volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

feat(secrets)!: replace the signing object with secrets.gpg

Browse Source 
The `signing` object was the last Secret-related configuration living outside of the `secrets` section introduced in the
previous commit. Keeping it separate meant that the GPG key Secret was the only one without configurable annotations,
labels and a proper `existingSecret` reference, and users had to learn two different conventions for the same concept.

`signing` is therefore removed and fully replaced by `secrets.gpg`:

  signing.enabled        -> secrets.gpg.enabled
  signing.gpgHome        -> secrets.gpg.new.gpgHome
  signing.privateKey     -> secrets.gpg.new.privateKey
  signing.existingSecret -> secrets.gpg.existingSecret.{enabled,secretName}

`gpgHome` is now stored as a key inside the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as
a plain environment variable value. This keeps the whole GPG configuration in a single object, so an operator can hand
over one Secret that fully describes the signing setup instead of splitting it across values and Secret data. The key
names of an externally provided Secret are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`, because chart-defined key names cannot be assumed for Secrets that are
managed by an external system such as an operator or a secret store.

To avoid silently ignoring a now unknown value, `deprecation.yaml` fails the render when `signing` is still set and
points to `secrets.gpg`. As with the other deprecation guards it can be bypassed via `checkDeprecation: false`.

The unit tests are migrated accordingly and the `GNUPGHOME` assertions now verify the `secretKeyRef` shape. Two new
cases cover custom `gpgHomeKey` and `privateKeyKey` values of an existing Secret.

The README gains a `To 13.0.0` upgrade section documenting this change together with the `secrets.*` block and the
Secret renames of the preceding commits.

BREAKING CHANGE: The `signing` object has been removed and is replaced by `secrets.gpg`. Rendering fails if `signing`
is still set. Secrets referenced via `secrets.gpg.existingSecret` now additionally require a `gpgHome` key next to
`privateKey`.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-03 17:36:33 +02:00
co-authored by Copilot
parent 4d82f17ce6
commit 3535611d4d
16 changed files with 228 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
unittests/helm/deployment/extraEnvSourceFile.yaml
+3 -3
View File
@@ -59,9 +59,9 @@ tests:
- it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
template: templates/gitea/deployment.yaml
set:
signing:
enabled: true
existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
gitea:
extraEnvSourceFile: /vault/secrets/gitea
asserts:
unittests/helm/deployment/extraInitContainers.yaml
+6 -4
View File
@@ -22,8 +22,9 @@ tests:
- it: Render the deployment (signing)
set:
signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts:
- hasDocuments:
count: 1
@@ -41,8 +42,9 @@ tests:
preExtraInitContainers:
- name: bar
image: docker.io/library/busybox:latest
signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts:
- hasDocuments:
count: 1
unittests/helm/deployment/openshift.yaml
+3 -2
View File
@@ -64,8 +64,9 @@ tests:
template: templates/gitea/deployment.yaml
set:
openshift.enabled: true
signing.enabled: true
signing.existingSecret: custom-gpg-secret
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: custom-gpg-secret
asserts:
- notExists:
path: spec.template.spec.initContainers[2].securityContext.runAsUser
unittests/helm/deployment/signing-disabled.yaml
+1 -2
View File
@@ -21,13 +21,12 @@ tests:
- it: skips gpg env in `init-directories` init container
template: templates/gitea/deployment.yaml
set:
signing.enabled: false
secrets.gpg.enabled: false
asserts:
- notContains:
path: spec.template.spec.initContainers[0].env
content:
name: GNUPGHOME
value: /data/git/.gnupg
- it: skips gpg env in runtime container
template: templates/gitea/deployment.yaml
asserts:
unittests/helm/deployment/signing-enabled.yaml
+44 -17
View File
@@ -13,9 +13,9 @@ tests:
- it: adds gpg init container
template: templates/gitea/deployment.yaml
set:
signing:
enabled: true
existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts:
- equal:
path: spec.template.spec.initContainers[2].name
@@ -31,7 +31,10 @@ tests:
path: spec.template.spec.initContainers[2].env
value:
- name: GNUPGHOME
value: /data/git/.gnupg
valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: gpgHome
- name: TMP_RAW_GPG_KEY
value: /raw/private.asc
- equal:
@@ -47,31 +50,54 @@ tests:
- it: adds gpg env in `init-directories` init container
template: templates/gitea/deployment.yaml
set:
signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts:
- contains:
path: spec.template.spec.initContainers[0].env
content:
name: GNUPGHOME
value: /data/git/.gnupg
valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: gpgHome
- it: adds gpg env in runtime container
template: templates/gitea/deployment.yaml
set:
signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: GNUPGHOME
value: /data/git/.gnupg
valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: gpgHome
- it: reads the gpg home from the configured key of an existing secret
template: templates/gitea/deployment.yaml
set:
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
secrets.gpg.existingSecret.gpgHomeKey: custom-gpg-home
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: GNUPGHOME
valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: custom-gpg-home
- it: adds gpg volume spec
template: templates/gitea/deployment.yaml
set:
signing:
enabled: true
existingSecret: "gitea-unittests-gpg-key"
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: "gpg-key-placeholder"
asserts:
- contains:
path: spec.template.spec.volumes
@@ -86,9 +112,10 @@ tests:
- it: supports gpg volume spec with external reference
template: templates/gitea/deployment.yaml
set:
signing:
enabled: true
existingSecret: custom-gpg-secret
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: custom-gpg-secret
secrets.gpg.existingSecret.privateKeyKey: custom-private-key
asserts:
- contains:
path: spec.template.spec.volumes
@@ -97,6 +124,6 @@ tests:
secret:
secretName: custom-gpg-secret
items:
- key: privateKey
- key: custom-private-key
path: private.asc
defaultMode: 0100