The /gitea/api proxy was pointing at the external Gitea hostname which
is unreachable from inside the Kubernetes cluster (no hairpin NAT). Switch
to the in-cluster service DNS, set secure: false for plain HTTP, and
remove the redundant 'Basic ' prefix from the Authorization header.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The CloudSQL proxy pod was using backstage.selectorLabels which made it
match the Backstage service selector (app.kubernetes.io/name: backstage,
app.kubernetes.io/instance: backstage). This caused Traefik to sometimes
route requests to the CloudSQL proxy instead of Backstage, resulting in
502 errors.
Changed pod labels to use distinct values (backstage-cloudsql-proxy)
so the pod is not selected by the Backstage service.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds /gitea/api proxy to access Gitea API for fetching Helm values files
in the environment provisioner.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update catalog rules to allow User and Group entities
- Add osmos-org repository as catalog location
- Enables Google OAuth sign-in for users in org.yaml
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
