chore(deps): rollback docker docker.io/volkerraschek/helm to 3.19.2

The patch add the annotation `checksum/secret-<name of the TLS secret>` with the
sha512 value of the secret. This ensures a rolling update if the TLS secrets has
been updated. Such an update can be triggered by the cert-manager.

.gitea/workflows/release.yaml

@@ -8,7 +8,7 @@ on:
 jobs:
   publish-chart:
     container:
-      image: docker.io/volkerraschek/helm:4.0.1
+      image: docker.io/volkerraschek/helm:3.19.2
     runs-on: ubuntu-latest
     steps:
       - name: Install packages via apk

templates/_pod.tpl

@@ -4,6 +4,10 @@
 
 {{- define "athens-proxy.pod.annotations" }}
 {{- include "athens-proxy.annotations" . }}
+{{- if and .Values.certificate.enabled (not .Values.certificate.existingSecret.enabled) }}
+{{- $secretName := include "athens-proxy.certificates.server.name" $ }}
+{{ printf "checksum/secret-%s: %s" $secretName (print (lookup "v1" "Secret" .Release.Namespace $secretName) | sha256sum) }}
+{{- end }}
 {{- if and .Values.config.env.enabled (not .Values.config.env.existingSecret.enabled) }}
 {{ printf "checksum/secret-%s: %s" (include "athens-proxy.secrets.env.name" $) (include (print $.Template.BasePath "/secretEnv.yaml") . | sha256sum) }}
 {{- end }}
@@ -21,8 +25,6 @@
 {{- end }}
 {{- end }}
 
-
-
 {{/* labels */}}
 
 {{- define "athens-proxy.pod.labels" -}}

unittests/deployment/certificate.yaml

@@ -46,6 +46,9 @@ tests:
     certificate.new.issuerRef.kind: ClusterIssuer
     certificate.new.issuerRef.name: MyIssuer
   asserts:
+    - exists:
+        path: spec.template.metadata.annotations["checksum/secret-athens-proxy-unittest-tls"]
+      template: templates/deployment.yaml
     - contains:
         path: spec.template.spec.containers[0].env
         content: