diff --git a/README.md b/README.md index 78a3fe4..e0f9b77 100644 --- a/README.md +++ b/README.md @@ -1116,6 +1116,36 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.labels` | Labels for the deployment | `{}` | | `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` | +### Secret + +| Name | Description | Value | +| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- | +| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` | +| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | +| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | +| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | +| `secrets.config.new.labels` | Labels for the config Secret | `{}` | +| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` | +| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | +| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | +| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | +| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | +| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` | +| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | +| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | +| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | +| `secrets.init.new.labels` | Labels for the init Secret | `{}` | +| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` | +| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | +| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | +| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | +| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | +| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` | +| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | +| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | +| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | +| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | + ### ServiceAccount | Name | Description | Value | diff --git a/templates/gitea/_secrets.tpl b/templates/gitea/_secrets.tpl index aef22a9..48ac0bb 100644 --- a/templates/gitea/_secrets.tpl +++ b/templates/gitea/_secrets.tpl @@ -1,23 +1,112 @@ {{/* vim: set filetype=mustache: */}} +{{/* annotations */}} + +{{- define "gitea.secret.config.annotations" -}} +{{- with .Values.secrets.config.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.gpg.annotations" -}} +{{- with .Values.secrets.gpg.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.init.annotations" -}} +{{- with .Values.secrets.init.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.inlineConfig.annotations" -}} +{{- with .Values.secrets.inlineConfig.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.metrics.annotations" -}} +{{- with .Values.secrets.metrics.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.secret.config.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.config.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.gpg.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.gpg.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.init.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.init.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.inlineConfig.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.inlineConfig.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.metrics.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.metrics.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + {{/* names */}} {{- define "gitea.secret.config.name" -}} +{{- if .Values.secrets.config.existingSecret.enabled -}} +{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-config +{{- end -}} {{- end }} {{- define "gitea.secret.gpg.name" -}} +{{- if .Values.secrets.gpg.existingSecret.enabled -}} +{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }} +{{- else -}} {{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} +{{- end -}} {{- end }} {{- define "gitea.secret.init.name" -}} +{{- if .Values.secrets.init.existingSecret.enabled -}} +{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-init +{{- end -}} {{- end }} {{- define "gitea.secret.inlineConfig.name" -}} +{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}} +{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-inline-config +{{- end -}} {{- end }} {{- define "gitea.secret.metrics.name" -}} +{{- if .Values.secrets.metrics.existingSecret.enabled -}} +{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-metrics +{{- end -}} {{- end }} diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml index 219736a..ccc46af 100644 --- a/templates/gitea/deployment.yaml +++ b/templates/gitea/deployment.yaml @@ -27,8 +27,21 @@ spec: template: metadata: annotations: + {{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }} checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.gpg.addSHASumAnnotation (not .Values.secrets.gpg.existingSecret.enabled) }} + checksum/gpg: {{ include (print $.Template.BasePath "/gitea/secret_gpg.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.init.addSHASumAnnotation (not .Values.secrets.init.existingSecret.enabled) }} + checksum/init: {{ include (print $.Template.BasePath "/gitea/secret_init.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.inlineConfig.addSHASumAnnotation (not .Values.secrets.inlineConfig.existingSecret.enabled) }} checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.metrics.addSHASumAnnotation (not .Values.secrets.metrics.existingSecret.enabled) }} + checksum/metrics: {{ include (print $.Template.BasePath "/gitea/secret_metrics.yaml") . | sha256sum }} + {{- end }} {{- range $idx, $value := .Values.gitea.ldap }} checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }} {{- end }} diff --git a/templates/gitea/secret_config.yaml b/templates/gitea/secret_config.yaml index 70bc154..4fd6279 100644 --- a/templates/gitea/secret_config.yaml +++ b/templates/gitea/secret_config.yaml @@ -1,47 +1,59 @@ +{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}} +{{- $assertions := include "gitea.config.assertions" . -}} +{{- if not .Values.secrets.config.existingSecret.enabled -}} --- apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.config.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.config.labels" . | nindent 4 }} name: {{ include "gitea.secret.config.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque stringData: {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }} assertions: | + {{- $assertions | nindent 4 }} +{{- end }} - {{- /*assert that only one PG dep is enabled */ -}} - {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}} - {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}} +{{- define "gitea.config.assertions" -}} + + {{- /*assert that only one PG dep is enabled */ -}} + {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}} + {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}} + {{- end }} + + {{- /* multiple replicas assertions */ -}} + {{- if gt (.Values.replicaCount | int) 1 -}} + {{- if .Values.gitea.config.cron -}} + {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}} + {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}} + {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }} + {{- end }} + {{- end }} {{- end }} - {{- /* multiple replicas assertions */ -}} - {{- if gt (.Values.replicaCount | int) 1 -}} - {{- if .Values.gitea.config.cron -}} - {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}} - {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}} - {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }} - {{- end }} - {{- end }} + {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}} + {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}} + {{- end }} + {{- if .Values.gitea.config.indexer -}} + {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}} + {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}} {{- end }} - - {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}} - {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}} - {{- end }} - {{- if .Values.gitea.config.indexer -}} - {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}} - {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}} - {{- end }} - {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}} - {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}} - {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}} - {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}} - {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}} - {{- end }} + {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}} + {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}} + {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}} + {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}} + {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}} {{- end }} {{- end }} {{- end }} {{- end }} - {{- end }} + + {{- end }} +{{- end }} diff --git a/templates/gitea/secret_gpg.yaml b/templates/gitea/secret_gpg.yaml index 4ac8e6e..19cca19 100644 --- a/templates/gitea/secret_gpg.yaml +++ b/templates/gitea/secret_gpg.yaml @@ -1,13 +1,17 @@ -{{- if .Values.signing.enabled -}} +{{- if and (.Values.signing.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}} {{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} - {{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}} + {{- fail "Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`" -}} {{- end }} {{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.gpg.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.gpg.labels" . | nindent 4 }} name: {{ include "gitea.secret.gpg.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque diff --git a/templates/gitea/secret_init.yaml b/templates/gitea/secret_init.yaml index e3d8dc0..308543d 100644 --- a/templates/gitea/secret_init.yaml +++ b/templates/gitea/secret_init.yaml @@ -1,8 +1,13 @@ +{{- if not .Values.secrets.init.existingSecret.enabled -}} apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.init.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.init.labels" . | nindent 4 }} name: {{ include "gitea.secret.init.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque @@ -226,3 +231,4 @@ stringData: configure_oauth echo '==== END GITEA CONFIGURATION ====' +{{- end }} diff --git a/templates/gitea/secret_inlineConfig.yaml b/templates/gitea/secret_inlineConfig.yaml index c8778f0..96d37d8 100644 --- a/templates/gitea/secret_inlineConfig.yaml +++ b/templates/gitea/secret_inlineConfig.yaml @@ -1,11 +1,19 @@ +{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}} +{{- $inlineConfiguration := include "gitea.inline_configuration" . -}} +{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}} --- apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.inlineConfig.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }} name: {{ include "gitea.secret.inlineConfig.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque stringData: - {{- include "gitea.inline_configuration" . | nindent 2 }} \ No newline at end of file + {{- $inlineConfiguration | nindent 2 }} +{{- end }} \ No newline at end of file diff --git a/templates/gitea/secret_metrics.yaml b/templates/gitea/secret_metrics.yaml index 5651353..a1346d7 100644 --- a/templates/gitea/secret_metrics.yaml +++ b/templates/gitea/secret_metrics.yaml @@ -1,9 +1,13 @@ -{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}} +{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}} apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.metrics.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.metrics.labels" . | nindent 4 }} name: {{ include "gitea.secret.metrics.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque diff --git a/unittests/helm/deployment/HA.yaml b/unittests/helm/deployment/HA.yaml index 8344b0b..8fea9bb 100644 --- a/unittests/helm/deployment/HA.yaml +++ b/unittests/helm/deployment/HA.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: fails with multiple replicas and "GIT_GC_REPOS" enabled template: templates/gitea/secret_config.yaml diff --git a/unittests/helm/deployment/basic.yaml b/unittests/helm/deployment/basic.yaml index 757366f..2889c0c 100644 --- a/unittests/helm/deployment/basic.yaml +++ b/unittests/helm/deployment/basic.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: renders a deployment template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/checksum-annotations.yaml b/unittests/helm/deployment/checksum-annotations.yaml new file mode 100644 index 0000000..7533ad1 --- /dev/null +++ b/unittests/helm/deployment/checksum-annotations.yaml @@ -0,0 +1,82 @@ +suite: deployment template (checksum annotations) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/deployment.yaml + - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml + - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml +tests: + - it: adds a checksum annotation for every Secret by default + template: templates/gitea/deployment.yaml + asserts: + - exists: + path: spec.template.metadata.annotations["checksum/config"] + - exists: + path: spec.template.metadata.annotations["checksum/gpg"] + - exists: + path: spec.template.metadata.annotations["checksum/init"] + - exists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - exists: + path: spec.template.metadata.annotations["checksum/metrics"] + + - it: omits the checksum annotations when addSHASumAnnotation is disabled + template: templates/gitea/deployment.yaml + set: + secrets.config.addSHASumAnnotation: false + secrets.gpg.addSHASumAnnotation: false + secrets.init.addSHASumAnnotation: false + secrets.inlineConfig.addSHASumAnnotation: false + secrets.metrics.addSHASumAnnotation: false + asserts: + - notExists: + path: spec.template.metadata.annotations["checksum/config"] + - notExists: + path: spec.template.metadata.annotations["checksum/gpg"] + - notExists: + path: spec.template.metadata.annotations["checksum/init"] + - notExists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - notExists: + path: spec.template.metadata.annotations["checksum/metrics"] + + - it: omits the checksum annotation of a single disabled Secret only + template: templates/gitea/deployment.yaml + set: + secrets.init.addSHASumAnnotation: false + asserts: + - exists: + path: spec.template.metadata.annotations["checksum/config"] + - notExists: + path: spec.template.metadata.annotations["checksum/init"] + - exists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + + - it: omits the checksum annotations of Secrets provided by the user + template: templates/gitea/deployment.yaml + set: + secrets.config.existingSecret.enabled: true + secrets.config.existingSecret.secretName: custom-config + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: custom-gpg + secrets.init.existingSecret.enabled: true + secrets.init.existingSecret.secretName: custom-init + secrets.inlineConfig.existingSecret.enabled: true + secrets.inlineConfig.existingSecret.secretName: custom-inline-config + secrets.metrics.existingSecret.enabled: true + secrets.metrics.existingSecret.secretName: custom-metrics + asserts: + - notExists: + path: spec.template.metadata.annotations["checksum/config"] + - notExists: + path: spec.template.metadata.annotations["checksum/gpg"] + - notExists: + path: spec.template.metadata.annotations["checksum/init"] + - notExists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - notExists: + path: spec.template.metadata.annotations["checksum/metrics"] diff --git a/unittests/helm/deployment/deployment-additional-config.yaml b/unittests/helm/deployment/deployment-additional-config.yaml index 894c056..c4b72e7 100644 --- a/unittests/helm/deployment/deployment-additional-config.yaml +++ b/unittests/helm/deployment/deployment-additional-config.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: Renders a deployment template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/extraEnvSourceFile.yaml b/unittests/helm/deployment/extraEnvSourceFile.yaml index 15acdfd..a05ed52 100644 --- a/unittests/helm/deployment/extraEnvSourceFile.yaml +++ b/unittests/helm/deployment/extraEnvSourceFile.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: uses direct execution when extraEnvSourceFile is not set template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/extraInitContainers.yaml b/unittests/helm/deployment/extraInitContainers.yaml index c23191d..74a29f6 100644 --- a/unittests/helm/deployment/extraInitContainers.yaml +++ b/unittests/helm/deployment/extraInitContainers.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: Render the deployment (default) asserts: @@ -20,6 +23,7 @@ tests: - it: Render the deployment (signing) set: signing.enabled: true + signing.existingSecret: "custom-gpg-secret" asserts: - hasDocuments: count: 1 @@ -38,6 +42,7 @@ tests: - name: bar image: docker.io/library/busybox:latest signing.enabled: true + signing.existingSecret: "custom-gpg-secret" asserts: - hasDocuments: count: 1 diff --git a/unittests/helm/deployment/image-configuration.yaml b/unittests/helm/deployment/image-configuration.yaml index 7bfa04f..6b9f2dd 100644 --- a/unittests/helm/deployment/image-configuration.yaml +++ b/unittests/helm/deployment/image-configuration.yaml @@ -8,7 +8,10 @@ chart: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: default values template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/openshift.yaml b/unittests/helm/deployment/openshift.yaml index 1b0329a..89633e8 100644 --- a/unittests/helm/deployment/openshift.yaml +++ b/unittests/helm/deployment/openshift.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: renders openshift-compatible defaults for chart-managed containers template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/probes.yaml b/unittests/helm/deployment/probes.yaml index 86a5fe5..3d75a7d 100644 --- a/unittests/helm/deployment/probes.yaml +++ b/unittests/helm/deployment/probes.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: renders default liveness probe template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/sidecar-container.yaml b/unittests/helm/deployment/sidecar-container.yaml index c58c5ca..9787571 100644 --- a/unittests/helm/deployment/sidecar-container.yaml +++ b/unittests/helm/deployment/sidecar-container.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: supports adding a sidecar container template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/signing-disabled.yaml b/unittests/helm/deployment/signing-disabled.yaml index 6de1193..266b490 100644 --- a/unittests/helm/deployment/signing-disabled.yaml +++ b/unittests/helm/deployment/signing-disabled.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: skips gpg init container template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/signing-enabled.yaml b/unittests/helm/deployment/signing-enabled.yaml index 7de53f3..468bee2 100644 --- a/unittests/helm/deployment/signing-enabled.yaml +++ b/unittests/helm/deployment/signing-enabled.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: adds gpg init container template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/ssh-configuration.yaml b/unittests/helm/deployment/ssh-configuration.yaml index 8895e83..edeb05e 100644 --- a/unittests/helm/deployment/ssh-configuration.yaml +++ b/unittests/helm/deployment/ssh-configuration.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: supports defining SSH log level for root based image template: templates/gitea/deployment.yaml diff --git a/unittests/helm/gpg-secret/signing-enabled.yaml b/unittests/helm/gpg-secret/signing-enabled.yaml index 1ba137a..2e976c0 100644 --- a/unittests/helm/gpg-secret/signing-enabled.yaml +++ b/unittests/helm/gpg-secret/signing-enabled.yaml @@ -11,7 +11,7 @@ tests: enabled: true asserts: - failedTemplate: - errorMessage: Either specify `signing.privateKey` or `signing.existingSecret` + errorMessage: Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret` - it: skips rendering using external secret reference set: signing: diff --git a/unittests/helm/serviceaccount/reference.yaml b/unittests/helm/serviceaccount/reference.yaml index 4c8de3f..b25ec52 100644 --- a/unittests/helm/serviceaccount/reference.yaml +++ b/unittests/helm/serviceaccount/reference.yaml @@ -6,7 +6,10 @@ templates: - templates/gitea/serviceAccount.yaml - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: does not modify the deployment by default template: templates/gitea/deployment.yaml diff --git a/values.yaml b/values.yaml index 37be20f..143984a 100644 --- a/values.yaml +++ b/values.yaml @@ -343,6 +343,88 @@ deployment: labels: {} annotations: {} +## @section Secret +secrets: + config: + ## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.config.existingSecret.enabled Use an already existing Secret instead of creating the config Secret + ## @param secrets.config.existingSecret.secretName Name of the already existing config Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.config.new.annotations Annotations for the config Secret + ## @param secrets.config.new.labels Labels for the config Secret + new: + annotations: {} + labels: {} + + gpg: + ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret + ## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.gpg.new.annotations Annotations for the GPG key Secret + ## @param secrets.gpg.new.labels Labels for the GPG key Secret + new: + annotations: {} + labels: {} + + init: + ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.init.existingSecret.enabled Use an already existing Secret instead of creating the init Secret + ## @param secrets.init.existingSecret.secretName Name of the already existing init Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.init.new.annotations Annotations for the init Secret + ## @param secrets.init.new.labels Labels for the init Secret + new: + annotations: {} + labels: {} + + inlineConfig: + ## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.inlineConfig.existingSecret.enabled Use an already existing Secret instead of creating the inline configuration Secret + ## @param secrets.inlineConfig.existingSecret.secretName Name of the already existing inline configuration Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.inlineConfig.new.annotations Annotations for the inline configuration Secret + ## @param secrets.inlineConfig.new.labels Labels for the inline configuration Secret + new: + annotations: {} + labels: {} + + metrics: + ## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.metrics.existingSecret.enabled Use an already existing Secret instead of creating the metrics Secret + ## @param secrets.metrics.existingSecret.secretName Name of the already existing metrics Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.metrics.new.annotations Annotations for the metrics Secret + ## @param secrets.metrics.new.labels Labels for the metrics Secret + new: + annotations: {} + labels: {} + ## @section ServiceAccount ## @param serviceAccount.create Enable the creation of a ServiceAccount