deploy: fix image name to match Gitea repository name

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/commands/ship.md

@@ -0,0 +1 @@
+Commit all staged and unstaged changes into git, assign the next tag in sequence, then ask for confirmation before pushing.

.gitea/workflows/build.yaml

@@ -30,10 +30,12 @@ jobs:
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             TAG=${{ inputs.tag }}
           fi
-          IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}:$TAG
+          REPO=gitea.home.hrajfrisbee.cz/${{ github.repository }}
           docker build -f Dockerfile \
             --build-arg GIT_TAG=$TAG \
             --build-arg GIT_COMMIT=${{ github.sha }} \
             --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
-            -t $IMAGE .
-          docker push $IMAGE
+            -t $REPO:$TAG \
+            -t $REPO:latest .
+          docker push $REPO:$TAG
+          docker push $REPO:latest

CLAUDE.md

@@ -0,0 +1,5 @@
+# Claude Instructions
+
+## Git
+
+- Always ask for confirmation before running `git push`.

deploy/deployment_gateway-cert-operator.yaml

@@ -17,6 +17,8 @@ spec:
         app.kubernetes.io/name: gateway-cert-operator
         app.kubernetes.io/component: operator
     spec:
+      imagePullSecrets:
+        - name: gitea-registry
       serviceAccountName: gateway-cert-operator
       terminationGracePeriodSeconds: 10
       securityContext:
@@ -25,7 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: manager
-          image: gateway-cert-operator:latest
+          image: gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator:latest
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

deploy/externalsecret_gitea-registry.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-registry
+  namespace: gateway-cert-operator-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: gitea-registry
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .token }}"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: k8s_home/gitea/container-registry
+        property: token

deploy/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 
 resources:
   - namespace_gateway-cert-operator-system.yaml
+  - externalsecret_gitea-registry.yaml
   - serviceaccount_gateway-cert-operator.yaml
   - clusterrole_gateway-cert-operator.yaml
   - clusterrolebinding_gateway-cert-operator.yaml