refactor(templates): rename template files to match rendered resource kinds
The files in templates/gitea/ used a mix of naming styles: lowercase concatenations (poddisruptionbudget.yaml, serviceaccount.yaml, servicemonitor.yaml, pvc.yaml), camelCase (httpService.yaml, sshService.yaml) and kind-suffixed names (gpg-secret.yaml, metrics-secret.yaml). It was therefore not obvious from a file name which Kubernetes resource it renders, and the naming contradicted the camelCase convention the Gateway API templates already follow. Files are now named after the kind they render, with a lowercase suffix distinguishing several resources of the same kind: config.yaml -> secret_config.yaml + secret_inlineConfig.yaml gpg-secret.yaml -> secret_gpg.yaml init.yaml -> secret_init.yaml metrics-secret.yaml -> secret_metrics.yaml httpService.yaml -> service_http.yaml sshService.yaml -> service_ssh.yaml poddisruptionbudget.yaml -> podDisruptionBudget.yaml pvc.yaml -> persistentVolumeClaim.yaml serviceaccount.yaml -> serviceAccount.yaml servicemonitor.yaml -> serviceMonitor.yaml config.yaml rendered two Secrets from a single file, which forced every unit test to address them via documentIndex. It is split so that each file renders exactly one resource. The rendered manifests are unchanged; only file names and the references to them were touched. This includes the checksum/config annotation in deployment.yaml and all helm unit test suites. The HA guard assertions had to move from deployment.yaml to secret_config.yaml: Helm sorts templates in reverse alphabetical order, so secret_config.yaml is now rendered before deployment.yaml and the fail() is reported for that file directly instead of bubbling up through the include chain of the Deployment. Users relying on the template paths (e.g. `helm template --show-only` or post-renderers) have to adjust to the new file names. Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Copilot
@@ -0,0 +1,228 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}-init
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
|
||||
init_directory_structure.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
{{- if .Values.initPreScript }}
|
||||
# BEGIN: initPreScript
|
||||
{{- with .Values.initPreScript -}}
|
||||
{{ . | nindent 4}}
|
||||
{{- end -}}
|
||||
# END: initPreScript
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.image.rootless }}
|
||||
chown -v 1000:1000 /data
|
||||
{{- end }}
|
||||
mkdir -pv /data/git/.ssh
|
||||
chmod -Rv 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -pv "${GITEA_TEMP}"
|
||||
{{- if not .Values.image.rootless }}
|
||||
chown -v 1000:1000 "${GITEA_TEMP}"
|
||||
{{- end }}
|
||||
chmod -v ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
{{ if .Values.signing.enabled -}}
|
||||
if [ ! -d "${GNUPGHOME}" ]; then
|
||||
mkdir -pv "${GNUPGHOME}"
|
||||
chmod -v 700 "${GNUPGHOME}"
|
||||
chown -v 1000:1000 "${GNUPGHOME}"
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
configure_gitea.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||
|
||||
{ # try
|
||||
gitea migrate
|
||||
} || { # catch
|
||||
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
exit 1
|
||||
}
|
||||
|
||||
{{- if include "valkey.servicename" . }}
|
||||
function test_valkey_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for valkey to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Valkey not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_valkey_connection
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
|
||||
function configure_admin_user() {
|
||||
local full_admin_list=$(gitea admin user list --admin)
|
||||
local actual_user_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
|
||||
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||
echo "--"
|
||||
echo "${full_admin_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||
local -a create_args
|
||||
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||
create_args+=(--must-change-password=true)
|
||||
else
|
||||
create_args+=(--must-change-password=false)
|
||||
fi
|
||||
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||
gitea admin user create "${create_args[@]}"
|
||||
echo '...created.'
|
||||
else
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||
# See https://gitea.com/gitea/helm-gitea/issues/673
|
||||
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||
# should add it to prevent requiring frequent admin password resets.
|
||||
local -a change_args
|
||||
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||
if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
|
||||
change_args+=(--must-change-password=false)
|
||||
fi
|
||||
gitea admin user change-password "${change_args[@]}"
|
||||
echo '...password sync done.'
|
||||
else
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configure_admin_user
|
||||
{{- end }}
|
||||
|
||||
function configure_ldap() {
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
|
||||
local full_auth_list=$(gitea admin auth list --vertical-bars)
|
||||
local actual_auth_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
|
||||
if [[ "${full_auth_list}" =~ $regex ]]; then
|
||||
actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
|
||||
echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
|
||||
echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
|
||||
echo "--"
|
||||
echo "${full_auth_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}")
|
||||
|
||||
if [[ -z "${GITEA_AUTH_ID}" ]]; then
|
||||
echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
|
||||
gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...installed.'
|
||||
else
|
||||
echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
|
||||
gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...sync settings done.'
|
||||
fi
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
echo 'no ldap configuration... skipping.'
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
configure_ldap
|
||||
|
||||
function configure_oauth() {
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
|
||||
local full_auth_list=$(gitea admin auth list --vertical-bars)
|
||||
local actual_auth_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
|
||||
if [[ "${full_auth_list}" =~ $regex ]]; then
|
||||
actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
|
||||
echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
|
||||
echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
|
||||
echo "--"
|
||||
echo "${full_auth_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}")
|
||||
|
||||
if [[ -z "${AUTH_ID}" ]]; then
|
||||
echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
|
||||
gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...installed.'
|
||||
else
|
||||
echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
|
||||
gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...sync settings done.'
|
||||
fi
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
echo 'no oauth configuration... skipping.'
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
configure_oauth
|
||||
|
||||
echo '==== END GITEA CONFIGURATION ===='
|
||||
Reference in New Issue
Block a user