volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

feat(deployment)!: move security contexts into the deployment dict

Browse Source 
`podSecurityContext` and `containerSecurityContext` are both Deployment-scoped: the former is rendered into
`spec.template.spec.securityContext`, the latter into the securityContext of the Gitea container and the
chart-managed init containers. Keeping them at the top level hid that pod/container distinction behind a
naming convention and separated them from the other pod- and container-scoped settings that already live
under `deployment` and `deployment.gitea`.

`podSecurityContext` therefore becomes `deployment.securityContext` and `containerSecurityContext` becomes
`deployment.gitea.securityContext`, which makes the scope obvious from the values path alone and continues
the consolidation started with `deployment.gitea.env`, `deployment.gitea.resources` and
`deployment.gitea.image`.

The template helpers keep their argument-based signatures, because `gitea.containerSecurityContext` is also
used by the Helm test pod and is not bound to a single values path.

Both removed keys are covered by the deprecation check so that a silently dropped security context cannot
lead to containers unexpectedly running as root or without the configured capability set.

BREAKING CHANGE: `podSecurityContext` and `containerSecurityContext` no longer exist. Use
`deployment.securityContext` and `deployment.gitea.securityContext` instead. Installations that still set
the old keys will fail to render unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-04 13:28:54 +02:00
co-authored by Copilot
parent 3c9fc19829
commit 377306b418
7 changed files with 79 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/_helpers.tpl
+7 -7
View File
@@ -104,13 +104,13 @@ Return the pod's hostUsers setting when OpenShift compatibility is enabled.
{{/*
Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
*/}}
{{- define "gitea.podSecurityContext" -}}
{{- $podSecurityContext := deepCopy .Values.podSecurityContext -}}
{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $podSecurityContext "fsGroup")) -}}
{{- $_ := set $podSecurityContext "fsGroup" 1000 -}}
{{- define "gitea.deployment.securityContext" -}}
{{- $securityContext := deepCopy .Values.deployment.securityContext -}}
{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $securityContext "fsGroup")) -}}
{{- $_ := set $securityContext "fsGroup" 1000 -}}
{{- end -}}
{{- if gt (len $podSecurityContext) 0 -}}
{{ toYaml $podSecurityContext }}
{{- if gt (len $securityContext) 0 -}}
{{ toYaml $securityContext }}
{{- end -}}
{{- end -}}
@@ -150,7 +150,7 @@ These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
Render the runtime container securityContext while honoring the deprecated securityContext value.
*/}}
{{- define "gitea.runtimeContainerSecurityContext" -}}
{{- $containerSecurityContext := deepCopy .Values.containerSecurityContext -}}
{{- $containerSecurityContext := deepCopy .Values.deployment.gitea.securityContext -}}
{{- if and (eq (len $containerSecurityContext) 0) .Values.securityContext -}}
{{- $containerSecurityContext = deepCopy .Values.securityContext -}}
{{- end -}}