Fix gitea 28 and openproject 17 deployment issues

- gitea: use rootless image tag (28.2.0-rootless) since deployment
  runs as non-root UID 1000; standard tag uses s6-overlay requiring root
- openproject: add secretKeyBase secret and SECRET_KEY_BASE env var
  to web, worker, and seeder; v17 enforces non-default SECRET_KEY_BASE

gitea/versions/28/deployment.yaml

@@ -27,7 +27,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: "gitea/gitea:28.2.0"
+          image: "gitea/gitea:28.2.0-rootless"
           imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:

openproject/versions/17/manifest.yaml

@@ -17,6 +17,7 @@ defaultConfig:
     host: '{{ .apps.memcached.host }}'
     port: '{{ .apps.memcached.port }}'
 defaultSecrets:
+- key: secretKeyBase
 - key: dbPassword
 - key: adminPassword
 requiredSecrets:

openproject/versions/17/seeder-job.yaml

@@ -58,6 +58,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -102,6 +107,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

openproject/versions/17/web-deployment.yaml

@@ -126,6 +126,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

openproject/versions/17/worker-deployment.yaml

@@ -129,7 +129,11 @@ spec:
             - bash
             - /app/docker/prod/worker
           env:
-            
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef: