You've already forked helm-gitea
Add gpg configuration settings (#343)
### Description of the change This PR adds support for gpg key setup. It allows to pass the gpg private key content inline inside `values.yaml` or refer to an existing secret containing the key content data. ### Benefits Administrators don't need to manually setup the gpg environment from inside a running container. It also eliminates the breaking change of Gitea 1.17 regarding `[git].HOME` as the `GNUPGHOME` environment variable is used consistently to relocate the `.gnupg` directory to its former location. ### Applicable issues - fixes #107 ### Additional information This PR add the first unit tests to this Helm Chart, ensuring templating integrity for signing related configuration. ### Checklist - [x] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Co-authored-by: pat-s <pat-s@noreply.gitea.io> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/343 Reviewed-by: luhahn <luhahn@noreply.gitea.io> Reviewed-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>
This commit is contained in:
justusbunsi
13
unittests/gpg-secret/signing-disabled.yaml
Normal file
13
unittests/gpg-secret/signing-disabled.yaml
Normal file
@ -0,0 +1,13 @@
|
||||
suite: GPG secret template (signing disabled)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/gpg-secret.yaml
|
||||
tests:
|
||||
- it: renders nothing
|
||||
set:
|
||||
signing.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
40
unittests/gpg-secret/signing-enabled.yaml
Normal file
40
unittests/gpg-secret/signing-enabled.yaml
Normal file
@ -0,0 +1,40 @@
|
||||
suite: GPG secret template (signing enabled)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/gpg-secret.yaml
|
||||
tests:
|
||||
- it: fails rendering when nothing is configured
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: Either specify `signing.privateKey` or `signing.existingKey`
|
||||
- it: skips rendering using external secret reference
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
existingSecret: "external-secret-reference"
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
- it: renders secret specification using inline gpg key
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
privateKey: "gpg-key-placeholder"
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- documentIndex: 0
|
||||
containsDocument:
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-gpg-key
|
||||
- isNotEmpty:
|
||||
path: metadata.labels
|
||||
- equal:
|
||||
path: data.privateKey
|
||||
value: "Z3BnLWtleS1wbGFjZWhvbGRlcg=="
|
||||
15
unittests/init/basic.yaml
Normal file
15
unittests/init/basic.yaml
Normal file
@ -0,0 +1,15 @@
|
||||
suite: Init template (basic)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/init.yaml
|
||||
tests:
|
||||
- it: renders a secret
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-init
|
||||
53
unittests/init/init_directory_structure.sh.yaml
Normal file
53
unittests/init/init_directory_structure.sh.yaml
Normal file
@ -0,0 +1,53 @@
|
||||
suite: Init template
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/init.yaml
|
||||
tests:
|
||||
- it: skips gpg script block for disabled signing
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData.[init_directory_structure.sh]
|
||||
value: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
chown 1000:1000 /data
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chown 1000:1000 "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
- it: adds gpg script block for enabled signing
|
||||
set:
|
||||
signing.enabled: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData.[init_directory_structure.sh]
|
||||
value: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
chown 1000:1000 /data
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chown 1000:1000 "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
if [ ! -d "${GNUPGHOME}" ]; then
|
||||
mkdir -p "${GNUPGHOME}"
|
||||
chmod 700 "${GNUPGHOME}"
|
||||
chown 1000:1000 "${GNUPGHOME}"
|
||||
fi
|
||||
17
unittests/statefulset/basic.yaml
Normal file
17
unittests/statefulset/basic.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
suite: Statefulset template (basic)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: renders a statefulset
|
||||
template: templates/gitea/statefulset.yaml
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: StatefulSet
|
||||
apiVersion: apps/v1
|
||||
name: gitea-unittests
|
||||
40
unittests/statefulset/signing-disabled.yaml
Normal file
40
unittests/statefulset/signing-disabled.yaml
Normal file
@ -0,0 +1,40 @@
|
||||
suite: Statefulset template (signing disabled)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: skips gpg init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers
|
||||
any: true
|
||||
content:
|
||||
name: configure-gpg
|
||||
- it: skips gpg env in `init-directories` init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
signing.enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[0].env
|
||||
content:
|
||||
name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- it: skips gpg env in runtime container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: GNUPGHOME
|
||||
- it: skips gpg volume spec
|
||||
template: templates/gitea/statefulset.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: gpg-private-key
|
||||
93
unittests/statefulset/signing-enabled.yaml
Normal file
93
unittests/statefulset/signing-enabled.yaml
Normal file
@ -0,0 +1,93 @@
|
||||
suite: Statefulset template (signing enabled)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: adds gpg init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
existingSecret: "custom-gpg-secret"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].name
|
||||
value: configure-gpg
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].command
|
||||
value: ["/usr/sbin/configure_gpg_environment.sh"]
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].securityContext
|
||||
value:
|
||||
runAsUser: 1000
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].env
|
||||
value:
|
||||
- name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].volumeMounts
|
||||
value:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: gpg-private-key
|
||||
mountPath: /raw
|
||||
readOnly: true
|
||||
- it: adds gpg env in `init-directories` init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
signing.enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[0].env
|
||||
content:
|
||||
name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- it: adds gpg env in runtime container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
signing.enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- it: adds gpg volume spec
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: gpg-private-key
|
||||
secret:
|
||||
secretName: gitea-unittests-gpg-key
|
||||
items:
|
||||
- key: privateKey
|
||||
path: private.asc
|
||||
defaultMode: 0100
|
||||
- it: supports gpg volume spec with external reference
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
existingSecret: custom-gpg-secret
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.volumes
|
||||
content:
|
||||
name: gpg-private-key
|
||||
secret:
|
||||
secretName: custom-gpg-secret
|
||||
items:
|
||||
- key: privateKey
|
||||
path: private.asc
|
||||
defaultMode: 0100
|
||||
Reference in New Issue
Block a user