From 6deb39df15d72fe0c4ea84c8d545c872d16f5938 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Sun, 13 Sep 2026 19:22:33 +0200 Subject: [PATCH] refactor!: move `openshift.hostUsers` to `deployment.hostUsers` The PodSpec `hostUsers` field has nothing to do with the OpenShift compatibility profile. It only selects whether the pod shares the host's user namespace, which is a plain Kubernetes feature. Nesting it below `openshift` implied that it requires OpenShift and, worse, the helper only rendered it when `openshift.enabled` evaluated to `true`, so the setting was silently ignored on vanilla Kubernetes clusters. `gitea.hostUsers` now reads `deployment.hostUsers` and no longer depends on the OpenShift profile. The value is only rendered when it is an actual boolean, so the field stays omitted for `null` and the platform default applies. BREAKING CHANGE: `openshift.hostUsers` has been removed. Configure `deployment.hostUsers` instead. Co-authored-by: Copilot --- README.md | 11 +++++++---- templates/_helpers.tpl | 8 +++----- templates/gitea/deprecation.yaml | 5 +++++ unittests/helm/deployment/deprecations.yaml | 6 ++++++ unittests/helm/deployment/openshift.yaml | 3 ++- unittests/helm/tests/test-http-connection.yaml | 1 + values.yaml | 11 ++++++----- 7 files changed, 30 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index e75be0d..494eefe 100644 --- a/README.md +++ b/README.md @@ -289,15 +289,18 @@ openshift: ``` When enabled, the chart applies `allowPrivilegeEscalation: false`, drops all -Linux capabilities, sets `runAsNonRoot: true`, uses -`seccompProfile.type: RuntimeDefault`, and leaves `hostUsers` unset unless -`openshift.hostUsers` is explicitly overridden. +Linux capabilities, sets `runAsNonRoot: true` and uses +`seccompProfile.type: RuntimeDefault`. The deployment keeps the existing vanilla Kubernetes behavior when OpenShift compatibility is disabled. Auto-detection relies on the `security.openshift.io/v1/SecurityContextConstraints` API, so set `openshift.enabled: true` explicitly when rendering outside a live cluster. +The PodSpec `hostUsers` field is independent of the OpenShift profile and is only +rendered when `deployment.hostUsers` is set to a boolean. When left unset, the +field is omitted so the platform default applies. + If you also want to expose Gitea through an OpenShift Route, enable the optional Route resource: ```yaml @@ -1042,6 +1045,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` | | `deployment.gitea.securityContext` | Security context of the Gitea container. Used as fallback for the chart-managed init containers. | `{}` | | `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` | +| `deployment.hostUsers` | Use the host's user namespace. When unset, the field is omitted so the platform default is used. | `nil` | | `deployment.initContainers` | List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. | `[]` | | `deployment.initDirectories.env` | Additional environment variables to pass to the init container. | `[]` | | `deployment.initDirectories.envFrom` | List of environment variables mounted from configMaps or secrets for the initDirectories container. | `[]` | @@ -1165,7 +1169,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | Name | Description | Value | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ----- | | `openshift.enabled` | Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API. | `nil` | -| `openshift.hostUsers` | Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used. | `nil` | | `podDisruptionBudget` | Pod disruption budget | `{}` | ### Route diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 7e38fdf..8699f30 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -101,13 +101,11 @@ false {{- end -}} {{/* -Return the pod's hostUsers setting when OpenShift compatibility is enabled. +Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean. */}} {{- define "gitea.hostUsers" -}} -{{- if eq (include "gitea.openshift.enabled" . | trim) "true" -}} -{{- if kindIs "bool" .Values.openshift.hostUsers -}} -{{ ternary "true" "false" .Values.openshift.hostUsers }} -{{- end -}} +{{- if kindIs "bool" .Values.deployment.hostUsers -}} +{{ ternary "true" "false" .Values.deployment.hostUsers }} {{- end -}} {{- end -}} diff --git a/templates/gitea/deprecation.yaml b/templates/gitea/deprecation.yaml index d244808..915f2ca 100644 --- a/templates/gitea/deprecation.yaml +++ b/templates/gitea/deprecation.yaml @@ -75,6 +75,11 @@ {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}} {{- end -}} + {{/* OPENSHIFT HOST USERS */}} + {{- if hasKey .Values.openshift "hostUsers" -}} + {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}} + {{- end -}} + {{/* PRIORITY CLASS NAME */}} {{- if .Values.priorityClassName -}} {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}} diff --git a/unittests/helm/deployment/deprecations.yaml b/unittests/helm/deployment/deprecations.yaml index 42be631..ac555c6 100644 --- a/unittests/helm/deployment/deprecations.yaml +++ b/unittests/helm/deployment/deprecations.yaml @@ -70,6 +70,12 @@ tests: asserts: - failedTemplate: errorMessage: "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." + - it: fails when the removed `openshift.hostUsers` value is set + set: + openshift.hostUsers: false + asserts: + - failedTemplate: + errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." - it: fails when the removed `priorityClassName` value is set set: priorityClassName: high-priority diff --git a/unittests/helm/deployment/openshift.yaml b/unittests/helm/deployment/openshift.yaml index c39b9f9..07f0873 100644 --- a/unittests/helm/deployment/openshift.yaml +++ b/unittests/helm/deployment/openshift.yaml @@ -79,8 +79,8 @@ tests: set: openshift: enabled: true - hostUsers: true deployment: + hostUsers: true securityContext: fsGroup: 1000620000 gitea: @@ -107,6 +107,7 @@ tests: set: openshift: enabled: true + deployment: hostUsers: false asserts: - equal: diff --git a/unittests/helm/tests/test-http-connection.yaml b/unittests/helm/tests/test-http-connection.yaml index 52a94d1..24b3fd1 100644 --- a/unittests/helm/tests/test-http-connection.yaml +++ b/unittests/helm/tests/test-http-connection.yaml @@ -26,6 +26,7 @@ tests: set: openshift: enabled: true + deployment: hostUsers: false asserts: - equal: diff --git a/values.yaml b/values.yaml index 29214a6..6026615 100644 --- a/values.yaml +++ b/values.yaml @@ -133,6 +133,9 @@ deployment: # mountPath: /configmap # readOnly: true + ## @param deployment.hostUsers Use the host's user namespace. When unset, the field is omitted so the platform default is used. + hostUsers: ~ + ## @param deployment.initContainers [array] List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. initContainers: # - container: @@ -609,25 +612,23 @@ ingress: ## @param namespace An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified namespace: "" + ## @section Network ## @param clusterDomain Domain of the Cluster. Domain is part of internally issued certificates. clusterDomain: cluster.local + ## @section Image ## @param imagePullSecrets Secret to use for pulling the image imagePullSecrets: [] + ## @section Security # Security context is only usable with rootless image due to image design ## @param openshift.enabled Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API. -## @param openshift.hostUsers Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used. openshift: enabled: null - hostUsers: null -## @deprecated The securityContext variable has been split two: -## - deployment.gitea.securityContext -## - deployment.securityContext. ## @param podDisruptionBudget Pod disruption budget podDisruptionBudget: {}