volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

refactor!: move openshift.hostUsers to deployment.hostUsers

Browse Source 
The PodSpec `hostUsers` field has nothing to do with the OpenShift compatibility profile. It only selects whether the
pod shares the host's user namespace, which is a plain Kubernetes feature. Nesting it below `openshift` implied that it
requires OpenShift and, worse, the helper only rendered it when `openshift.enabled` evaluated to `true`, so the setting
was silently ignored on vanilla Kubernetes clusters.

`gitea.hostUsers` now reads `deployment.hostUsers` and no longer depends on the OpenShift profile. The value is only
rendered when it is an actual boolean, so the field stays omitted for `null` and the platform default applies.

BREAKING CHANGE: `openshift.hostUsers` has been removed. Configure `deployment.hostUsers` instead.

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
volker.raschek
2026-09-13 19:22:33 +02:00
co-authored by Copilot
parent cc99cada4d
commit 6deb39df15
7 changed files with 30 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -4
View File
@@ -289,15 +289,18 @@ openshift:
```
When enabled, the chart applies `allowPrivilegeEscalation: false`, drops all
Linux capabilities, sets `runAsNonRoot: true`, uses
`seccompProfile.type: RuntimeDefault`, and leaves `hostUsers` unset unless
`openshift.hostUsers` is explicitly overridden.
Linux capabilities, sets `runAsNonRoot: true` and uses
`seccompProfile.type: RuntimeDefault`.
The deployment keeps the existing vanilla Kubernetes behavior when OpenShift
compatibility is disabled. Auto-detection relies on the
`security.openshift.io/v1/SecurityContextConstraints` API, so set
`openshift.enabled: true` explicitly when rendering outside a live cluster.
The PodSpec `hostUsers` field is independent of the OpenShift profile and is only
rendered when `deployment.hostUsers` is set to a boolean. When left unset, the
field is omitted so the platform default applies.
If you also want to expose Gitea through an OpenShift Route, enable the optional Route resource:
```yaml
@@ -1042,6 +1045,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` |
| `deployment.gitea.securityContext` | Security context of the Gitea container. Used as fallback for the chart-managed init containers. | `{}` |
| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` |
| `deployment.hostUsers` | Use the host's user namespace. When unset, the field is omitted so the platform default is used. | `nil` |
| `deployment.initContainers` | List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. | `[]` |
| `deployment.initDirectories.env` | Additional environment variables to pass to the init container. | `[]` |
| `deployment.initDirectories.envFrom` | List of environment variables mounted from configMaps or secrets for the initDirectories container. | `[]` |
@@ -1165,7 +1169,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
| Name | Description | Value |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ----- |
| `openshift.enabled` | Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API. | `nil` |
| `openshift.hostUsers` | Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used. | `nil` |
| `podDisruptionBudget` | Pod disruption budget | `{}` |
### Route
templates/_helpers.tpl
+3 -5
View File
@@ -101,13 +101,11 @@ false
{{- end -}}
{{/*
Return the pod's hostUsers setting when OpenShift compatibility is enabled.
Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean.
*/}}
{{- define "gitea.hostUsers" -}}
{{- if eq (include "gitea.openshift.enabled" . | trim) "true" -}}
{{- if kindIs "bool" .Values.openshift.hostUsers -}}
{{ ternary "true" "false" .Values.openshift.hostUsers }}
{{- end -}}
{{- if kindIs "bool" .Values.deployment.hostUsers -}}
{{ ternary "true" "false" .Values.deployment.hostUsers }}
{{- end -}}
{{- end -}}
templates/gitea/deprecation.yaml
+5
View File
@@ -75,6 +75,11 @@
{{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}
{{- end -}}
{{/* OPENSHIFT HOST USERS */}}
{{- if hasKey .Values.openshift "hostUsers" -}}
{{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
{{- end -}}
{{/* PRIORITY CLASS NAME */}}
{{- if .Values.priorityClassName -}}
{{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}
unittests/helm/deployment/deprecations.yaml
+6
View File
@@ -70,6 +70,12 @@ tests:
asserts:
- failedTemplate:
errorMessage: "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead."
- it: fails when the removed `openshift.hostUsers` value is set
set:
openshift.hostUsers: false
asserts:
- failedTemplate:
errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead."
- it: fails when the removed `priorityClassName` value is set
set:
priorityClassName: high-priority
unittests/helm/deployment/openshift.yaml
+2 -1
View File
@@ -79,8 +79,8 @@ tests:
set:
openshift:
enabled: true
hostUsers: true
deployment:
hostUsers: true
securityContext:
fsGroup: 1000620000
gitea:
@@ -107,6 +107,7 @@ tests:
set:
openshift:
enabled: true
deployment:
hostUsers: false
asserts:
- equal:
unittests/helm/tests/test-http-connection.yaml
+1
View File
@@ -26,6 +26,7 @@ tests:
set:
openshift:
enabled: true
deployment:
hostUsers: false
asserts:
- equal:
values.yaml
+6 -5
View File
@@ -133,6 +133,9 @@ deployment:
# mountPath: /configmap
# readOnly: true
## @param deployment.hostUsers Use the host's user namespace. When unset, the field is omitted so the platform default is used.
hostUsers: ~
## @param deployment.initContainers [array] List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration.
initContainers:
# - container:
@@ -609,25 +612,23 @@ ingress:
## @param namespace An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified
namespace: ""
## @section Network
## @param clusterDomain Domain of the Cluster. Domain is part of internally issued certificates.
clusterDomain: cluster.local
## @section Image
## @param imagePullSecrets Secret to use for pulling the image
imagePullSecrets: []
## @section Security
# Security context is only usable with rootless image due to image design
## @param openshift.enabled Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API.
## @param openshift.hostUsers Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used.
openshift:
enabled: null
hostUsers: null
## @deprecated The securityContext variable has been split two:
## - deployment.gitea.securityContext
## - deployment.securityContext.
## @param podDisruptionBudget Pod disruption budget
podDisruptionBudget: {}