From 64c2f1a9cc356b696d1669c26beaeb7eb1081121 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Sat, 3 Oct 2026 17:34:48 +0200 Subject: [PATCH] fix(secrets): render config and init secrets as data to prune removed keys Both Secrets rendered their payload via `stringData`. That field is write-only: the API server decodes it into `data` and does not persist `stringData` itself. Helm's three-way merge therefore generates a deletion patch that targets `stringData`, while the live object only ever carries `data` - so a key that disappears from the rendered manifest is never pruned and survives every upgrade. Unlike the inline-config Secret fixed in #1110, the keys here are driven by the files in `scripts/init-containers/**` rather than by user values, so the bug is latent rather than acute. It still bites whenever a script is removed or renamed in the chart: the stale key stays in the Secret and keeps being mounted into the init containers. The two inline scripts of the init Secret were YAML block scalars and had to be moved into `define` blocks to be pipeable through `b64enc`. The bodies are dedented by four columns accordingly, and `trimAll "\n"` reproduces the chomping semantics of the previous `|-` scalars. Rendering was diffed against the previous revision for defaults, rootless, initPreScript, GPG, admin, LDAP, OAuth and all valkey variants - the decoded payloads are byte-identical, so no init script changes behaviour. Unit tests now read the payloads from `data.*` with `decodeBase64: true` and assert that `stringData` no longer exists, to catch a regression early. See: https://gitea.com/gitea/helm-gitea/issues/1109 See: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: Copilot --- templates/secret_config.yaml | 7 +- templates/secret_init.yaml | 441 +++++++++--------- .../config/config-environment-script.yaml | 12 +- .../customization-integrity-valkey.yaml | 6 +- .../init_directory_structure.sh-rootless.yaml | 18 +- .../init/init_directory_structure.sh.yaml | 17 +- 6 files changed, 269 insertions(+), 232 deletions(-) diff --git a/templates/secret_config.yaml b/templates/secret_config.yaml index 4b61dce..61bc051 100644 --- a/templates/secret_config.yaml +++ b/templates/secret_config.yaml @@ -14,10 +14,9 @@ metadata: name: {{ include "gitea.secret.config.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque -stringData: -{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }} - assertions: | - {{- $assertions | nindent 4 }} +data: +{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }} + assertions: {{ $assertions | b64enc | quote }} {{- end }} {{- define "gitea.config.assertions" -}} diff --git a/templates/secret_init.yaml b/templates/secret_init.yaml index ee2903d..a323402 100644 --- a/templates/secret_init.yaml +++ b/templates/secret_init.yaml @@ -11,224 +11,229 @@ metadata: name: {{ include "gitea.secret.init.name" . }} namespace: {{ .Values.namespace | default .Release.Namespace }} type: Opaque -stringData: -{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }} - init_directory_structure.sh: |- - #!/usr/bin/env bash - - set -euo pipefail - - {{- if .Values.initPreScript }} - # BEGIN: initPreScript - {{- with .Values.initPreScript -}} - {{ . | nindent 4}} - {{- end -}} - # END: initPreScript - {{- end }} - - {{- if not .Values.deployment.gitea.image.rootless }} - chown -v 1000:1000 /data - {{- end }} - mkdir -pv /data/git/.ssh - chmod -Rv 700 /data/git/.ssh - [ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf - - # prepare temp directory structure - mkdir -pv "${GITEA_TEMP}" - {{- if not .Values.deployment.gitea.image.rootless }} - chown -v 1000:1000 "${GITEA_TEMP}" - {{- end }} - chmod -v ug+rwx "${GITEA_TEMP}" - - {{ if .Values.secrets.gpg.enabled -}} - if [ ! -d "${GNUPGHOME}" ]; then - mkdir -pv "${GNUPGHOME}" - chmod -v 700 "${GNUPGHOME}" - chown -v 1000:1000 "${GNUPGHOME}" +data: +{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsSecrets | indent 2 }} + configure_gitea.sh: {{ include "gitea.init.configureGitea" . | trimAll "\n" | b64enc | quote }} + init_directory_structure.sh: {{ include "gitea.init.initDirectoryStructure" . | trimAll "\n" | b64enc | quote }} +{{- end }} + +{{- define "gitea.init.initDirectoryStructure" -}} +#!/usr/bin/env bash + +set -euo pipefail + +{{- if .Values.initPreScript }} +# BEGIN: initPreScript +{{- with .Values.initPreScript -}} +{{ . | nindent 0 }} +{{- end -}} +# END: initPreScript +{{- end }} + +{{- if not .Values.deployment.gitea.image.rootless }} +chown -v 1000:1000 /data +{{- end }} +mkdir -pv /data/git/.ssh +chmod -Rv 700 /data/git/.ssh +[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf + +# prepare temp directory structure +mkdir -pv "${GITEA_TEMP}" +{{- if not .Values.deployment.gitea.image.rootless }} +chown -v 1000:1000 "${GITEA_TEMP}" +{{- end }} +chmod -v ug+rwx "${GITEA_TEMP}" + +{{ if .Values.secrets.gpg.enabled -}} +if [ ! -d "${GNUPGHOME}" ]; then + mkdir -pv "${GNUPGHOME}" + chmod -v 700 "${GNUPGHOME}" + chown -v 1000:1000 "${GNUPGHOME}" +fi +{{- end }} +{{- end }} + +{{- define "gitea.init.configureGitea" -}} +#!/usr/bin/env bash + +set -euo pipefail + +echo '==== BEGIN GITEA CONFIGURATION ====' + +{ # try + gitea migrate +} || { # catch + echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds" + exit 1 +} + +{{- if include "valkey.servicename" . }} +function test_valkey_connection() { + local RETRY=0 + local MAX=30 + + echo 'Wait for valkey to become avialable...' + until [ "${RETRY}" -ge "${MAX}" ]; do + RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break + RETRY=$[${RETRY}+1] + echo "...not ready yet (${RETRY}/${MAX})" + done + + if [ "${RETRY}" -ge "${MAX}" ]; then + echo "Valkey not reachable after '${MAX}' attempts!" + exit 1 + fi +} + +test_valkey_connection +{{- end }} + + +{{- if .Values.secrets.admin.enabled }} +function configure_admin_user() { + local full_admin_list=$(gitea admin user list --admin) + local actual_user_table='' + + # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line + local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)" + if [[ "${full_admin_list}" =~ $regex ]]; then + actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline + else + # This code block should never be reached, as long as the output table header remains the same. + # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. + + echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users." + echo " Please review the output of 'gitea admin user list --admin' shown below." + echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." + echo "DEBUG: Output of 'gitea admin user list --admin'" + echo "--" + echo "${full_admin_list}" + echo "--" + exit 1 + fi + + local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}") + if [[ -z "${ACCOUNT_ID}" ]]; then + local -a create_args + create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}") + if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then + create_args+=(--must-change-password=true) + else + create_args+=(--must-change-password=false) fi - {{- end }} - - configure_gitea.sh: |- - #!/usr/bin/env bash - - set -euo pipefail - - echo '==== BEGIN GITEA CONFIGURATION ====' - - { # try - gitea migrate - } || { # catch - echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds" - exit 1 - } - - {{- if include "valkey.servicename" . }} - function test_valkey_connection() { - local RETRY=0 - local MAX=30 - - echo 'Wait for valkey to become avialable...' - until [ "${RETRY}" -ge "${MAX}" ]; do - RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break - RETRY=$[${RETRY}+1] - echo "...not ready yet (${RETRY}/${MAX})" - done - - if [ "${RETRY}" -ge "${MAX}" ]; then - echo "Valkey not reachable after '${MAX}' attempts!" - exit 1 + echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..." + gitea admin user create "${create_args[@]}" + echo '...created.' + else + if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then + echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..." + # See https://gitea.com/gitea/helm-gitea/issues/673 + # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior + # which acted as if it were provided with =false. If the argument is present in this version of gitea, then we + # should add it to prevent requiring frequent admin password resets. + local -a change_args + change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}") + if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then + change_args+=(--must-change-password=false) fi - } - - test_valkey_connection - {{- end }} - - - {{- if .Values.secrets.admin.enabled }} - function configure_admin_user() { - local full_admin_list=$(gitea admin user list --admin) - local actual_user_table='' - - # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line - local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)" - if [[ "${full_admin_list}" =~ $regex ]]; then - actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline - else - # This code block should never be reached, as long as the output table header remains the same. - # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. - - echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users." - echo " Please review the output of 'gitea admin user list --admin' shown below." - echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." - echo "DEBUG: Output of 'gitea admin user list --admin'" - echo "--" - echo "${full_admin_list}" - echo "--" - exit 1 - fi - - local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}") - if [[ -z "${ACCOUNT_ID}" ]]; then - local -a create_args - create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}") - if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then - create_args+=(--must-change-password=true) - else - create_args+=(--must-change-password=false) - fi - echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..." - gitea admin user create "${create_args[@]}" - echo '...created.' - else - if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then - echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..." - # See https://gitea.com/gitea/helm-gitea/issues/673 - # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior - # which acted as if it were provided with =false. If the argument is present in this version of gitea, then we - # should add it to prevent requiring frequent admin password resets. - local -a change_args - change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}") - if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then - change_args+=(--must-change-password=false) - fi - gitea admin user change-password "${change_args[@]}" - echo '...password sync done.' - else - echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping." - fi - fi - } - - configure_admin_user - {{- end }} - - function configure_ldap() { - {{- if .Values.gitea.ldap }} - {{- range $idx, $value := .Values.gitea.ldap }} - local LDAP_NAME={{ (printf "%s" $value.name) | squote }} - local full_auth_list=$(gitea admin auth list --vertical-bars) - local actual_auth_table='' - - # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line - local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)" - if [[ "${full_auth_list}" =~ $regex ]]; then - actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline - else - # This code block should never be reached, as long as the output table header remains the same. - # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. - - echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources." - echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below." - echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." - echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'" - echo "--" - echo "${full_auth_list}" - echo "--" - exit 1 - fi - - local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}") - - if [[ -z "${GITEA_AUTH_ID}" ]]; then - echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..." - gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }} - echo '...installed.' - else - echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..." - gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }} - echo '...sync settings done.' - fi - {{- end }} - {{- else }} - echo 'no ldap configuration... skipping.' - {{- end }} - } - - configure_ldap - - function configure_oauth() { - {{- if .Values.gitea.oauth }} - {{- range $idx, $value := .Values.gitea.oauth }} - local OAUTH_NAME={{ (printf "%s" $value.name) | squote }} - local full_auth_list=$(gitea admin auth list --vertical-bars) - local actual_auth_table='' - - # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line - local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)" - if [[ "${full_auth_list}" =~ $regex ]]; then - actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline - else - # This code block should never be reached, as long as the output table header remains the same. - # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. - - echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources." - echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below." - echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." - echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'" - echo "--" - echo "${full_auth_list}" - echo "--" - exit 1 - fi - - local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}") - - if [[ -z "${AUTH_ID}" ]]; then - echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..." - gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }} - echo '...installed.' - else - echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..." - gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }} - echo '...sync settings done.' - fi - {{- end }} - {{- else }} - echo 'no oauth configuration... skipping.' - {{- end }} - } - - configure_oauth - - echo '==== END GITEA CONFIGURATION ====' + gitea admin user change-password "${change_args[@]}" + echo '...password sync done.' + else + echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping." + fi + fi +} + +configure_admin_user +{{- end }} + +function configure_ldap() { + {{- if .Values.gitea.ldap }} + {{- range $idx, $value := .Values.gitea.ldap }} + local LDAP_NAME={{ (printf "%s" $value.name) | squote }} + local full_auth_list=$(gitea admin auth list --vertical-bars) + local actual_auth_table='' + + # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line + local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)" + if [[ "${full_auth_list}" =~ $regex ]]; then + actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline + else + # This code block should never be reached, as long as the output table header remains the same. + # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. + + echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources." + echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below." + echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." + echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'" + echo "--" + echo "${full_auth_list}" + echo "--" + exit 1 + fi + + local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}") + + if [[ -z "${GITEA_AUTH_ID}" ]]; then + echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..." + gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }} + echo '...installed.' + else + echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..." + gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }} + echo '...sync settings done.' + fi + {{- end }} + {{- else }} + echo 'no ldap configuration... skipping.' + {{- end }} +} + +configure_ldap + +function configure_oauth() { + {{- if .Values.gitea.oauth }} + {{- range $idx, $value := .Values.gitea.oauth }} + local OAUTH_NAME={{ (printf "%s" $value.name) | squote }} + local full_auth_list=$(gitea admin auth list --vertical-bars) + local actual_auth_table='' + + # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line + local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)" + if [[ "${full_auth_list}" =~ $regex ]]; then + actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline + else + # This code block should never be reached, as long as the output table header remains the same. + # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. + + echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources." + echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below." + echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." + echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'" + echo "--" + echo "${full_auth_list}" + echo "--" + exit 1 + fi + + local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}") + + if [[ -z "${AUTH_ID}" ]]; then + echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..." + gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }} + echo '...installed.' + else + echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..." + gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }} + echo '...sync settings done.' + fi + {{- end }} + {{- else }} + echo 'no oauth configuration... skipping.' + {{- end }} +} + +configure_oauth + +echo '==== END GITEA CONFIGURATION ====' {{- end }} diff --git a/unittests/helm/config/config-environment-script.yaml b/unittests/helm/config/config-environment-script.yaml index 28a1e5d..03bf2f8 100644 --- a/unittests/helm/config/config-environment-script.yaml +++ b/unittests/helm/config/config-environment-script.yaml @@ -11,5 +11,15 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData["config_environment.sh"] + path: data["config_environment.sh"] + decodeBase64: true pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI' + - it: renders data, not stringData, so removed keys are pruned on upgrade + template: templates/secret_config.yaml + asserts: + - documentIndex: 0 + notExists: + path: stringData + - documentIndex: 0 + exists: + path: data["config_environment.sh"] diff --git a/unittests/helm/dependency-checks/customization-integrity-valkey.yaml b/unittests/helm/dependency-checks/customization-integrity-valkey.yaml index 4b32674..696fad4 100644 --- a/unittests/helm/dependency-checks/customization-integrity-valkey.yaml +++ b/unittests/helm/dependency-checks/customization-integrity-valkey.yaml @@ -39,7 +39,8 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData["configure_gitea.sh"] + path: data["configure_gitea.sh"] + decodeBase64: true pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379 - it: "[gitea] waits for valkey to be up and running with custom cluster domain" set: @@ -48,5 +49,6 @@ tests: asserts: - documentIndex: 0 matchRegex: - path: stringData["configure_gitea.sh"] + path: data["configure_gitea.sh"] + decodeBase64: true pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379 diff --git a/unittests/helm/init/init_directory_structure.sh-rootless.yaml b/unittests/helm/init/init_directory_structure.sh-rootless.yaml index 48eaf7e..915bfd8 100644 --- a/unittests/helm/init/init_directory_structure.sh-rootless.yaml +++ b/unittests/helm/init/init_directory_structure.sh-rootless.yaml @@ -14,7 +14,8 @@ tests: -----END PGP PRIVATE KEY BLOCK----- asserts: - equal: - path: stringData["configure_gpg_environment.sh"] + path: data["configure_gpg_environment.sh"] + decodeBase64: true value: | #!/usr/bin/env bash set -eu @@ -23,7 +24,8 @@ tests: - it: skips gpg script block for disabled signing asserts: - equal: - path: stringData["init_directory_structure.sh"] + path: data["init_directory_structure.sh"] + decodeBase64: true value: |- #!/usr/bin/env bash @@ -44,7 +46,8 @@ tests: -----END PGP PRIVATE KEY BLOCK----- asserts: - equal: - path: stringData["init_directory_structure.sh"] + path: data["init_directory_structure.sh"] + decodeBase64: true value: |- #!/usr/bin/env bash @@ -68,7 +71,8 @@ tests: deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.20.5 asserts: - equal: - path: stringData["init_directory_structure.sh"] + path: data["init_directory_structure.sh"] + decodeBase64: true value: |- #!/usr/bin/env bash @@ -80,3 +84,9 @@ tests: # prepare temp directory structure mkdir -pv "${GITEA_TEMP}" chmod -v ug+rwx "${GITEA_TEMP}" + - it: renders data, not stringData, so removed keys are pruned on upgrade + asserts: + - notExists: + path: stringData + - exists: + path: data["init_directory_structure.sh"] diff --git a/unittests/helm/init/init_directory_structure.sh.yaml b/unittests/helm/init/init_directory_structure.sh.yaml index cc67bf6..c819cd9 100644 --- a/unittests/helm/init/init_directory_structure.sh.yaml +++ b/unittests/helm/init/init_directory_structure.sh.yaml @@ -15,7 +15,8 @@ tests: -----END PGP PRIVATE KEY BLOCK----- asserts: - equal: - path: stringData["configure_gpg_environment.sh"] + path: data["configure_gpg_environment.sh"] + decodeBase64: true value: | #!/usr/bin/env bash set -eu @@ -26,7 +27,8 @@ tests: deployment.gitea.image.rootless: false asserts: - equal: - path: stringData["init_directory_structure.sh"] + path: data["init_directory_structure.sh"] + decodeBase64: true value: |- #!/usr/bin/env bash @@ -50,7 +52,8 @@ tests: -----END PGP PRIVATE KEY BLOCK----- asserts: - equal: - path: stringData["init_directory_structure.sh"] + path: data["init_directory_structure.sh"] + decodeBase64: true value: |- #!/usr/bin/env bash @@ -70,3 +73,11 @@ tests: chmod -v 700 "${GNUPGHOME}" chown -v 1000:1000 "${GNUPGHOME}" fi + - it: renders data, not stringData, so removed keys are pruned on upgrade + set: + deployment.gitea.image.rootless: false + asserts: + - notExists: + path: stringData + - exists: + path: data["init_directory_structure.sh"]