refactor!: remove actions runner token provisioning (#15)

To be discussed. In https://gitea.com/gitea/helm-actions/issues/9#issuecomment-1002191 and https://gitea.com/gitea/helm-actions/pulls/13 I described that a migration of provisioning is currently not feasible due to - helm limitations - You are forced to repeat a lot of stuff for the default branch - helm-actions cannot read values of the helm-gitea chart to fix this - No agreement about making helm-gitea a optional dependency of helm-actions can be reached at the moment # Proposal - Create a new repository that includes both helm-gitea **and** helm-actions - Provisioning leaves this repository as well like it did in helm-gitea - Create that as gitea/helm-stack or whatever name - Provisioning code and tests moves to gitea/helm-stack We would need help with the repository creation Reviewed-on: https://gitea.com/gitea/helm-actions/pulls/15 Reviewed-by: DaanSelen <daanselen@noreply.gitea.com> Co-authored-by: ChristopherHX <christopherhx@noreply.gitea.com> Co-committed-by: ChristopherHX <christopherhx@noreply.gitea.com>
2025-08-13 21:15:21 +00:00
parent 7ad8e12e45
commit 8c95dcd282
18 changed files with 8 additions and 698 deletions
--- a/templates/01-consistency-checks.yaml
+++ b/templates/01-consistency-checks.yaml
@ -1,15 +1,6 @@
 {{- if .Values.enabled -}}
-    {{- if .Values.provisioning.enabled -}}
-        {{- if not (and .Values.persistence.enabled .Values.persistence.mount) -}}
-            {{- fail "persistence.enabled and persistence.mount are required when provisioning is enabled" -}}
-        {{- end -}}
-        {{- if and .Values.persistence.enabled .Values.persistence.mount -}}
-            {{- if .Values.existingSecret -}}
-                {{- fail "Can't specify both actions.provisioning.enabled and actions.existingSecret" -}}
-            {{- end -}}
-        {{- end -}}
-    {{- end -}}
-    {{- if and (not .Values.provisioning.enabled) (or (empty .Values.existingSecret) (empty .Values.existingSecretKey)) -}}
+
+    {{- if or (empty .Values.existingSecret) (empty .Values.existingSecretKey) -}}
        {{- fail "existingSecret and existingSecretKey are required when provisioning is disabled" -}}
    {{- end -}}
    {{- if not .Values.giteaRootURL -}}
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@ -39,34 +39,11 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}

-{{/*
-Create image name and tag used by the deployment.
-*/}}
-{{- define "gitea.actions.image" -}}
-{{- $fullOverride := .Values.image.fullOverride | default "" -}}
-{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
-{{- $repository := .Values.image.repository -}}
-{{- $separator := ":" -}}
-{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
-{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
-{{- $digest := "" -}}
-{{- if .Values.image.digest }}
-    {{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
-{{- end -}}
-{{- if $fullOverride }}
-    {{- printf "%s" $fullOverride -}}
-{{- else if $registry }}
-    {{- printf "%s/%s%s%s%s%s" $registry $repository $separator $tag $rootless $digest -}}
-{{- else -}}
-    {{- printf "%s%s%s%s%s" $repository $separator $tag $rootless $digest -}}
-{{- end -}}
-{{- end -}}
-
 {{/*
 Storage Class
 */}}
 {{- define "gitea.actions.persistence.storageClass" -}}
-{{- $storageClass :=  (tpl ( default "" .Values.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
+{{- $storageClass :=  default (tpl ( default "" .Values.global.storageClass) .) }}
 {{- if $storageClass }}
 storageClassName: {{ $storageClass | quote }}
 {{- end }}
@ -79,8 +56,8 @@ Common labels
 helm.sh/chart: {{ include "gitea.actions.chart" . }}
 app: {{ include "gitea.actions.name" . }}
 {{ include "gitea.actions.selectorLabels" . }}
-app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ default .Chart.AppVersion | quote }}
+version: {{ default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}

@ -88,8 +65,8 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 helm.sh/chart: {{ include "gitea.actions.chart" . }}
 app: {{ include "gitea.actions.name" . }}-act-runner
 {{ include "gitea.actions.selectorLabels.actRunner" . }}
-app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ default .Chart.AppVersion | quote }}
+version: {{ default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}

--- a/templates/config-scripts.yaml
+++ b/templates/config-scripts.yaml
@ -1,14 +0,0 @@
-{{- if .Values.enabled }}
-{{- if and (and .Values.provisioning.enabled .Values.persistence.enabled) .Values.persistence.mount }}
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "gitea.actions.fullname" . }}-scripts
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.actions.labels" . | nindent 4 }}
-data:
-{{ (.Files.Glob "scripts/*.sh").AsConfig | indent 2 }}
-{{- end }}
-{{- end }}
--- a/templates/job.yaml
+++ b/templates/job.yaml
@ -1,115 +0,0 @@
-{{- if .Values.enabled }}
-{{- if and (and .Values.provisioning.enabled .Values.persistence.enabled) .Values.persistence.mount }}
-{{- $name := include "gitea.actions.workername" (dict "global" . "worker" "actions-token-job") }}
-{{- $secretName := include "gitea.actions.workername" (dict "global" . "worker" "actions-token") }}
---
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: {{ $name }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.actions.labels" . | nindent 4 }}
-    {{- with .Values.provisioning.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-    app.kubernetes.io/component: token-job
-  annotations:
-    {{- with .Values.provisioning.annotations }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  ttlSecondsAfterFinished: {{ .Values.provisioning.ttlSecondsAfterFinished }}
-  template:
-    metadata:
-      labels:
-        {{- include "gitea.actions.labels" . | nindent 8 }}
-        {{- with .Values.provisioning.labels }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-        app.kubernetes.io/component: token-job
-    spec:
-      initContainers:
-        - name: init-gitea
-          image: "{{ .Values.init.image.repository }}:{{ .Values.init.image.tag }}"
-          command:
-            - sh
-            - -c
-            - |
-              while ! nc -z {{ include "gitea.actions.nc" . }}; do
-                sleep 5
-              done
-      containers:
-        - name: actions-token-create
-          image: "{{ include "gitea.actions.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-          command:
-            - sh
-            - -c
-            - |
-              echo "Generating act_runner token via 'gitea actions generate-runner-token'..."
-              mkdir -p /data/actions/
-              gitea actions generate-runner-token | grep -E '^.{40}$' | tr -d '\n' > /data/actions/token
-          resources:
-            {{- toYaml .Values.provisioning.resources | nindent 12 }}
-          volumeMounts:
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-        - name: actions-token-upload
-          image: "{{ .Values.provisioning.publish.repository }}:{{ .Values.provisioning.publish.tag }}"
-          imagePullPolicy: {{ .Values.provisioning.publish.pullPolicy }}
-          env:
-            - name: SECRET_NAME
-              value: {{ $secretName }}
-          command:
-            - sh
-            - -c
-            - |
-              printf "Checking rights to update kubernetes act_runner secret..."
-              kubectl auth can-i update secret/${SECRET_NAME}
-              /scripts/token.sh
-          resources:
-            {{- toYaml .Values.provisioning.resources | nindent 12 }}
-          volumeMounts:
-            - mountPath: /scripts
-              name: scripts
-              readOnly: true
-            - mountPath: /data
-              name: data
-              readOnly: true
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-      {{- range $key, $value := .Values.provisioning.nodeSelector }}
-      nodeSelector:
-        {{ $key }}: {{ $value | quote }}
-      {{- end }}
-      {{- with .Values.provisioning.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.provisioning.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      restartPolicy: Never
-      serviceAccount: {{ $name }}
-      volumes:
-        - name: scripts
-          configMap:
-            name: {{ include "gitea.actions.fullname" . }}-scripts
-            defaultMode: 0755
-        - name: data
-          persistentVolumeClaim:
-            claimName: {{ .Values.persistence.claimName }}
-  parallelism: 1
-  completions: 1
-  backoffLimit: 1
-{{- end }}
-{{- end }}
--- a/templates/role-job.yaml
+++ b/templates/role-job.yaml
@ -1,26 +0,0 @@
-{{- if .Values.enabled }}
-{{- if and (and .Values.provisioning.enabled .Values.persistence.enabled) .Values.persistence.mount }}
-{{- $name := include "gitea.actions.workername" (dict "global" . "worker" "actions-token-job") }}
-{{- $secretName := include "gitea.actions.workername" (dict "global" . "worker" "actions-token") }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ $name }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.actions.labels" . | nindent 4 }}
-    app.kubernetes.io/component: token-job
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    resourceNames:
-      - {{ $secretName }}
-    verbs:
-      - get
-      - update
-      - patch
-{{- end }}
-{{- end }}
--- a/templates/rolebinding-job.yaml
+++ b/templates/rolebinding-job.yaml
@ -1,22 +0,0 @@
-{{- if .Values.enabled }}
-{{- if and (and .Values.provisioning.enabled .Values.persistence.enabled) .Values.persistence.mount }}
-{{- $name := include "gitea.actions.workername" (dict "global" . "worker" "actions-token-job") }}
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ $name }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.actions.labels" . | nindent 4 }}
-    app.kubernetes.io/component: token-job
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ $name }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ $name }}
-    namespace: {{ .Values.namespace | default .Release.Namespace }}
-{{- end }}
-{{- end }}
--- a/templates/secret-token.yaml
+++ b/templates/secret-token.yaml
@ -1,20 +0,0 @@
-{{- if .Values.enabled }}
-{{- if and (and .Values.provisioning.enabled .Values.persistence.enabled) .Values.persistence.mount }}
-{{- $name := include "gitea.actions.workername" (dict "global" . "worker" "actions-token-job") }}
-{{- $secretName := include "gitea.actions.workername" (dict "global" . "worker" "actions-token") }}
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $secretName }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.actions.labels" . | nindent 4 }}
-    app.kubernetes.io/component: token-job
-{{ $secret := (lookup "v1" "Secret" (.Values.namespace | default .Release.Namespace) $secretName) -}}
-{{ if $secret -}}
-data:
-  token: {{ (b64dec (index $secret.data "token")) | b64enc }}
-{{ end -}}
-{{- end }}
-{{- end }}
--- a/templates/serviceaccount-job.yaml
+++ b/templates/serviceaccount-job.yaml
@ -1,14 +0,0 @@
-{{- if .Values.enabled }}
-{{- if and (and .Values.provisioning.enabled .Values.persistence.enabled) .Values.persistence.mount }}
-{{- $name := include "gitea.actions.workername" (dict "global" . "worker" "actions-token-job") }}
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ $name }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.actions.labels" . | nindent 4 }}
-    app.kubernetes.io/component: token-job
-{{- end }}
-{{- end }}