volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 2 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix(secrets): render config and init secrets as data to prune removed keys

Browse Source 
Both Secrets rendered their payload via `stringData`. That field is write-only: the API server decodes it into
`data` and does not persist `stringData` itself. Helm's three-way merge therefore generates a deletion patch
that targets `stringData`, while the live object only ever carries `data` - so a key that disappears from the
rendered manifest is never pruned and survives every upgrade.

Unlike the inline-config Secret fixed in #1110, the keys here are driven by the files in
`scripts/init-containers/**` rather than by user values, so the bug is latent rather than acute. It still
bites whenever a script is removed or renamed in the chart: the stale key stays in the Secret and keeps being
mounted into the init containers.

The two inline scripts of the init Secret were YAML block scalars and had to be moved into `define` blocks to
be pipeable through `b64enc`. The bodies are dedented by four columns accordingly, and `trimAll "\n"`
reproduces the chomping semantics of the previous `|-` scalars. Rendering was diffed against the previous
revision for defaults, rootless, initPreScript, GPG, admin, LDAP, OAuth and all valkey variants - the decoded
payloads are byte-identical, so no init script changes behaviour.

Unit tests now read the payloads from `data.*` with `decodeBase64: true` and assert that `stringData` no
longer exists, to catch a regression early.

See: https://gitea.com/gitea/helm-gitea/issues/1109
See: https://gitea.com/gitea/helm-gitea/pulls/1110

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-10-03 17:34:48 +02:00
co-authored by Copilot
parent 6025d82333
commit 64c2f1a9cc
6 changed files with 269 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files
templates/secret_config.yaml
+3 -4
View File
@@ -14,10 +14,9 @@ metadata:
name: {{ include "gitea.secret.config.name" . }} name: {{ include "gitea.secret.config.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
stringData: data:
{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }} {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
assertions: | assertions: {{ $assertions | b64enc | quote }}
{{- $assertions | nindent 4 }}
{{- end }} {{- end }}
{{- define "gitea.config.assertions" -}} {{- define "gitea.config.assertions" -}}
templates/secret_init.yaml
+223 -218
View File
@@ -11,224 +11,229 @@ metadata:
name: {{ include "gitea.secret.init.name" . }} name: {{ include "gitea.secret.init.name" . }}
namespace: {{ .Values.namespace | default .Release.Namespace }} namespace: {{ .Values.namespace | default .Release.Namespace }}
type: Opaque type: Opaque
stringData: data:
{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }} {{ (.Files.Glob "scripts/init-containers/init/*.sh").AsSecrets | indent 2 }}
init_directory_structure.sh: |- configure_gitea.sh: {{ include "gitea.init.configureGitea" . | trimAll "\n" | b64enc | quote }}
#!/usr/bin/env bash init_directory_structure.sh: {{ include "gitea.init.initDirectoryStructure" . | trimAll "\n" | b64enc | quote }}
{{- end }}
set -euo pipefail
{{- define "gitea.init.initDirectoryStructure" -}}
{{- if .Values.initPreScript }} #!/usr/bin/env bash
# BEGIN: initPreScript
{{- with .Values.initPreScript -}} set -euo pipefail
{{ . | nindent 4}}
{{- end -}} {{- if .Values.initPreScript }}
# END: initPreScript # BEGIN: initPreScript
{{- end }} {{- with .Values.initPreScript -}}
{{ . | nindent 0 }}
{{- if not .Values.deployment.gitea.image.rootless }} {{- end -}}
chown -v 1000:1000 /data # END: initPreScript
{{- end }} {{- end }}
mkdir -pv /data/git/.ssh
chmod -Rv 700 /data/git/.ssh {{- if not .Values.deployment.gitea.image.rootless }}
[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf chown -v 1000:1000 /data
{{- end }}
# prepare temp directory structure mkdir -pv /data/git/.ssh
mkdir -pv "${GITEA_TEMP}" chmod -Rv 700 /data/git/.ssh
{{- if not .Values.deployment.gitea.image.rootless }} [ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
chown -v 1000:1000 "${GITEA_TEMP}"
{{- end }} # prepare temp directory structure
chmod -v ug+rwx "${GITEA_TEMP}" mkdir -pv "${GITEA_TEMP}"
{{- if not .Values.deployment.gitea.image.rootless }}
{{ if .Values.secrets.gpg.enabled -}} chown -v 1000:1000 "${GITEA_TEMP}"
if [ ! -d "${GNUPGHOME}" ]; then {{- end }}
mkdir -pv "${GNUPGHOME}" chmod -v ug+rwx "${GITEA_TEMP}"
chmod -v 700 "${GNUPGHOME}"
chown -v 1000:1000 "${GNUPGHOME}" {{ if .Values.secrets.gpg.enabled -}}
if [ ! -d "${GNUPGHOME}" ]; then
mkdir -pv "${GNUPGHOME}"
chmod -v 700 "${GNUPGHOME}"
chown -v 1000:1000 "${GNUPGHOME}"
fi
{{- end }}
{{- end }}
{{- define "gitea.init.configureGitea" -}}
#!/usr/bin/env bash
set -euo pipefail
echo '==== BEGIN GITEA CONFIGURATION ===='
{ # try
gitea migrate
} || { # catch
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
exit 1
}
{{- if include "valkey.servicename" . }}
function test_valkey_connection() {
local RETRY=0
local MAX=30
echo 'Wait for valkey to become avialable...'
until [ "${RETRY}" -ge "${MAX}" ]; do
RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
RETRY=$[${RETRY}+1]
echo "...not ready yet (${RETRY}/${MAX})"
done
if [ "${RETRY}" -ge "${MAX}" ]; then
echo "Valkey not reachable after '${MAX}' attempts!"
exit 1
fi
}
test_valkey_connection
{{- end }}
{{- if .Values.secrets.admin.enabled }}
function configure_admin_user() {
local full_admin_list=$(gitea admin user list --admin)
local actual_user_table=''
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
if [[ "${full_admin_list}" =~ $regex ]]; then
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
else
# This code block should never be reached, as long as the output table header remains the same.
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
echo " Please review the output of 'gitea admin user list --admin' shown below."
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
echo "DEBUG: Output of 'gitea admin user list --admin'"
echo "--"
echo "${full_admin_list}"
echo "--"
exit 1
fi
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
if [[ -z "${ACCOUNT_ID}" ]]; then
local -a create_args
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
create_args+=(--must-change-password=true)
else
create_args+=(--must-change-password=false)
fi fi
{{- end }} echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
gitea admin user create "${create_args[@]}"
configure_gitea.sh: |- echo '...created.'
#!/usr/bin/env bash else
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
set -euo pipefail echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
# See https://gitea.com/gitea/helm-gitea/issues/673
echo '==== BEGIN GITEA CONFIGURATION ====' # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
{ # try # should add it to prevent requiring frequent admin password resets.
gitea migrate local -a change_args
} || { # catch change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds" if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
exit 1 change_args+=(--must-change-password=false)
}
{{- if include "valkey.servicename" . }}
function test_valkey_connection() {
local RETRY=0
local MAX=30
echo 'Wait for valkey to become avialable...'
until [ "${RETRY}" -ge "${MAX}" ]; do
RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
RETRY=$[${RETRY}+1]
echo "...not ready yet (${RETRY}/${MAX})"
done
if [ "${RETRY}" -ge "${MAX}" ]; then
echo "Valkey not reachable after '${MAX}' attempts!"
exit 1
fi fi
} gitea admin user change-password "${change_args[@]}"
echo '...password sync done.'
test_valkey_connection else
{{- end }} echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
fi
fi
{{- if .Values.secrets.admin.enabled }} }
function configure_admin_user() {
local full_admin_list=$(gitea admin user list --admin) configure_admin_user
local actual_user_table='' {{- end }}
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line function configure_ldap() {
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)" {{- if .Values.gitea.ldap }}
if [[ "${full_admin_list}" =~ $regex ]]; then {{- range $idx, $value := .Values.gitea.ldap }}
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
else local full_auth_list=$(gitea admin auth list --vertical-bars)
# This code block should never be reached, as long as the output table header remains the same. local actual_auth_table=''
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users." local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
echo " Please review the output of 'gitea admin user list --admin' shown below." if [[ "${full_auth_list}" =~ $regex ]]; then
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues." actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
echo "DEBUG: Output of 'gitea admin user list --admin'" else
echo "--" # This code block should never be reached, as long as the output table header remains the same.
echo "${full_admin_list}" # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
echo "--"
exit 1 echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
fi echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}") echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
if [[ -z "${ACCOUNT_ID}" ]]; then echo "--"
local -a create_args echo "${full_auth_list}"
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}") echo "--"
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then exit 1
create_args+=(--must-change-password=true) fi
else
create_args+=(--must-change-password=false) local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}")
fi
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..." if [[ -z "${GITEA_AUTH_ID}" ]]; then
gitea admin user create "${create_args[@]}" echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
echo '...created.' gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
else echo '...installed.'
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then else
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..." echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
# See https://gitea.com/gitea/helm-gitea/issues/673 gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior echo '...sync settings done.'
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we fi
# should add it to prevent requiring frequent admin password resets. {{- end }}
local -a change_args {{- else }}
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}") echo 'no ldap configuration... skipping.'
if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then {{- end }}
change_args+=(--must-change-password=false) }
fi
gitea admin user change-password "${change_args[@]}" configure_ldap
echo '...password sync done.'
else function configure_oauth() {
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping." {{- if .Values.gitea.oauth }}
fi {{- range $idx, $value := .Values.gitea.oauth }}
fi local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
} local full_auth_list=$(gitea admin auth list --vertical-bars)
local actual_auth_table=''
configure_admin_user
{{- end }} # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
function configure_ldap() { if [[ "${full_auth_list}" =~ $regex ]]; then
{{- if .Values.gitea.ldap }} actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
{{- range $idx, $value := .Values.gitea.ldap }} else
local LDAP_NAME={{ (printf "%s" $value.name) | squote }} # This code block should never be reached, as long as the output table header remains the same.
local full_auth_list=$(gitea admin auth list --vertical-bars) # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
local actual_auth_table=''
echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)" echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
if [[ "${full_auth_list}" =~ $regex ]]; then echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline echo "--"
else echo "${full_auth_list}"
# This code block should never be reached, as long as the output table header remains the same. echo "--"
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script. exit 1
fi
echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below." local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}")
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'" if [[ -z "${AUTH_ID}" ]]; then
echo "--" echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
echo "${full_auth_list}" gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
echo "--" echo '...installed.'
exit 1 else
fi echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}") echo '...sync settings done.'
fi
if [[ -z "${GITEA_AUTH_ID}" ]]; then {{- end }}
echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..." {{- else }}
gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }} echo 'no oauth configuration... skipping.'
echo '...installed.' {{- end }}
else }
echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }} configure_oauth
echo '...sync settings done.'
fi echo '==== END GITEA CONFIGURATION ===='
{{- end }}
{{- else }}
echo 'no ldap configuration... skipping.'
{{- end }}
}
configure_ldap
function configure_oauth() {
{{- if .Values.gitea.oauth }}
{{- range $idx, $value := .Values.gitea.oauth }}
local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
local full_auth_list=$(gitea admin auth list --vertical-bars)
local actual_auth_table=''
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
if [[ "${full_auth_list}" =~ $regex ]]; then
actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
else
# This code block should never be reached, as long as the output table header remains the same.
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
echo "--"
echo "${full_auth_list}"
echo "--"
exit 1
fi
local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}")
if [[ -z "${AUTH_ID}" ]]; then
echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
echo '...installed.'
else
echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
echo '...sync settings done.'
fi
{{- end }}
{{- else }}
echo 'no oauth configuration... skipping.'
{{- end }}
}
configure_oauth
echo '==== END GITEA CONFIGURATION ===='
{{- end }} {{- end }}
unittests/helm/config/config-environment-script.yaml
+11 -1
View File
@@ -11,5 +11,15 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData["config_environment.sh"] path: data["config_environment.sh"]
decodeBase64: true
pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI' pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
- it: renders data, not stringData, so removed keys are pruned on upgrade
template: templates/secret_config.yaml
asserts:
- documentIndex: 0
notExists:
path: stringData
- documentIndex: 0
exists:
path: data["config_environment.sh"]
unittests/helm/dependency-checks/customization-integrity-valkey.yaml
+4 -2
View File
@@ -39,7 +39,8 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData["configure_gitea.sh"] path: data["configure_gitea.sh"]
decodeBase64: true
pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379 pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
- it: "[gitea] waits for valkey to be up and running with custom cluster domain" - it: "[gitea] waits for valkey to be up and running with custom cluster domain"
set: set:
@@ -48,5 +49,6 @@ tests:
asserts: asserts:
- documentIndex: 0 - documentIndex: 0
matchRegex: matchRegex:
path: stringData["configure_gitea.sh"] path: data["configure_gitea.sh"]
decodeBase64: true
pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379 pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379
unittests/helm/init/init_directory_structure.sh-rootless.yaml
+14 -4
View File
@@ -14,7 +14,8 @@ tests:
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
asserts: asserts:
- equal: - equal:
path: stringData["configure_gpg_environment.sh"] path: data["configure_gpg_environment.sh"]
decodeBase64: true
value: | value: |
#!/usr/bin/env bash #!/usr/bin/env bash
set -eu set -eu
@@ -23,7 +24,8 @@ tests:
- it: skips gpg script block for disabled signing - it: skips gpg script block for disabled signing
asserts: asserts:
- equal: - equal:
path: stringData["init_directory_structure.sh"] path: data["init_directory_structure.sh"]
decodeBase64: true
value: |- value: |-
#!/usr/bin/env bash #!/usr/bin/env bash
@@ -44,7 +46,8 @@ tests:
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
asserts: asserts:
- equal: - equal:
path: stringData["init_directory_structure.sh"] path: data["init_directory_structure.sh"]
decodeBase64: true
value: |- value: |-
#!/usr/bin/env bash #!/usr/bin/env bash
@@ -68,7 +71,8 @@ tests:
deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.20.5 deployment.gitea.image.fullOverride: docker.gitea.com/gitea:1.20.5
asserts: asserts:
- equal: - equal:
path: stringData["init_directory_structure.sh"] path: data["init_directory_structure.sh"]
decodeBase64: true
value: |- value: |-
#!/usr/bin/env bash #!/usr/bin/env bash
@@ -80,3 +84,9 @@ tests:
# prepare temp directory structure # prepare temp directory structure
mkdir -pv "${GITEA_TEMP}" mkdir -pv "${GITEA_TEMP}"
chmod -v ug+rwx "${GITEA_TEMP}" chmod -v ug+rwx "${GITEA_TEMP}"
- it: renders data, not stringData, so removed keys are pruned on upgrade
asserts:
- notExists:
path: stringData
- exists:
path: data["init_directory_structure.sh"]
unittests/helm/init/init_directory_structure.sh.yaml
+14 -3
View File
@@ -15,7 +15,8 @@ tests:
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
asserts: asserts:
- equal: - equal:
path: stringData["configure_gpg_environment.sh"] path: data["configure_gpg_environment.sh"]
decodeBase64: true
value: | value: |
#!/usr/bin/env bash #!/usr/bin/env bash
set -eu set -eu
@@ -26,7 +27,8 @@ tests:
deployment.gitea.image.rootless: false deployment.gitea.image.rootless: false
asserts: asserts:
- equal: - equal:
path: stringData["init_directory_structure.sh"] path: data["init_directory_structure.sh"]
decodeBase64: true
value: |- value: |-
#!/usr/bin/env bash #!/usr/bin/env bash
@@ -50,7 +52,8 @@ tests:
-----END PGP PRIVATE KEY BLOCK----- -----END PGP PRIVATE KEY BLOCK-----
asserts: asserts:
- equal: - equal:
path: stringData["init_directory_structure.sh"] path: data["init_directory_structure.sh"]
decodeBase64: true
value: |- value: |-
#!/usr/bin/env bash #!/usr/bin/env bash
@@ -70,3 +73,11 @@ tests:
chmod -v 700 "${GNUPGHOME}" chmod -v 700 "${GNUPGHOME}"
chown -v 1000:1000 "${GNUPGHOME}" chown -v 1000:1000 "${GNUPGHOME}"
fi fi
- it: renders data, not stringData, so removed keys are pruned on upgrade
set:
deployment.gitea.image.rootless: false
asserts:
- notExists:
path: stringData
- exists:
path: data["init_directory_structure.sh"]