¶ Security And Operations
Date: 2026-02-06
- Run Gitea as non-root.
- Use least-privilege service accounts.
- Use
NetworkPolicy to limit egress/ingress if feasible.
- Keep secrets in Kubernetes Secrets.
- Do not store secret values in git or in this documentation.
- Mandatory on single-node clusters.
- Define:
- backup schedule
- retention
- restore test cadence
- Prefer versioned Helm chart upgrades (or pinned image tags).
- Rehearse upgrades in a maintenance window.
- Use TLS for UI and git HTTP.
- Choose between:
- manually managed TLS secrets
- cert-manager automation