diff --git a/README.md b/README.md index e0f9b77..5beb415 100644 --- a/README.md +++ b/README.md @@ -46,10 +46,10 @@ - [Route](#route) - [Gateway API](#gateway-api) - [deployment](#deployment) + - [Secret](#secret) - [ServiceAccount](#serviceaccount) - [Persistence](#persistence-1) - [Init](#init) - - [Signing](#signing) - [Gitea](#gitea) - [LivenessProbe](#livenessprobe) - [ReadinessProbe](#readinessprobe) @@ -766,17 +766,20 @@ When using the rootless image the gpg key folder is not persistent by default. If you consider using signed commits for internal Gitea activities (e.g. initial commit), you'd need to provide a signing key. Prior to [PR186](https://gitea.com/gitea/helm-gitea/pulls/186), imported keys had to be re-imported once the container got replaced by another. -The mentioned PR introduced a new configuration object `signing` allowing you to configure prerequisites for commit signing. +The `secrets.gpg` object allows you to configure the prerequisites for commit signing. By default this section is disabled to maintain backwards compatibility. ```yaml -signing: - enabled: false - gpgHome: /data/git/.gnupg +secrets: + gpg: + enabled: false + new: + gpgHome: /data/git/.gnupg ``` -Regardless of the used container image the `signing` object allows to specify a private gpg key. -Either using the `signing.privateKey` to define the key inline, or refer to an existing secret containing the key data by using `signing.existingSecret`. +Regardless of the used container image the `secrets.gpg` object allows to specify a private gpg key. +Either using `secrets.gpg.new.privateKey` to define the key inline, or refer to an existing Secret containing the key data by +using `secrets.gpg.existingSecret`. ```yaml apiVersion: v1 @@ -785,6 +788,7 @@ metadata: name: custom-gitea-gpg-key type: Opaque stringData: + gpgHome: /data/git/.gnupg privateKey: |- -----BEGIN PGP PRIVATE KEY BLOCK----- ... @@ -792,10 +796,17 @@ stringData: ``` ```yaml -signing: - existingSecret: custom-gitea-gpg-key +secrets: + gpg: + enabled: true + existingSecret: + enabled: true + secretName: custom-gitea-gpg-key ``` +The keys within the existing Secret can be customized via `secrets.gpg.existingSecret.gpgHomeKey` and +`secrets.gpg.existingSecret.privateKeyKey`. + To use the gpg key, Gitea needs to be configured accordingly. A detailed description can be found in the [official Gitea documentation](https://docs.gitea.com/administration/signing#general-configuration). @@ -1118,33 +1129,38 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo ### Secret -| Name | Description | Value | -| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- | -| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` | -| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | -| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | -| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | -| `secrets.config.new.labels` | Labels for the config Secret | `{}` | -| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` | -| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | -| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | -| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | -| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | -| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` | -| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | -| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | -| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | -| `secrets.init.new.labels` | Labels for the init Secret | `{}` | -| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` | -| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | -| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | -| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | -| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | -| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` | -| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | -| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | -| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | -| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | +| Name | Description | Value | +| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------ | +| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` | +| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | +| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | +| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | +| `secrets.config.new.labels` | Labels for the config Secret | `{}` | +| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` | +| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` | +| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | +| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | +| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` | +| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` | +| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | +| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | +| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` | +| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` | +| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` | +| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | +| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | +| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | +| `secrets.init.new.labels` | Labels for the init Secret | `{}` | +| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` | +| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | +| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | +| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | +| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | +| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` | +| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | +| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | +| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | +| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | ### ServiceAccount @@ -1190,15 +1206,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `initContainers.resources.requests.cpu` | initContainers.requests.cpu Kubernetes cpu resource limits for init containers | `100m` | | `initContainers.resources.requests.memory` | initContainers.requests.memory Kubernetes memory resource limits for init containers | `128Mi` | -### Signing - -| Name | Description | Value | -| ------------------------ | ----------------------------------------------------------------- | ------------------ | -| `signing.enabled` | Enable commit/action signing | `false` | -| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | -| `signing.privateKey` | Inline private gpg key for signed internal Git activity | `""` | -| `signing.existingSecret` | Use an existing secret to store the value of `signing.privateKey` | `""` | - ### Gitea | Name | Description | Value | @@ -1351,6 +1358,41 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma
+To 13.0.0 + + + +**Breaking changes** + + +- All Secrets created by this chart are now configured through the new `secrets` section. + It exposes `annotations`, `labels`, a checksum-annotation toggle and an `existingSecret` reference for each of the + `config`, `gpg`, `init`, `inlineConfig` and `metrics` Secrets. +- The top-level `signing` object has been replaced by `secrets.gpg`. + The chart fails to render if `signing` is still set. + Migrate as follows: + + | Old | New | + | ------------------------ | -------------------------------------------------------------------------------- | + | `signing.enabled` | `secrets.gpg.enabled` | + | `signing.gpgHome` | `secrets.gpg.new.gpgHome` | + | `signing.privateKey` | `secrets.gpg.new.privateKey` | + | `signing.existingSecret` | `secrets.gpg.existingSecret.enabled` and `secrets.gpg.existingSecret.secretName` | + + The `gpgHome` path is now stored in the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as a + plain environment variable value. + Existing Secrets referenced via `secrets.gpg.existingSecret` therefore need a `gpgHome` key in addition to + `privateKey`. Both key names are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and + `secrets.gpg.existingSecret.privateKeyKey`. + +- Renamed the generated Secrets to make their purpose obvious: + the config Secret changed from `` to `-config` and the metrics Secret from + `-metrics-secret` to `-metrics`. + +
+ +
+ To 12.0.0 @@ -1366,6 +1408,7 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma This change was made to avoid overloading the existing helm chart, which is already quite large in size and configuration options. In addition, the existing maintainers team was not actively using "Actions" which slowed down development and community contributions. While the new chart is still young (and waiting for contributions! and maintainers), we believe that it is the best way moving forward for both parts. + - Migrated from Redis/Redis-cluster to Valkey/Valkey-cluster charts (#775). While marked as breaking, there is no need to migrate data. The cache will start to refill automatically. diff --git a/templates/gitea/_secrets.tpl b/templates/gitea/_secrets.tpl index 48ac0bb..96cb4b5 100644 --- a/templates/gitea/_secrets.tpl +++ b/templates/gitea/_secrets.tpl @@ -83,7 +83,7 @@ {{- if .Values.secrets.gpg.existingSecret.enabled -}} {{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }} {{- else -}} -{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} +{{ include "gitea.fullname" . }}-gpg-key {{- end -}} {{- end }} @@ -110,3 +110,21 @@ {{ include "gitea.fullname" . }}-metrics {{- end -}} {{- end }} + +{{/* keys */}} + +{{- define "gitea.secret.gpg.gpgHomeKey" -}} +{{- if .Values.secrets.gpg.existingSecret.enabled -}} +{{ .Values.secrets.gpg.existingSecret.gpgHomeKey }} +{{- else -}} +gpgHome +{{- end -}} +{{- end }} + +{{- define "gitea.secret.gpg.privateKeyKey" -}} +{{- if .Values.secrets.gpg.existingSecret.enabled -}} +{{ .Values.secrets.gpg.existingSecret.privateKeyKey }} +{{- else -}} +privateKey +{{- end -}} +{{- end }} diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml index ccc46af..a86f78e 100644 --- a/templates/gitea/deployment.yaml +++ b/templates/gitea/deployment.yaml @@ -100,9 +100,12 @@ spec: {{- if .Values.deployment.env }} {{- toYaml .Values.deployment.env | nindent 12 }} {{- end }} - {{- if .Values.signing.enabled }} + {{- if .Values.secrets.gpg.enabled }} - name: GNUPGHOME - value: {{ .Values.signing.gpgHome }} + valueFrom: + secretKeyRef: + name: {{ include "gitea.secret.gpg.name" . }} + key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} {{- end }} volumeMounts: - name: init @@ -176,7 +179,7 @@ spec: {{- end }} resources: {{- toYaml .Values.initContainers.resources | nindent 12 }} - {{- if .Values.signing.enabled }} + {{- if .Values.secrets.gpg.enabled }} - name: configure-gpg image: "{{ include "gitea.image" . }}" {{- if .Values.gitea.extraEnvSourceFile }} @@ -196,7 +199,10 @@ spec: {{- end }} env: - name: GNUPGHOME - value: {{ .Values.signing.gpgHome }} + valueFrom: + secretKeyRef: + name: {{ include "gitea.secret.gpg.name" . }} + key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} - name: TMP_RAW_GPG_KEY value: /raw/private.asc volumeMounts: @@ -357,9 +363,12 @@ spec: - name: HOME value: /data/gitea/git {{- end }} - {{- if .Values.signing.enabled }} + {{- if .Values.secrets.gpg.enabled }} - name: GNUPGHOME - value: {{ .Values.signing.gpgHome }} + valueFrom: + secretKeyRef: + name: {{ include "gitea.secret.gpg.name" . }} + key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} {{- end }} {{- if .Values.deployment.env }} {{- toYaml .Values.deployment.env | nindent 12 }} @@ -451,12 +460,12 @@ spec: {{- end }} - name: temp emptyDir: {} - {{- if .Values.signing.enabled }} + {{- if .Values.secrets.gpg.enabled }} - name: gpg-private-key secret: secretName: {{ include "gitea.secret.gpg.name" . }} items: - - key: privateKey + - key: {{ include "gitea.secret.gpg.privateKeyKey" . }} path: private.asc defaultMode: 0100 {{- end }} diff --git a/templates/gitea/deprecation.yaml b/templates/gitea/deprecation.yaml index 057c5bd..081d28f 100644 --- a/templates/gitea/deprecation.yaml +++ b/templates/gitea/deprecation.yaml @@ -14,12 +14,12 @@ {{- if kindIs "map" .Values.gitea.ldap -}} {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}} {{- end -}} - + {{/* OAUTH SOURCES */}} {{- if kindIs "map" .Values.gitea.oauth -}} {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}} {{- end -}} - + {{/* BUILTIN */}} {{- if .Values.gitea.cache -}} {{- if .Values.gitea.cache.builtIn -}} @@ -31,4 +31,9 @@ {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}} {{- end -}} {{- end -}} + + {{/* SIGNING */}} + {{- if .Values.signing -}} + {{- fail "`signing` does no longer exist. Please refer to the changelog and configure `secrets.gpg` instead." -}} + {{- end -}} {{- end -}} diff --git a/templates/gitea/secret_gpg.yaml b/templates/gitea/secret_gpg.yaml index 19cca19..44460be 100644 --- a/templates/gitea/secret_gpg.yaml +++ b/templates/gitea/secret_gpg.yaml @@ -1,8 +1,7 @@ -{{- if and (.Values.signing.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}} -{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} - {{- fail "Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`" -}} +{{- if and (.Values.secrets.gpg.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}} +{{- if empty .Values.secrets.gpg.new.privateKey -}} + {{- fail "Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`" -}} {{- end }} -{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} apiVersion: v1 kind: Secret metadata: @@ -16,6 +15,6 @@ metadata: namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque data: - privateKey: {{ .Values.signing.privateKey | b64enc }} -{{- end }} + gpgHome: {{ .Values.secrets.gpg.new.gpgHome | b64enc }} + privateKey: {{ .Values.secrets.gpg.new.privateKey | b64enc }} {{- end }} diff --git a/templates/gitea/secret_init.yaml b/templates/gitea/secret_init.yaml index 308543d..32b003e 100644 --- a/templates/gitea/secret_init.yaml +++ b/templates/gitea/secret_init.yaml @@ -40,7 +40,7 @@ stringData: {{- end }} chmod -v ug+rwx "${GITEA_TEMP}" - {{ if .Values.signing.enabled -}} + {{ if .Values.secrets.gpg.enabled -}} if [ ! -d "${GNUPGHOME}" ]; then mkdir -pv "${GNUPGHOME}" chmod -v 700 "${GNUPGHOME}" diff --git a/unittests/helm/deployment/extraEnvSourceFile.yaml b/unittests/helm/deployment/extraEnvSourceFile.yaml index a05ed52..9eb0202 100644 --- a/unittests/helm/deployment/extraEnvSourceFile.yaml +++ b/unittests/helm/deployment/extraEnvSourceFile.yaml @@ -59,9 +59,9 @@ tests: - it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled template: templates/gitea/deployment.yaml set: - signing: - enabled: true - existingSecret: "custom-gpg-secret" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" gitea: extraEnvSourceFile: /vault/secrets/gitea asserts: diff --git a/unittests/helm/deployment/extraInitContainers.yaml b/unittests/helm/deployment/extraInitContainers.yaml index 74a29f6..6734080 100644 --- a/unittests/helm/deployment/extraInitContainers.yaml +++ b/unittests/helm/deployment/extraInitContainers.yaml @@ -22,8 +22,9 @@ tests: - it: Render the deployment (signing) set: - signing.enabled: true - signing.existingSecret: "custom-gpg-secret" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" asserts: - hasDocuments: count: 1 @@ -41,8 +42,9 @@ tests: preExtraInitContainers: - name: bar image: docker.io/library/busybox:latest - signing.enabled: true - signing.existingSecret: "custom-gpg-secret" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" asserts: - hasDocuments: count: 1 diff --git a/unittests/helm/deployment/openshift.yaml b/unittests/helm/deployment/openshift.yaml index 89633e8..be68382 100644 --- a/unittests/helm/deployment/openshift.yaml +++ b/unittests/helm/deployment/openshift.yaml @@ -64,8 +64,9 @@ tests: template: templates/gitea/deployment.yaml set: openshift.enabled: true - signing.enabled: true - signing.existingSecret: custom-gpg-secret + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: custom-gpg-secret asserts: - notExists: path: spec.template.spec.initContainers[2].securityContext.runAsUser diff --git a/unittests/helm/deployment/signing-disabled.yaml b/unittests/helm/deployment/signing-disabled.yaml index 266b490..173cb99 100644 --- a/unittests/helm/deployment/signing-disabled.yaml +++ b/unittests/helm/deployment/signing-disabled.yaml @@ -21,13 +21,12 @@ tests: - it: skips gpg env in `init-directories` init container template: templates/gitea/deployment.yaml set: - signing.enabled: false + secrets.gpg.enabled: false asserts: - notContains: path: spec.template.spec.initContainers[0].env content: name: GNUPGHOME - value: /data/git/.gnupg - it: skips gpg env in runtime container template: templates/gitea/deployment.yaml asserts: diff --git a/unittests/helm/deployment/signing-enabled.yaml b/unittests/helm/deployment/signing-enabled.yaml index 468bee2..a32bb74 100644 --- a/unittests/helm/deployment/signing-enabled.yaml +++ b/unittests/helm/deployment/signing-enabled.yaml @@ -13,9 +13,9 @@ tests: - it: adds gpg init container template: templates/gitea/deployment.yaml set: - signing: - enabled: true - existingSecret: "custom-gpg-secret" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" asserts: - equal: path: spec.template.spec.initContainers[2].name @@ -31,7 +31,10 @@ tests: path: spec.template.spec.initContainers[2].env value: - name: GNUPGHOME - value: /data/git/.gnupg + valueFrom: + secretKeyRef: + name: custom-gpg-secret + key: gpgHome - name: TMP_RAW_GPG_KEY value: /raw/private.asc - equal: @@ -47,31 +50,54 @@ tests: - it: adds gpg env in `init-directories` init container template: templates/gitea/deployment.yaml set: - signing.enabled: true - signing.existingSecret: "custom-gpg-secret" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" asserts: - contains: path: spec.template.spec.initContainers[0].env content: name: GNUPGHOME - value: /data/git/.gnupg + valueFrom: + secretKeyRef: + name: custom-gpg-secret + key: gpgHome - it: adds gpg env in runtime container template: templates/gitea/deployment.yaml set: - signing.enabled: true - signing.existingSecret: "custom-gpg-secret" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" asserts: - contains: path: spec.template.spec.containers[0].env content: name: GNUPGHOME - value: /data/git/.gnupg + valueFrom: + secretKeyRef: + name: custom-gpg-secret + key: gpgHome + - it: reads the gpg home from the configured key of an existing secret + template: templates/gitea/deployment.yaml + set: + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "custom-gpg-secret" + secrets.gpg.existingSecret.gpgHomeKey: custom-gpg-home + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: GNUPGHOME + valueFrom: + secretKeyRef: + name: custom-gpg-secret + key: custom-gpg-home - it: adds gpg volume spec template: templates/gitea/deployment.yaml set: - signing: - enabled: true - existingSecret: "gitea-unittests-gpg-key" + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: "gpg-key-placeholder" asserts: - contains: path: spec.template.spec.volumes @@ -86,9 +112,10 @@ tests: - it: supports gpg volume spec with external reference template: templates/gitea/deployment.yaml set: - signing: - enabled: true - existingSecret: custom-gpg-secret + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: custom-gpg-secret + secrets.gpg.existingSecret.privateKeyKey: custom-private-key asserts: - contains: path: spec.template.spec.volumes @@ -97,6 +124,6 @@ tests: secret: secretName: custom-gpg-secret items: - - key: privateKey + - key: custom-private-key path: private.asc defaultMode: 0100 diff --git a/unittests/helm/gpg-secret/signing-disabled.yaml b/unittests/helm/gpg-secret/signing-disabled.yaml index ce783c0..3604920 100644 --- a/unittests/helm/gpg-secret/signing-disabled.yaml +++ b/unittests/helm/gpg-secret/signing-disabled.yaml @@ -7,7 +7,7 @@ templates: tests: - it: renders nothing set: - signing.enabled: false + secrets.gpg.enabled: false asserts: - hasDocuments: count: 0 diff --git a/unittests/helm/gpg-secret/signing-enabled.yaml b/unittests/helm/gpg-secret/signing-enabled.yaml index 2e976c0..80d1b98 100644 --- a/unittests/helm/gpg-secret/signing-enabled.yaml +++ b/unittests/helm/gpg-secret/signing-enabled.yaml @@ -7,24 +7,22 @@ templates: tests: - it: fails rendering when nothing is configured set: - signing: - enabled: true + secrets.gpg.enabled: true asserts: - failedTemplate: - errorMessage: Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret` + errorMessage: Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret` - it: skips rendering using external secret reference set: - signing: - enabled: true - existingSecret: "external-secret-reference" + secrets.gpg.enabled: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: "external-secret-reference" asserts: - hasDocuments: count: 0 - it: renders secret specification using inline gpg key set: - signing: - enabled: true - privateKey: "gpg-key-placeholder" + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: "gpg-key-placeholder" asserts: - hasDocuments: count: 1 @@ -35,6 +33,9 @@ tests: name: gitea-unittests-gpg-key - isNotNullOrEmpty: path: metadata.labels + - equal: + path: data.gpgHome + value: "L2RhdGEvZ2l0Ly5nbnVwZw==" - equal: path: data.privateKey value: "Z3BnLWtleS1wbGFjZWhvbGRlcg==" diff --git a/unittests/helm/init/init_directory_structure.sh-rootless.yaml b/unittests/helm/init/init_directory_structure.sh-rootless.yaml index 7e04fc1..0e51bd3 100644 --- a/unittests/helm/init/init_directory_structure.sh-rootless.yaml +++ b/unittests/helm/init/init_directory_structure.sh-rootless.yaml @@ -7,8 +7,8 @@ templates: tests: - it: runs gpg in batch mode set: - signing.enabled: true - signing.privateKey: |- + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: |- -----BEGIN PGP PRIVATE KEY BLOCK----- {placeholder} -----END PGP PRIVATE KEY BLOCK----- @@ -37,8 +37,8 @@ tests: chmod -v ug+rwx "${GITEA_TEMP}" - it: adds gpg script block for enabled signing set: - signing.enabled: true - signing.privateKey: |- + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: |- -----BEGIN PGP PRIVATE KEY BLOCK----- {placeholder} -----END PGP PRIVATE KEY BLOCK----- diff --git a/unittests/helm/init/init_directory_structure.sh.yaml b/unittests/helm/init/init_directory_structure.sh.yaml index 3001cbe..1fc46d1 100644 --- a/unittests/helm/init/init_directory_structure.sh.yaml +++ b/unittests/helm/init/init_directory_structure.sh.yaml @@ -8,8 +8,8 @@ tests: - it: runs gpg in batch mode set: image.rootless: false - signing.enabled: true - signing.privateKey: |- + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: |- -----BEGIN PGP PRIVATE KEY BLOCK----- {placeholder} -----END PGP PRIVATE KEY BLOCK----- @@ -43,8 +43,8 @@ tests: - it: adds gpg script block for enabled signing set: image.rootless: false - signing.enabled: true - signing.privateKey: |- + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: |- -----BEGIN PGP PRIVATE KEY BLOCK----- {placeholder} -----END PGP PRIVATE KEY BLOCK----- diff --git a/values.yaml b/values.yaml index 143984a..333e409 100644 --- a/values.yaml +++ b/values.yaml @@ -362,20 +362,35 @@ secrets: labels: {} gpg: + ## @param secrets.gpg.enabled Enable mounting of a GPG key to sign git commits. + enabled: false + ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change addSHASumAnnotation: true ## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret ## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret + ## @param secrets.gpg.existingSecret.gpgHomeKey Key of the GPG home directory in the existing GPG key Secret + ## @param secrets.gpg.existingSecret.privateKeyKey Key of the private key in the existing GPG key Secret. existingSecret: enabled: false secretName: "" + gpgHomeKey: gpgHome + privateKeyKey: privateKey ## @param secrets.gpg.new.annotations Annotations for the GPG key Secret ## @param secrets.gpg.new.labels Labels for the GPG key Secret + ## @param secrets.gpg.new.gpgHome Path to the GPG home directory. + ## @param secrets.gpg.new.privateKey Content of the private GPG key in armored format. new: annotations: {} labels: {} + gpgHome: /data/git/.gnupg + privateKey: "" + # privateKey: |- + # -----BEGIN PGP PRIVATE KEY BLOCK----- + # ... + # -----END PGP PRIVATE KEY BLOCK----- init: ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change @@ -532,23 +547,6 @@ initContainers: cpu: 100m memory: 128Mi -# Configure commit/action signing prerequisites -## @section Signing -# -## @param signing.enabled Enable commit/action signing -## @param signing.gpgHome GPG home directory -## @param signing.privateKey Inline private gpg key for signed internal Git activity -## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey` -signing: - enabled: false - gpgHome: /data/git/.gnupg - privateKey: "" - # privateKey: |- - # -----BEGIN PGP PRIVATE KEY BLOCK----- - # ... - # -----END PGP PRIVATE KEY BLOCK----- - existingSecret: "" - ## @section Gitea # gitea: