volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

feat(secrets): make every Secret configurable via a secrets.* block
changelog / changelog (push) Successful in 24s
Details
check-and-test / check-and-test (push) Successful in 1m48s
Details

Browse Source 
Until now the Secrets rendered by this chart were not configurable at all. Their labels were fixed
to the chart defaults, they could not carry annotations, and there was no way to hand in a Secret
that is managed outside of the chart - except for the GPG key, which had its own special case via
`signing.existingSecret`. Users who manage their secrets with an external operator (e.g. External
Secrets, Sealed Secrets) or who need annotations for tooling such as Reloader or Kyverno had no
option but to fork the chart.

A `secrets` section is introduced with one entry per Secret (config, gpg, init, inlineConfig,
metrics), each offering:

  addSHASumAnnotation            add a checksum annotation to the pod template (default: true)
  existingSecret.enabled         reference a Secret that is not managed by this chart
  existingSecret.secretName      name of that Secret
  new.annotations                annotations for the Secret created by the chart
  new.labels                     additional labels for the Secret created by the chart

The `new` sub-key keeps the properties of a chart-managed Secret clearly separated from the
properties of a referenced one, so it is obvious which settings are ignored once `existingSecret` is
enabled. `secretName` rather than `name` mirrors the field the value ends up in, the `secretName` of
a pod volume.

The `gitea.secret.*.name` helpers resolve to the user-provided name when `existingSecret` is
enabled, which means the Deployment volumes and the ServiceMonitor credentials pick it up without
further changes. Enabling `existingSecret` without a name fails the render with a message naming the
full values path, because Helm would otherwise silently create a Secret under the referenced name and
overwrite it.

Only two of the five Secrets had a checksum annotation before, so changes to the init scripts, the
GPG key or the metrics token did not trigger a rollout. Annotations for all five are now rendered,
each gated by `addSHASumAnnotation` and skipped for Secrets the chart does not manage.

Two side effects had to be preserved when a Secret is no longer rendered:

- secret_config.yaml carries the HA assertions (RWX access mode, issue/repo indexer, mutually
  exclusive PostgreSQL dependencies) inside its `assertions` field. They are extracted into
  `gitea.config.assertions` and evaluated before the guard, otherwise providing an own config Secret
  would silently disable chart-wide validation.
- secret_inlineConfig.yaml populates `.Values.gitea.config` as a side effect of
  `gitea.inline_configuration`. Without evaluating it, even NOTES.txt fails on
  `.Values.gitea.config.cache`. The include therefore runs independently of the guard as well.

`signing.existingSecret` keeps working; `secrets.gpg.existingSecret` takes precedence over it. The
error message raised for an enabled but unconfigured signing setup now lists all three options.

Test suites rendering the Deployment have to declare the Secret templates it checksums, hence the
added `templates:` entries. unittests/helm/deployment/extraInitContainers.yaml set `signing.enabled`
without a key or an existing Secret - a combination that fails a real `helm install` and only went
unnoticed because the Deployment never rendered secret_gpg.yaml before.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-03 17:14:11 +02:00
co-authored by Copilot
parent a4c6893874
commit 4d82f17ce6
24 changed files with 407 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+30
View File
@@ -1116,6 +1116,36 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
| `deployment.labels` | Labels for the deployment | `{}` | | `deployment.labels` | Labels for the deployment | `{}` |
| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` | | `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` |
### Secret
| Name | Description | Value |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- |
| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` |
| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` |
| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` |
| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` |
| `secrets.config.new.labels` | Labels for the config Secret | `{}` |
| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` |
| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` |
| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` |
| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` |
| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` |
| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` |
| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` |
| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` |
| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` |
| `secrets.init.new.labels` | Labels for the init Secret | `{}` |
| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` |
| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` |
| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` |
| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` |
| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` |
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` |
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` |
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` |
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` |
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` |
### ServiceAccount ### ServiceAccount
| Name | Description | Value | | Name | Description | Value |
templates/gitea/_secrets.tpl
+89
View File
@@ -1,23 +1,112 @@
{{/* vim: set filetype=mustache: */}} {{/* vim: set filetype=mustache: */}}
{{/* annotations */}}
{{- define "gitea.secret.config.annotations" -}}
{{- with .Values.secrets.config.new.annotations }}
{{- toYaml . -}}
{{- end }}
{{- end }}
{{- define "gitea.secret.gpg.annotations" -}}
{{- with .Values.secrets.gpg.new.annotations }}
{{- toYaml . -}}
{{- end }}
{{- end }}
{{- define "gitea.secret.init.annotations" -}}
{{- with .Values.secrets.init.new.annotations }}
{{- toYaml . -}}
{{- end }}
{{- end }}
{{- define "gitea.secret.inlineConfig.annotations" -}}
{{- with .Values.secrets.inlineConfig.new.annotations }}
{{- toYaml . -}}
{{- end }}
{{- end }}
{{- define "gitea.secret.metrics.annotations" -}}
{{- with .Values.secrets.metrics.new.annotations }}
{{- toYaml . -}}
{{- end }}
{{- end }}
{{/* labels */}}
{{- define "gitea.secret.config.labels" -}}
{{ include "gitea.labels" . }}
{{- with .Values.secrets.config.new.labels }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{- define "gitea.secret.gpg.labels" -}}
{{ include "gitea.labels" . }}
{{- with .Values.secrets.gpg.new.labels }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{- define "gitea.secret.init.labels" -}}
{{ include "gitea.labels" . }}
{{- with .Values.secrets.init.new.labels }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{- define "gitea.secret.inlineConfig.labels" -}}
{{ include "gitea.labels" . }}
{{- with .Values.secrets.inlineConfig.new.labels }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{- define "gitea.secret.metrics.labels" -}}
{{ include "gitea.labels" . }}
{{- with .Values.secrets.metrics.new.labels }}
{{ toYaml . }}
{{- end }}
{{- end }}
{{/* names */}} {{/* names */}}
{{- define "gitea.secret.config.name" -}} {{- define "gitea.secret.config.name" -}}
{{- if .Values.secrets.config.existingSecret.enabled -}}
{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
{{- else -}}
{{ include "gitea.fullname" . }}-config {{ include "gitea.fullname" . }}-config
{{- end -}}
{{- end }} {{- end }}
{{- define "gitea.secret.gpg.name" -}} {{- define "gitea.secret.gpg.name" -}}
{{- if .Values.secrets.gpg.existingSecret.enabled -}}
{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
{{- else -}}
{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} {{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
{{- end -}}
{{- end }} {{- end }}
{{- define "gitea.secret.init.name" -}} {{- define "gitea.secret.init.name" -}}
{{- if .Values.secrets.init.existingSecret.enabled -}}
{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }}
{{- else -}}
{{ include "gitea.fullname" . }}-init {{ include "gitea.fullname" . }}-init
{{- end -}}
{{- end }} {{- end }}
{{- define "gitea.secret.inlineConfig.name" -}} {{- define "gitea.secret.inlineConfig.name" -}}
{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}}
{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }}
{{- else -}}
{{ include "gitea.fullname" . }}-inline-config {{ include "gitea.fullname" . }}-inline-config
{{- end -}}
{{- end }} {{- end }}
{{- define "gitea.secret.metrics.name" -}} {{- define "gitea.secret.metrics.name" -}}
{{- if .Values.secrets.metrics.existingSecret.enabled -}}
{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }}
{{- else -}}
{{ include "gitea.fullname" . }}-metrics {{ include "gitea.fullname" . }}-metrics
{{- end -}}
{{- end }} {{- end }}
templates/gitea/deployment.yaml
+13
View File
@@ -27,8 +27,21 @@ spec:
template: template:
metadata: metadata:
annotations: annotations:
{{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }}
checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }} checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }}
{{- end }}
{{- if and .Values.secrets.gpg.addSHASumAnnotation (not .Values.secrets.gpg.existingSecret.enabled) }}
checksum/gpg: {{ include (print $.Template.BasePath "/gitea/secret_gpg.yaml") . | sha256sum }}
{{- end }}
{{- if and .Values.secrets.init.addSHASumAnnotation (not .Values.secrets.init.existingSecret.enabled) }}
checksum/init: {{ include (print $.Template.BasePath "/gitea/secret_init.yaml") . | sha256sum }}
{{- end }}
{{- if and .Values.secrets.inlineConfig.addSHASumAnnotation (not .Values.secrets.inlineConfig.existingSecret.enabled) }}
checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }} checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }}
{{- end }}
{{- if and .Values.secrets.metrics.addSHASumAnnotation (not .Values.secrets.metrics.existingSecret.enabled) }}
checksum/metrics: {{ include (print $.Template.BasePath "/gitea/secret_metrics.yaml") . | sha256sum }}
{{- end }}
{{- range $idx, $value := .Values.gitea.ldap }} {{- range $idx, $value := .Values.gitea.ldap }}
checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }} checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
{{- end }} {{- end }}
templates/gitea/secret_config.yaml
+13 -1
View File
@@ -1,15 +1,26 @@
{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
{{- $assertions := include "gitea.config.assertions" . -}}
{{- if not .Values.secrets.config.existingSecret.enabled -}}
--- ---
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
{{- with (include "gitea.secret.config.annotations" .) }}
annotations:
{{- . | nindent 4 }}
{{- end }}
labels: labels:
{{- include "gitea.labels" . | nindent 4 }} {{- include "gitea.secret.config.labels" . | nindent 4 }}
name: {{ include "gitea.secret.config.name" . }} name: {{ include "gitea.secret.config.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
stringData: stringData:
{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }} {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
assertions: | assertions: |
{{- $assertions | nindent 4 }}
{{- end }}
{{- define "gitea.config.assertions" -}}
{{- /*assert that only one PG dep is enabled */ -}} {{- /*assert that only one PG dep is enabled */ -}}
{{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}} {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
@@ -45,3 +56,4 @@ stringData:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }}
templates/gitea/secret_gpg.yaml
+7 -3
View File
@@ -1,13 +1,17 @@
{{- if .Values.signing.enabled -}} {{- if and (.Values.signing.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} {{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
{{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}} {{- fail "Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`" -}}
{{- end }} {{- end }}
{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} {{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
{{- with (include "gitea.secret.gpg.annotations" .) }}
annotations:
{{- . | nindent 4 }}
{{- end }}
labels: labels:
{{- include "gitea.labels" . | nindent 4 }} {{- include "gitea.secret.gpg.labels" . | nindent 4 }}
name: {{ include "gitea.secret.gpg.name" . }} name: {{ include "gitea.secret.gpg.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
templates/gitea/secret_init.yaml
+7 -1
View File
@@ -1,8 +1,13 @@
{{- if not .Values.secrets.init.existingSecret.enabled -}}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
{{- with (include "gitea.secret.init.annotations" .) }}
annotations:
{{- . | nindent 4 }}
{{- end }}
labels: labels:
{{- include "gitea.labels" . | nindent 4 }} {{- include "gitea.secret.init.labels" . | nindent 4 }}
name: {{ include "gitea.secret.init.name" . }} name: {{ include "gitea.secret.init.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
@@ -226,3 +231,4 @@ stringData:
configure_oauth configure_oauth
echo '==== END GITEA CONFIGURATION ====' echo '==== END GITEA CONFIGURATION ===='
{{- end }}
templates/gitea/secret_inlineConfig.yaml
+10 -2
View File
@@ -1,11 +1,19 @@
{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}}
{{- $inlineConfiguration := include "gitea.inline_configuration" . -}}
{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}}
--- ---
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
{{- with (include "gitea.secret.inlineConfig.annotations" .) }}
annotations:
{{- . | nindent 4 }}
{{- end }}
labels: labels:
{{- include "gitea.labels" . | nindent 4 }} {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }}
name: {{ include "gitea.secret.inlineConfig.name" . }} name: {{ include "gitea.secret.inlineConfig.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
stringData: stringData:
{{- include "gitea.inline_configuration" . | nindent 2 }} {{- $inlineConfiguration | nindent 2 }}
{{- end }}
templates/gitea/secret_metrics.yaml
+6 -2
View File
@@ -1,9 +1,13 @@
{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}} {{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
{{- with (include "gitea.secret.metrics.annotations" .) }}
annotations:
{{- . | nindent 4 }}
{{- end }}
labels: labels:
{{- include "gitea.labels" . | nindent 4 }} {{- include "gitea.secret.metrics.labels" . | nindent 4 }}
name: {{ include "gitea.secret.metrics.name" . }} name: {{ include "gitea.secret.metrics.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
unittests/helm/deployment/HA.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: fails with multiple replicas and "GIT_GC_REPOS" enabled - it: fails with multiple replicas and "GIT_GC_REPOS" enabled
template: templates/gitea/secret_config.yaml template: templates/gitea/secret_config.yaml
unittests/helm/deployment/basic.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: renders a deployment - it: renders a deployment
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/checksum-annotations.yaml
+82
View File
@@ -0,0 +1,82 @@
suite: deployment template (checksum annotations)
release:
name: gitea-unittests
namespace: testing
templates:
- templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests:
- it: adds a checksum annotation for every Secret by default
template: templates/gitea/deployment.yaml
asserts:
- exists:
path: spec.template.metadata.annotations["checksum/config"]
- exists:
path: spec.template.metadata.annotations["checksum/gpg"]
- exists:
path: spec.template.metadata.annotations["checksum/init"]
- exists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- exists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: omits the checksum annotations when addSHASumAnnotation is disabled
template: templates/gitea/deployment.yaml
set:
secrets.config.addSHASumAnnotation: false
secrets.gpg.addSHASumAnnotation: false
secrets.init.addSHASumAnnotation: false
secrets.inlineConfig.addSHASumAnnotation: false
secrets.metrics.addSHASumAnnotation: false
asserts:
- notExists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/gpg"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- notExists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- notExists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: omits the checksum annotation of a single disabled Secret only
template: templates/gitea/deployment.yaml
set:
secrets.init.addSHASumAnnotation: false
asserts:
- exists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- exists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- it: omits the checksum annotations of Secrets provided by the user
template: templates/gitea/deployment.yaml
set:
secrets.config.existingSecret.enabled: true
secrets.config.existingSecret.secretName: custom-config
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: custom-gpg
secrets.init.existingSecret.enabled: true
secrets.init.existingSecret.secretName: custom-init
secrets.inlineConfig.existingSecret.enabled: true
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
secrets.metrics.existingSecret.enabled: true
secrets.metrics.existingSecret.secretName: custom-metrics
asserts:
- notExists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/gpg"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- notExists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- notExists:
path: spec.template.metadata.annotations["checksum/metrics"]
unittests/helm/deployment/deployment-additional-config.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: Renders a deployment - it: Renders a deployment
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/extraEnvSourceFile.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: uses direct execution when extraEnvSourceFile is not set - it: uses direct execution when extraEnvSourceFile is not set
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/extraInitContainers.yaml
+5
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: Render the deployment (default) - it: Render the deployment (default)
asserts: asserts:
@@ -20,6 +23,7 @@ tests:
- it: Render the deployment (signing) - it: Render the deployment (signing)
set: set:
signing.enabled: true signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 1 count: 1
@@ -38,6 +42,7 @@ tests:
- name: bar - name: bar
image: docker.io/library/busybox:latest image: docker.io/library/busybox:latest
signing.enabled: true signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 1 count: 1
unittests/helm/deployment/image-configuration.yaml
+3
View File
@@ -8,7 +8,10 @@ chart:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: default values - it: default values
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/openshift.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: renders openshift-compatible defaults for chart-managed containers - it: renders openshift-compatible defaults for chart-managed containers
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/probes.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: renders default liveness probe - it: renders default liveness probe
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/sidecar-container.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: supports adding a sidecar container - it: supports adding a sidecar container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/signing-disabled.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: skips gpg init container - it: skips gpg init container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/signing-enabled.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: adds gpg init container - it: adds gpg init container
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/deployment/ssh-configuration.yaml
+3
View File
@@ -5,7 +5,10 @@ release:
templates: templates:
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: supports defining SSH log level for root based image - it: supports defining SSH log level for root based image
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
unittests/helm/gpg-secret/signing-enabled.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ tests:
enabled: true enabled: true
asserts: asserts:
- failedTemplate: - failedTemplate:
errorMessage: Either specify `signing.privateKey` or `signing.existingSecret` errorMessage: Either specify `signing.privateKey`, `signing.existingSecret` or `secrets.gpg.existingSecret`
- it: skips rendering using external secret reference - it: skips rendering using external secret reference
set: set:
signing: signing:
unittests/helm/serviceaccount/reference.yaml
+3
View File
@@ -6,7 +6,10 @@ templates:
- templates/gitea/serviceAccount.yaml - templates/gitea/serviceAccount.yaml
- templates/gitea/deployment.yaml - templates/gitea/deployment.yaml
- templates/gitea/secret_config.yaml - templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests: tests:
- it: does not modify the deployment by default - it: does not modify the deployment by default
template: templates/gitea/deployment.yaml template: templates/gitea/deployment.yaml
values.yaml
+82
View File
@@ -343,6 +343,88 @@ deployment:
labels: {} labels: {}
annotations: {} annotations: {}
## @section Secret
secrets:
config:
## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change
addSHASumAnnotation: true
## @param secrets.config.existingSecret.enabled Use an already existing Secret instead of creating the config Secret
## @param secrets.config.existingSecret.secretName Name of the already existing config Secret
existingSecret:
enabled: false
secretName: ""
## @param secrets.config.new.annotations Annotations for the config Secret
## @param secrets.config.new.labels Labels for the config Secret
new:
annotations: {}
labels: {}
gpg:
## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change
addSHASumAnnotation: true
## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret
## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret
existingSecret:
enabled: false
secretName: ""
## @param secrets.gpg.new.annotations Annotations for the GPG key Secret
## @param secrets.gpg.new.labels Labels for the GPG key Secret
new:
annotations: {}
labels: {}
init:
## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change
addSHASumAnnotation: true
## @param secrets.init.existingSecret.enabled Use an already existing Secret instead of creating the init Secret
## @param secrets.init.existingSecret.secretName Name of the already existing init Secret
existingSecret:
enabled: false
secretName: ""
## @param secrets.init.new.annotations Annotations for the init Secret
## @param secrets.init.new.labels Labels for the init Secret
new:
annotations: {}
labels: {}
inlineConfig:
## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change
addSHASumAnnotation: true
## @param secrets.inlineConfig.existingSecret.enabled Use an already existing Secret instead of creating the inline configuration Secret
## @param secrets.inlineConfig.existingSecret.secretName Name of the already existing inline configuration Secret
existingSecret:
enabled: false
secretName: ""
## @param secrets.inlineConfig.new.annotations Annotations for the inline configuration Secret
## @param secrets.inlineConfig.new.labels Labels for the inline configuration Secret
new:
annotations: {}
labels: {}
metrics:
## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change
addSHASumAnnotation: true
## @param secrets.metrics.existingSecret.enabled Use an already existing Secret instead of creating the metrics Secret
## @param secrets.metrics.existingSecret.secretName Name of the already existing metrics Secret
existingSecret:
enabled: false
secretName: ""
## @param secrets.metrics.new.annotations Annotations for the metrics Secret
## @param secrets.metrics.new.labels Labels for the metrics Secret
new:
annotations: {}
labels: {}
## @section ServiceAccount ## @section ServiceAccount
## @param serviceAccount.create Enable the creation of a ServiceAccount ## @param serviceAccount.create Enable the creation of a ServiceAccount