volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 2 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

[Close #1119] fix(secrets): render inline config as data to prune removed sections

Browse Source 
The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts.

This renders the Secret as base64 `data` instead.

- `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`).
- Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`.

Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned.

`make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean.
Co-authored-by: perfectra1n <jonfuller2012@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110
Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com>
This commit is contained in:
perfectra1n
2026-10-03 15:16:25 +00:00
committed by Markus Pesch
co-authored by perfectra1n
parent 92c761c9ba
commit 4631d42156
10 changed files with 102 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/secret_inlineConfig.yaml
+4 -2
View File
@@ -14,6 +14,8 @@ metadata:
name: {{ include "gitea.secret.inlineConfig.name" . }} name: {{ include "gitea.secret.inlineConfig.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
stringData: data:
{{- $inlineConfiguration | nindent 2 }} {{- range $key, $value := fromYaml $inlineConfiguration }}
{{ $key }}: {{ $value | b64enc | quote }}
{{- end }}
{{- end }} {{- end }}
unittests/helm/config/actions-config.yaml
+3 -2
View File
@@ -10,7 +10,7 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
notExists: notExists:
path: stringData.actions path: data.actions
- it: "actions can be disabled via inline config" - it: "actions can be disabled via inline config"
template: templates/secret_inlineConfig.yaml template: templates/secret_inlineConfig.yaml
@@ -19,6 +19,7 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.actions path: data.actions
decodeBase64: true
value: |- value: |-
ENABLED=false ENABLED=false
unittests/helm/config/cache-config.yaml
+6 -3
View File
@@ -11,7 +11,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.cache path: data.cache
decodeBase64: true
value: |- value: |-
ADAPTER=redis ADAPTER=redis
HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
@@ -24,7 +25,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.cache path: data.cache
decodeBase64: true
value: |- value: |-
ADAPTER=memory ADAPTER=memory
HOST= HOST=
@@ -39,7 +41,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.cache path: data.cache
decodeBase64: true
value: |- value: |-
ADAPTER=custom-adapter ADAPTER=custom-adapter
HOST=custom-host HOST=custom-host
unittests/helm/config/metrics-section_metrics-token.yaml
+8 -4
View File
@@ -13,7 +13,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.metrics path: data.metrics
decodeBase64: true
value: |- value: |-
ENABLED=true ENABLED=true
TOKEN=somepassword TOKEN=somepassword
@@ -27,7 +28,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.metrics path: data.metrics
decodeBase64: true
value: |- value: |-
ENABLED=true ENABLED=true
- it: metrics token is nil - it: metrics token is nil
@@ -40,7 +42,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.metrics path: data.metrics
decodeBase64: true
value: |- value: |-
ENABLED=true ENABLED=true
- it: does not configures a token if metrics are disabled - it: does not configures a token if metrics are disabled
@@ -53,6 +56,7 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.metrics path: data.metrics
decodeBase64: true
value: |- value: |-
ENABLED=false ENABLED=false
unittests/helm/config/queue-config.yaml
+6 -3
View File
@@ -11,7 +11,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.queue path: data.queue
decodeBase64: true
value: |- value: |-
CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
TYPE=redis TYPE=redis
@@ -24,7 +25,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.queue path: data.queue
decodeBase64: true
value: |- value: |-
CONN_STR= CONN_STR=
TYPE=level TYPE=level
@@ -39,7 +41,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.queue path: data.queue
decodeBase64: true
value: |- value: |-
CONN_STR=custom-connection-string CONN_STR=custom-connection-string
TYPE=custom-type TYPE=custom-type
unittests/helm/config/server-section_domain.yaml
+34 -17
View File
@@ -8,15 +8,18 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nDOMAIN=git.example.com pattern: \nDOMAIN=git.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nSSH_DOMAIN=git.example.com pattern: \nSSH_DOMAIN=git.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=http://git.example.com pattern: \nROOT_URL=http://git.example.com
################################################ ################################################
@@ -29,15 +32,18 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
################################################ ################################################
@@ -55,15 +61,18 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nDOMAIN=provided.example.com pattern: \nDOMAIN=provided.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nSSH_DOMAIN=provided.example.com pattern: \nSSH_DOMAIN=provided.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=http://provided.example.com pattern: \nROOT_URL=http://provided.example.com
################################################ ################################################
@@ -77,15 +86,18 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nDOMAIN=route.example.com pattern: \nDOMAIN=route.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nSSH_DOMAIN=route.example.com pattern: \nSSH_DOMAIN=route.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=http://route.example.com pattern: \nROOT_URL=http://route.example.com
################################################ ################################################
@@ -101,7 +113,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=https://route.example.com pattern: \nROOT_URL=https://route.example.com
################################################ ################################################
@@ -123,15 +136,18 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nDOMAIN=gw.example.com pattern: \nDOMAIN=gw.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nSSH_DOMAIN=gw.example.com pattern: \nSSH_DOMAIN=gw.example.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=http://gw.example.com pattern: \nROOT_URL=http://gw.example.com
################################################ ################################################
@@ -154,5 +170,6 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: \nROOT_URL=https://gw.example.com pattern: \nROOT_URL=https://gw.example.com
unittests/helm/config/session-config.yaml
+6 -3
View File
@@ -11,7 +11,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.session path: data.session
decodeBase64: true
value: |- value: |-
PROVIDER=redis PROVIDER=redis
PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s& PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
@@ -24,7 +25,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.session path: data.session
decodeBase64: true
value: |- value: |-
PROVIDER=memory PROVIDER=memory
PROVIDER_CONFIG= PROVIDER_CONFIG=
@@ -39,7 +41,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
equal: equal:
path: stringData.session path: data.session
decodeBase64: true
value: |- value: |-
PROVIDER=custom-provider PROVIDER=custom-provider
PROVIDER_CONFIG=custom-provider-config PROVIDER_CONFIG=custom-provider-config
unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml
+10 -5
View File
@@ -110,7 +110,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234 pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
- it: "[gitea] connects to pgpool service with custom cluster domain" - it: "[gitea] connects to pgpool service with custom cluster domain"
set: set:
@@ -119,20 +120,24 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234 pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
- it: "[gitea] connects to configured database" - it: "[gitea] connects to configured database"
template: templates/secret_inlineConfig.yaml template: templates/secret_inlineConfig.yaml
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: NAME=gitea-database pattern: NAME=gitea-database
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: USER=gitea-username pattern: USER=gitea-username
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: PASSWD=gitea-password pattern: PASSWD=gitea-password
unittests/helm/dependency-checks/customization-integrity-postgresql.yaml
+10 -5
View File
@@ -69,7 +69,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234 pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
- it: "[gitea] connects to postgresql service with custom cluster domain" - it: "[gitea] connects to postgresql service with custom cluster domain"
set: set:
@@ -78,20 +79,24 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234 pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234
- it: "[gitea] connects to configured database" - it: "[gitea] connects to configured database"
template: templates/secret_inlineConfig.yaml template: templates/secret_inlineConfig.yaml
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: NAME=gitea-database pattern: NAME=gitea-database
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: USER=gitea-username pattern: USER=gitea-username
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.database path: data.database
decodeBase64: true
pattern: PASSWD=gitea-password pattern: PASSWD=gitea-password
unittests/helm/deployment/inline-config.yaml
+15 -4
View File
@@ -5,7 +5,7 @@ release:
templates: templates:
- templates/secret_inlineConfig.yaml - templates/secret_inlineConfig.yaml
tests: tests:
- it: inline config stringData.server using TPL - it: inline config data.server using TPL
set: set:
global.giteaHostName: "gitea.example.com" global.giteaHostName: "gitea.example.com"
ingress.enabled: true ingress.enabled: true
@@ -21,13 +21,24 @@ tests:
pattern: .*-inline-config$ pattern: .*-inline-config$
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: DOMAIN=gitea\.example\.com pattern: DOMAIN=gitea\.example\.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: ROOT_URL=https://gitea\.example\.com pattern: ROOT_URL=https://gitea\.example\.com
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData.server path: data.server
decodeBase64: true
pattern: SSH_DOMAIN=gitea\.example\.com pattern: SSH_DOMAIN=gitea\.example\.com
- it: renders data, not stringData, so removed sections are pruned on upgrade
asserts:
- documentIndex: 0
notExists:
path: stringData
- documentIndex: 0
exists:
path: data.server