From ab24bcd9a57cbb776571fd5b051efc714e1574fd Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Fri, 4 Sep 2026 14:03:39 +0200 Subject: [PATCH] feat(deployment)!: move `extraVolumes` and `extraContainerVolumeMounts` into the `deployment` dict Both values are Deployment-scoped: `extraVolumes` is rendered into `spec.template.spec.volumes` and `extraContainerVolumeMounts` only into the volumeMounts of the Gitea container. The `extra*` prefix said nothing about that scope and left them sitting at the top level, far away from the pod- and container-scoped settings that already live under `deployment` and `deployment.gitea`. They therefore become `deployment.volumes` and `deployment.gitea.volumeMounts`, which makes the target resource and container obvious from the values path alone and continues the consolidation started with `deployment.gitea.env`, `deployment.gitea.image`, `deployment.gitea.resources` and the security contexts. `extraInitVolumeMounts` stays where it is for now, because it targets the init containers rather than the Gitea container. The deprecated `extraVolumeMounts` fallback is kept intact and now points at `deployment.gitea.volumeMounts` in its documentation. Both removed keys are covered by the deprecation check, because silently ignoring them would drop mounted TLS certificates, custom themes or client certs and leave Gitea running with a broken or unexpected configuration. BREAKING CHANGE: `extraVolumes` and `extraContainerVolumeMounts` no longer exist. Use `deployment.volumes` and `deployment.gitea.volumeMounts` instead. Installations that still set the old keys will fail to render unless `checkDeprecation` is set to `false`. Co-authored-by: Copilot --- README.md | 59 +++++++++++---------- docs/gateway-api.md | 20 +++---- templates/_helpers.tpl | 4 +- templates/gitea/deployment.yaml | 4 +- templates/gitea/deprecation.yaml | 10 ++++ unittests/helm/deployment/deprecations.yaml | 24 +++++++++ values.yaml | 27 ++++++---- 7 files changed, 96 insertions(+), 52 deletions(-) diff --git a/README.md b/README.md index a209a6f..0f2feb8 100644 --- a/README.md +++ b/README.md @@ -894,15 +894,16 @@ Custom themes can be added via k8s secrets and referencing them in `values.yaml` The [http provider](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) is useful here. ```yaml -extraVolumes: - - name: gitea-themes - secret: - secretName: gitea-themes - -extraVolumeMounts: - - name: gitea-themes - readOnly: true - mountPath: "/data/gitea/public/assets/css" +deployment: + gitea: + volumeMounts: + - name: gitea-themes + readOnly: true + mountPath: "/data/gitea/public/assets/css" + volumes: + - name: gitea-themes + secret: + secretName: gitea-themes ``` The secret can be created via `terraform`: @@ -1015,6 +1016,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | | `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` | | `deployment.gitea.securityContext` | Security context of the Gitea container and the chart-managed init containers. | `{}` | +| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` | | `deployment.nodeSelector` | NodeSelector for the deployment | `{}` | | `deployment.priorityClassName` | priorityClassName for the deployment | `""` | | `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` | @@ -1027,6 +1029,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` | | `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` | | `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` | +| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` | ### Gateway API @@ -1200,26 +1203,24 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo ### Persistence -| Name | Description | Value | -| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------- | -| `persistence.enabled` | Enable persistent storage | `true` | -| `persistence.create` | Whether to create the persistentVolumeClaim for shared storage | `true` | -| `persistence.mount` | Whether the persistentVolumeClaim should be mounted (even if not created) | `true` | -| `persistence.claimName` | Use an existing claim to store repository information | `gitea-shared-storage` | -| `persistence.size` | Size for persistence to store repo information | `10Gi` | -| `persistence.accessModes` | AccessMode for persistence | `["ReadWriteOnce"]` | -| `persistence.labels` | Labels for the persistence volume claim to be created | `{}` | -| `persistence.annotations.helm.sh/resource-policy` | Resource policy for the persistence volume claim | `keep` | -| `persistence.storageClass` | Name of the storage class to use | `nil` | -| `persistence.subPath` | Subdirectory of the volume to mount at | `nil` | -| `persistence.volumeName` | Name of persistent volume in PVC | `""` | -| `extraContainers` | Additional sidecar containers to run in the pod | `[]` | -| `preExtraInitContainers` | Additional init containers to run in the pod before Gitea runs it owns init containers. | `[]` | -| `postExtraInitContainers` | Additional init containers to run in the pod after Gitea runs it owns init containers. | `[]` | -| `extraVolumes` | Additional volumes to mount to the Gitea deployment | `[]` | -| `extraContainerVolumeMounts` | Mounts that are only mapped into the Gitea runtime/main container, to e.g. override custom templates. | `[]` | -| `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` | -| `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Gitea main container | `[]` | +| Name | Description | Value | +| ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ---------------------- | +| `persistence.enabled` | Enable persistent storage | `true` | +| `persistence.create` | Whether to create the persistentVolumeClaim for shared storage | `true` | +| `persistence.mount` | Whether the persistentVolumeClaim should be mounted (even if not created) | `true` | +| `persistence.claimName` | Use an existing claim to store repository information | `gitea-shared-storage` | +| `persistence.size` | Size for persistence to store repo information | `10Gi` | +| `persistence.accessModes` | AccessMode for persistence | `["ReadWriteOnce"]` | +| `persistence.labels` | Labels for the persistence volume claim to be created | `{}` | +| `persistence.annotations.helm.sh/resource-policy` | Resource policy for the persistence volume claim | `keep` | +| `persistence.storageClass` | Name of the storage class to use | `nil` | +| `persistence.subPath` | Subdirectory of the volume to mount at | `nil` | +| `persistence.volumeName` | Name of persistent volume in PVC | `""` | +| `extraContainers` | Additional sidecar containers to run in the pod | `[]` | +| `preExtraInitContainers` | Additional init containers to run in the pod before Gitea runs it owns init containers. | `[]` | +| `postExtraInitContainers` | Additional init containers to run in the pod after Gitea runs it owns init containers. | `[]` | +| `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` | +| `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Gitea main container | `[]` | ### Init diff --git a/docs/gateway-api.md b/docs/gateway-api.md index 2f1d1ce..1407f5f 100644 --- a/docs/gateway-api.md +++ b/docs/gateway-api.md @@ -122,7 +122,7 @@ verify the backend certificate before forwarding the request. Gitea serves HTTPS via three `[server]` app.ini options ([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the -cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths: +cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths: ```yaml gitea: @@ -132,14 +132,16 @@ gitea: CERT_FILE: /etc/gitea-tls/tls.crt KEY_FILE: /etc/gitea-tls/tls.key -extraVolumes: - - name: gitea-tls - secret: - secretName: gitea-backend-tls # cert-manager-issued Secret, etc. -extraContainerVolumeMounts: - - name: gitea-tls - mountPath: /etc/gitea-tls - readOnly: true +deployment: + gitea: + volumeMounts: + - name: gitea-tls + mountPath: /etc/gitea-tls + readOnly: true + volumes: + - name: gitea-tls + secret: + secretName: gitea-backend-tls # cert-manager-issued Secret, etc. ``` - Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 2af960d..3c049ed 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -489,8 +489,8 @@ https {{- define "gitea.container-additional-mounts" -}} {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}} - {{- if gt (len .Values.extraContainerVolumeMounts) 0 -}} - {{- toYaml .Values.extraContainerVolumeMounts -}} + {{- if gt (len .Values.deployment.gitea.volumeMounts) 0 -}} + {{- toYaml .Values.deployment.gitea.volumeMounts -}} {{- else if gt (len .Values.extraVolumeMounts) 0 -}} {{- toYaml .Values.extraVolumeMounts -}} {{- end -}} diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml index 9499a4a..58af957 100644 --- a/templates/gitea/deployment.yaml +++ b/templates/gitea/deployment.yaml @@ -457,8 +457,8 @@ spec: secret: secretName: {{ include "gitea.secret.config.name" . }} defaultMode: 110 - {{- if gt (len .Values.extraVolumes) 0 }} - {{- toYaml .Values.extraVolumes | nindent 8 }} + {{- if gt (len .Values.deployment.volumes) 0 }} + {{- toYaml .Values.deployment.volumes | nindent 8 }} {{- end }} - name: inline-config-sources secret: diff --git a/templates/gitea/deprecation.yaml b/templates/gitea/deprecation.yaml index dcf4641..d7d573b 100644 --- a/templates/gitea/deprecation.yaml +++ b/templates/gitea/deprecation.yaml @@ -60,6 +60,16 @@ {{- fail "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." -}} {{- end -}} + {{/* EXTRA CONTAINER VOLUME MOUNTS */}} + {{- if .Values.extraContainerVolumeMounts -}} + {{- fail "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." -}} + {{- end -}} + + {{/* EXTRA VOLUMES */}} + {{- if .Values.extraVolumes -}} + {{- fail "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." -}} + {{- end -}} + {{/* NODE SELECTOR */}} {{- if .Values.nodeSelector -}} {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}} diff --git a/unittests/helm/deployment/deprecations.yaml b/unittests/helm/deployment/deprecations.yaml index 5b7f6aa..5c9447f 100644 --- a/unittests/helm/deployment/deprecations.yaml +++ b/unittests/helm/deployment/deprecations.yaml @@ -46,6 +46,23 @@ tests: asserts: - failedTemplate: errorMessage: "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." + - it: fails when the removed `extraContainerVolumeMounts` value is set + set: + extraContainerVolumeMounts: + - name: postgres-ssl-vol + mountPath: /pg-ssl + asserts: + - failedTemplate: + errorMessage: "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." + - it: fails when the removed `extraVolumes` value is set + set: + extraVolumes: + - name: postgres-ssl-vol + secret: + secretName: gitea-postgres-ssl + asserts: + - failedTemplate: + errorMessage: "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." - it: fails when the removed `nodeSelector` value is set set: nodeSelector: @@ -130,6 +147,13 @@ tests: dnsConfig: nameservers: - 192.0.2.1 + extraContainerVolumeMounts: + - name: postgres-ssl-vol + mountPath: /pg-ssl + extraVolumes: + - name: postgres-ssl-vol + secret: + secretName: gitea-postgres-ssl nodeSelector: foo: bar podSecurityContext: diff --git a/values.yaml b/values.yaml index c286e61..fe01cea 100644 --- a/values.yaml +++ b/values.yaml @@ -120,6 +120,12 @@ deployment: # runAsNonRoot: true # runAsUser: 1000 + ## @param deployment.gitea.volumeMounts Additional volume mounts. + volumeMounts: [] + # - name: my-configmap-volume + # mountPath: /configmap + # readOnly: true + ## @param deployment.nodeSelector NodeSelector for the deployment nodeSelector: {} @@ -176,6 +182,16 @@ deployment: # app.kubernetes.io/instance: gitea + ## @param deployment.volumes Additional volumes to mount into the pods of the Gitea deployment. + volumes: [] + # - name: my-configmap-volume + # config: + # name: my-configmap + # - name: my-secret-volume + # secret: + # secretName: my-secret + + ## @section Gateway API ## See docs/gateway-api.md for full guidance. gatewayAPI: @@ -594,20 +610,11 @@ postExtraInitContainers: [] # image: docker.io/library/busybox # command: [ /bin/sh, -c, 'echo "Hello world! I am a post init container."' ] -## @param extraVolumes Additional volumes to mount to the Gitea deployment -extraVolumes: [] -# - name: postgres-ssl-vol -# secret: -# secretName: gitea-postgres-ssl - -## @param extraContainerVolumeMounts Mounts that are only mapped into the Gitea runtime/main container, to e.g. override custom templates. -extraContainerVolumeMounts: [] - ## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. extraInitVolumeMounts: [] ## @deprecated The extraVolumeMounts variable has been split two: -## - extraContainerVolumeMounts +## - deployment.gitea.volumeMounts ## - extraInitVolumeMounts ## As an example, can be used to mount a client cert when connecting to an external Postgres server. ## @param extraVolumeMounts **DEPRECATED** Additional volume mounts for init containers and the Gitea main container