORY_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
+readonly -a RENDERED_MANIFEST_NAMES=(
+  namespaces
+  ssd-local-pv
+  cnpg-operator
+  platform-postgres
+  gitea
+  gitea-oidc
+)
+
+fail() {
+  printf 'ERROR: %s\n' "$*" >&2
+  exit 1
+}
+
+assert_exact_source_text() {
+  local file="$1"
+  local expected_text="$2"
+  local description="$3"
+  local count
+
+  count="$(rg --count-matches --fixed-strings -- "$expected_text" "$file" || true)"
+  [[ "$count" == "1" ]] || \
+    fail "${description} must appear exactly once in ${file#${REPOSITORY_ROOT}/}"
+}
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  bash scripts/validate/render-phase1.sh
+  bash scripts/validate/render-phase1.sh \
+    --verified-output-dir /tmp/platform-phase1-apply.XXXXXX
+
+The output option is an internal handoff used only by the Phase 1 apply
+script. The destination must be an existing, empty, non-symlink directory
+created directly below /tmp with the platform-phase1-apply.* prefix.
+USAGE
+}
+
+verified_output_dir=""
+case "$#" in
+  0)
+    ;;
+  2)
+    [[ "$1" == "--verified-output-dir" ]] || {
+      usage >&2
+      exit 2
+    }
+    verified_output_dir="$2"
+    ;;
+  *)
+    usage >&2
+    exit 2
+    ;;
+esac
+
+if [[ -n "$verified_output_dir" ]]; then
+  [[ "$verified_output_dir" == /tmp/platform-phase1-apply.* ]] || \
+    fail "verified output directory must match /tmp/platform-phase1-apply.*"
+  [[ -d "$verified_output_dir" && ! -L "$verified_output_dir" ]] || \
+    fail "verified output directory must be an existing non-symlink directory"
+  [[ "$(cd -- "$verified_output_dir" && pwd -P)" == "$verified_output_dir" ]] || \
+    fail "verified output directory must be an absolute canonical path"
+  [[ -O "$verified_output_dir" ]] || \
+    fail "verified output directory must be owned by the current user"
+  [[ "$(stat --format='%a' -- "$verified_output_dir")" == "700" ]] || \
+    fail "verified output directory must have mode 0700"
+  [[ -z "$(find "$verified_output_dir" -mindepth 1 -maxdepth 1 -print -quit)" ]] || \
+    fail "verified output directory must be empty"
+fi
+
+command -v kubectl >/dev/null 2>&1 || fail "kubectl is required"
+command -v jq >/dev/null 2>&1 || fail "jq is required"
+command -v rg >/dev/null 2>&1 || fail "ripgrep (rg) is required"
+command -v sha256sum >/dev/null 2>&1 || fail "sha256sum is required"
+command -v tar >/dev/null 2>&1 || fail "tar is required"
+command -v cmp >/dev/null 2>&1 || fail "cmp is required"
+command -v find >/dev/null 2>&1 || fail "find is required"
+command -v install >/dev/null 2>&1 || fail "install is required"
+command -v stat >/dev/null 2>&1 || fail "stat is required"
+
+if [[ -n "${PLATFORM_HELM_BIN:-}" ]]; then
+  [[ "$PLATFORM_HELM_BIN" == /* ]] || \
+    fail "PLATFORM_HELM_BIN must be an absolute path"
+  [[ -f "$PLATFORM_HELM_BIN" && -x "$PLATFORM_HELM_BIN" ]] || \
+    fail "PLATFORM_HELM_BIN is not an executable file: ${PLATFORM_HELM_BIN}"
+  readonly HELM_BIN="$PLATFORM_HELM_BIN"
+else
+  HELM_BIN="$(command -v helm 2>/dev/null)" || \
+    fail "Helm ${EXPECTED_HELM_VERSION} is required"
+  readonly HELM_BIN
+fi
+
+kustomize_version="$(kubectl version --client --output=yaml | sed -n 's/^kustomizeVersion: //p')"
+helm_version="$("$HELM_BIN" version --template '{{.Version}}')"
+
+[[ "$kustomize_version" == "$EXPECTED_KUSTOMIZE_VERSION" ]] || \
+  fail "expected Kustomize ${EXPECTED_KUSTOMIZE_VERSION}, found ${kustomize_version:-unknown}"
+[[ "$helm_version" == "$EXPECTED_HELM_VERSION" ]] || \
+  fail "expected Helm ${EXPECTED_HELM_VERSION}, found ${helm_version:-unknown}"
+
+render_dir="$(mktemp -d "${TMPDIR:-/tmp}/platform-phase1-render.XXXXXX")"
+declare -a generated_chart_cache_dirs=()
+declare -a generated_chart_cache_parent_dirs=()
+cleanup() {
+  local cache_dir
+  local parent_dir
+
+  for cache_dir in "${generated_chart_cache_dirs[@]}"; do
+    case "$cache_dir" in
+      "${REPOSITORY_ROOT}/infrastructure/controllers/cloudnative-pg/.helm/charts/cloudnative-pg-0.29.0"|\
+      "${REPOSITORY_ROOT}/services/gitea/profiles/oidc/.helm/charts/gitea-12.7.0")
+        rm -rf -- "$cache_dir"
+        ;;
+      *)
+        printf 'WARNING: refusing to remove unexpected chart cache: %s\n' \
+          "$cache_dir" >&2
+        ;;
+    esac
+  done
+  for parent_dir in "${generated_chart_cache_parent_dirs[@]}"; do
+    case "$parent_dir" in
+      "${REPOSITORY_ROOT}/infrastructure/controllers/cloudnative-pg/.helm/charts"|\
+      "${REPOSITORY_ROOT}/infrastructure/controllers/cloudnative-pg/.helm"|\
+      "${REPOSITORY_ROOT}/services/gitea/profiles/oidc/.helm/charts"|\
+      "${REPOSITORY_ROOT}/services/gitea/profiles/oidc/.helm")
+        rmdir -- "$parent_dir" 2>/dev/null || true
+        ;;
+      *)
+        printf 'WARNING: refusing to remove unexpected chart cache parent: %s\n' \
+          "$parent_dir" >&2
+        ;;
+    esac
+  done
+
+
+  case "$render_dir" in
+    /tmp/platform-phase1-render.*|"${TMPDIR:-/tmp}"/platform-phase1-render.*)
+      rm -rf -- "$render_dir"
+      ;;
+    *)
+      printf 'WARNING: refusing to remove unexpected render directory: %s\n' "$render_dir" >&2
+      ;;
+  esac
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+render_plain() {
+  local label="$1"
+  local relative_path="$2"
+  local output="${render_dir}/${label}.yaml"
+
+  kubectl kustomize "${REPOSITORY_ROOT}/${relative_path}" >"$output"
+  [[ -s "$output" ]] || fail "${label} rendered an empty manifest"
+  printf 'Rendered %-20s %8s bytes\n' "$label" "$(wc -c <"$output" | tr -d '[:space:]')"
+}
+
+render_helm() {
+  local label="$1"
+  local relative_path="$2"
+  local output="${render_dir}/${label}.yaml"
+
+  kubectl kustomize \
+    --enable-helm \
+    --helm-command "$HELM_BIN" \
+    --helm-kube-version "$TARGET_KUBERNETES_VERSION" \
+    "${REPOSITORY_ROOT}/${relative_path}" >"$output"
+  [[ -s "$output" ]] || fail "${label} rendered an empty manifest"
+  printf 'Rendered %-20s %8s bytes\n' "$label" "$(wc -c <"$output" | tr -d '[:space:]')"
+}
+
+extract_rendered_document() {
+  local manifest="$1"
+  local wanted_kind="$2"
+  local wanted_name="$3"
+  local output="$4"
+
+  awk \
+    -v wanted_kind="$wanted_kind" \
+    -v wanted_name="$wanted_name" \
+    '
+      function reset_document() {
+        document = ""
+        document_kind = ""
+        document_name = ""
+        in_metadata = 0
+      }
+
+      function flush_document() {
+        if (document_kind == wanted_kind && document_name == wanted_name) {
+          matches++
+          printf "%s", document
+        }
+      }
+
+      BEGIN {
+        reset_document()
+      }
+
+      /^---[[:space:]]*$/ {
+        flush_document()
+        reset_document()
+        next
+      }
+
+      {
+        document = document $0 ORS
+
+        if ($0 ~ /^kind:[[:space:]]*/) {
+          document_kind = $0
+          sub(/^kind:[[:space:]]*/, "", document_kind)
+          sub(/[[:space:]]*$/, "", document_kind)
+        }
+
+        if ($0 == "metadata:") {
+          in_metadata = 1
+          next
+        }
+
+        if (in_metadata && $0 ~ /^  name:[[:space:]]*/) {
+          document_name = $0
+          sub(/^  name:[[:space:]]*/, "", document_name)
+          sub(/[[:space:]]*$/, "", document_name)
+          in_metadata = 0
+        } else if (in_metadata && $0 ~ /^[^[:space:]]/) {
+          in_metadata = 0
+        }
+      }
+
+      END {
+        flush_document()
+        if (matches != 1) {
+          exit 42
+        }
+      }
+    ' \
+    "$manifest" >"$output"
+}
+
+prepare_verified_chart_cache() {
+  local label="$1"
+  local chart_name="$2"
+  local chart_repository="$3"
+  local chart_version="$4"
+  local build_root_relative_path="$5"
+  local expected_digest="$6"
+  local package_path="${render_dir}/${chart_name}-${chart_version}.tgz"
+  local cache_version_dir="${REPOSITORY_ROOT}/${build_root_relative_path}/.helm/charts/${chart_name}-${chart_version}"
+  local checksum_output
+  local actual_digest
+  local chart_cache_dir="${cache_version_dir%/*}"
+  local helm_cache_dir="${chart_cache_dir%/*}"
+  local cache_parent
+
+  if [[ ! -f "$package_path" ]]; then
+    "$HELM_BIN" pull "$chart_name" \
+      --repo "$chart_repository" \
+      --version "$chart_version" \
+      --destination "$render_dir"
+  fi
+
+  [[ -f "$package_path" ]] || fail "${label} chart package was not downloaded: ${package_path}"
+  checksum_output="$(sha256sum -- "$package_path")"
+  actual_digest="${checksum_output%% *}"
+  [[ "$actual_digest" == "$expected_digest" ]] || \
+    fail "${label} chart package SHA-256 mismatch: expected ${expected_digest}, found ${actual_digest}"
+
+  case "$cache_version_dir" in
+    "${REPOSITORY_ROOT}/infrastructure/controllers/cloudnative-pg/.helm/charts/cloudnative-pg-0.29.0"|\
+    "${REPOSITORY_ROOT}/services/gitea/profiles/oidc/.helm/charts/gitea-12.7.0")
+      ;;
+    *)
+      fail "refusing to create unexpected chart cache directory: ${cache_version_dir}"
+      ;;
+  esac
+  for cache_parent in "$helm_cache_dir" "$chart_cache_dir"; do
+    [[ ! -L "$cache_parent" ]] || \
+      fail "refusing symlinked chart cache parent: ${cache_parent}"
+    [[ ! -e "$cache_parent" || -d "$cache_parent" ]] || \
+      fail "chart cache parent is not a directory: ${cache_parent}"
+  done
+  [[ ! -e "$cache_version_dir" && ! -L "$cache_version_dir" ]] || \
+    fail "generated chart cache already exists; remove it only after confirming it is disposable: ${cache_version_dir}"
+  [[ -e "$chart_cache_dir" ]] || generated_chart_cache_parent_dirs+=("$chart_cache_dir")
+  [[ -e "$helm_cache_dir" ]] || generated_chart_cache_parent_dirs+=("$helm_cache_dir")
+
+  mkdir -p -- "$cache_version_dir"
+  generated_chart_cache_dirs+=("$cache_version_dir")
+  tar -xzf "$package_path" -C "$cache_version_dir"
+  [[ -f "${cache_version_dir}/${chart_name}/Chart.yaml" ]] || \
+    fail "${label} extracted chart is missing Chart.yaml"
+
+  printf 'Verified %-20s SHA-256 %s\n' "$label" "$actual_digest"
+}
+
+cd -- "$REPOSITORY_ROOT"
+
+if rg --line-number --glob '*.yaml' --glob '*.yml' \
+  --glob '!**/.helm/**' --glob '!**/charts/**' \
+  '^[[:space:]]*kind:[[:space:]]*Secret[[:space:]]*$' \
+  infrastructure services bootstrap clusters components; then
+  fail "a source-controlled Kubernetes Secret manifest was found"
+fi
+
+if rg --line-number --glob 'kustomization.yaml' 'LoadRestrictionsNone|load-restrictor' .; then
+  fail "the repository must keep Kustomize LoadRestrictionsRootOnly"
+fi
+
+readonly GITEA_BASELINE_KUSTOMIZATION="${REPOSITORY_ROOT}/services/gitea/kustomization.yaml"
+readonly GITEA_OIDC_KUSTOMIZATION="${REPOSITORY_ROOT}/services/gitea/profiles/oidc/kustomization.yaml"
+for gitea_kustomization in \
+  "$GITEA_BASELINE_KUSTOMIZATION" \
+  "$GITEA_OIDC_KUSTOMIZATION"; do
+  assert_exact_source_text "$gitea_kustomization" \
+    'repo: https://dl.gitea.com/charts/' \
+    "the pinned Gitea Chart repository"
+  assert_exact_source_text "$gitea_kustomization" \
+    'version: 12.7.0' \
+    "the pinned Gitea Chart version"
+  assert_exact_source_text "$gitea_kustomization" \
+    'includeCRDs: false' \
+    "the Gitea includeCRDs policy"
+  assert_exact_source_text "$gitea_kustomization" \
+    'skipTests: true' \
+    "the Gitea Helm test policy"
+done
+assert_exact_source_text "$GITEA_BASELINE_KUSTOMIZATION" \
+  'chartHome: profiles/oidc/.helm/charts' \
+  "the baseline Gitea verified Chart cache"
+assert_exact_source_text "$GITEA_BASELINE_KUSTOMIZATION" \
+  'valuesFile: profiles/oidc/values/baseline.yaml' \
+  "the baseline Gitea values path"
+assert_exact_source_text "$GITEA_OIDC_KUSTOMIZATION" \
+  'chartHome: .helm/charts' \
+  "the OIDC Gitea verified Chart cache"
+assert_exact_source_text "$GITEA_OIDC_KUSTOMIZATION" \
+  'valuesFile: values/baseline.yaml' \
+  "the OIDC Gitea baseline values path"
+assert_exact_source_text "$GITEA_OIDC_KUSTOMIZATION" \
+  'additionalValuesFiles:' \
+  "the OIDC Gitea values merge"
+assert_exact_source_text "$GITEA_OIDC_KUSTOMIZATION" \
+  'values/oidc.yaml' \
+  "the OIDC Gitea override path"
+
+render_plain namespaces infrastructure/namespaces/overlays/home
+render_plain ssd-local-pv infrastructure/storage/ssd-local-pv
+prepare_verified_chart_cache \
+  cloudnative-pg-chart \
+  "$CNPG_CHART_NAME" \
+  "$CNPG_CHART_REPOSITORY" \
+  "$CNPG_CHART_VERSION" \
+  infrastructure/controllers/cloudnative-pg \
+  "$EXPECTED_CNPG_CHART_SHA256"
+render_helm cnpg-operator infrastructure/controllers/cloudnative-pg
+render_plain platform-postgres services/platform-postgres
+prepare_verified_chart_cache \
+  gitea-chart \
+  "$GITEA_CHART_NAME" \
+  "$GITEA_CHART_REPOSITORY" \
+  "$GITEA_CHART_VERSION" \
+  services/gitea/profiles/oidc \
+  "$EXPECTED_GITEA_CHART_SHA256"
+render_helm gitea services/gitea
+
+render_helm gitea-oidc services/gitea/profiles/oidc
+[[ "$(awk '$0 == "kind: Cluster" { count++ } END { print count + 0 }' "${render_dir}/platform-postgres.yaml")" == "1" ]] || \
+  fail "the Phase 1 PostgreSQL root must contain exactly one Cluster"
+[[ "$(awk '$0 == "kind: DatabaseRole" { count++ } END { print count + 0 }' "${render_dir}/platform-postgres.yaml")" == "1" ]] || \
+  fail "the Phase 1 PostgreSQL root must contain exactly one Gitea DatabaseRole"
+[[ "$(awk '$0 == "kind: Database" { count++ } END { print count + 0 }' "${render_dir}/platform-postgres.yaml")" == "1" ]] || \
+  fail "the Phase 1 PostgreSQL root must contain exactly one Gitea Database"
+[[ "$(awk '$0 == "kind: NetworkPolicy" { count++ } END { print count + 0 }' "${render_dir}/platform-postgres.yaml")" == "1" ]] || \
+  fail "the Phase 1 PostgreSQL root must contain exactly one base NetworkPolicy"
+[[ "$(rg --count -- '^[[:space:]]*name:[[:space:]]platform-postgres-gitea[[:space:]]*$' "${render_dir}/platform-postgres.yaml" || true)" == "2" ]] || \
+  fail "the Phase 1 PostgreSQL root must contain the Gitea DatabaseRole and Database"
+if rg --quiet '^[[:space:]]*name:[[:space:]]platform-postgres-keycloak[[:space:]]*$' "${render_dir}/platform-postgres.yaml"; then
+  fail "the Phase 1 PostgreSQL root must not contain a Keycloak DatabaseRole or Database"
+fi
+[[ "$(rg --count -- '^[[:space:]]*-[[:space:]]host gitea gitea all scram-sha-256[[:space:]]*$' "${render_dir}/platform-postgres.yaml" || true)" == "1" ]] || \
+  fail "the Gitea role must authenticate only to the Gitea database"
+[[ "$(rg --count -- '^[[:space:]]*-[[:space:]]host all gitea all reject[[:space:]]*$' "${render_dir}/platform-postgres.yaml" || true)" == "1" ]] || \
+  fail "the Gitea role must be rejected from every other database"
+[[ "$(rg --count -- '^[[:space:]]*-[[:space:]]host keycloak keycloak all scram-sha-256[[:space:]]*$' "${render_dir}/platform-postgres.yaml" || true)" == "1" ]] || \
+  fail "the Keycloak role must authenticate only to the Keycloak database"
+[[ "$(rg --count -- '^[[:space:]]*-[[:space:]]host all keycloak all reject[[:space:]]*$' "${render_dir}/platform-postgres.yaml" || true)" == "1" ]] || \
+  fail "the Keycloak role must be rejected from every other database"
+
+
+rg --quiet '^kind: CustomResourceDefinition$' "${render_dir}/cnpg-operator.yaml" || \
+  fail "CloudNativePG CRDs are missing from the operator render"
+rg --quiet '^kind: Cluster$' "${render_dir}/platform-postgres.yaml" || \
+  fail "the platform PostgreSQL Cluster is missing"
+rg --quiet '^kind: DatabaseRole$' "${render_dir}/platform-postgres.yaml" || \
+  fail "the Gitea DatabaseRole is missing"
+rg --quiet '^kind: Database$' "${render_dir}/platform-postgres.yaml" || \
+  fail "the Gitea Database is missing"
+for gitea_profile in gitea gitea-oidc; do
+  gitea_profile_manifest="${render_dir}/${gitea_profile}.yaml"
+  gitea_profile_deployment_document="${render_dir}/${gitea_profile}-deployment.yaml"
+  gitea_profile_ingress_document="${render_dir}/${gitea_profile}-ingress.yaml"
+  gitea_profile_servicemonitor_document="${render_dir}/${gitea_profile}-servicemonitor.yaml"
+
+  rg --quiet '^kind: PersistentVolumeClaim$' "$gitea_profile_manifest" || \
+    fail "${gitea_profile} is missing the Gitea PVC"
+  rg --quiet '^kind: Ingress$' "$gitea_profile_manifest" || \
+    fail "${gitea_profile} is missing the Gitea Ingress"
+  rg --quiet \
+    '^[[:space:]]*-[[:space:]]*host:[[:space:]]*git\.learn\.hyeonworks\.com[[:space:]]*$' \
+    "$gitea_profile_manifest" || \
+    fail "${gitea_profile} Ingress host is not git.learn.hyeonworks.com"
+  [[ "$(rg --count-matches \
+    '^[[:space:]]*ROOT_URL=https://git\.learn\.hyeonworks\.com/[[:space:]]*$' \
+    "$gitea_profile_manifest" || true)" == "1" ]] || \
+    fail "${gitea_profile} must render the external HTTPS ROOT_URL exactly once"
+
+  extract_rendered_document \
+    "$gitea_profile_manifest" \
+    Deployment \
+    gitea \
+    "$gitea_profile_deployment_document" || \
+    fail "${gitea_profile} must contain exactly one gitea Deployment"
+  extract_rendered_document \
+    "$gitea_profile_manifest" \
+    Ingress \
+    gitea-http \
+    "$gitea_profile_ingress_document" || \
+    fail "${gitea_profile} must contain exactly one gitea-http Ingress"
+  extract_rendered_document \
+    "$gitea_profile_manifest" \
+    ServiceMonitor \
+    gitea \
+    "$gitea_profile_servicemonitor_document" || \
+    fail "${gitea_profile} must contain exactly one gitea ServiceMonitor"
+  if rg --quiet '^[[:space:]]{2}tls:[[:space:]]*' "$gitea_profile_ingress_document"; then
+    fail "${gitea_profile} must not render an in-cluster TLS section"
+  fi
+
+  if ! kubectl create --dry-run=client \
+    -f "$gitea_profile_servicemonitor_document" \
+    -o json | jq -e '
+      .apiVersion == "monitoring.coreos.com/v1" and
+      .kind == "ServiceMonitor" and
+      .metadata.name == "gitea" and
+      .metadata.namespace == "gitea" and
+      .metadata.labels["observability.hyeonworks.com/instance"] == "home" and
+      .spec.jobLabel == "app.kubernetes.io/name" and
+      .spec.selector.matchLabels == {
+        "app.kubernetes.io/instance": "gitea",
+        "app.kubernetes.io/name": "gitea"
+      } and
+      .spec.endpoints == [{
+        "interval": "30s",
+        "port": "http",
+        "scrapeTimeout": "10s"
+      }]
+    ' >/dev/null; then
+    fail "${gitea_profile} ServiceMonitor contract is not exact"
+  fi
+
+  for restricted_setting in \
+    'allowPrivilegeEscalation: false' \
+    'runAsNonRoot: true' \
+    'type: RuntimeDefault' \
+    '- ALL'; do
+    [[ "$(rg --count-matches --fixed-strings -- "$restricted_setting" \
+      "$gitea_profile_deployment_document" || true)" == "4" ]] || \
+      fail "${gitea_profile} must apply ${restricted_setting} to all four containers"
+  done
+done
+
+for forbidden_baseline_marker in \
+  'gitea-keycloak-oidc' \
+  'id.learn.hyeonworks.com' \
+  'gitea-allow-host-nginx-keycloak' \
+  'gitea-branding-assets' \
+  'gitea-branding-templates' \
+  'ALLOW_ONLY_EXTERNAL_REGISTRATION=true'; do
+  if rg --quiet --fixed-strings -- "$forbidden_baseline_marker" "${render_dir}/gitea.yaml"; then
+    fail "the baseline Gitea render contains OIDC-only marker ${forbidden_baseline_marker}"
+  fi
+done
+for baseline_setting in \
+  'DISABLE_REGISTRATION=true' \
+  'ALLOW_ONLY_EXTERNAL_REGISTRATION=false' \
+  'SHOW_REGISTRATION_BUTTON=false' \
+  'ENABLE_PASSWORD_SIGNIN_FORM=true'; do
+  [[ "$(rg --count-matches --fixed-strings -- "$baseline_setting" \
+    "${render_dir}/gitea.yaml" || true)" == "1" ]] || \
+    fail "the baseline Gitea render must contain exactly one ${baseline_setting} setting"
+done
+
+gitea_deployment_document="${render_dir}/gitea-oidc-deployment.yaml"
+gitea_keycloak_policy_document="${render_dir}/gitea-keycloak-egress-policy.yaml"
+gitea_branding_assets_document="${render_dir}/gitea-branding-assets-configmap.yaml"
+gitea_branding_templates_document="${render_dir}/gitea-branding-templates-configmap.yaml"
+
+extract_rendered_document \
+  "${render_dir}/gitea-oidc.yaml" \
+  Deployment \
+  gitea \
+  "$gitea_deployment_document" || \
+  fail "the Gitea render must contain exactly one gitea Deployment"
+extract_rendered_document \
+  "${render_dir}/gitea-oidc.yaml" \
+  NetworkPolicy \
+  gitea-allow-host-nginx-keycloak \
+  "$gitea_keycloak_policy_document" || \
+  fail "the Gitea render must contain exactly one dedicated Keycloak egress NetworkPolicy"
+
+# Assert only references to the externally-created OIDC credential Secret.
+# No credential payload is rendered, decoded, read, or printed by these checks.
+rg --quiet --multiline \
+  '(?s)- name: GITEA_OAUTH_KEY_0\n[[:space:]]+valueFrom:\n[[:space:]]+secretKeyRef:\n[[:space:]]+key: key\n[[:space:]]+name: gitea-keycloak-oidc' \
+  "$gitea_deployment_document" || \
+  fail "the Gitea Deployment does not reference gitea-keycloak-oidc key=key"
+rg --quiet --multiline \
+  '(?s)- name: GITEA_OAUTH_SECRET_0\n[[:space:]]+valueFrom:\n[[:space:]]+secretKeyRef:\n[[:space:]]+key: secret\n[[:space:]]+name: gitea-keycloak-oidc' \
+  "$gitea_deployment_document" || \
+  fail "the Gitea Deployment does not reference gitea-keycloak-oidc key=secret"
+[[ "$(rg --count-matches --fixed-strings \
+  'https://id.learn.hyeonworks.com/realms/hyeonworks/.well-known/openid-configuration' \
+  "${render_dir}/gitea-oidc.yaml" || true)" == "2" ]] || \
+  fail "the Gitea OAuth add/update script must use the exact Keycloak discovery URL"
+
+# These are non-sensitive app.ini policy values rendered by the pinned Chart.
+for expected_setting in \
+  'ALLOW_ONLY_EXTERNAL_REGISTRATION=true' \
+  'DISABLE_REGISTRATION=false' \
+  'SHOW_REGISTRATION_BUTTON=false' \
+  'ENABLE_PASSWORD_SIGNIN_FORM=true' \
+  'ENABLE_AUTO_REGISTRATION=true' \
+  'USERNAME=preferred_username' \
+  'ACCOUNT_LINKING=login' \
+  'OPENID_CONNECT_SCOPES=profile email'; do
+  [[ "$(rg --count-matches --fixed-strings "$expected_setting" \
+    "${render_dir}/gitea-oidc.yaml" || true)" == "1" ]] || \
+    fail "the Gitea render must contain exactly one ${expected_setting} setting"
+done
+
+if rg --quiet '^[[:space:]]*hostAliases:' "$gitea_deployment_document"; then
+  fail "the Gitea Deployment must rely on CoreDNS and must not contain hostAliases"
+fi
+
+[[ "$(rg --count-matches \
+  '^[[:space:]]*cidr:[[:space:]]*192\.168\.0\.107/32[[:space:]]*$' \
+  "$gitea_keycloak_policy_document" || true)" == "1" ]] || \
+  fail "the dedicated Keycloak egress policy must allow exactly 192.168.0.107/32"
+[[ "$(rg --count-matches \
+  '^[[:space:]]*-[[:space:]]*port:[[:space:]]*443[[:space:]]*$' \
+  "$gitea_keycloak_policy_document" || true)" == "1" ]] || \
+  fail "the dedicated Keycloak egress policy must allow exactly TCP port 443"
+[[ "$(rg --count-matches \
+  '^[[:space:]]*protocol:[[:space:]]*TCP[[:space:]]*$' \
+  "$gitea_keycloak_policy_document" || true)" == "1" ]] || \
+  fail "the dedicated Keycloak egress policy must use TCP"
+rg --quiet \
+  '^[[:space:]]*-[[:space:]]*Egress[[:space:]]*$' \
+  "$gitea_keycloak_policy_document" || \
+  fail "the dedicated Keycloak NetworkPolicy must select egress traffic"
+
+gitea_branding_assets_configmap_name="$(
+  (rg --only-matching --no-filename \
+    'gitea-branding-assets-[a-z0-9]+' \
+    "${render_dir}/gitea-oidc.yaml" || true) |
+    LC_ALL=C sort --unique
+)"
+gitea_branding_templates_configmap_name="$(
+  (rg --only-matching --no-filename \
+    'gitea-branding-templates-[a-z0-9]+' \
+    "${render_dir}/gitea-oidc.yaml" || true) |
+    LC_ALL=C sort --unique
+)"
+[[ "$gitea_branding_assets_configmap_name" =~ ^gitea-branding-assets-[a-z0-9]{10}$ ]] || \
+  fail "the Gitea branding assets ConfigMap must have one Kustomize content hash"
+[[ "$gitea_branding_templates_configmap_name" =~ ^gitea-branding-templates-[a-z0-9]{10}$ ]] || \
+  fail "the Gitea branding templates ConfigMap must have one Kustomize content hash"
+
+extract_rendered_document \
+  "${render_dir}/gitea-oidc.yaml" \
+  ConfigMap \
+  "$gitea_branding_assets_configmap_name" \
+  "$gitea_branding_assets_document" || \
+  fail "the Gitea render must contain exactly one branding assets ConfigMap"
+extract_rendered_document \
+  "${render_dir}/gitea-oidc.yaml" \
+  ConfigMap \
+  "$gitea_branding_templates_configmap_name" \
+  "$gitea_branding_templates_document" || \
+  fail "the Gitea render must contain exactly one branding templates ConfigMap"
+
+for asset_key in hyeonworks.css logo.svg favicon.svg; do
+  [[ "$(rg --count-matches \
+    "^[[:space:]]{2}${asset_key//./\\.}:[[:space:]]*\\|[+-]?[[:space:]]*$" \
+    "$gitea_branding_assets_document" || true)" == "1" ]] || \
+    fail "the branding assets ConfigMap must contain exactly one ${asset_key}"
+done
+for template_key in header.tmpl extra_links.tmpl; do
+  [[ "$(rg --count-matches \
+    "^[[:space:]]{2}${template_key//./\\.}:[[:space:]]*\\|[+-]?[[:space:]]*$" \
+    "$gitea_branding_templates_document" || true)" == "1" ]] || \
+    fail "the branding templates ConfigMap must contain exactly one ${template_key}"
+done
+
+[[ "$(rg --count-matches --fixed-strings \
+  "$gitea_branding_assets_configmap_name" \
+  "$gitea_deployment_document" || true)" == "1" ]] || \
+  fail "the Gitea Deployment must reference the hashed branding assets ConfigMap once"
+[[ "$(rg --count-matches --fixed-strings \
+  "$gitea_branding_templates_configmap_name" \
+  "$gitea_deployment_document" || true)" == "1" ]] || \
+  fail "the Gitea Deployment must reference the hashed branding templates ConfigMap once"
+rg --quiet --multiline \
+  '(?s)- mountPath: /data/gitea/public/assets\n[[:space:]]+name: branding-assets\n[[:space:]]+readOnly: true' \
+  "$gitea_deployment_document" || \
+  fail "the Gitea branding assets must be mounted read-only at the official custom path"
+rg --quiet --multiline \
+  '(?s)- mountPath: /data/gitea/templates/custom\n[[:space:]]+name: branding-templates\n[[:space:]]+readOnly: true' \
+  "$gitea_deployment_document" || \
+  fail "the Gitea branding templates must be mounted read-only at the official custom path"
+
+if rg --quiet '^[[:space:]]*type:[[:space:]]*(NodePort|LoadBalancer)[[:space:]]*$' \
+  "${render_dir}/platform-postgres.yaml" \
+  "${render_dir}/gitea.yaml" \
+  "${render_dir}/gitea-oidc.yaml"; then
+  fail "an application service is exposed as NodePort or LoadBalancer"
+fi
+
+if rg --quiet '^[[:space:]]*name:[[:space:]]*gitea-ssh[[:space:]]*$' \
+  "${render_dir}/gitea.yaml" "${render_dir}/gitea-oidc.yaml"; then
+  fail "the disabled Gitea SSH Service is still rendered"
+fi
+
+if [[ -n "$verified_output_dir" ]]; then
+  for manifest_name in "${RENDERED_MANIFEST_NAMES[@]}"; do
+    source_manifest="${render_dir}/${manifest_name}.yaml"
+    output_manifest="${verified_output_dir}/${manifest_name}.yaml"
+
+    [[ -f "$source_manifest" && ! -L "$source_manifest" && -s "$source_manifest" ]] || \
+      fail "validated manifest is missing or unsafe: ${source_manifest}"
+    install -m 0600 -- "$source_manifest" "$output_manifest"
+    [[ -f "$output_manifest" && ! -L "$output_manifest" && -s "$output_manifest" ]] || \
+      fail "verified manifest handoff failed: ${output_manifest}"
+    cmp --silent -- "$source_manifest" "$output_manifest" || \
+      fail "verified manifest changed during handoff: ${manifest_name}.yaml"
+  done
+  verified_entry_count="$(find "$verified_output_dir" -mindepth 1 -maxdepth 1 | wc -l | tr -d '[:space:]')"
+  [[ "$verified_entry_count" == "${#RENDERED_MANIFEST_NAMES[@]}" ]] || \
+    fail "verified output directory does not contain exactly six manifest files"
+  printf 'Preserved six verified manifests for the apply handoff.\n'
+fi
+
+printf 'Phase 1 baseline and Gitea OIDC desired rendering invariants passed.\n'
+printf 'Temporary rendered manifests and generated chart caches will be removed on exit.\n'