feat(secrets)!: replace the gitea.admin object with secrets.admin

The admin user was the last piece of credential handling that lived outside of the `secrets` section. Worse, it was the
only credential the chart rendered as a plain environment variable value into the Deployment: unless an existing Secret
was referenced, username and password ended up in the pod spec in clear text, readable by anyone who can `get` or
`describe` the Deployment.

`gitea.admin` is therefore removed and fully replaced by `secrets.admin`:

  gitea.admin.username       -> secrets.admin.new.username
  gitea.admin.password       -> secrets.admin.new.password
  gitea.admin.email          -> secrets.admin.new.email
  gitea.admin.passwordMode   -> secrets.admin.passwordMode
  gitea.admin.existingSecret -> secrets.admin.existingSecret.{enabled,secretName}

The chart now always creates a dedicated `<fullname>-admin` Secret and the Deployment consumes `GITEA_ADMIN_USERNAME`,
`GITEA_ADMIN_PASSWORD` and `GITEA_ADMIN_EMAIL` via `secretKeyRef`. This removes the clear text credentials from the pod
spec and makes the chart-managed and the externally provided case behave identically, which previously diverged.

The email address moved into the Secret as well. It used to be interpolated directly into the init script, so changing
it rewrote the init Secret, and an operator handing over admin credentials could not supply it. The key names of an
externally provided Secret are configurable via `secrets.admin.existingSecret.{emailKey,passwordKey,usernameKey}`,
because chart-defined key names cannot be assumed for Secrets managed by an external system such as a secret store.

Admin handling was previously skipped implicitly when neither an existing Secret nor a username and password were set.
This implicit behaviour is replaced by the explicit `secrets.admin.enabled` flag, so disabling it no longer requires
blanking out unrelated values.

`gitea.admin.passwordMode` validation moved from `_helpers.tpl` to `_secrets.tpl` as
`gitea.secret.admin.passwordMode` to keep all Secret related helpers in one place. `deprecation.yaml` fails the render
when `gitea.admin` is still set and points to `secrets.admin`.

New test suites cover the rendered admin Secret, the `secretKeyRef` wiring, custom key names of an existing Secret and
the password mode validation. The `secret_admin.yaml` template is registered in every suite that renders the Deployment,
as helm-unittest requires templates referenced via `$.Template.BasePath` to be listed explicitly.

BREAKING CHANGE: The `gitea.admin` object has been removed and is replaced by `secrets.admin`. Rendering fails if
`gitea.admin` is still set. Secrets referenced via `secrets.admin.existingSecret` now additionally require an `email`
key next to `username` and `password`.

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -621,8 +621,9 @@ This has to be done in the ui.
 You cannot use `admin` as username.
 
 ```yaml
-gitea:
+secrets:
   admin:
+    new:
       username: "MyAwesomeGiteaAdmin"
       password: "AReallyAwesomeGiteaPassword"
       email: "gi@tea.com"
@@ -637,16 +638,22 @@ metadata:
   name: gitea-admin-secret
 type: Opaque
 stringData:
+  email: gi@tea.com
   username: MyAwesomeGiteaAdmin
   password: AReallyAwesomeGiteaPassword
 ```
 
 ```yaml
-gitea:
+secrets:
   admin:
-    existingSecret: gitea-admin-secret
+    existingSecret:
+      enabled: true
+      secretName: gitea-admin-secret
 ```
 
+The keys within the existing Secret can be customized via `secrets.admin.existingSecret.emailKey`,
+`secrets.admin.existingSecret.passwordKey` and `secrets.admin.existingSecret.usernameKey`.
+
 Whether you use the existing Secret or specify a user name and password, there are three modes for how the admin user password is created or set.
 
 - `keepUpdated` (the default) will set the admin user password, and reset it to the defined value every time the pod is recreated.
@@ -656,11 +663,13 @@ Whether you use the existing Secret or specify a user name and password, there a
 These modes can be set like the following:
 
 ```yaml
-gitea:
+secrets:
   admin:
     passwordMode: initialOnlyRequireReset
 ```
 
+Set `secrets.admin.enabled` to `false` to skip the admin user handling entirely.
+
 ### LDAP Settings
 
 Like the admin user the LDAP settings can be updated.
@@ -1130,7 +1139,20 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 ### Secret
 
 | Name                                             | Description                                                                                                                   | Value                |
-| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------ |
+| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------- |
+| `secrets.admin.enabled`                          | Create and keep the Gitea admin user in sync                                                                                  | `true`               |
+| `secrets.admin.addSHASumAnnotation`              | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change                                      | `true`               |
+| `secrets.admin.passwordMode`                     | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated`        |
+| `secrets.admin.existingSecret.enabled`           | Use an already existing Secret instead of creating the admin Secret                                                           | `false`              |
+| `secrets.admin.existingSecret.secretName`        | Name of the already existing admin Secret                                                                                     | `""`                 |
+| `secrets.admin.existingSecret.emailKey`          | Key of the email address in the existing admin Secret                                                                         | `email`              |
+| `secrets.admin.existingSecret.passwordKey`       | Key of the password in the existing admin Secret                                                                              | `password`           |
+| `secrets.admin.existingSecret.usernameKey`       | Key of the username in the existing admin Secret                                                                              | `username`           |
+| `secrets.admin.new.annotations`                  | Annotations for the admin Secret                                                                                              | `{}`                 |
+| `secrets.admin.new.labels`                       | Labels for the admin Secret                                                                                                   | `{}`                 |
+| `secrets.admin.new.email`                        | Email of the Gitea admin user                                                                                                 | `gitea@local.domain` |
+| `secrets.admin.new.password`                     | Password of the Gitea admin user                                                                                              | `r8sA8CPHD9!bt6d`    |
+| `secrets.admin.new.username`                     | Username of the Gitea admin user                                                                                              | `gitea_admin`        |
 | `secrets.config.addSHASumAnnotation`             | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change                                     | `true`               |
 | `secrets.config.existingSecret.enabled`          | Use an already existing Secret instead of creating the config Secret                                                          | `false`              |
 | `secrets.config.existingSecret.secretName`       | Name of the already existing config Secret                                                                                    | `""`                 |
@@ -1209,12 +1231,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 ### Gitea
 
 | Name                                         | Description                                                                                                                                                                     | Value   |
-| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
-| `gitea.admin.username`                       | Username for the Gitea admin user                                                                                                                                               | `gitea_admin`        |
-| `gitea.admin.existingSecret`                 | Use an existing secret to store admin user credentials                                                                                                                          | `nil`                |
-| `gitea.admin.password`                       | Password for the Gitea admin user                                                                                                                                               | `r8sA8CPHD9!bt6d`    |
-| `gitea.admin.email`                          | Email for the Gitea admin user                                                                                                                                                  | `gitea@local.domain` |
-| `gitea.admin.passwordMode`                   | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated                                                   | `keepUpdated`        |
+| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
 | `gitea.metrics.enabled`                      | Enable Gitea metrics                                                                                                                                                            | `false` |
 | `gitea.metrics.token`                        | used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public.                                                               | `nil`   |
 | `gitea.metrics.serviceMonitor.enabled`       | Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally.                                                  | `false` |
@@ -1367,7 +1384,27 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma
 
 - All Secrets created by this chart are now configured through the new `secrets` section.
   It exposes `annotations`, `labels`, a checksum-annotation toggle and an `existingSecret` reference for each of the
-  `config`, `gpg`, `init`, `inlineConfig` and `metrics` Secrets.
+  `admin`, `config`, `gpg`, `init`, `inlineConfig` and `metrics` Secrets.
+- The `gitea.admin` object has been replaced by `secrets.admin`.
+  The chart fails to render if `gitea.admin` is still set.
+  Migrate as follows:
+
+  | Old                            | New                                                                                  |
+  | ------------------------------ | ------------------------------------------------------------------------------------ |
+  | `gitea.admin.username`         | `secrets.admin.new.username`                                                         |
+  | `gitea.admin.password`         | `secrets.admin.new.password`                                                         |
+  | `gitea.admin.email`            | `secrets.admin.new.email`                                                            |
+  | `gitea.admin.passwordMode`     | `secrets.admin.passwordMode`                                                         |
+  | `gitea.admin.existingSecret`   | `secrets.admin.existingSecret.enabled` and `secrets.admin.existingSecret.secretName` |
+
+  The admin credentials are no longer rendered as plain environment variable values into the Deployment. They are stored
+  in a dedicated Secret and consumed via `secretKeyRef` instead. The email address is part of that Secret as well, so
+  Secrets referenced via `secrets.admin.existingSecret` now need an `email` key in addition to `username` and
+  `password`. All three key names are configurable via `secrets.admin.existingSecret.emailKey`,
+  `secrets.admin.existingSecret.passwordKey` and `secrets.admin.existingSecret.usernameKey`.
+
+  Admin user handling was previously skipped implicitly when neither an existing Secret nor a username and password were
+  set. It is now controlled explicitly via `secrets.admin.enabled`.
 - The top-level `signing` object has been replaced by `secrets.gpg`.
   The chart fails to render if `signing` is still set.
   Migrate as follows:

templates/_helpers.tpl

@@ -523,14 +523,6 @@ https
   {{- end }}
 {{- end -}}
 
-{{- define "gitea.admin.passwordMode" -}}
-{{- if has .Values.gitea.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
-{{ .Values.gitea.admin.passwordMode }}
-{{- else -}}
-{{ printf "gitea.admin.passwordMode must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.gitea.admin.passwordMode | fail }}
-{{- end -}}
-{{- end -}}
-
 {{/* Create a functioning probe object for rendering. Given argument must be either a livenessProbe, readinessProbe, or startupProbe */}}
 {{- define "gitea.deployment.probe" -}}
   {{- $probe := unset . "enabled" -}}

templates/gitea/_secrets.tpl

@@ -2,6 +2,12 @@
 
 {{/* annotations */}}
 
+{{- define "gitea.secret.admin.annotations" -}}
+{{- with .Values.secrets.admin.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.annotations" -}}
 {{- with .Values.secrets.config.new.annotations }}
 {{- toYaml . -}}
@@ -34,6 +40,13 @@
 
 {{/* labels */}}
 
+{{- define "gitea.secret.admin.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.admin.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.config.new.labels }}
@@ -71,6 +84,14 @@
 
 {{/* names */}}
 
+{{- define "gitea.secret.admin.name" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ required "`secrets.admin.existingSecret.secretName` must be set when `secrets.admin.existingSecret.enabled` is enabled" .Values.secrets.admin.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-admin
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.config.name" -}}
 {{- if .Values.secrets.config.existingSecret.enabled -}}
 {{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
@@ -113,6 +134,30 @@
 
 {{/* keys */}}
 
+{{- define "gitea.secret.admin.emailKey" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ .Values.secrets.admin.existingSecret.emailKey }}
+{{- else -}}
+email
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.admin.passwordKey" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ .Values.secrets.admin.existingSecret.passwordKey }}
+{{- else -}}
+password
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.admin.usernameKey" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ .Values.secrets.admin.existingSecret.usernameKey }}
+{{- else -}}
+username
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.gpg.gpgHomeKey" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
@@ -128,3 +173,13 @@ gpgHome
 privateKey
 {{- end -}}
 {{- end }}
+
+{{/* misc */}}
+
+{{- define "gitea.secret.admin.passwordMode" -}}
+{{- if has .Values.secrets.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
+{{ .Values.secrets.admin.passwordMode }}
+{{- else -}}
+{{ printf "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.secrets.admin.passwordMode | fail }}
+{{- end -}}
+{{- end }}

templates/gitea/deployment.yaml

@@ -27,6 +27,9 @@ spec:
   template:
     metadata:
       annotations:
+        {{- if and .Values.secrets.admin.addSHASumAnnotation (not .Values.secrets.admin.existingSecret.enabled) }}
+        checksum/admin: {{ include (print $.Template.BasePath "/gitea/secret_admin.yaml") . | sha256sum }}
+        {{- end }}
         {{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }}
         checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }}
         {{- end }}
@@ -289,25 +292,25 @@ spec:
             {{- end }}
             {{- end }}
             {{- end }}
-            {{- if .Values.gitea.admin.existingSecret }}
+            {{- if .Values.secrets.admin.enabled }}
             - name: GITEA_ADMIN_USERNAME
               valueFrom:
                 secretKeyRef:
-                  key:  username
-                  name: {{ .Values.gitea.admin.existingSecret }}
+                  key: {{ include "gitea.secret.admin.usernameKey" . }}
+                  name: {{ include "gitea.secret.admin.name" . }}
             - name: GITEA_ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  key:  password
-                  name: {{ .Values.gitea.admin.existingSecret }}
-            {{- else }}
-            - name: GITEA_ADMIN_USERNAME
-              value: {{ .Values.gitea.admin.username | quote }}
-            - name: GITEA_ADMIN_PASSWORD
-              value: {{ .Values.gitea.admin.password | quote }}
-            {{- end }}
+                  key: {{ include "gitea.secret.admin.passwordKey" . }}
+                  name: {{ include "gitea.secret.admin.name" . }}
+            - name: GITEA_ADMIN_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  key: {{ include "gitea.secret.admin.emailKey" . }}
+                  name: {{ include "gitea.secret.admin.name" . }}
             - name: GITEA_ADMIN_PASSWORD_MODE
-              value: {{ include "gitea.admin.passwordMode" $ }}
+              value: {{ include "gitea.secret.admin.passwordMode" $ }}
+            {{- end }}
             {{- if .Values.deployment.env }}
             {{- toYaml .Values.deployment.env | nindent 12 }}
             {{- end }}

templates/gitea/deprecation.yaml

@@ -31,6 +31,9 @@
       {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
     {{- end -}}
   {{- end -}}
+  {{- if .Values.gitea.admin -}}
+    {{- fail "`gitea.admin` does no longer exist. Please refer to the changelog and configure `secrets.admin` instead." -}}
+  {{- end -}}
 
   {{/* SIGNING */}}
   {{- if .Values.signing -}}

templates/gitea/secret_admin.yaml

@@ -0,0 +1,21 @@
+{{- if and (.Values.secrets.admin.enabled) (not .Values.secrets.admin.existingSecret.enabled) -}}
+{{- if or (empty .Values.secrets.admin.new.username) (empty .Values.secrets.admin.new.password) -}}
+  {{- fail "Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`" -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.admin.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.admin.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.admin.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: Opaque
+data:
+  email: {{ .Values.secrets.admin.new.email | b64enc }}
+  password: {{ .Values.secrets.admin.new.password | b64enc }}
+  username: {{ .Values.secrets.admin.new.username | b64enc }}
+{{- end }}

templates/gitea/secret_init.yaml

@@ -84,7 +84,7 @@ stringData:
     {{- end }}
 
 
-    {{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
+    {{- if .Values.secrets.admin.enabled }}
     function configure_admin_user() {
       local full_admin_list=$(gitea admin user list --admin)
       local actual_user_table=''
@@ -110,7 +110,7 @@ stringData:
       local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
       if [[ -z "${ACCOUNT_ID}" ]]; then
         local -a create_args
-        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
+        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
         if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
           create_args+=(--must-change-password=true)
         else

unittests/helm/admin-secret/admin.yaml

@@ -0,0 +1,64 @@
+suite: Admin secret template
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/secret_admin.yaml
+tests:
+  - it: skips rendering when the admin user is disabled
+    set:
+      secrets.admin.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: skips rendering using an existing secret reference
+    set:
+      secrets.admin.enabled: true
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: "external-secret-reference"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: fails rendering without credentials
+    set:
+      secrets.admin.new.password: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`
+
+  - it: renders the secret specification with the default credentials
+    asserts:
+      - hasDocuments:
+          count: 1
+      - documentIndex: 0
+        containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-admin
+      - isNotNullOrEmpty:
+          path: metadata.labels
+      - equal:
+          path: data.email
+          value: "Z2l0ZWFAbG9jYWwuZG9tYWlu"
+      - equal:
+          path: data.password
+          value: "cjhzQThDUEhEOSFidDZk"
+      - equal:
+          path: data.username
+          value: "Z2l0ZWFfYWRtaW4="
+
+  - it: supports custom annotations and labels
+    set:
+      secrets.admin.new.annotations:
+        custom-annotation: annotation-value
+      secrets.admin.new.labels:
+        custom-label: label-value
+    asserts:
+      - equal:
+          path: metadata.annotations["custom-annotation"]
+          value: annotation-value
+      - equal:
+          path: metadata.labels["custom-label"]
+          value: label-value

unittests/helm/config/config-environment-script.yaml

@@ -3,6 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
 tests:
   - it: uses `gitea config edit-ini` to write app.ini from environment variables

unittests/helm/deployment/HA.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/admin.yaml

@@ -0,0 +1,103 @@
+suite: deployment template (admin user)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
+tests:
+  - it: reads the admin credentials from the generated secret
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_USERNAME
+            valueFrom:
+              secretKeyRef:
+                key: username
+                name: gitea-unittests-admin
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: gitea-unittests-admin
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_EMAIL
+            valueFrom:
+              secretKeyRef:
+                key: email
+                name: gitea-unittests-admin
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD_MODE
+            value: keepUpdated
+
+  - it: reads the admin credentials from the configured keys of an existing secret
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: custom-admin-secret
+      secrets.admin.existingSecret.emailKey: custom-email
+      secrets.admin.existingSecret.passwordKey: custom-password
+      secrets.admin.existingSecret.usernameKey: custom-username
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_USERNAME
+            valueFrom:
+              secretKeyRef:
+                key: custom-username
+                name: custom-admin-secret
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: custom-password
+                name: custom-admin-secret
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_EMAIL
+            valueFrom:
+              secretKeyRef:
+                key: custom-email
+                name: custom-admin-secret
+
+  - it: omits the admin environment when the admin user is disabled
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_USERNAME
+          any: true
+      - notContains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD_MODE
+          any: true
+
+  - it: fails on an unsupported password mode
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.passwordMode: unsupported
+    asserts:
+      - failedTemplate:
+          errorMessage: "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: 'unsupported'"

unittests/helm/deployment/basic.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/checksum-annotations.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml
@@ -14,9 +15,9 @@ tests:
     template: templates/gitea/deployment.yaml
     asserts:
       - exists:
-          path: spec.template.metadata.annotations["checksum/config"]
+          path: spec.template.metadata.annotations["checksum/admin"]
       - exists:
-          path: spec.template.metadata.annotations["checksum/gpg"]
+          path: spec.template.metadata.annotations["checksum/config"]
       - exists:
           path: spec.template.metadata.annotations["checksum/init"]
       - exists:
@@ -27,12 +28,15 @@ tests:
   - it: omits the checksum annotations when addSHASumAnnotation is disabled
     template: templates/gitea/deployment.yaml
     set:
+      secrets.admin.addSHASumAnnotation: false
       secrets.config.addSHASumAnnotation: false
       secrets.gpg.addSHASumAnnotation: false
       secrets.init.addSHASumAnnotation: false
       secrets.inlineConfig.addSHASumAnnotation: false
       secrets.metrics.addSHASumAnnotation: false
     asserts:
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/admin"]
       - notExists:
           path: spec.template.metadata.annotations["checksum/config"]
       - notExists:
@@ -59,6 +63,8 @@ tests:
   - it: omits the checksum annotations of Secrets provided by the user
     template: templates/gitea/deployment.yaml
     set:
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: custom-admin
       secrets.config.existingSecret.enabled: true
       secrets.config.existingSecret.secretName: custom-config
       secrets.gpg.existingSecret.enabled: true
@@ -70,6 +76,8 @@ tests:
       secrets.metrics.existingSecret.enabled: true
       secrets.metrics.existingSecret.secretName: custom-metrics
     asserts:
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/admin"]
       - notExists:
           path: spec.template.metadata.annotations["checksum/config"]
       - notExists:

unittests/helm/deployment/deployment-additional-config.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/extraEnvSourceFile.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/extraInitContainers.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/image-configuration.yaml

@@ -7,6 +7,7 @@ chart:
   appVersion: 1.19.3
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/openshift.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/probes.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/sidecar-container.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/signing-disabled.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/signing-enabled.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/deployment/ssh-configuration.yaml

@@ -4,6 +4,7 @@ release:
   namespace: testing
 templates:
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

unittests/helm/serviceaccount/reference.yaml

@@ -5,6 +5,7 @@ release:
 templates:
   - templates/gitea/serviceAccount.yaml
   - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
   - templates/gitea/secret_config.yaml
   - templates/gitea/secret_gpg.yaml
   - templates/gitea/secret_init.yaml

values.yaml

@@ -345,6 +345,40 @@ deployment:
 
 ## @section Secret
 secrets:
+  admin:
+    ## @param secrets.admin.enabled Create and keep the Gitea admin user in sync
+    enabled: true
+
+    ## @param secrets.admin.addSHASumAnnotation Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change
+    addSHASumAnnotation: true
+
+    ## @param secrets.admin.passwordMode Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated
+    passwordMode: keepUpdated
+
+    ## @param secrets.admin.existingSecret.enabled Use an already existing Secret instead of creating the admin Secret
+    ## @param secrets.admin.existingSecret.secretName Name of the already existing admin Secret
+    ## @param secrets.admin.existingSecret.emailKey Key of the email address in the existing admin Secret
+    ## @param secrets.admin.existingSecret.passwordKey Key of the password in the existing admin Secret
+    ## @param secrets.admin.existingSecret.usernameKey Key of the username in the existing admin Secret
+    existingSecret:
+      enabled: false
+      secretName: ""
+      emailKey: email
+      passwordKey: password
+      usernameKey: username
+
+    ## @param secrets.admin.new.annotations Annotations for the admin Secret
+    ## @param secrets.admin.new.labels Labels for the admin Secret
+    ## @param secrets.admin.new.email Email of the Gitea admin user
+    ## @param secrets.admin.new.password Password of the Gitea admin user
+    ## @param secrets.admin.new.username Username of the Gitea admin user
+    new:
+      annotations: {}
+      labels: {}
+      email: gitea@local.domain
+      password: r8sA8CPHD9!bt6d
+      username: gitea_admin
+
   config:
     ## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change
     addSHASumAnnotation: true
@@ -550,19 +584,6 @@ initContainers:
 ## @section Gitea
 #
 gitea:
-  ## @param gitea.admin.username Username for the Gitea admin user
-  ## @param gitea.admin.existingSecret Use an existing secret to store admin user credentials
-  ## @param gitea.admin.password Password for the Gitea admin user
-  ## @param gitea.admin.email Email for the Gitea admin user
-  ## @param gitea.admin.passwordMode Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated
-  admin:
-    # existingSecret: gitea-admin-secret
-    existingSecret:
-    username: gitea_admin
-    password: r8sA8CPHD9!bt6d
-    email: "gitea@local.domain"
-    passwordMode: keepUpdated
-
   ## @param gitea.metrics.enabled Enable Gitea metrics
   ## @param gitea.metrics.token used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public.
   ## @param gitea.metrics.serviceMonitor.enabled Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally.