From 4d82f17ce6c2b8086e1d8bfea5b43ed1c3269380 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Thu, 3 Sep 2026 17:14:11 +0200 Subject: [PATCH] feat(secrets): make every Secret configurable via a `secrets.*` block Until now the Secrets rendered by this chart were not configurable at all. Their labels were fixed to the chart defaults, they could not carry annotations, and there was no way to hand in a Secret that is managed outside of the chart - except for the GPG key, which had its own special case via `signing.existingSecret`. Users who manage their secrets with an external operator (e.g. External Secrets, Sealed Secrets) or who need annotations for tooling such as Reloader or Kyverno had no option but to fork the chart. A `secrets` section is introduced with one entry per Secret (config, gpg, init, inlineConfig, metrics), each offering: addSHASumAnnotation add a checksum annotation to the pod template (default: true) existingSecret.enabled reference a Secret that is not managed by this chart existingSecret.secretName name of that Secret new.annotations annotations for the Secret created by the chart new.labels additional labels for the Secret created by the chart The `new` sub-key keeps the properties of a chart-managed Secret clearly separated from the properties of a referenced one, so it is obvious which settings are ignored once `existingSecret` is enabled. `secretName` rather than `name` mirrors the field the value ends up in, the `secretName` of a pod volume. The `gitea.secret.*.name` helpers resolve to the user-provided name when `existingSecret` is enabled, which means the Deployment volumes and the ServiceMonitor credentials pick it up without further changes. Enabling `existingSecret` without a name fails the render with a message naming the full values path, because Helm would otherwise silently create a Secret under the referenced name and overwrite it. Only two of the five Secrets had a checksum annotation before, so changes to the init scripts, the GPG key or the metrics token did not trigger a rollout. Annotations for all five are now rendered, each gated by `addSHASumAnnotation` and skipped for Secrets the chart does not manage. Two side effects had to be preserved when a Secret is no longer rendered: - secret_config.yaml carries the HA assertions (RWX access mode, issue/repo indexer, mutually exclusive PostgreSQL dependencies) inside its `assertions` field. They are extracted into `gitea.config.assertions` and evaluated before the guard, otherwise providing an own config Secret would silently disable chart-wide validation. - secret_inlineConfig.yaml populates `.Values.gitea.config` as a side effect of `gitea.inline_configuration`. Without evaluating it, even NOTES.txt fails on `.Values.gitea.config.cache`. The include therefore runs independently of the guard as well. `signing.existingSecret` keeps working; `secrets.gpg.existingSecret` takes precedence over it. The error message raised for an enabled but unconfigured signing setup now lists all three options. Test suites rendering the Deployment have to declare the Secret templates it checksums, hence the added `templates:` entries. unittests/helm/deployment/extraInitContainers.yaml set `signing.enabled` without a key or an existing Secret - a combination that fails a real `helm install` and only went unnoticed because the Deployment never rendered secret_gpg.yaml before. Co-authored-by: Copilot --- README.md | 30 +++++++ templates/gitea/_secrets.tpl | 89 +++++++++++++++++++ templates/gitea/deployment.yaml | 13 +++ templates/gitea/secret_config.yaml | 66 ++++++++------ templates/gitea/secret_gpg.yaml | 10 ++- templates/gitea/secret_init.yaml | 8 +- templates/gitea/secret_inlineConfig.yaml | 12 ++- templates/gitea/secret_metrics.yaml | 8 +- unittests/helm/deployment/HA.yaml | 3 + unittests/helm/deployment/basic.yaml | 3 + .../helm/deployment/checksum-annotations.yaml | 82 +++++++++++++++++ .../deployment-additional-config.yaml | 3 + .../helm/deployment/extraEnvSourceFile.yaml | 3 + .../helm/deployment/extraInitContainers.yaml | 5 ++ .../helm/deployment/image-configuration.yaml | 3 + unittests/helm/deployment/openshift.yaml | 3 + unittests/helm/deployment/probes.yaml | 3 + .../helm/deployment/sidecar-container.yaml | 3 + .../helm/deployment/signing-disabled.yaml | 3 + .../helm/deployment/signing-enabled.yaml | 3 + .../helm/deployment/ssh-configuration.yaml | 3 + .../helm/gpg-secret/signing-enabled.yaml | 2 +- unittests/helm/serviceaccount/reference.yaml | 3 + values.yaml | 82 +++++++++++++++++ 24 files changed, 407 insertions(+), 36 deletions(-) create mode 100644 unittests/helm/deployment/checksum-annotations.yaml diff --git a/README.md b/README.md index 78a3fe4..e0f9b77 100644 --- a/README.md +++ b/README.md @@ -1116,6 +1116,36 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.labels` | Labels for the deployment | `{}` | | `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` | +### Secret + +| Name | Description | Value | +| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- | +| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` | +| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | +| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | +| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | +| `secrets.config.new.labels` | Labels for the config Secret | `{}` | +| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` | +| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | +| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | +| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | +| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | +| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` | +| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | +| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | +| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | +| `secrets.init.new.labels` | Labels for the init Secret | `{}` | +| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` | +| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | +| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | +| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | +| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | +| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` | +| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | +| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | +| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | +| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | + ### ServiceAccount | Name | Description | Value | diff --git a/templates/gitea/_secrets.tpl b/templates/gitea/_secrets.tpl index aef22a9..48ac0bb 100644 --- a/templates/gitea/_secrets.tpl +++ b/templates/gitea/_secrets.tpl @@ -1,23 +1,112 @@ {{/* vim: set filetype=mustache: */}} +{{/* annotations */}} + +{{- define "gitea.secret.config.annotations" -}} +{{- with .Values.secrets.config.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.gpg.annotations" -}} +{{- with .Values.secrets.gpg.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.init.annotations" -}} +{{- with .Values.secrets.init.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.inlineConfig.annotations" -}} +{{- with .Values.secrets.inlineConfig.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{- define "gitea.secret.metrics.annotations" -}} +{{- with .Values.secrets.metrics.new.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.secret.config.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.config.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.gpg.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.gpg.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.init.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.init.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.inlineConfig.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.inlineConfig.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{- define "gitea.secret.metrics.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.secrets.metrics.new.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} + {{/* names */}} {{- define "gitea.secret.config.name" -}} +{{- if .Values.secrets.config.existingSecret.enabled -}} +{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-config +{{- end -}} {{- end }} {{- define "gitea.secret.gpg.name" -}} +{{- if .Values.secrets.gpg.existingSecret.enabled -}} +{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }} +{{- else -}} {{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} +{{- end -}} {{- end }} {{- define "gitea.secret.init.name" -}} +{{- if .Values.secrets.init.existingSecret.enabled -}} +{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-init +{{- end -}} {{- end }} {{- define "gitea.secret.inlineConfig.name" -}} +{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}} +{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-inline-config +{{- end -}} {{- end }} {{- define "gitea.secret.metrics.name" -}} +{{- if .Values.secrets.metrics.existingSecret.enabled -}} +{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }} +{{- else -}} {{ include "gitea.fullname" . }}-metrics +{{- end -}} {{- end }} diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml index 219736a..ccc46af 100644 --- a/templates/gitea/deployment.yaml +++ b/templates/gitea/deployment.yaml @@ -27,8 +27,21 @@ spec: template: metadata: annotations: + {{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }} checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.gpg.addSHASumAnnotation (not .Values.secrets.gpg.existingSecret.enabled) }} + checksum/gpg: {{ include (print $.Template.BasePath "/gitea/secret_gpg.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.init.addSHASumAnnotation (not .Values.secrets.init.existingSecret.enabled) }} + checksum/init: {{ include (print $.Template.BasePath "/gitea/secret_init.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.inlineConfig.addSHASumAnnotation (not .Values.secrets.inlineConfig.existingSecret.enabled) }} checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }} + {{- end }} + {{- if and .Values.secrets.metrics.addSHASumAnnotation (not .Values.secrets.metrics.existingSecret.enabled) }} + checksum/metrics: {{ include (print $.Template.BasePath "/gitea/secret_metrics.yaml") . | sha256sum }} + {{- end }} {{- range $idx, $value := .Values.gitea.ldap }} checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }} {{- end }} diff --git a/templates/gitea/secret_config.yaml b/templates/gitea/secret_config.yaml index 70bc154..4fd6279 100644 --- a/templates/gitea/secret_config.yaml +++ b/templates/gitea/secret_config.yaml @@ -1,47 +1,59 @@ +{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}} +{{- $assertions := include "gitea.config.assertions" . -}} +{{- if not .Values.secrets.config.existingSecret.enabled -}} --- apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.config.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.config.labels" . | nindent 4 }} name: {{ include "gitea.secret.config.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque stringData: {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }} assertions: | + {{- $assertions | nindent 4 }} +{{- end }} - {{- /*assert that only one PG dep is enabled */ -}} - {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}} - {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}} +{{- define "gitea.config.assertions" -}} + + {{- /*assert that only one PG dep is enabled */ -}} + {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}} + {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}} + {{- end }} + + {{- /* multiple replicas assertions */ -}} + {{- if gt (.Values.replicaCount | int) 1 -}} + {{- if .Values.gitea.config.cron -}} + {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}} + {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}} + {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }} + {{- end }} + {{- end }} {{- end }} - {{- /* multiple replicas assertions */ -}} - {{- if gt (.Values.replicaCount | int) 1 -}} - {{- if .Values.gitea.config.cron -}} - {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}} - {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}} - {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }} - {{- end }} - {{- end }} + {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}} + {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}} + {{- end }} + {{- if .Values.gitea.config.indexer -}} + {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}} + {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}} {{- end }} - - {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}} - {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}} - {{- end }} - {{- if .Values.gitea.config.indexer -}} - {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}} - {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}} - {{- end }} - {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}} - {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}} - {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}} - {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}} - {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}} - {{- end }} + {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}} + {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}} + {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}} + {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}} + {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}} {{- end }} {{- end }} {{- end }} {{- end }} - {{- end }} + + {{- end }} +{{- end }} diff --git a/templates/gitea/secret_gpg.yaml b/templates/gitea/secret_gpg.yaml index 4ac8e6e..19cca19 100644 --- a/templates/gitea/secret_gpg.yaml +++ b/templates/gitea/secret_gpg.yaml @@ -1,13 +1,17 @@ -{{- if .Values.signing.enabled -}} +{{- if and (.Values.signing.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}} {{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} - {{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}} + {{- fail "Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`" -}} {{- end }} {{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.gpg.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.gpg.labels" . | nindent 4 }} name: {{ include "gitea.secret.gpg.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque diff --git a/templates/gitea/secret_init.yaml b/templates/gitea/secret_init.yaml index e3d8dc0..308543d 100644 --- a/templates/gitea/secret_init.yaml +++ b/templates/gitea/secret_init.yaml @@ -1,8 +1,13 @@ +{{- if not .Values.secrets.init.existingSecret.enabled -}} apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.init.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.init.labels" . | nindent 4 }} name: {{ include "gitea.secret.init.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque @@ -226,3 +231,4 @@ stringData: configure_oauth echo '==== END GITEA CONFIGURATION ====' +{{- end }} diff --git a/templates/gitea/secret_inlineConfig.yaml b/templates/gitea/secret_inlineConfig.yaml index c8778f0..96d37d8 100644 --- a/templates/gitea/secret_inlineConfig.yaml +++ b/templates/gitea/secret_inlineConfig.yaml @@ -1,11 +1,19 @@ +{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}} +{{- $inlineConfiguration := include "gitea.inline_configuration" . -}} +{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}} --- apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.inlineConfig.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }} name: {{ include "gitea.secret.inlineConfig.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque stringData: - {{- include "gitea.inline_configuration" . | nindent 2 }} \ No newline at end of file + {{- $inlineConfiguration | nindent 2 }} +{{- end }} \ No newline at end of file diff --git a/templates/gitea/secret_metrics.yaml b/templates/gitea/secret_metrics.yaml index 5651353..a1346d7 100644 --- a/templates/gitea/secret_metrics.yaml +++ b/templates/gitea/secret_metrics.yaml @@ -1,9 +1,13 @@ -{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}} +{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}} apiVersion: v1 kind: Secret metadata: + {{- with (include "gitea.secret.metrics.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} labels: - {{- include "gitea.labels" . | nindent 4 }} + {{- include "gitea.secret.metrics.labels" . | nindent 4 }} name: {{ include "gitea.secret.metrics.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque diff --git a/unittests/helm/deployment/HA.yaml b/unittests/helm/deployment/HA.yaml index 8344b0b..8fea9bb 100644 --- a/unittests/helm/deployment/HA.yaml +++ b/unittests/helm/deployment/HA.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: fails with multiple replicas and "GIT_GC_REPOS" enabled template: templates/gitea/secret_config.yaml diff --git a/unittests/helm/deployment/basic.yaml b/unittests/helm/deployment/basic.yaml index 757366f..2889c0c 100644 --- a/unittests/helm/deployment/basic.yaml +++ b/unittests/helm/deployment/basic.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: renders a deployment template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/checksum-annotations.yaml b/unittests/helm/deployment/checksum-annotations.yaml new file mode 100644 index 0000000..7533ad1 --- /dev/null +++ b/unittests/helm/deployment/checksum-annotations.yaml @@ -0,0 +1,82 @@ +suite: deployment template (checksum annotations) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/deployment.yaml + - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml + - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml +tests: + - it: adds a checksum annotation for every Secret by default + template: templates/gitea/deployment.yaml + asserts: + - exists: + path: spec.template.metadata.annotations["checksum/config"] + - exists: + path: spec.template.metadata.annotations["checksum/gpg"] + - exists: + path: spec.template.metadata.annotations["checksum/init"] + - exists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - exists: + path: spec.template.metadata.annotations["checksum/metrics"] + + - it: omits the checksum annotations when addSHASumAnnotation is disabled + template: templates/gitea/deployment.yaml + set: + secrets.config.addSHASumAnnotation: false + secrets.gpg.addSHASumAnnotation: false + secrets.init.addSHASumAnnotation: false + secrets.inlineConfig.addSHASumAnnotation: false + secrets.metrics.addSHASumAnnotation: false + asserts: + - notExists: + path: spec.template.metadata.annotations["checksum/config"] + - notExists: + path: spec.template.metadata.annotations["checksum/gpg"] + - notExists: + path: spec.template.metadata.annotations["checksum/init"] + - notExists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - notExists: + path: spec.template.metadata.annotations["checksum/metrics"] + + - it: omits the checksum annotation of a single disabled Secret only + template: templates/gitea/deployment.yaml + set: + secrets.init.addSHASumAnnotation: false + asserts: + - exists: + path: spec.template.metadata.annotations["checksum/config"] + - notExists: + path: spec.template.metadata.annotations["checksum/init"] + - exists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + + - it: omits the checksum annotations of Secrets provided by the user + template: templates/gitea/deployment.yaml + set: + secrets.config.existingSecret.enabled: true + secrets.config.existingSecret.secretName: custom-config + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: custom-gpg + secrets.init.existingSecret.enabled: true + secrets.init.existingSecret.secretName: custom-init + secrets.inlineConfig.existingSecret.enabled: true + secrets.inlineConfig.existingSecret.secretName: custom-inline-config + secrets.metrics.existingSecret.enabled: true + secrets.metrics.existingSecret.secretName: custom-metrics + asserts: + - notExists: + path: spec.template.metadata.annotations["checksum/config"] + - notExists: + path: spec.template.metadata.annotations["checksum/gpg"] + - notExists: + path: spec.template.metadata.annotations["checksum/init"] + - notExists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - notExists: + path: spec.template.metadata.annotations["checksum/metrics"] diff --git a/unittests/helm/deployment/deployment-additional-config.yaml b/unittests/helm/deployment/deployment-additional-config.yaml index 894c056..c4b72e7 100644 --- a/unittests/helm/deployment/deployment-additional-config.yaml +++ b/unittests/helm/deployment/deployment-additional-config.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: Renders a deployment template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/extraEnvSourceFile.yaml b/unittests/helm/deployment/extraEnvSourceFile.yaml index 15acdfd..a05ed52 100644 --- a/unittests/helm/deployment/extraEnvSourceFile.yaml +++ b/unittests/helm/deployment/extraEnvSourceFile.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: uses direct execution when extraEnvSourceFile is not set template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/extraInitContainers.yaml b/unittests/helm/deployment/extraInitContainers.yaml index c23191d..74a29f6 100644 --- a/unittests/helm/deployment/extraInitContainers.yaml +++ b/unittests/helm/deployment/extraInitContainers.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: Render the deployment (default) asserts: @@ -20,6 +23,7 @@ tests: - it: Render the deployment (signing) set: signing.enabled: true + signing.existingSecret: "custom-gpg-secret" asserts: - hasDocuments: count: 1 @@ -38,6 +42,7 @@ tests: - name: bar image: docker.io/library/busybox:latest signing.enabled: true + signing.existingSecret: "custom-gpg-secret" asserts: - hasDocuments: count: 1 diff --git a/unittests/helm/deployment/image-configuration.yaml b/unittests/helm/deployment/image-configuration.yaml index 7bfa04f..6b9f2dd 100644 --- a/unittests/helm/deployment/image-configuration.yaml +++ b/unittests/helm/deployment/image-configuration.yaml @@ -8,7 +8,10 @@ chart: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: default values template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/openshift.yaml b/unittests/helm/deployment/openshift.yaml index 1b0329a..89633e8 100644 --- a/unittests/helm/deployment/openshift.yaml +++ b/unittests/helm/deployment/openshift.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: renders openshift-compatible defaults for chart-managed containers template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/probes.yaml b/unittests/helm/deployment/probes.yaml index 86a5fe5..3d75a7d 100644 --- a/unittests/helm/deployment/probes.yaml +++ b/unittests/helm/deployment/probes.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: renders default liveness probe template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/sidecar-container.yaml b/unittests/helm/deployment/sidecar-container.yaml index c58c5ca..9787571 100644 --- a/unittests/helm/deployment/sidecar-container.yaml +++ b/unittests/helm/deployment/sidecar-container.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: supports adding a sidecar container template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/signing-disabled.yaml b/unittests/helm/deployment/signing-disabled.yaml index 6de1193..266b490 100644 --- a/unittests/helm/deployment/signing-disabled.yaml +++ b/unittests/helm/deployment/signing-disabled.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: skips gpg init container template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/signing-enabled.yaml b/unittests/helm/deployment/signing-enabled.yaml index 7de53f3..468bee2 100644 --- a/unittests/helm/deployment/signing-enabled.yaml +++ b/unittests/helm/deployment/signing-enabled.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: adds gpg init container template: templates/gitea/deployment.yaml diff --git a/unittests/helm/deployment/ssh-configuration.yaml b/unittests/helm/deployment/ssh-configuration.yaml index 8895e83..edeb05e 100644 --- a/unittests/helm/deployment/ssh-configuration.yaml +++ b/unittests/helm/deployment/ssh-configuration.yaml @@ -5,7 +5,10 @@ release: templates: - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: supports defining SSH log level for root based image template: templates/gitea/deployment.yaml diff --git a/unittests/helm/gpg-secret/signing-enabled.yaml b/unittests/helm/gpg-secret/signing-enabled.yaml index 1ba137a..2e976c0 100644 --- a/unittests/helm/gpg-secret/signing-enabled.yaml +++ b/unittests/helm/gpg-secret/signing-enabled.yaml @@ -11,7 +11,7 @@ tests: enabled: true asserts: - failedTemplate: - errorMessage: Either specify `signing.privateKey` or `signing.existingSecret` + errorMessage: Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret` - it: skips rendering using external secret reference set: signing: diff --git a/unittests/helm/serviceaccount/reference.yaml b/unittests/helm/serviceaccount/reference.yaml index 4c8de3f..b25ec52 100644 --- a/unittests/helm/serviceaccount/reference.yaml +++ b/unittests/helm/serviceaccount/reference.yaml @@ -6,7 +6,10 @@ templates: - templates/gitea/serviceAccount.yaml - templates/gitea/deployment.yaml - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml tests: - it: does not modify the deployment by default template: templates/gitea/deployment.yaml diff --git a/values.yaml b/values.yaml index 37be20f..143984a 100644 --- a/values.yaml +++ b/values.yaml @@ -343,6 +343,88 @@ deployment: labels: {} annotations: {} +## @section Secret +secrets: + config: + ## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.config.existingSecret.enabled Use an already existing Secret instead of creating the config Secret + ## @param secrets.config.existingSecret.secretName Name of the already existing config Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.config.new.annotations Annotations for the config Secret + ## @param secrets.config.new.labels Labels for the config Secret + new: + annotations: {} + labels: {} + + gpg: + ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret + ## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.gpg.new.annotations Annotations for the GPG key Secret + ## @param secrets.gpg.new.labels Labels for the GPG key Secret + new: + annotations: {} + labels: {} + + init: + ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.init.existingSecret.enabled Use an already existing Secret instead of creating the init Secret + ## @param secrets.init.existingSecret.secretName Name of the already existing init Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.init.new.annotations Annotations for the init Secret + ## @param secrets.init.new.labels Labels for the init Secret + new: + annotations: {} + labels: {} + + inlineConfig: + ## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.inlineConfig.existingSecret.enabled Use an already existing Secret instead of creating the inline configuration Secret + ## @param secrets.inlineConfig.existingSecret.secretName Name of the already existing inline configuration Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.inlineConfig.new.annotations Annotations for the inline configuration Secret + ## @param secrets.inlineConfig.new.labels Labels for the inline configuration Secret + new: + annotations: {} + labels: {} + + metrics: + ## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change + addSHASumAnnotation: true + + ## @param secrets.metrics.existingSecret.enabled Use an already existing Secret instead of creating the metrics Secret + ## @param secrets.metrics.existingSecret.secretName Name of the already existing metrics Secret + existingSecret: + enabled: false + secretName: "" + + ## @param secrets.metrics.new.annotations Annotations for the metrics Secret + ## @param secrets.metrics.new.labels Labels for the metrics Secret + new: + annotations: {} + labels: {} + ## @section ServiceAccount ## @param serviceAccount.create Enable the creation of a ServiceAccount