volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

feat(secrets)!: replace the signing object with secrets.gpg

Browse Source 
The `signing` object was the last Secret-related configuration living outside of the `secrets` section introduced in the
previous commit. Keeping it separate meant that the GPG key Secret was the only one without configurable annotations,
labels and a proper `existingSecret` reference, and users had to learn two different conventions for the same concept.

`signing` is therefore removed and fully replaced by `secrets.gpg`:

  signing.enabled        -> secrets.gpg.enabled
  signing.gpgHome        -> secrets.gpg.new.gpgHome
  signing.privateKey     -> secrets.gpg.new.privateKey
  signing.existingSecret -> secrets.gpg.existingSecret.{enabled,secretName}

`gpgHome` is now stored as a key inside the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as
a plain environment variable value. This keeps the whole GPG configuration in a single object, so an operator can hand
over one Secret that fully describes the signing setup instead of splitting it across values and Secret data. The key
names of an externally provided Secret are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`, because chart-defined key names cannot be assumed for Secrets that are
managed by an external system such as an operator or a secret store.

To avoid silently ignoring a now unknown value, `deprecation.yaml` fails the render when `signing` is still set and
points to `secrets.gpg`. As with the other deprecation guards it can be bypassed via `checkDeprecation: false`.

The unit tests are migrated accordingly and the `GNUPGHOME` assertions now verify the `secretKeyRef` shape. Two new
cases cover custom `gpgHomeKey` and `privateKeyKey` values of an existing Secret.

The README gains a `To 13.0.0` upgrade section documenting this change together with the `secrets.*` block and the
Secret renames of the preceding commits.

BREAKING CHANGE: The `signing` object has been removed and is replaced by `secrets.gpg`. Rendering fails if `signing`
is still set. Secrets referenced via `secrets.gpg.existingSecret` now additionally require a `gpgHome` key next to
`privateKey`.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-03 17:36:33 +02:00
co-authored by Copilot
parent 4d82f17ce6
commit 3535611d4d
16 changed files with 228 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+88 -45
View File
@@ -46,10 +46,10 @@
- [Route](#route) - [Route](#route)
- [Gateway API](#gateway-api) - [Gateway API](#gateway-api)
- [deployment](#deployment) - [deployment](#deployment)
- [Secret](#secret)
- [ServiceAccount](#serviceaccount) - [ServiceAccount](#serviceaccount)
- [Persistence](#persistence-1) - [Persistence](#persistence-1)
- [Init](#init) - [Init](#init)
- [Signing](#signing)
- [Gitea](#gitea) - [Gitea](#gitea)
- [LivenessProbe](#livenessprobe) - [LivenessProbe](#livenessprobe)
- [ReadinessProbe](#readinessprobe) - [ReadinessProbe](#readinessprobe)
@@ -766,17 +766,20 @@ When using the rootless image the gpg key folder is not persistent by default.
If you consider using signed commits for internal Gitea activities (e.g. initial commit), you'd need to provide a signing key. If you consider using signed commits for internal Gitea activities (e.g. initial commit), you'd need to provide a signing key.
Prior to [PR186](https://gitea.com/gitea/helm-gitea/pulls/186), imported keys had to be re-imported once the container got replaced by another. Prior to [PR186](https://gitea.com/gitea/helm-gitea/pulls/186), imported keys had to be re-imported once the container got replaced by another.
The mentioned PR introduced a new configuration object `signing` allowing you to configure prerequisites for commit signing. The `secrets.gpg` object allows you to configure the prerequisites for commit signing.
By default this section is disabled to maintain backwards compatibility. By default this section is disabled to maintain backwards compatibility.
```yaml ```yaml
signing: secrets:
enabled: false gpg:
gpgHome: /data/git/.gnupg enabled: false
new:
gpgHome: /data/git/.gnupg
``` ```
Regardless of the used container image the `signing` object allows to specify a private gpg key. Regardless of the used container image the `secrets.gpg` object allows to specify a private gpg key.
Either using the `signing.privateKey` to define the key inline, or refer to an existing secret containing the key data by using `signing.existingSecret`. Either using `secrets.gpg.new.privateKey` to define the key inline, or refer to an existing Secret containing the key data by
using `secrets.gpg.existingSecret`.
```yaml ```yaml
apiVersion: v1 apiVersion: v1
@@ -785,6 +788,7 @@ metadata:
name: custom-gitea-gpg-key name: custom-gitea-gpg-key
type: Opaque type: Opaque
stringData: stringData:
gpgHome: /data/git/.gnupg
privateKey: |- privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK----- -----BEGIN PGP PRIVATE KEY BLOCK-----
... ...
@@ -792,10 +796,17 @@ stringData:
``` ```
```yaml ```yaml
signing: secrets:
existingSecret: custom-gitea-gpg-key gpg:
enabled: true
existingSecret:
enabled: true
secretName: custom-gitea-gpg-key
``` ```
The keys within the existing Secret can be customized via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`.
To use the gpg key, Gitea needs to be configured accordingly. To use the gpg key, Gitea needs to be configured accordingly.
A detailed description can be found in the [official Gitea documentation](https://docs.gitea.com/administration/signing#general-configuration). A detailed description can be found in the [official Gitea documentation](https://docs.gitea.com/administration/signing#general-configuration).
@@ -1118,33 +1129,38 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
### Secret ### Secret
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------ |
| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` | | `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` |
| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | | `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` |
| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | | `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` |
| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | | `secrets.config.new.annotations` | Annotations for the config Secret | `{}` |
| `secrets.config.new.labels` | Labels for the config Secret | `{}` | | `secrets.config.new.labels` | Labels for the config Secret | `{}` |
| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` | | `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` |
| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | | `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` |
| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | | `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` |
| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | | `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` |
| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | | `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` |
| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` | | `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` |
| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | | `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` |
| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | | `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` |
| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | | `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` |
| `secrets.init.new.labels` | Labels for the init Secret | `{}` | | `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` |
| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` | | `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` |
| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | | `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` |
| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | | `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` |
| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | | `secrets.init.new.annotations` | Annotations for the init Secret | `{}` |
| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | | `secrets.init.new.labels` | Labels for the init Secret | `{}` |
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` | | `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` |
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | | `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` |
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | | `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` |
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | | `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` |
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | | `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` |
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` |
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` |
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` |
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` |
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` |
### ServiceAccount ### ServiceAccount
@@ -1190,15 +1206,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
| `initContainers.resources.requests.cpu` | initContainers.requests.cpu Kubernetes cpu resource limits for init containers | `100m` | | `initContainers.resources.requests.cpu` | initContainers.requests.cpu Kubernetes cpu resource limits for init containers | `100m` |
| `initContainers.resources.requests.memory` | initContainers.requests.memory Kubernetes memory resource limits for init containers | `128Mi` | | `initContainers.resources.requests.memory` | initContainers.requests.memory Kubernetes memory resource limits for init containers | `128Mi` |
### Signing
| Name | Description | Value |
| ------------------------ | ----------------------------------------------------------------- | ------------------ |
| `signing.enabled` | Enable commit/action signing | `false` |
| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` |
| `signing.privateKey` | Inline private gpg key for signed internal Git activity | `""` |
| `signing.existingSecret` | Use an existing secret to store the value of `signing.privateKey` | `""` |
### Gitea ### Gitea
| Name | Description | Value | | Name | Description | Value |
@@ -1351,6 +1358,41 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma
<details> <details>
<summary>To 13.0.0</summary>
<!-- prettier-ignore-start -->
<!-- markdownlint-disable-next-line -->
**Breaking changes**
<!-- prettier-ignore-end -->
- All Secrets created by this chart are now configured through the new `secrets` section.
It exposes `annotations`, `labels`, a checksum-annotation toggle and an `existingSecret` reference for each of the
`config`, `gpg`, `init`, `inlineConfig` and `metrics` Secrets.
- The top-level `signing` object has been replaced by `secrets.gpg`.
The chart fails to render if `signing` is still set.
Migrate as follows:
| Old | New |
| ------------------------ | -------------------------------------------------------------------------------- |
| `signing.enabled` | `secrets.gpg.enabled` |
| `signing.gpgHome` | `secrets.gpg.new.gpgHome` |
| `signing.privateKey` | `secrets.gpg.new.privateKey` |
| `signing.existingSecret` | `secrets.gpg.existingSecret.enabled` and `secrets.gpg.existingSecret.secretName` |
The `gpgHome` path is now stored in the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as a
plain environment variable value.
Existing Secrets referenced via `secrets.gpg.existingSecret` therefore need a `gpgHome` key in addition to
`privateKey`. Both key names are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`.
- Renamed the generated Secrets to make their purpose obvious:
the config Secret changed from `<fullname>` to `<fullname>-config` and the metrics Secret from
`<fullname>-metrics-secret` to `<fullname>-metrics`.
</details>
<details>
<summary>To 12.0.0</summary> <summary>To 12.0.0</summary>
<!-- prettier-ignore-start --> <!-- prettier-ignore-start -->
@@ -1366,6 +1408,7 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma
This change was made to avoid overloading the existing helm chart, which is already quite large in size and configuration options. This change was made to avoid overloading the existing helm chart, which is already quite large in size and configuration options.
In addition, the existing maintainers team was not actively using "Actions" which slowed down development and community contributions. In addition, the existing maintainers team was not actively using "Actions" which slowed down development and community contributions.
While the new chart is still young (and waiting for contributions! and maintainers), we believe that it is the best way moving forward for both parts. While the new chart is still young (and waiting for contributions! and maintainers), we believe that it is the best way moving forward for both parts.
- Migrated from Redis/Redis-cluster to Valkey/Valkey-cluster charts (#775). - Migrated from Redis/Redis-cluster to Valkey/Valkey-cluster charts (#775).
While marked as breaking, there is no need to migrate data. While marked as breaking, there is no need to migrate data.
The cache will start to refill automatically. The cache will start to refill automatically.
templates/gitea/_secrets.tpl
+19 -1
View File
@@ -83,7 +83,7 @@
{{- if .Values.secrets.gpg.existingSecret.enabled -}} {{- if .Values.secrets.gpg.existingSecret.enabled -}}
{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }} {{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
{{- else -}} {{- else -}}
{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} {{ include "gitea.fullname" . }}-gpg-key
{{- end -}} {{- end -}}
{{- end }} {{- end }}
@@ -110,3 +110,21 @@
{{ include "gitea.fullname" . }}-metrics {{ include "gitea.fullname" . }}-metrics
{{- end -}} {{- end -}}
{{- end }} {{- end }}
{{/* keys */}}
{{- define "gitea.secret.gpg.gpgHomeKey" -}}
{{- if .Values.secrets.gpg.existingSecret.enabled -}}
{{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
{{- else -}}
gpgHome
{{- end -}}
{{- end }}
{{- define "gitea.secret.gpg.privateKeyKey" -}}
{{- if .Values.secrets.gpg.existingSecret.enabled -}}
{{ .Values.secrets.gpg.existingSecret.privateKeyKey }}
{{- else -}}
privateKey
{{- end -}}
{{- end }}
templates/gitea/deployment.yaml
+17 -8
View File
@@ -100,9 +100,12 @@ spec:
{{- if .Values.deployment.env }} {{- if .Values.deployment.env }}
{{- toYaml .Values.deployment.env | nindent 12 }} {{- toYaml .Values.deployment.env | nindent 12 }}
{{- end }} {{- end }}
{{- if .Values.signing.enabled }} {{- if .Values.secrets.gpg.enabled }}
- name: GNUPGHOME - name: GNUPGHOME
value: {{ .Values.signing.gpgHome }} valueFrom:
secretKeyRef:
name: {{ include "gitea.secret.gpg.name" . }}
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
{{- end }} {{- end }}
volumeMounts: volumeMounts:
- name: init - name: init
@@ -176,7 +179,7 @@ spec:
{{- end }} {{- end }}
resources: resources:
{{- toYaml .Values.initContainers.resources | nindent 12 }} {{- toYaml .Values.initContainers.resources | nindent 12 }}
{{- if .Values.signing.enabled }} {{- if .Values.secrets.gpg.enabled }}
- name: configure-gpg - name: configure-gpg
image: "{{ include "gitea.image" . }}" image: "{{ include "gitea.image" . }}"
{{- if .Values.gitea.extraEnvSourceFile }} {{- if .Values.gitea.extraEnvSourceFile }}
@@ -196,7 +199,10 @@ spec:
{{- end }} {{- end }}
env: env:
- name: GNUPGHOME - name: GNUPGHOME
value: {{ .Values.signing.gpgHome }} valueFrom:
secretKeyRef:
name: {{ include "gitea.secret.gpg.name" . }}
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
- name: TMP_RAW_GPG_KEY - name: TMP_RAW_GPG_KEY
value: /raw/private.asc value: /raw/private.asc
volumeMounts: volumeMounts:
@@ -357,9 +363,12 @@ spec:
- name: HOME - name: HOME
value: /data/gitea/git value: /data/gitea/git
{{- end }} {{- end }}
{{- if .Values.signing.enabled }} {{- if .Values.secrets.gpg.enabled }}
- name: GNUPGHOME - name: GNUPGHOME
value: {{ .Values.signing.gpgHome }} valueFrom:
secretKeyRef:
name: {{ include "gitea.secret.gpg.name" . }}
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
{{- end }} {{- end }}
{{- if .Values.deployment.env }} {{- if .Values.deployment.env }}
{{- toYaml .Values.deployment.env | nindent 12 }} {{- toYaml .Values.deployment.env | nindent 12 }}
@@ -451,12 +460,12 @@ spec:
{{- end }} {{- end }}
- name: temp - name: temp
emptyDir: {} emptyDir: {}
{{- if .Values.signing.enabled }} {{- if .Values.secrets.gpg.enabled }}
- name: gpg-private-key - name: gpg-private-key
secret: secret:
secretName: {{ include "gitea.secret.gpg.name" . }} secretName: {{ include "gitea.secret.gpg.name" . }}
items: items:
- key: privateKey - key: {{ include "gitea.secret.gpg.privateKeyKey" . }}
path: private.asc path: private.asc
defaultMode: 0100 defaultMode: 0100
{{- end }} {{- end }}
templates/gitea/deprecation.yaml
+7 -2
View File
@@ -14,12 +14,12 @@
{{- if kindIs "map" .Values.gitea.ldap -}} {{- if kindIs "map" .Values.gitea.ldap -}}
{{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}} {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
{{- end -}} {{- end -}}
{{/* OAUTH SOURCES */}} {{/* OAUTH SOURCES */}}
{{- if kindIs "map" .Values.gitea.oauth -}} {{- if kindIs "map" .Values.gitea.oauth -}}
{{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}} {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
{{- end -}} {{- end -}}
{{/* BUILTIN */}} {{/* BUILTIN */}}
{{- if .Values.gitea.cache -}} {{- if .Values.gitea.cache -}}
{{- if .Values.gitea.cache.builtIn -}} {{- if .Values.gitea.cache.builtIn -}}
@@ -31,4 +31,9 @@
{{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}} {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
{{- end -}} {{- end -}}
{{- end -}} {{- end -}}
{{/* SIGNING */}}
{{- if .Values.signing -}}
{{- fail "`signing` does no longer exist. Please refer to the changelog and configure `secrets.gpg` instead." -}}
{{- end -}}
{{- end -}} {{- end -}}
templates/gitea/secret_gpg.yaml
+5 -6
View File
@@ -1,8 +1,7 @@
{{- if and (.Values.signing.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}} {{- if and (.Values.secrets.gpg.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} {{- if empty .Values.secrets.gpg.new.privateKey -}}
{{- fail "Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`" -}} {{- fail "Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`" -}}
{{- end }} {{- end }}
{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
@@ -16,6 +15,6 @@ metadata:
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
data: data:
privateKey: {{ .Values.signing.privateKey | b64enc }} gpgHome: {{ .Values.secrets.gpg.new.gpgHome | b64enc }}
{{- end }} privateKey: {{ .Values.secrets.gpg.new.privateKey | b64enc }}
{{- end }} {{- end }}
templates/gitea/secret_init.yaml
+1 -1
View File
@@ -40,7 +40,7 @@ stringData:
{{- end }} {{- end }}
chmod -v ug+rwx "${GITEA_TEMP}" chmod -v ug+rwx "${GITEA_TEMP}"
{{ if .Values.signing.enabled -}} {{ if .Values.secrets.gpg.enabled -}}
if [ ! -d "${GNUPGHOME}" ]; then if [ ! -d "${GNUPGHOME}" ]; then
mkdir -pv "${GNUPGHOME}" mkdir -pv "${GNUPGHOME}"
chmod -v 700 "${GNUPGHOME}" chmod -v 700 "${GNUPGHOME}"
unittests/helm/deployment/extraEnvSourceFile.yaml
+3 -3
View File
@@ -59,9 +59,9 @@ tests:
- it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled - it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing: secrets.gpg.enabled: true
enabled: true secrets.gpg.existingSecret.enabled: true
existingSecret: "custom-gpg-secret" secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
gitea: gitea:
extraEnvSourceFile: /vault/secrets/gitea extraEnvSourceFile: /vault/secrets/gitea
asserts: asserts:
unittests/helm/deployment/extraInitContainers.yaml
+6 -4
View File
@@ -22,8 +22,9 @@ tests:
- it: Render the deployment (signing) - it: Render the deployment (signing)
set: set:
signing.enabled: true secrets.gpg.enabled: true
signing.existingSecret: "custom-gpg-secret" secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 1 count: 1
@@ -41,8 +42,9 @@ tests:
preExtraInitContainers: preExtraInitContainers:
- name: bar - name: bar
image: docker.io/library/busybox:latest image: docker.io/library/busybox:latest
signing.enabled: true secrets.gpg.enabled: true
signing.existingSecret: "custom-gpg-secret" secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 1 count: 1
unittests/helm/deployment/openshift.yaml
+3 -2
View File
@@ -64,8 +64,9 @@ tests:
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
openshift.enabled: true openshift.enabled: true
signing.enabled: true secrets.gpg.enabled: true
signing.existingSecret: custom-gpg-secret secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: custom-gpg-secret
asserts: asserts:
- notExists: - notExists:
path: spec.template.spec.initContainers[2].securityContext.runAsUser path: spec.template.spec.initContainers[2].securityContext.runAsUser
unittests/helm/deployment/signing-disabled.yaml
+1 -2
View File
@@ -21,13 +21,12 @@ tests:
- it: skips gpg env in `init-directories` init container - it: skips gpg env in `init-directories` init container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing.enabled: false secrets.gpg.enabled: false
asserts: asserts:
- notContains: - notContains:
path: spec.template.spec.initContainers[0].env path: spec.template.spec.initContainers[0].env
content: content:
name: GNUPGHOME name: GNUPGHOME
value: /data/git/.gnupg
- it: skips gpg env in runtime container - it: skips gpg env in runtime container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
asserts: asserts:
unittests/helm/deployment/signing-enabled.yaml
+44 -17
View File
@@ -13,9 +13,9 @@ tests:
- it: adds gpg init container - it: adds gpg init container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing: secrets.gpg.enabled: true
enabled: true secrets.gpg.existingSecret.enabled: true
existingSecret: "custom-gpg-secret" secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts: asserts:
- equal: - equal:
path: spec.template.spec.initContainers[2].name path: spec.template.spec.initContainers[2].name
@@ -31,7 +31,10 @@ tests:
path: spec.template.spec.initContainers[2].env path: spec.template.spec.initContainers[2].env
value: value:
- name: GNUPGHOME - name: GNUPGHOME
value: /data/git/.gnupg valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: gpgHome
- name: TMP_RAW_GPG_KEY - name: TMP_RAW_GPG_KEY
value: /raw/private.asc value: /raw/private.asc
- equal: - equal:
@@ -47,31 +50,54 @@ tests:
- it: adds gpg env in `init-directories` init container - it: adds gpg env in `init-directories` init container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing.enabled: true secrets.gpg.enabled: true
signing.existingSecret: "custom-gpg-secret" secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts: asserts:
- contains: - contains:
path: spec.template.spec.initContainers[0].env path: spec.template.spec.initContainers[0].env
content: content:
name: GNUPGHOME name: GNUPGHOME
value: /data/git/.gnupg valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: gpgHome
- it: adds gpg env in runtime container - it: adds gpg env in runtime container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing.enabled: true secrets.gpg.enabled: true
signing.existingSecret: "custom-gpg-secret" secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
asserts: asserts:
- contains: - contains:
path: spec.template.spec.containers[0].env path: spec.template.spec.containers[0].env
content: content:
name: GNUPGHOME name: GNUPGHOME
value: /data/git/.gnupg valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: gpgHome
- it: reads the gpg home from the configured key of an existing secret
template: templates/gitea/deployment.yaml
set:
secrets.gpg.enabled: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
secrets.gpg.existingSecret.gpgHomeKey: custom-gpg-home
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: GNUPGHOME
valueFrom:
secretKeyRef:
name: custom-gpg-secret
key: custom-gpg-home
- it: adds gpg volume spec - it: adds gpg volume spec
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing: secrets.gpg.enabled: true
enabled: true secrets.gpg.new.privateKey: "gpg-key-placeholder"
existingSecret: "gitea-unittests-gpg-key"
asserts: asserts:
- contains: - contains:
path: spec.template.spec.volumes path: spec.template.spec.volumes
@@ -86,9 +112,10 @@ tests:
- it: supports gpg volume spec with external reference - it: supports gpg volume spec with external reference
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
set: set:
signing: secrets.gpg.enabled: true
enabled: true secrets.gpg.existingSecret.enabled: true
existingSecret: custom-gpg-secret secrets.gpg.existingSecret.secretName: custom-gpg-secret
secrets.gpg.existingSecret.privateKeyKey: custom-private-key
asserts: asserts:
- contains: - contains:
path: spec.template.spec.volumes path: spec.template.spec.volumes
@@ -97,6 +124,6 @@ tests:
secret: secret:
secretName: custom-gpg-secret secretName: custom-gpg-secret
items: items:
- key: privateKey - key: custom-private-key
path: private.asc path: private.asc
defaultMode: 0100 defaultMode: 0100
unittests/helm/gpg-secret/signing-disabled.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ templates:
tests: tests:
- it: renders nothing - it: renders nothing
set: set:
signing.enabled: false secrets.gpg.enabled: false
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 0 count: 0
unittests/helm/gpg-secret/signing-enabled.yaml
+10 -9
View File
@@ -7,24 +7,22 @@ templates:
tests: tests:
- it: fails rendering when nothing is configured - it: fails rendering when nothing is configured
set: set:
signing: secrets.gpg.enabled: true
enabled: true
asserts: asserts:
- failedTemplate: - failedTemplate:
errorMessage: Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret` errorMessage: Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`
- it: skips rendering using external secret reference - it: skips rendering using external secret reference
set: set:
signing: secrets.gpg.enabled: true
enabled: true secrets.gpg.existingSecret.enabled: true
existingSecret: "external-secret-reference" secrets.gpg.existingSecret.secretName: "external-secret-reference"
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 0 count: 0
- it: renders secret specification using inline gpg key - it: renders secret specification using inline gpg key
set: set:
signing: secrets.gpg.enabled: true
enabled: true secrets.gpg.new.privateKey: "gpg-key-placeholder"
privateKey: "gpg-key-placeholder"
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 1 count: 1
@@ -35,6 +33,9 @@ tests:
name: gitea-unittests-gpg-key name: gitea-unittests-gpg-key
- isNotNullOrEmpty: - isNotNullOrEmpty:
path: metadata.labels path: metadata.labels
- equal:
path: data.gpgHome
value: "L2RhdGEvZ2l0Ly5nbnVwZw=="
- equal: - equal:
path: data.privateKey path: data.privateKey
value: "Z3BnLWtleS1wbGFjZWhvbGRlcg==" value: "Z3BnLWtleS1wbGFjZWhvbGRlcg=="
unittests/helm/init/init_directory_structure.sh-rootless.yaml
+4 -4
View File
@@ -7,8 +7,8 @@ templates:
tests: tests:
- it: runs gpg in batch mode - it: runs gpg in batch mode
set: set:
signing.enabled: true secrets.gpg.enabled: true
signing.privateKey: |- secrets.gpg.new.privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK----- -----BEGIN PGP PRIVATE KEY BLOCK-----
{placeholder} {placeholder}
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
@@ -37,8 +37,8 @@ tests:
chmod -v ug+rwx "${GITEA_TEMP}" chmod -v ug+rwx "${GITEA_TEMP}"
- it: adds gpg script block for enabled signing - it: adds gpg script block for enabled signing
set: set:
signing.enabled: true secrets.gpg.enabled: true
signing.privateKey: |- secrets.gpg.new.privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK----- -----BEGIN PGP PRIVATE KEY BLOCK-----
{placeholder} {placeholder}
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
unittests/helm/init/init_directory_structure.sh.yaml
+4 -4
View File
@@ -8,8 +8,8 @@ tests:
- it: runs gpg in batch mode - it: runs gpg in batch mode
set: set:
image.rootless: false image.rootless: false
signing.enabled: true secrets.gpg.enabled: true
signing.privateKey: |- secrets.gpg.new.privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK----- -----BEGIN PGP PRIVATE KEY BLOCK-----
{placeholder} {placeholder}
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
@@ -43,8 +43,8 @@ tests:
- it: adds gpg script block for enabled signing - it: adds gpg script block for enabled signing
set: set:
image.rootless: false image.rootless: false
signing.enabled: true secrets.gpg.enabled: true
signing.privateKey: |- secrets.gpg.new.privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK----- -----BEGIN PGP PRIVATE KEY BLOCK-----
{placeholder} {placeholder}
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
values.yaml
+15 -17
View File
@@ -362,20 +362,35 @@ secrets:
labels: {} labels: {}
gpg: gpg:
## @param secrets.gpg.enabled Enable mounting of a GPG key to sign git commits.
enabled: false
## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change
addSHASumAnnotation: true addSHASumAnnotation: true
## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret ## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret
## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret ## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret
## @param secrets.gpg.existingSecret.gpgHomeKey Key of the GPG home directory in the existing GPG key Secret
## @param secrets.gpg.existingSecret.privateKeyKey Key of the private key in the existing GPG key Secret.
existingSecret: existingSecret:
enabled: false enabled: false
secretName: "" secretName: ""
gpgHomeKey: gpgHome
privateKeyKey: privateKey
## @param secrets.gpg.new.annotations Annotations for the GPG key Secret ## @param secrets.gpg.new.annotations Annotations for the GPG key Secret
## @param secrets.gpg.new.labels Labels for the GPG key Secret ## @param secrets.gpg.new.labels Labels for the GPG key Secret
## @param secrets.gpg.new.gpgHome Path to the GPG home directory.
## @param secrets.gpg.new.privateKey Content of the private GPG key in armored format.
new: new:
annotations: {} annotations: {}
labels: {} labels: {}
gpgHome: /data/git/.gnupg
privateKey: ""
# privateKey: |-
# -----BEGIN PGP PRIVATE KEY BLOCK-----
# ...
# -----END PGP PRIVATE KEY BLOCK-----
init: init:
## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change
@@ -532,23 +547,6 @@ initContainers:
cpu: 100m cpu: 100m
memory: 128Mi memory: 128Mi
# Configure commit/action signing prerequisites
## @section Signing
#
## @param signing.enabled Enable commit/action signing
## @param signing.gpgHome GPG home directory
## @param signing.privateKey Inline private gpg key for signed internal Git activity
## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey`
signing:
enabled: false
gpgHome: /data/git/.gnupg
privateKey: ""
# privateKey: |-
# -----BEGIN PGP PRIVATE KEY BLOCK-----
# ...
# -----END PGP PRIVATE KEY BLOCK-----
existingSecret: ""
## @section Gitea ## @section Gitea
# #
gitea: gitea: