[Close #1119] fix(secrets): render inline config as `data` to prune removed sections

The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts.

This renders the Secret as base64 `data` instead.

- `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`).
- Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`.

Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned.

`make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean.
Co-authored-by: perfectra1n <jonfuller2012@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110
Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com>

This commit is contained in:

perfectra1n

2026-10-03 15:16:25 +00:00

committed by

Markus Pesch

co-authored by

perfectra1n

parent 92c761c9ba

commit 4631d42156

10 changed files with 102 additions and 48 deletions

									
										templates/secret_inlineConfig.yaml
									
		+4
		-2
	
												View File
												
				@@ -14,6 +14,8 @@ metadata:

				  name: {{ include "gitea.secret.inlineConfig.name" . }}

				  namespace: {{ .Values.namespace | default .Release.Namespace }}

				type: Opaque

				stringData:

				  {{- $inlineConfiguration | nindent 2 }}

				data:

				  {{- range $key, $value := fromYaml $inlineConfiguration }}

				  {{ $key }}: {{ $value | b64enc | quote }}

				  {{- end }}

				{{- end }}

[Close #1119] fix(secrets): render inline config as data to prune removed sections

[Close #1119] fix(secrets): render inline config as `data` to prune removed sections