feat(secrets)!: replace the gitea.admin object with secrets.admin
The admin user was the last piece of credential handling that lived outside of the `secrets` section. Worse, it was the
only credential the chart rendered as a plain environment variable value into the Deployment: unless an existing Secret
was referenced, username and password ended up in the pod spec in clear text, readable by anyone who can `get` or
`describe` the Deployment.
`gitea.admin` is therefore removed and fully replaced by `secrets.admin`:
gitea.admin.username -> secrets.admin.new.username
gitea.admin.password -> secrets.admin.new.password
gitea.admin.email -> secrets.admin.new.email
gitea.admin.passwordMode -> secrets.admin.passwordMode
gitea.admin.existingSecret -> secrets.admin.existingSecret.{enabled,secretName}
The chart now always creates a dedicated `<fullname>-admin` Secret and the Deployment consumes `GITEA_ADMIN_USERNAME`,
`GITEA_ADMIN_PASSWORD` and `GITEA_ADMIN_EMAIL` via `secretKeyRef`. This removes the clear text credentials from the pod
spec and makes the chart-managed and the externally provided case behave identically, which previously diverged.
The email address moved into the Secret as well. It used to be interpolated directly into the init script, so changing
it rewrote the init Secret, and an operator handing over admin credentials could not supply it. The key names of an
externally provided Secret are configurable via `secrets.admin.existingSecret.{emailKey,passwordKey,usernameKey}`,
because chart-defined key names cannot be assumed for Secrets managed by an external system such as a secret store.
Admin handling was previously skipped implicitly when neither an existing Secret nor a username and password were set.
This implicit behaviour is replaced by the explicit `secrets.admin.enabled` flag, so disabling it no longer requires
blanking out unrelated values.
`gitea.admin.passwordMode` validation moved from `_helpers.tpl` to `_secrets.tpl` as
`gitea.secret.admin.passwordMode` to keep all Secret related helpers in one place. `deprecation.yaml` fails the render
when `gitea.admin` is still set and points to `secrets.admin`.
New test suites cover the rendered admin Secret, the `secretKeyRef` wiring, custom key names of an existing Secret and
the password mode validation. The `secret_admin.yaml` template is registered in every suite that renders the Deployment,
as helm-unittest requires templates referenced via `$.Template.BasePath` to be listed explicitly.
BREAKING CHANGE: The `gitea.admin` object has been removed and is replaced by `secrets.admin`. Rendering fails if
`gitea.admin` is still set. Secrets referenced via `secrets.admin.existingSecret` now additionally require an `email`
key next to `username` and `password`.
Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Copilot
@@ -0,0 +1,64 @@
|
||||
suite: Admin secret template
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/secret_admin.yaml
|
||||
tests:
|
||||
- it: skips rendering when the admin user is disabled
|
||||
set:
|
||||
secrets.admin.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: skips rendering using an existing secret reference
|
||||
set:
|
||||
secrets.admin.enabled: true
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: "external-secret-reference"
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: fails rendering without credentials
|
||||
set:
|
||||
secrets.admin.new.password: ""
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`
|
||||
|
||||
- it: renders the secret specification with the default credentials
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- documentIndex: 0
|
||||
containsDocument:
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-admin
|
||||
- isNotNullOrEmpty:
|
||||
path: metadata.labels
|
||||
- equal:
|
||||
path: data.email
|
||||
value: "Z2l0ZWFAbG9jYWwuZG9tYWlu"
|
||||
- equal:
|
||||
path: data.password
|
||||
value: "cjhzQThDUEhEOSFidDZk"
|
||||
- equal:
|
||||
path: data.username
|
||||
value: "Z2l0ZWFfYWRtaW4="
|
||||
|
||||
- it: supports custom annotations and labels
|
||||
set:
|
||||
secrets.admin.new.annotations:
|
||||
custom-annotation: annotation-value
|
||||
secrets.admin.new.labels:
|
||||
custom-label: label-value
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations["custom-annotation"]
|
||||
value: annotation-value
|
||||
- equal:
|
||||
path: metadata.labels["custom-label"]
|
||||
value: label-value
|
||||
@@ -3,6 +3,7 @@ release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
tests:
|
||||
- it: uses `gitea config edit-ini` to write app.ini from environment variables
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -0,0 +1,103 @@
|
||||
suite: deployment template (admin user)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
- templates/gitea/secret_inlineConfig.yaml
|
||||
- templates/gitea/secret_metrics.yaml
|
||||
tests:
|
||||
- it: reads the admin credentials from the generated secret
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: username
|
||||
name: gitea-unittests-admin
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: gitea-unittests-admin
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: email
|
||||
name: gitea-unittests-admin
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: keepUpdated
|
||||
|
||||
- it: reads the admin credentials from the configured keys of an existing secret
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: custom-admin-secret
|
||||
secrets.admin.existingSecret.emailKey: custom-email
|
||||
secrets.admin.existingSecret.passwordKey: custom-password
|
||||
secrets.admin.existingSecret.usernameKey: custom-username
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: custom-username
|
||||
name: custom-admin-secret
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: custom-password
|
||||
name: custom-admin-secret
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: custom-email
|
||||
name: custom-admin-secret
|
||||
|
||||
- it: omits the admin environment when the admin user is disabled
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.enabled: false
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_USERNAME
|
||||
any: true
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
content:
|
||||
name: GITEA_ADMIN_PASSWORD_MODE
|
||||
any: true
|
||||
|
||||
- it: fails on an unsupported password mode
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.passwordMode: unsupported
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: 'unsupported'"
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
@@ -14,9 +15,9 @@ tests:
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/gpg"]
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
@@ -27,12 +28,15 @@ tests:
|
||||
- it: omits the checksum annotations when addSHASumAnnotation is disabled
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.addSHASumAnnotation: false
|
||||
secrets.config.addSHASumAnnotation: false
|
||||
secrets.gpg.addSHASumAnnotation: false
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
secrets.inlineConfig.addSHASumAnnotation: false
|
||||
secrets.metrics.addSHASumAnnotation: false
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- notExists:
|
||||
@@ -59,6 +63,8 @@ tests:
|
||||
- it: omits the checksum annotations of Secrets provided by the user
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: custom-admin
|
||||
secrets.config.existingSecret.enabled: true
|
||||
secrets.config.existingSecret.secretName: custom-config
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
@@ -70,6 +76,8 @@ tests:
|
||||
secrets.metrics.existingSecret.enabled: true
|
||||
secrets.metrics.existingSecret.secretName: custom-metrics
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- notExists:
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -7,6 +7,7 @@ chart:
|
||||
appVersion: 1.19.3
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -4,6 +4,7 @@ release:
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
@@ -5,6 +5,7 @@ release:
|
||||
templates:
|
||||
- templates/gitea/serviceAccount.yaml
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
|
||||
Reference in New Issue
Block a user