From 4631d42156a631e9dd1585e94cbfc5d0ed4985c9 Mon Sep 17 00:00:00 2001 From: perfectra1n <49838+perfectra1n@noreply.gitea.com> Date: Sat, 3 Oct 2026 15:16:25 +0000 Subject: [PATCH] [Close #1119] fix(secrets): render inline config as `data` to prune removed sections MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts. This renders the Secret as base64 `data` instead. - `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`). - Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`. Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned. `make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean. Co-authored-by: perfectra1n Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com> --- templates/secret_inlineConfig.yaml | 6 ++- unittests/helm/config/actions-config.yaml | 5 +- unittests/helm/config/cache-config.yaml | 9 ++-- .../config/metrics-section_metrics-token.yaml | 12 +++-- unittests/helm/config/queue-config.yaml | 9 ++-- .../helm/config/server-section_domain.yaml | 51 ++++++++++++------- unittests/helm/config/session-config.yaml | 9 ++-- ...customization-integrity-postgresql-ha.yaml | 15 ++++-- .../customization-integrity-postgresql.yaml | 15 ++++-- unittests/helm/deployment/inline-config.yaml | 19 +++++-- 10 files changed, 102 insertions(+), 48 deletions(-) diff --git a/templates/secret_inlineConfig.yaml b/templates/secret_inlineConfig.yaml index 96d37d8..91d12bb 100644 --- a/templates/secret_inlineConfig.yaml +++ b/templates/secret_inlineConfig.yaml @@ -14,6 +14,8 @@ metadata: name: {{ include "gitea.secret.inlineConfig.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque -stringData: - {{- $inlineConfiguration | nindent 2 }} +data: + {{- range $key, $value := fromYaml $inlineConfiguration }} + {{ $key }}: {{ $value | b64enc | quote }} + {{- end }} {{- end }} \ No newline at end of file diff --git a/unittests/helm/config/actions-config.yaml b/unittests/helm/config/actions-config.yaml index 7851bcf..c1aede2 100644 --- a/unittests/helm/config/actions-config.yaml +++ b/unittests/helm/config/actions-config.yaml @@ -10,7 +10,7 @@ tests: asserts: - documentIndex: 0 notExists: - path: stringData.actions + path: data.actions - it: "actions can be disabled via inline config" template: templates/secret_inlineConfig.yaml @@ -19,6 +19,7 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.actions + path: data.actions + decodeBase64: true value: |- ENABLED=false diff --git a/unittests/helm/config/cache-config.yaml b/unittests/helm/config/cache-config.yaml index 986e728..0fdc3d7 100644 --- a/unittests/helm/config/cache-config.yaml +++ b/unittests/helm/config/cache-config.yaml @@ -11,7 +11,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.cache + path: data.cache + decodeBase64: true value: |- ADAPTER=redis HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& @@ -24,7 +25,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.cache + path: data.cache + decodeBase64: true value: |- ADAPTER=memory HOST= @@ -39,7 +41,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.cache + path: data.cache + decodeBase64: true value: |- ADAPTER=custom-adapter HOST=custom-host diff --git a/unittests/helm/config/metrics-section_metrics-token.yaml b/unittests/helm/config/metrics-section_metrics-token.yaml index 2b440ff..7062488 100644 --- a/unittests/helm/config/metrics-section_metrics-token.yaml +++ b/unittests/helm/config/metrics-section_metrics-token.yaml @@ -13,7 +13,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.metrics + path: data.metrics + decodeBase64: true value: |- ENABLED=true TOKEN=somepassword @@ -27,7 +28,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.metrics + path: data.metrics + decodeBase64: true value: |- ENABLED=true - it: metrics token is nil @@ -40,7 +42,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.metrics + path: data.metrics + decodeBase64: true value: |- ENABLED=true - it: does not configures a token if metrics are disabled @@ -53,6 +56,7 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.metrics + path: data.metrics + decodeBase64: true value: |- ENABLED=false diff --git a/unittests/helm/config/queue-config.yaml b/unittests/helm/config/queue-config.yaml index e862411..40f3e95 100644 --- a/unittests/helm/config/queue-config.yaml +++ b/unittests/helm/config/queue-config.yaml @@ -11,7 +11,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.queue + path: data.queue + decodeBase64: true value: |- CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& TYPE=redis @@ -24,7 +25,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.queue + path: data.queue + decodeBase64: true value: |- CONN_STR= TYPE=level @@ -39,7 +41,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.queue + path: data.queue + decodeBase64: true value: |- CONN_STR=custom-connection-string TYPE=custom-type diff --git a/unittests/helm/config/server-section_domain.yaml b/unittests/helm/config/server-section_domain.yaml index a079959..ead24f1 100644 --- a/unittests/helm/config/server-section_domain.yaml +++ b/unittests/helm/config/server-section_domain.yaml @@ -8,15 +8,18 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nDOMAIN=git.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nSSH_DOMAIN=git.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=http://git.example.com ################################################ @@ -29,15 +32,18 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local ################################################ @@ -55,15 +61,18 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nDOMAIN=provided.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nSSH_DOMAIN=provided.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=http://provided.example.com ################################################ @@ -77,15 +86,18 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nDOMAIN=route.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nSSH_DOMAIN=route.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=http://route.example.com ################################################ @@ -101,7 +113,8 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=https://route.example.com ################################################ @@ -123,15 +136,18 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nDOMAIN=gw.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nSSH_DOMAIN=gw.example.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=http://gw.example.com ################################################ @@ -154,5 +170,6 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: \nROOT_URL=https://gw.example.com diff --git a/unittests/helm/config/session-config.yaml b/unittests/helm/config/session-config.yaml index 4f5f688..e54f27d 100644 --- a/unittests/helm/config/session-config.yaml +++ b/unittests/helm/config/session-config.yaml @@ -11,7 +11,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.session + path: data.session + decodeBase64: true value: |- PROVIDER=redis PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& @@ -24,7 +25,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.session + path: data.session + decodeBase64: true value: |- PROVIDER=memory PROVIDER_CONFIG= @@ -39,7 +41,8 @@ tests: asserts: - documentIndex: 0 equal: - path: stringData.session + path: data.session + decodeBase64: true value: |- PROVIDER=custom-provider PROVIDER_CONFIG=custom-provider-config diff --git a/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml b/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml index c357740..d9c77c2 100644 --- a/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml +++ b/unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml @@ -110,7 +110,8 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234 - it: "[gitea] connects to pgpool service with custom cluster domain" set: @@ -119,20 +120,24 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234 - it: "[gitea] connects to configured database" template: templates/secret_inlineConfig.yaml asserts: - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: NAME=gitea-database - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: USER=gitea-username - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: PASSWD=gitea-password diff --git a/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml b/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml index dfa2094..aae0a63 100644 --- a/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml +++ b/unittests/helm/dependency-checks/customization-integrity-postgresql.yaml @@ -69,7 +69,8 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234 - it: "[gitea] connects to postgresql service with custom cluster domain" set: @@ -78,20 +79,24 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234 - it: "[gitea] connects to configured database" template: templates/secret_inlineConfig.yaml asserts: - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: NAME=gitea-database - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: USER=gitea-username - documentIndex: 0 matchRegex: - path: stringData.database + path: data.database + decodeBase64: true pattern: PASSWD=gitea-password diff --git a/unittests/helm/deployment/inline-config.yaml b/unittests/helm/deployment/inline-config.yaml index dc6f97e..c07a97a 100644 --- a/unittests/helm/deployment/inline-config.yaml +++ b/unittests/helm/deployment/inline-config.yaml @@ -5,7 +5,7 @@ release: templates: - templates/secret_inlineConfig.yaml tests: - - it: inline config stringData.server using TPL + - it: inline config data.server using TPL set: global.giteaHostName: "gitea.example.com" ingress.enabled: true @@ -21,13 +21,24 @@ tests: pattern: .*-inline-config$ - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: DOMAIN=gitea\.example\.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: ROOT_URL=https://gitea\.example\.com - documentIndex: 0 matchRegex: - path: stringData.server + path: data.server + decodeBase64: true pattern: SSH_DOMAIN=gitea\.example\.com + - it: renders data, not stringData, so removed sections are pruned on upgrade + asserts: + - documentIndex: 0 + notExists: + path: stringData + - documentIndex: 0 + exists: + path: data.server