volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

feat(secrets)!: replace the signing object with secrets.gpg

Browse Source 
The `signing` object was the last Secret-related configuration living outside of the `secrets` section introduced in the
previous commit. Keeping it separate meant that the GPG key Secret was the only one without configurable annotations,
labels and a proper `existingSecret` reference, and users had to learn two different conventions for the same concept.

`signing` is therefore removed and fully replaced by `secrets.gpg`:

  signing.enabled        -> secrets.gpg.enabled
  signing.gpgHome        -> secrets.gpg.new.gpgHome
  signing.privateKey     -> secrets.gpg.new.privateKey
  signing.existingSecret -> secrets.gpg.existingSecret.{enabled,secretName}

`gpgHome` is now stored as a key inside the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as
a plain environment variable value. This keeps the whole GPG configuration in a single object, so an operator can hand
over one Secret that fully describes the signing setup instead of splitting it across values and Secret data. The key
names of an externally provided Secret are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`, because chart-defined key names cannot be assumed for Secrets that are
managed by an external system such as an operator or a secret store.

To avoid silently ignoring a now unknown value, `deprecation.yaml` fails the render when `signing` is still set and
points to `secrets.gpg`. As with the other deprecation guards it can be bypassed via `checkDeprecation: false`.

The unit tests are migrated accordingly and the `GNUPGHOME` assertions now verify the `secretKeyRef` shape. Two new
cases cover custom `gpgHomeKey` and `privateKeyKey` values of an existing Secret.

The README gains a `To 13.0.0` upgrade section documenting this change together with the `secrets.*` block and the
Secret renames of the preceding commits.

BREAKING CHANGE: The `signing` object has been removed and is replaced by `secrets.gpg`. Rendering fails if `signing`
is still set. Secrets referenced via `secrets.gpg.existingSecret` now additionally require a `gpgHome` key next to
`privateKey`.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-03 17:36:33 +02:00
co-authored by Copilot
parent 4d82f17ce6
commit 3535611d4d
16 changed files with 228 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
unittests/helm/deployment/extraEnvSourceFile.yaml
+3 -3
View File
@@ -59,9 +59,9 @@ tests:
- it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
template: templates/gitea/deployment.yaml
set:
signing:
enabled: true
existingSecret: "custom-gpg-secret"
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
gitea:
extraEnvSourceFile: /vault/secrets/gitea
asserts: