From 7747a001f73f55cef0e2ae689686e054198f568a Mon Sep 17 00:00:00 2001 From: Todd Marimon Date: Sun, 19 Jul 2026 16:25:28 +0000 Subject: [PATCH] feat: add Gateway API support (#1073) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add full Gateway API support for exposing Gitea via HTTPRoute, TCPRoute, BackendTLSPolicy, and ClientSettingsPolicy resources. New templates: - `httpRoute.yaml` — renders an HTTPRoute with configurable parentRefs, hostnames, and rules (defaults to PathPrefix `/`) - `tcpRoute.yaml` — renders a TCPRoute for SSH traffic - `backendTLSPolicy.yaml` — renders a BackendTLSPolicy for encrypted backend connections with required validation config - `clientSettingsPolicy.yaml` — renders an NGINX Gateway Fabric ClientSettingsPolicy to raise the request body size limit Infrastructure: - `gatewayAPI.enabled` global toggle gates all resources - Resources grouped under `gatewayAPI.core.*` and `gatewayAPI.nginx.*` - Helper templates extracted into dedicated `_*.tpl` files - Service name helpers (`gitea.service.http.name`, `gitea.service.ssh.name`) extracted into `_services.tpl`; service templates renamed to camelCase - `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` auto-resolve from `httpRoute.hostnames[0]`; `httpRoute.tls` switches to `https` Documentation: - New `docs/gateway-api.md` with topology examples, BackendTLSPolicy setup, sectionName guidance, SSH considerations, and NGINX body size limit configuration - `.github/copilot-instructions.md` with project conventions - README parameter table auto-generated via `make readme` Tests: - Helm unit tests for all four new resource templates - Config tests for hostname/TLS resolution from Gateway API values Co-authored-by: Todd Marimon --- .github/copilot-instructions.md | 62 ++++ README.md | 37 +++ docs/gateway-api.md | 267 ++++++++++++++++++ templates/_helpers.tpl | 4 + templates/gitea/_backendTLSPolicies.tpl | 30 ++ templates/gitea/_clientSettingsPolicies.tpl | 30 ++ templates/gitea/_httpRoutes.tpl | 30 ++ templates/gitea/_services.tpl | 11 + templates/gitea/_tcpRoutes.tpl | 30 ++ templates/gitea/backendTLSPolicy.yaml | 30 ++ templates/gitea/clientSettingsPolicy.yaml | 30 ++ templates/gitea/httpRoute.yaml | 42 +++ .../gitea/{http-svc.yaml => httpService.yaml} | 8 +- templates/gitea/ingress.yaml | 6 +- templates/gitea/route.yaml | 2 +- .../gitea/{ssh-svc.yaml => sshService.yaml} | 8 +- templates/gitea/tcpRoute.yaml | 34 +++ templates/tests/test-http-connection.yaml | 2 +- .../helm/config/server-section_domain.yaml | 53 ++++ .../helm/deployment/svc-configuration.yaml | 28 +- .../helm/gatewayAPI/backendTLSPolicy.yaml | 89 ++++++ .../helm/gatewayAPI/clientSettingsPolicy.yaml | 105 +++++++ unittests/helm/gatewayAPI/httpRoute.yaml | 117 ++++++++ unittests/helm/gatewayAPI/tcpRoute.yaml | 79 ++++++ values.yaml | 106 ++++++- 25 files changed, 1200 insertions(+), 40 deletions(-) create mode 100644 .github/copilot-instructions.md create mode 100644 docs/gateway-api.md create mode 100644 templates/gitea/_backendTLSPolicies.tpl create mode 100644 templates/gitea/_clientSettingsPolicies.tpl create mode 100644 templates/gitea/_httpRoutes.tpl create mode 100644 templates/gitea/_services.tpl create mode 100644 templates/gitea/_tcpRoutes.tpl create mode 100644 templates/gitea/backendTLSPolicy.yaml create mode 100644 templates/gitea/clientSettingsPolicy.yaml create mode 100644 templates/gitea/httpRoute.yaml rename templates/gitea/{http-svc.yaml => httpService.yaml} (97%) rename templates/gitea/{ssh-svc.yaml => sshService.yaml} (97%) create mode 100644 templates/gitea/tcpRoute.yaml create mode 100644 unittests/helm/gatewayAPI/backendTLSPolicy.yaml create mode 100644 unittests/helm/gatewayAPI/clientSettingsPolicy.yaml create mode 100644 unittests/helm/gatewayAPI/httpRoute.yaml create mode 100644 unittests/helm/gatewayAPI/tcpRoute.yaml diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 100644 index 0000000..1b92c8c --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1,62 @@ +# Gitea Helm Chart — Copilot Instructions + +## Project Overview + +Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster. + +## Build & Test + +```bash +make readme # Regenerate README.md parameter table + lint +make unittests-helm # Run Helm unit tests (helm-unittest plugin required) +make unittests-bash # Run bash/bats script tests (requires git submodule init) +make unittests # Both of the above +``` + +Always run `make readme` after changing `values.yaml` `@param` annotations. +Always run `make unittests-helm` after changing templates or unit tests. + +## Conventions + +### values.yaml + +- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table. +- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields. +- Top-level keys are sorted alphabetically within their section group. +- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example: + +```yaml +image: + registry: docker.io + repository: library/busybox + tag: 0.1.0 +``` + +### Templates + +- Helm templates live in `templates/gitea/`. Helpers live in `templates/_helpers.tpl`. +- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`). +- Use `include "gitea.fullname"` for naming resources. +- Use `fail` for required-value validation with clear error messages referencing the full values path. +- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted. +- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`. +- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`). + +### Unit Tests + +- Helm unit tests live in `unittests/helm/` mirroring the template structure. +- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format. +- Each test must set all required values explicitly — do not rely on cross-test state. +- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint`. Use `make yamllint` to run the linter. + +### Commits & PRs + +- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`). +- See `CONTRIBUTING.md` for full PR requirements. +- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references. +- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message. + +### Documentation + +- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`). +- `README.md` parameter tables are auto-generated — never edit them manually. diff --git a/README.md b/README.md index 7bce676..afa4adf 100644 --- a/README.md +++ b/README.md @@ -43,6 +43,8 @@ - [Security](#security) - [Service](#service) - [Ingress](#ingress) + - [Route](#route) + - [Gateway API](#gateway-api) - [deployment](#deployment) - [ServiceAccount](#serviceaccount) - [Persistence](#persistence-1) @@ -311,6 +313,11 @@ route: When `route.host` is set, the chart uses it for `DOMAIN`, `SSH_DOMAIN`, and `ROOT_URL`. Setting `route.tls.termination` also switches the default `ROOT_URL` scheme to `https`. +#### Gateway API + +The chart can also expose Gitea through Gateway API resources (`HTTPRoute`, `TCPRoute`, `BackendTLSPolicy`, and optionally `Gateway`). +See [docs/gateway-api.md](docs/gateway-api.md) for the full guide, including how routes interact with `ROOT_URL`/`DOMAIN` resolution and recommended topologies. + #### Session, Cache and Queue The session, cache and queue settings are set to use the built-in Valkey Cluster sub-chart dependency. @@ -1075,6 +1082,36 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `route.tls.caCertificate` | Route TLS CA certificate | `nil` | | `route.tls.destinationCACertificate` | Route destination CA certificate | `nil` | +### Gateway API + +| Name | Description | Value | +| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `gatewayAPI.enabled` | Enable deployment of Gateway API resources | `false` | +| `gatewayAPI.core.backendTLSPolicy.enabled` | Render a BackendTLSPolicy resource for encrypted backend traffic | `false` | +| `gatewayAPI.core.backendTLSPolicy.annotations` | Annotations applied to the BackendTLSPolicy | `{}` | +| `gatewayAPI.core.backendTLSPolicy.labels` | Additional labels applied to the BackendTLSPolicy | `{}` | +| `gatewayAPI.core.backendTLSPolicy.targetRefs` | Target references for the BackendTLSPolicy. Defaults to the HTTP service. | `[]` | +| `gatewayAPI.core.backendTLSPolicy.validation` | Validation configuration (required when enabled). See `docs/gateway-api.md`. | `{}` | +| `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`. | | +| `gatewayAPI.core.backendTLSPolicy.validation.hostname` | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. | | +| `gatewayAPI.core.httpRoute.enabled` | Render an HTTPRoute resource | `false` | +| `gatewayAPI.core.httpRoute.annotations` | Annotations applied to the HTTPRoute | `{}` | +| `gatewayAPI.core.httpRoute.labels` | Additional labels applied to the HTTPRoute | `{}` | +| `gatewayAPI.core.httpRoute.tls` | When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`. | `false` | +| `gatewayAPI.core.httpRoute.parentRefs` | Parent gateway references (required when enabled). | `[]` | +| `gatewayAPI.core.httpRoute.hostnames` | List of hostnames for the HTTPRoute. | `[]` | +| `gatewayAPI.core.httpRoute.rules` | Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service. | `[]` | +| `gatewayAPI.core.tcpRoute.enabled` | Render a TCPRoute resource (typically for SSH) | `false` | +| `gatewayAPI.core.tcpRoute.annotations` | Annotations applied to the TCPRoute | `{}` | +| `gatewayAPI.core.tcpRoute.labels` | Additional labels applied to the TCPRoute | `{}` | +| `gatewayAPI.core.tcpRoute.parentRefs` | Parent gateway references (required when enabled). | `[]` | +| `gatewayAPI.core.tcpRoute.rules` | Custom routing rules. Defaults to a rule targeting the SSH service. | `[]` | +| `gatewayAPI.nginx.clientSettingsPolicies.enabled` | Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit | `false` | +| `gatewayAPI.nginx.clientSettingsPolicies.annotations` | Annotations applied to the ClientSettingsPolicy | `{}` | +| `gatewayAPI.nginx.clientSettingsPolicies.labels` | Additional labels applied to the ClientSettingsPolicy | `{}` | +| `gatewayAPI.nginx.clientSettingsPolicies.targetRef` | Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute. | `{}` | +| `gatewayAPI.nginx.clientSettingsPolicies.body` | Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`. | `{}` | + ### deployment | Name | Description | Value | diff --git a/docs/gateway-api.md b/docs/gateway-api.md new file mode 100644 index 0000000..0f3f806 --- /dev/null +++ b/docs/gateway-api.md @@ -0,0 +1,267 @@ +# Gateway API + +This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources +alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources +are rendered: + +- `HTTPRoute` — required for HTTP traffic +- `TCPRoute` — optional, typically for SSH (port 22) +- `BackendTLSPolicy` — optional, for encrypted backend traffic +- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit + +All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster. + +The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator. + +## Prerequisites + +| Resource | API version | Status (as of writing) | +| ---------------------- | ------------------------------------ | ---------------------- | +| `HTTPRoute` | `gateway.networking.k8s.io/v1` | GA | +| `TCPRoute` | `gateway.networking.k8s.io/v1alpha2` | Experimental | +| `BackendTLSPolicy` | `gateway.networking.k8s.io/v1` | GA (v1.2+) | +| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1` | NGINX Gateway Fabric | + +## Common topology + +Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator: + +```yaml +gatewayAPI: + core: + httpRoute: + enabled: true + tls: true # the shared Gateway terminates TLS + hostnames: + - git.example.com + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: shared-gateway + namespace: gateway-system + sectionName: https-gitea # pin to a specific listener (see below) + tcpRoute: + enabled: true + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: shared-gateway + namespace: gateway-system + sectionName: ssh +``` + +With this configuration: + +- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname. +- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`. +- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`. +- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them. + +### Why `sectionName` matters + +Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations +that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try +to bind to every HTTPS listener — usually not what you want. Always pin to a named listener +(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway +side typically looks like: + +```yaml +listeners: + - name: https-gitea + port: 443 + protocol: HTTPS + hostname: git.example.com + tls: + certificateRefs: + - name: git-example-com-tls + allowedRoutes: + kinds: + - kind: HTTPRoute + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gitea + - name: ssh + port: 22 + protocol: TCP + allowedRoutes: + kinds: + - kind: TCPRoute + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gitea +``` + +### Sharing a hostname between HTTP and SSH + +HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both — +clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com` +and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no +extra configuration. + +If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart +cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames: + +```yaml +gitea: + config: + server: + SSH_DOMAIN: gitea-ssh.example.com +``` + +## BackendTLSPolicy + +Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with +`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to +verify the backend certificate before forwarding the request. + +### Configuring Gitea to serve HTTPS directly + +Gitea serves HTTPS via three `[server]` app.ini options +([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the +cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths: + +```yaml +gitea: + config: + server: + PROTOCOL: https + CERT_FILE: /etc/gitea-tls/tls.crt + KEY_FILE: /etc/gitea-tls/tls.key + +extraVolumes: + - name: gitea-tls + secret: + secretName: gitea-backend-tls # cert-manager-issued Secret, etc. +extraContainerVolumeMounts: + - name: gitea-tls + mountPath: /etc/gitea-tls + readOnly: true +``` + +- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the + official image); absolute paths are clearer. +- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`. +- For chained certs, the server cert comes first, intermediates after. +- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port + (3000 by default) is now speaking HTTPS instead of HTTP. + +### BackendTLSPolicy example + +Verify the backend with a CA bundle stored in a `ConfigMap`: + +```yaml +gatewayAPI: + core: + backendTLSPolicy: + enabled: true + validation: + hostname: gitea.svc.cluster.local + caCertificateRefs: + - name: gitea-backend-ca + group: "" + kind: ConfigMap +``` + +This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service` +(`-http`), and whose `validation` is passed through verbatim. `validation` is required by the +API; the template fails fast if omitted. + +### System CA trust and explicit targetRefs + +To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates` +and `targetRefs`: + +```yaml +gatewayAPI: + core: + backendTLSPolicy: + enabled: true + targetRefs: + - group: "" + kind: Service + name: gitea-sidecar + validation: + hostname: sidecar.gitea.svc.cluster.local + wellKnownCACertificates: System +``` + +Notes: + +- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group. +- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it + (otherwise stick with `caCertificateRefs`). +- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used, + `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route. + +## Raising the request body size limit (NGINX Gateway Fabric) + +NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request +Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container +images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the +`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway +API. NGINX Gateway Fabric instead reads the limit from a +[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`). + +This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do +**not** impose a default request body size limit, so large uploads work without any extra configuration — +leave `gatewayAPI.nginx.clientSettingsPolicies` disabled. + +```yaml +gatewayAPI: + enabled: true + nginx: + clientSettingsPolicies: + enabled: true + body: + maxSize: 100m # bytes, or with a k / m / g suffix; 0 disables the limit +``` + +This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute` +(``), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the +template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`) +are supported too. + +To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route — +override `targetRef`: + +```yaml +gatewayAPI: + nginx: + clientSettingsPolicies: + enabled: true + targetRef: + group: gateway.networking.k8s.io + kind: Gateway + name: shared-gateway + body: + maxSize: 100m +``` + +Notes: + +- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while + attaching it to an `HTTPRoute` scopes it to that route only. +- The policy must live in the same namespace as its `targetRef`. +- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and + `[packages]` sections) — raising the proxy limit alone is not always sufficient. + +## Interaction with `ingress` and `route` + +The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order: + +1. `route.host` (when `route.enabled`) +2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`) +3. First `ingress.hosts[0].host` +4. The in-cluster Service DNS name + +Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`. + +## SSH considerations + +- `TCPRoute` is still experimental. Many production-grade implementations support it (Envoy Gateway, Istio, Kgateway, NGINX Gateway Fabric), but you should verify before relying on it. +- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic. +- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod. diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 07ca70d..f2cb3c2 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -247,6 +247,8 @@ app.kubernetes.io/instance: {{ .Release.Name }} {{- define "gitea.public_hostname" -}} {{- if and .Values.route.enabled .Values.route.host -}} {{ tpl .Values.route.host . }} +{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}} +{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }} {{- else if gt (len .Values.ingress.hosts) 0 -}} {{ tpl (index .Values.ingress.hosts 0).host $ }} {{- else -}} @@ -308,6 +310,8 @@ app.kubernetes.io/instance: {{ .Release.Name }} https {{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}} https +{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}} +https {{- else -}} {{ .Values.gitea.config.server.PROTOCOL }} {{- end -}} diff --git a/templates/gitea/_backendTLSPolicies.tpl b/templates/gitea/_backendTLSPolicies.tpl new file mode 100644 index 0000000..a6d8c3b --- /dev/null +++ b/templates/gitea/_backendTLSPolicies.tpl @@ -0,0 +1,30 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* annotations */}} + +{{- define "gitea.backendTLSPolicy.annotations" -}} +{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* enabled */}} + +{{- define "gitea.backendTLSPolicy.enabled" -}} +{{- if and .Values.gatewayAPI.enabled + .Values.gatewayAPI.core.backendTLSPolicy.enabled +-}} +true +{{- else -}} +false +{{- end -}} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.backendTLSPolicy.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} diff --git a/templates/gitea/_clientSettingsPolicies.tpl b/templates/gitea/_clientSettingsPolicies.tpl new file mode 100644 index 0000000..3c00ad5 --- /dev/null +++ b/templates/gitea/_clientSettingsPolicies.tpl @@ -0,0 +1,30 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* annotations */}} + +{{- define "gitea.clientSettingsPolicies.annotations" -}} +{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* enabled */}} + +{{- define "gitea.clientSettingsPolicies.enabled" -}} +{{- if and .Values.gatewayAPI.enabled + .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled +-}} +true +{{- else -}} +false +{{- end -}} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.clientSettingsPolicies.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} diff --git a/templates/gitea/_httpRoutes.tpl b/templates/gitea/_httpRoutes.tpl new file mode 100644 index 0000000..d27cb28 --- /dev/null +++ b/templates/gitea/_httpRoutes.tpl @@ -0,0 +1,30 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* annotations */}} + +{{- define "gitea.httpRoute.annotations" -}} +{{- with .Values.gatewayAPI.core.httpRoute.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* enabled */}} + +{{- define "gitea.httpRoute.enabled" -}} +{{- if and .Values.gatewayAPI.enabled + .Values.gatewayAPI.core.httpRoute.enabled +-}} +true +{{- else -}} +false +{{- end -}} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.httpRoute.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.gatewayAPI.core.httpRoute.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} diff --git a/templates/gitea/_services.tpl b/templates/gitea/_services.tpl new file mode 100644 index 0000000..69ecf5c --- /dev/null +++ b/templates/gitea/_services.tpl @@ -0,0 +1,11 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* names */}} + +{{- define "gitea.service.http.name" -}} +{{ include "gitea.fullname" . }}-http +{{- end }} + +{{- define "gitea.service.ssh.name" -}} +{{ include "gitea.fullname" . }}-ssh +{{- end }} diff --git a/templates/gitea/_tcpRoutes.tpl b/templates/gitea/_tcpRoutes.tpl new file mode 100644 index 0000000..92a2356 --- /dev/null +++ b/templates/gitea/_tcpRoutes.tpl @@ -0,0 +1,30 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* annotations */}} + +{{- define "gitea.tcpRoute.annotations" -}} +{{- with .Values.gatewayAPI.core.tcpRoute.annotations }} +{{- toYaml . -}} +{{- end }} +{{- end }} + +{{/* enabled */}} + +{{- define "gitea.tcpRoute.enabled" -}} +{{- if and .Values.gatewayAPI.enabled + .Values.gatewayAPI.core.tcpRoute.enabled +-}} +true +{{- else -}} +false +{{- end -}} +{{- end }} + +{{/* labels */}} + +{{- define "gitea.tcpRoute.labels" -}} +{{ include "gitea.labels" . }} +{{- with .Values.gatewayAPI.core.tcpRoute.labels }} +{{ toYaml . }} +{{- end }} +{{- end }} diff --git a/templates/gitea/backendTLSPolicy.yaml b/templates/gitea/backendTLSPolicy.yaml new file mode 100644 index 0000000..fef760e --- /dev/null +++ b/templates/gitea/backendTLSPolicy.yaml @@ -0,0 +1,30 @@ +{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}} +{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }} +{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }} +{{- end }} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: BackendTLSPolicy +metadata: + {{- with (include "gitea.backendTLSPolicy.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} + {{- with (include "gitea.backendTLSPolicy.labels" .) }} + labels: + {{- . | nindent 4 }} + {{- end }} + name: {{ include "gitea.fullname" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} +spec: + targetRefs: + {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }} + {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }} + {{- else }} + - group: "" + kind: Service + name: {{ include "gitea.service.http.name" . }} + {{- end }} + validation: + {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }} +{{- end }} diff --git a/templates/gitea/clientSettingsPolicy.yaml b/templates/gitea/clientSettingsPolicy.yaml new file mode 100644 index 0000000..00685d5 --- /dev/null +++ b/templates/gitea/clientSettingsPolicy.yaml @@ -0,0 +1,30 @@ +{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}} +{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }} +{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }} +{{- end }} +--- +apiVersion: gateway.nginx.org/v1alpha1 +kind: ClientSettingsPolicy +metadata: + {{- with (include "gitea.clientSettingsPolicies.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} + {{- with (include "gitea.clientSettingsPolicies.labels" .) }} + labels: + {{- . | nindent 4 }} + {{- end }} + name: {{ include "gitea.fullname" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} +spec: + targetRef: + {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }} + {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }} + {{- else }} + group: gateway.networking.k8s.io + kind: HTTPRoute + name: {{ include "gitea.fullname" . }} + {{- end }} + body: + {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }} +{{- end }} diff --git a/templates/gitea/httpRoute.yaml b/templates/gitea/httpRoute.yaml new file mode 100644 index 0000000..017cff9 --- /dev/null +++ b/templates/gitea/httpRoute.yaml @@ -0,0 +1,42 @@ +{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + {{- with (include "gitea.httpRoute.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} + {{- with (include "gitea.httpRoute.labels" .) }} + labels: + {{- . | nindent 4 }} + {{- end }} + name: {{ include "gitea.fullname" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} +spec: + parentRefs: + {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }} + {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }} + {{- else }} + {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }} + {{- end }} + {{- with .Values.gatewayAPI.core.httpRoute.hostnames }} + hostnames: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + rules: + {{- if .Values.gatewayAPI.core.httpRoute.rules }} + {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }} + {{- else }} + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - group: "" + kind: Service + name: {{ include "gitea.service.http.name" . }} + port: {{ .Values.service.http.port }} + weight: 1 + {{- end }} +{{- end }} diff --git a/templates/gitea/http-svc.yaml b/templates/gitea/httpService.yaml similarity index 97% rename from templates/gitea/http-svc.yaml rename to templates/gitea/httpService.yaml index 28bd218..60460fb 100644 --- a/templates/gitea/http-svc.yaml +++ b/templates/gitea/httpService.yaml @@ -1,15 +1,15 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "gitea.fullname" . }}-http - namespace: {{ .Values.namespace | default .Release.Namespace }} + annotations: + {{- toYaml .Values.service.http.annotations | nindent 4 }} labels: {{- include "gitea.labels" . | nindent 4 }} {{- if .Values.service.http.labels }} {{- toYaml .Values.service.http.labels | nindent 4 }} {{- end }} - annotations: - {{- toYaml .Values.service.http.annotations | nindent 4 }} + name: {{ include "gitea.service.http.name" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} spec: type: {{ .Values.service.http.type }} {{- if eq .Values.service.http.type "LoadBalancer" }} diff --git a/templates/gitea/ingress.yaml b/templates/gitea/ingress.yaml index 9312ffb..408cba6 100644 --- a/templates/gitea/ingress.yaml +++ b/templates/gitea/ingress.yaml @@ -36,7 +36,7 @@ spec: pathType: {{ default "Prefix" $.Values.ingress.pathType }} backend: service: - name: {{ $fullName }}-http + name: {{ include "gitea.service.http.name" $ }} port: number: {{ $httpPort }} {{- else }} @@ -44,7 +44,7 @@ spec: pathType: {{ .pathType | default "Prefix" }} backend: service: - name: {{ $fullName }}-http + name: {{ include "gitea.service.http.name" $ }} port: number: {{ $httpPort }} {{- end }} @@ -54,7 +54,7 @@ spec: pathType: "Prefix" backend: service: - name: {{ $fullName }}-http + name: {{ include "gitea.service.http.name" $ }} port: number: {{ $httpPort }} {{- end }} diff --git a/templates/gitea/route.yaml b/templates/gitea/route.yaml index 7d44ef6..37981f3 100644 --- a/templates/gitea/route.yaml +++ b/templates/gitea/route.yaml @@ -20,7 +20,7 @@ spec: {{- end }} to: kind: Service - name: {{ $fullName }}-http + name: {{ include "gitea.service.http.name" . }} port: targetPort: http wildcardPolicy: {{ .Values.route.wildcardPolicy }} diff --git a/templates/gitea/ssh-svc.yaml b/templates/gitea/sshService.yaml similarity index 97% rename from templates/gitea/ssh-svc.yaml rename to templates/gitea/sshService.yaml index b2046fe..affa70d 100644 --- a/templates/gitea/ssh-svc.yaml +++ b/templates/gitea/sshService.yaml @@ -1,15 +1,15 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "gitea.fullname" . }}-ssh - namespace: {{ .Values.namespace | default .Release.Namespace }} + annotations: + {{- toYaml .Values.service.ssh.annotations | nindent 4 }} labels: {{- include "gitea.labels" . | nindent 4 }} {{- if .Values.service.ssh.labels }} {{- toYaml .Values.service.ssh.labels | nindent 4 }} {{- end }} - annotations: - {{- toYaml .Values.service.ssh.annotations | nindent 4 }} + name: {{ include "gitea.service.ssh.name" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} spec: type: {{ .Values.service.ssh.type }} {{- if eq .Values.service.ssh.type "LoadBalancer" }} diff --git a/templates/gitea/tcpRoute.yaml b/templates/gitea/tcpRoute.yaml new file mode 100644 index 0000000..26c2cac --- /dev/null +++ b/templates/gitea/tcpRoute.yaml @@ -0,0 +1,34 @@ +{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}} +--- +apiVersion: gateway.networking.k8s.io/v1alpha2 +kind: TCPRoute +metadata: + {{- with (include "gitea.tcpRoute.annotations" .) }} + annotations: + {{- . | nindent 4 }} + {{- end }} + {{- with (include "gitea.tcpRoute.labels" .) }} + labels: + {{- . | nindent 4 }} + {{- end }} + name: {{ include "gitea.fullname" . }} + namespace: {{ .Values.namespace | default .Release.Namespace }} +spec: + parentRefs: + {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }} + {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }} + {{- else }} + {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }} + {{- end }} + rules: + {{- if .Values.gatewayAPI.core.tcpRoute.rules }} + {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }} + {{- else }} + - backendRefs: + - group: "" + kind: Service + name: {{ include "gitea.service.ssh.name" . }} + port: {{ .Values.service.ssh.port }} + weight: 1 + {{- end }} +{{- end }} diff --git a/templates/tests/test-http-connection.yaml b/templates/tests/test-http-connection.yaml index c47d2d4..7abb934 100644 --- a/templates/tests/test-http-connection.yaml +++ b/templates/tests/test-http-connection.yaml @@ -22,6 +22,6 @@ spec: {{- $testContainerSecurityContext | nindent 8 }} {{- end }} command: ['wget'] - args: ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}'] + args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}'] restartPolicy: Never {{- end }} diff --git a/unittests/helm/config/server-section_domain.yaml b/unittests/helm/config/server-section_domain.yaml index 3fa141b..cbd95db 100644 --- a/unittests/helm/config/server-section_domain.yaml +++ b/unittests/helm/config/server-section_domain.yaml @@ -103,3 +103,56 @@ tests: matchRegex: path: stringData.server pattern: \nROOT_URL=https://route.example.com + + ################################################ + + - it: "[HTTPRoute enabled] uses first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL" + template: templates/gitea/config.yaml + set: + ingress: + hosts: [] + gatewayAPI: + enabled: true + core: + httpRoute: + enabled: true + hostnames: + - gw.example.com + parentRefs: + - name: shared-gateway + asserts: + - documentIndex: 0 + matchRegex: + path: stringData.server + pattern: \nDOMAIN=gw.example.com + - documentIndex: 0 + matchRegex: + path: stringData.server + pattern: \nSSH_DOMAIN=gw.example.com + - documentIndex: 0 + matchRegex: + path: stringData.server + pattern: \nROOT_URL=http://gw.example.com + + ################################################ + + - it: "[HTTPRoute tls] switches ROOT_URL to https" + template: templates/gitea/config.yaml + set: + ingress: + hosts: [] + gatewayAPI: + enabled: true + core: + httpRoute: + enabled: true + tls: true + hostnames: + - gw.example.com + parentRefs: + - name: shared-gateway + asserts: + - documentIndex: 0 + matchRegex: + path: stringData.server + pattern: \nROOT_URL=https://gw.example.com diff --git a/unittests/helm/deployment/svc-configuration.yaml b/unittests/helm/deployment/svc-configuration.yaml index 24059ea..05d8767 100644 --- a/unittests/helm/deployment/svc-configuration.yaml +++ b/unittests/helm/deployment/svc-configuration.yaml @@ -1,13 +1,13 @@ -suite: ssh-svc / http-svc template (Services configuration) +suite: sshService / httpService template (Services configuration) release: name: gitea-unittests namespace: testing templates: - - templates/gitea/ssh-svc.yaml - - templates/gitea/http-svc.yaml + - templates/gitea/sshService.yaml + - templates/gitea/httpService.yaml tests: - - it: supports adding custom labels to ssh-svc - template: templates/gitea/ssh-svc.yaml + - it: supports adding custom labels to sshService + template: templates/gitea/sshService.yaml set: service: ssh: @@ -19,7 +19,7 @@ tests: value: "testvalue" - it: keeps existing labels (ssh) - template: templates/gitea/ssh-svc.yaml + template: templates/gitea/sshService.yaml set: service: ssh: @@ -28,8 +28,8 @@ tests: - exists: path: metadata.labels["app"] - - it: supports adding custom labels to http-svc - template: templates/gitea/http-svc.yaml + - it: supports adding custom labels to httpService + template: templates/gitea/httpService.yaml set: service: http: @@ -41,7 +41,7 @@ tests: value: "testvalue" - it: keeps existing labels (http) - template: templates/gitea/http-svc.yaml + template: templates/gitea/httpService.yaml set: service: http: @@ -51,7 +51,7 @@ tests: path: metadata.labels["app"] - it: render service.ssh.loadBalancerClass if set and type is LoadBalancer - template: templates/gitea/ssh-svc.yaml + template: templates/gitea/sshService.yaml set: service: ssh: @@ -73,7 +73,7 @@ tests: value: ["1.2.3.4/32", "5.6.7.8/32"] - it: does not render when loadbalancer properties are set but type is not loadBalancerClass - template: templates/gitea/http-svc.yaml + template: templates/gitea/httpService.yaml set: service: http: @@ -92,7 +92,7 @@ tests: path: spec.loadBalancerSourceRanges - it: does not render loadBalancerClass by default even when type is LoadBalancer - template: templates/gitea/http-svc.yaml + template: templates/gitea/httpService.yaml set: service: http: @@ -107,8 +107,8 @@ tests: - it: both ssh and http services exist templates: - - templates/gitea/ssh-svc.yaml - - templates/gitea/http-svc.yaml + - templates/gitea/sshService.yaml + - templates/gitea/httpService.yaml asserts: - matchRegex: path: metadata.name diff --git a/unittests/helm/gatewayAPI/backendTLSPolicy.yaml b/unittests/helm/gatewayAPI/backendTLSPolicy.yaml new file mode 100644 index 0000000..c2681ec --- /dev/null +++ b/unittests/helm/gatewayAPI/backendTLSPolicy.yaml @@ -0,0 +1,89 @@ +suite: Test Gateway API backendTLSPolicy.yaml +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/backendTLSPolicy.yaml +tests: + - it: should not render when gatewayAPI.enabled is false + set: + gatewayAPI: + enabled: false + core: + backendTLSPolicy: + enabled: true + validation: + hostname: git.internal + caCertificateRefs: + - name: gitea-ca + group: "" + kind: ConfigMap + asserts: + - hasDocuments: + count: 0 + + - it: should not render when backendTLSPolicy.enabled is false + set: + gatewayAPI: + enabled: true + gatewayAPI.core.backendTLSPolicy.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should render a BackendTLSPolicy targeting the http Service by default + set: + gatewayAPI: + enabled: true + core: + backendTLSPolicy: + enabled: true + validation: + hostname: git.internal + caCertificateRefs: + - name: gitea-ca + group: "" + kind: ConfigMap + asserts: + - hasDocuments: + count: 1 + - isKind: + of: BackendTLSPolicy + - equal: + path: apiVersion + value: gateway.networking.k8s.io/v1 + - equal: + path: metadata.name + value: gitea-unittests + - equal: + path: spec.targetRefs[0].name + value: gitea-unittests-http + - equal: + path: spec.targetRefs[0].kind + value: Service + - equal: + path: spec.validation.hostname + value: git.internal + + - it: should fail when validation is missing + set: + gatewayAPI: + enabled: true + core: + backendTLSPolicy: + enabled: true + asserts: + - failedTemplate: + errorMessage: gatewayAPI.core.backendTLSPolicy.validation is required + + - it: should fail when validation is an empty dict + set: + gatewayAPI: + enabled: true + core: + backendTLSPolicy: + enabled: true + validation: {} + asserts: + - failedTemplate: + errorMessage: gatewayAPI.core.backendTLSPolicy.validation is required diff --git a/unittests/helm/gatewayAPI/clientSettingsPolicy.yaml b/unittests/helm/gatewayAPI/clientSettingsPolicy.yaml new file mode 100644 index 0000000..ed275bf --- /dev/null +++ b/unittests/helm/gatewayAPI/clientSettingsPolicy.yaml @@ -0,0 +1,105 @@ +suite: Test Gateway API clientSettingsPolicy.yaml +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/clientSettingsPolicy.yaml +tests: + - it: should not render when gatewayAPI.enabled is false + set: + gatewayAPI: + enabled: false + nginx: + clientSettingsPolicies: + enabled: true + body: + maxSize: 100m + asserts: + - hasDocuments: + count: 0 + + - it: should not render when clientSettingsPolicies.enabled is false + set: + gatewayAPI: + enabled: true + gatewayAPI.nginx.clientSettingsPolicies.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should render a ClientSettingsPolicy targeting the HTTPRoute by default + set: + gatewayAPI: + enabled: true + nginx: + clientSettingsPolicies: + enabled: true + body: + maxSize: 100m + asserts: + - hasDocuments: + count: 1 + - isKind: + of: ClientSettingsPolicy + - equal: + path: apiVersion + value: gateway.nginx.org/v1alpha1 + - equal: + path: metadata.name + value: gitea-unittests + - equal: + path: spec.targetRef.group + value: gateway.networking.k8s.io + - equal: + path: spec.targetRef.kind + value: HTTPRoute + - equal: + path: spec.targetRef.name + value: gitea-unittests + - equal: + path: spec.body.maxSize + value: 100m + + - it: should honor a custom targetRef + set: + gatewayAPI: + enabled: true + nginx: + clientSettingsPolicies: + enabled: true + targetRef: + group: gateway.networking.k8s.io + kind: Gateway + name: shared-gateway + body: + maxSize: 100m + asserts: + - equal: + path: spec.targetRef.kind + value: Gateway + - equal: + path: spec.targetRef.name + value: shared-gateway + + - it: should fail when body is missing + set: + gatewayAPI: + enabled: true + nginx: + clientSettingsPolicies: + enabled: true + asserts: + - failedTemplate: + errorMessage: gatewayAPI.nginx.clientSettingsPolicies.body is required + + - it: should fail when body is an empty dict + set: + gatewayAPI: + enabled: true + nginx: + clientSettingsPolicies: + enabled: true + body: {} + asserts: + - failedTemplate: + errorMessage: gatewayAPI.nginx.clientSettingsPolicies.body is required diff --git a/unittests/helm/gatewayAPI/httpRoute.yaml b/unittests/helm/gatewayAPI/httpRoute.yaml new file mode 100644 index 0000000..fab1b56 --- /dev/null +++ b/unittests/helm/gatewayAPI/httpRoute.yaml @@ -0,0 +1,117 @@ +suite: Test Gateway API httpRoute.yaml +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/httpRoute.yaml +tests: + - it: should not render when gatewayAPI.enabled is false + set: + gatewayAPI: + enabled: false + core: + httpRoute: + enabled: true + hostnames: + - git.example.com + parentRefs: + - name: shared-gateway + asserts: + - hasDocuments: + count: 0 + + - it: should not render when httpRoute.enabled is false + set: + gatewayAPI: + enabled: true + gatewayAPI.core.httpRoute.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should render a single HTTPRoute with default rule + set: + gatewayAPI: + enabled: true + core: + httpRoute: + enabled: true + annotations: + example.io/owner: gitea + hostnames: + - git.example.com + parentRefs: + - name: shared-gateway + namespace: gateway-system + asserts: + - hasDocuments: + count: 1 + - isKind: + of: HTTPRoute + - equal: + path: apiVersion + value: gateway.networking.k8s.io/v1 + - equal: + path: metadata.name + value: gitea-unittests + - equal: + path: metadata.annotations["example.io/owner"] + value: gitea + - equal: + path: spec.parentRefs[0].name + value: shared-gateway + - equal: + path: spec.parentRefs[0].namespace + value: gateway-system + - equal: + path: spec.hostnames[0] + value: git.example.com + - equal: + path: spec.rules[0].matches[0].path.value + value: / + - equal: + path: spec.rules[0].backendRefs[0].group + value: "" + - equal: + path: spec.rules[0].backendRefs[0].kind + value: Service + - equal: + path: spec.rules[0].backendRefs[0].name + value: gitea-unittests-http + - equal: + path: spec.rules[0].backendRefs[0].port + value: 3000 + - equal: + path: spec.rules[0].backendRefs[0].weight + value: 1 + + - it: should fail when parentRefs missing + set: + gatewayAPI: + enabled: true + core: + httpRoute: + enabled: true + hostnames: + - git.example.com + asserts: + - failedTemplate: + errorMessage: gatewayAPI.core.httpRoute.parentRefs is required + + - it: hostname tpl rendering + set: + global: + giteaHostName: gitea.tpl.example.com + gatewayAPI: + enabled: true + core: + httpRoute: + enabled: true + hostnames: + - "{{ .Values.global.giteaHostName }}" + parentRefs: + - name: gw + asserts: + - equal: + path: spec.hostnames[0] + value: gitea.tpl.example.com diff --git a/unittests/helm/gatewayAPI/tcpRoute.yaml b/unittests/helm/gatewayAPI/tcpRoute.yaml new file mode 100644 index 0000000..5a2082a --- /dev/null +++ b/unittests/helm/gatewayAPI/tcpRoute.yaml @@ -0,0 +1,79 @@ +suite: Test Gateway API tcpRoute.yaml +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/tcpRoute.yaml +tests: + - it: should not render when gatewayAPI.enabled is false + set: + gatewayAPI: + enabled: false + core: + tcpRoute: + enabled: true + parentRefs: + - name: shared-gateway + asserts: + - hasDocuments: + count: 0 + + - it: should not render when tcpRoute.enabled is false + set: + gatewayAPI: + enabled: true + gatewayAPI.core.tcpRoute.enabled: false + asserts: + - hasDocuments: + count: 0 + + - it: should render a TCPRoute defaulting to the SSH service + set: + gatewayAPI: + enabled: true + core: + tcpRoute: + enabled: true + parentRefs: + - name: shared-gateway + sectionName: ssh + asserts: + - hasDocuments: + count: 1 + - isKind: + of: TCPRoute + - equal: + path: apiVersion + value: gateway.networking.k8s.io/v1alpha2 + - equal: + path: metadata.name + value: gitea-unittests + - equal: + path: spec.parentRefs[0].sectionName + value: ssh + - equal: + path: spec.rules[0].backendRefs[0].group + value: "" + - equal: + path: spec.rules[0].backendRefs[0].kind + value: Service + - equal: + path: spec.rules[0].backendRefs[0].name + value: gitea-unittests-ssh + - equal: + path: spec.rules[0].backendRefs[0].port + value: 22 + - equal: + path: spec.rules[0].backendRefs[0].weight + value: 1 + + - it: should fail when parentRefs missing + set: + gatewayAPI: + enabled: true + core: + tcpRoute: + enabled: true + asserts: + - failedTemplate: + errorMessage: gatewayAPI.core.tcpRoute.parentRefs is required diff --git a/values.yaml b/values.yaml index e695c28..8ab15bf 100644 --- a/values.yaml +++ b/values.yaml @@ -208,11 +208,94 @@ route: caCertificate: destinationCACertificate: +## @section Gateway API +## See docs/gateway-api.md for full guidance. +gatewayAPI: + ## @param gatewayAPI.enabled Enable deployment of Gateway API resources + enabled: false + + core: + ## @param gatewayAPI.core.backendTLSPolicy.enabled Render a BackendTLSPolicy resource for encrypted backend traffic + ## @param gatewayAPI.core.backendTLSPolicy.annotations Annotations applied to the BackendTLSPolicy + ## @param gatewayAPI.core.backendTLSPolicy.labels Additional labels applied to the BackendTLSPolicy + ## @param gatewayAPI.core.backendTLSPolicy.targetRefs Target references for the BackendTLSPolicy. Defaults to the HTTP service. + ## @param gatewayAPI.core.backendTLSPolicy.validation Validation configuration (required when enabled). See `docs/gateway-api.md`. + ## @extra gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`. + ## @extra gatewayAPI.core.backendTLSPolicy.validation.hostname Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`. + backendTLSPolicy: + enabled: false + annotations: {} + labels: {} + targetRefs: [] + validation: {} + # caCertificateRefs: + # - name: gitea-ca + # group: "" + # kind: ConfigMap + # hostname: gitea-http + + ## @param gatewayAPI.core.httpRoute.enabled Render an HTTPRoute resource + ## @param gatewayAPI.core.httpRoute.annotations Annotations applied to the HTTPRoute + ## @param gatewayAPI.core.httpRoute.labels Additional labels applied to the HTTPRoute + ## @param gatewayAPI.core.httpRoute.tls When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`. + ## @param gatewayAPI.core.httpRoute.parentRefs Parent gateway references (required when enabled). + ## @param gatewayAPI.core.httpRoute.hostnames List of hostnames for the HTTPRoute. + ## @param gatewayAPI.core.httpRoute.rules Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service. + httpRoute: + enabled: false + annotations: {} + labels: {} + tls: false + parentRefs: [] + # - group: gateway.networking.k8s.io + # kind: Gateway + # name: shared-gateway + # namespace: gateway-system + # sectionName: http + hostnames: [] + # - git.example.com + rules: [] + + + ## @param gatewayAPI.core.tcpRoute.enabled Render a TCPRoute resource (typically for SSH) + ## @param gatewayAPI.core.tcpRoute.annotations Annotations applied to the TCPRoute + ## @param gatewayAPI.core.tcpRoute.labels Additional labels applied to the TCPRoute + ## @param gatewayAPI.core.tcpRoute.parentRefs Parent gateway references (required when enabled). + ## @param gatewayAPI.core.tcpRoute.rules Custom routing rules. Defaults to a rule targeting the SSH service. + tcpRoute: + enabled: false + annotations: {} + labels: {} + parentRefs: [] + # - group: gateway.networking.k8s.io + # kind: Gateway + # name: shared-gateway + # namespace: gateway-system + # sectionName: ssh + rules: [] + + + ## NGINX Gateway Fabric specific resources. Only relevant when the upstream + ## Gateway is backed by NGINX Gateway Fabric (nginx.org). Other implementations + ## (Envoy Gateway, Cilium, ...) do not impose a default request body size limit. + nginx: + ## @param gatewayAPI.nginx.clientSettingsPolicies.enabled Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit + ## @param gatewayAPI.nginx.clientSettingsPolicies.annotations Annotations applied to the ClientSettingsPolicy + ## @param gatewayAPI.nginx.clientSettingsPolicies.labels Additional labels applied to the ClientSettingsPolicy + ## @param gatewayAPI.nginx.clientSettingsPolicies.targetRef Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute. + ## @param gatewayAPI.nginx.clientSettingsPolicies.body Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`. + clientSettingsPolicies: + enabled: false + annotations: {} + labels: {} + targetRef: {} + body: {} + # maxSize: 100m + ## @section deployment # ## @param resources Kubernetes resources -resources: - {} +resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little # resources, such as Minikube. If you do want to specify resources, uncomment the following @@ -253,10 +336,9 @@ priorityClassName: "" ## @param deployment.labels Labels for the deployment ## @param deployment.annotations Annotations for the Gitea deployment to be created deployment: - env: - [] - # - name: VARIABLE - # value: my-value + env: [] + # - name: VARIABLE + # value: my-value terminationGracePeriodSeconds: 60 labels: {} annotations: {} @@ -423,8 +505,7 @@ gitea: tlsConfig: {} ## @param gitea.ldap LDAP configuration - ldap: - [] + ldap: [] # - name: "LDAP 1" # existingSecret: # securityProtocol: @@ -441,8 +522,7 @@ gitea: # Either specify inline `key` and `secret` or refer to them via `existingSecret` ## @param gitea.oauth OAuth configuration - oauth: - [] + oauth: [] # - name: 'OAuth 1' # provider: # key: @@ -659,9 +739,9 @@ valkey: repository: bitnamilegacy/redis-exporter primary: - ## @param valkey.primary.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims. - ## @param valkey.primary.persistence.storageClass Persistent Volume storage class. - ## @param valkey.primary.persistence.size Persistent Volume size. + ## @param valkey.primary.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims. + ## @param valkey.primary.persistence.storageClass Persistent Volume storage class. + ## @param valkey.primary.persistence.size Persistent Volume size. persistence: enabled: true storageClass: ""