refactor!: remove the deprecated securityContext value
changelog / changelog (push) Successful in 34s
check-and-test / check-and-test (push) Successful in 4m30s

`securityContext` was deprecated when the chart split it into a pod-level and a container-level value. It
only ever acted as a fallback for the runtime container: when the container-level value was empty, the
deprecated map was used instead. That fallback silently changed behaviour depending on whether an unrelated
value happened to be set, and it kept a third security-related values path alive next to
`deployment.securityContext` and `deployment.gitea.securityContext`.

With the fallback gone, `gitea.runtimeContainerSecurityContext` was identical to
`gitea.containerSecurityContext`, so the helper was dropped and the Gitea container now reuses the shared
one. A deprecation check fails the render when the removed value is still set, because silently ignoring it
would drop `runAsUser`, `runAsNonRoot` or the capability set and let the container run with weaker
restrictions than intended.

BREAKING CHANGE: `securityContext` no longer exists. Use `deployment.securityContext` for the pod-level and
`deployment.gitea.securityContext` for the container-level security context. Installations that still set
`securityContext` will fail to render unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
2026-09-04 13:41:58 +02:00
co-authored by Copilot
parent 377306b418
commit 00ccfc6734
6 changed files with 16 additions and 17 deletions
+2 -3
View File
@@ -65,7 +65,6 @@ spec:
{{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
{{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
{{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
{{- $runtimeContainerSecurityContext := include "gitea.runtimeContainerSecurityContext" . | trim }}
{{- if .Values.deployment.schedulerName }}
schedulerName: "{{ .Values.deployment.schedulerName }}"
{{- end }}
@@ -405,9 +404,9 @@ spec:
{{- end }}
resources:
{{- toYaml (.Values.deployment.gitea.resources | default dict) | nindent 12 }}
{{- if $runtimeContainerSecurityContext }}
{{- if $containerSecurityContext }}
securityContext:
{{- $runtimeContainerSecurityContext | nindent 12 }}
{{- $containerSecurityContext | nindent 12 }}
{{- end }}
volumeMounts:
- name: temp