From 4d1440331d1a61ac27cbc66ce5c32f09fa77c954 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Sat, 3 Oct 2026 17:46:08 +0200 Subject: [PATCH] feat!: remove the helm test connection Pod The chart shipped a `helm test` hook Pod that ran `wget` against the HTTP Service. It only proved that the Service resolves and answers on the configured port, which the readiness probe already covers, so it carried no information the release did not have anyway. In exchange it pulled `busybox:latest` into clusters -- an unpinned, mutable tag in a chart that otherwise pins every image digest -- and it kept a Pod spec alive that had to track every change to the security context and hostUsers helpers. Removing the template also removes the `test.*` values that only existed to configure it, so the parameter table in the README was regenerated accordingly. A guard in `deprecation.yaml` catches leftover `test` values instead of silently ignoring them. Its message deviates from the surrounding guards on purpose: there is no replacement value to point at, so it states that the feature is gone rather than suggesting a migration target. BREAKING CHANGE: `helm test ` no longer executes any test for this chart, and the values `test.enabled`, `test.image.name` and `test.image.tag` have been removed. Installations that still set them will fail with a descriptive error until the keys are dropped, unless `checkDeprecation` is set to false. Co-authored-by: Copilot --- README.md | 21 +++++++--------- templates/deprecation.yaml | 5 ++++ templates/tests/test-http-connection.yaml | 27 --------------------- unittests/helm/deployment/deprecations.yaml | 7 ++++++ values.yaml | 8 ------ 5 files changed, 21 insertions(+), 47 deletions(-) delete mode 100644 templates/tests/test-http-connection.yaml diff --git a/README.md b/README.md index db5fbc2..d2efeeb 100644 --- a/README.md +++ b/README.md @@ -1034,8 +1034,8 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.labels` | Labels for the deployment. | `{}` | | `deployment.affinity` | Affinity for the deployment. | `{}` | | `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` | -| `deployment.gitea.env` | Additional environment variables to pass to the gitea container. | `[]` | -| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the gitea container. | `[]` | +| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` | +| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the Gitea container. | `[]` | | `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io. | `docker.gitea.com` | | `deployment.gitea.image.repository` | Image to start for this pod. | `gitea` | | `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | @@ -1121,7 +1121,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `gatewayAPI.core.backendTLSPolicy.targetRefs` | Target references for the BackendTLSPolicy. Defaults to the HTTP service. | `[]` | | `gatewayAPI.core.backendTLSPolicy.validation` | Validation configuration (required when enabled). See `docs/gateway-api.md`. | `{}` | | `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`. | | -| `gatewayAPI.core.backendTLSPolicy.validation.hostname` | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`. | | +| `gatewayAPI.core.backendTLSPolicy.validation.hostname` | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. | | | `gatewayAPI.core.httpRoute.enabled` | Render an HTTPRoute resource. | `false` | | `gatewayAPI.core.httpRoute.annotations` | Annotations applied to the HTTPRoute. | `{}` | | `gatewayAPI.core.httpRoute.labels` | Additional labels applied to the HTTPRoute. | `{}` | @@ -1152,7 +1152,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `ingress.hosts[0].host` | Default Ingress host. | `git.example.com` | | `ingress.hosts[0].paths[0].path` | Default Ingress path. | `/` | | `ingress.tls` | Ingress tls settings. | `[]` | -| `namespace` | An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified. | `""` | +| `namespace` | An explicit namespace to deploy Gitea into. Defaults to the release namespace if not specified. | `""` | ### Network @@ -1212,7 +1212,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `secrets.config.existingSecret.secretName` | Name of the already existing config Secret. | `""` | | `secrets.config.new.annotations` | Annotations for the config Secret. | `{}` | | `secrets.config.new.labels` | Labels for the config Secret. | `{}` | -| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign git commits. | `false` | +| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` | | `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | | `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret. | `false` | | `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret. | `""` | @@ -1438,13 +1438,10 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo ### Advanced -| Name | Description | Value | -| ------------------ | ------------------------------------------------------------------ | --------- | -| `checkDeprecation` | Set it to false to skip this basic validation check. | `true` | -| `test.enabled` | Set it to false to disable test-connection Pod. | `true` | -| `test.image.name` | Image name for the wget container used in the test-connection Pod. | `busybox` | -| `test.image.tag` | Image tag for the wget container used in the test-connection Pod. | `latest` | -| `extraDeploy` | Array of extra objects to deploy with the release. | `[]` | +| Name | Description | Value | +| ------------------ | ---------------------------------------------------- | ------ | +| `checkDeprecation` | Set it to false to skip this basic validation check. | `true` | +| `extraDeploy` | Array of extra objects to deploy with the release. | `[]` | ## Contributing diff --git a/templates/deprecation.yaml b/templates/deprecation.yaml index 915f2ca..3c294ee 100644 --- a/templates/deprecation.yaml +++ b/templates/deprecation.yaml @@ -125,6 +125,11 @@ {{- fail "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." -}} {{- end -}} + {{/* TEST */}} + {{- if .Values.test -}} + {{- fail "`test` does no longer exist. Please refer to the changelog. The `helm test` connection Pod has been removed without replacement." -}} + {{- end -}} + {{/* TOLERATIONS */}} {{- if .Values.tolerations -}} {{- fail "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead." -}} diff --git a/templates/tests/test-http-connection.yaml b/templates/tests/test-http-connection.yaml deleted file mode 100644 index 7abb934..0000000 --- a/templates/tests/test-http-connection.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if .Values.test.enabled }} -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "gitea.fullname" . }}-test-connection" - namespace: {{ .Values.namespace | default .Release.Namespace }} - labels: -{{ include "gitea.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test-success -spec: - {{- $hostUsers := include "gitea.hostUsers" . | trim }} - {{- $testContainerSecurityContext := include "gitea.containerSecurityContext" (list . (dict)) | trim }} - {{- if $hostUsers }} - hostUsers: {{ $hostUsers }} - {{- end }} - containers: - - name: wget - image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}" - {{- if $testContainerSecurityContext }} - securityContext: - {{- $testContainerSecurityContext | nindent 8 }} - {{- end }} - command: ['wget'] - args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}'] - restartPolicy: Never -{{- end }} diff --git a/unittests/helm/deployment/deprecations.yaml b/unittests/helm/deployment/deprecations.yaml index 2a4a5b5..c338e14 100644 --- a/unittests/helm/deployment/deprecations.yaml +++ b/unittests/helm/deployment/deprecations.yaml @@ -139,6 +139,13 @@ tests: asserts: - failedTemplate: errorMessage: "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." + - it: fails when the removed `test` value is set + set: + test: + enabled: false + asserts: + - failedTemplate: + errorMessage: "`test` does no longer exist. Please refer to the changelog. The `helm test` connection Pod has been removed without replacement." - it: fails when the removed `tolerations` value is set set: tolerations: diff --git a/values.yaml b/values.yaml index 934b090..9d93325 100644 --- a/values.yaml +++ b/values.yaml @@ -1299,15 +1299,7 @@ postgresql: # Set it to false to skip this basic validation check. ## @section Advanced ## @param checkDeprecation Set it to false to skip this basic validation check. -## @param test.enabled Set it to false to disable test-connection Pod. -## @param test.image.name Image name for the wget container used in the test-connection Pod. -## @param test.image.tag Image tag for the wget container used in the test-connection Pod. checkDeprecation: true -test: - enabled: true - image: - name: busybox - tag: latest ## @param extraDeploy Array of extra objects to deploy with the release. ##