diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 1b92c8c..9870a5e 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -48,6 +48,7 @@ image: - Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format. - Each test must set all required values explicitly — do not rely on cross-test state. - The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint`. Use `make yamllint` to run the linter. +- The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period. ### Commits & PRs diff --git a/README.md b/README.md index 0f2feb8..e75be0d 100644 --- a/README.md +++ b/README.md @@ -862,6 +862,30 @@ gitea: podAnnotations: {} ``` +### Secret checksum annotations + +Each Secret of the chart has an `addSHASumAnnotation` option (disabled by default). It adds a +`checksum/` pod annotation so that a change to the Secret triggers a rolling update of the +Gitea pod. + +The SHA sum is computed differently depending on where the Secret comes from: + +- **Chart-managed Secrets** (`secrets..existingSecret.enabled: false`): the SHA sum is + computed from the manifest rendered by the chart. The cluster still holds the pre-upgrade state of + that Secret during rendering, so it cannot be used as the source. +- **User-provided Secrets** (`secrets..existingSecret.enabled: true`): the content is unknown + to the chart, so the Secret is looked up in the cluster via Helm's `lookup` function. + +The lookup is the reason why the option is disabled by default: + +- The credentials used by Helm need `get` permission on Secrets in the release namespace. +- The lookup returns nothing during client-side rendering, for example with `helm template`, during + `helm install --dry-run`, or with Argo CD unless the Helm chart is rendered against a live cluster. + The annotation is still emitted, but its value stays constant and therefore no longer triggers a + rollout. Keep `secrets..addSHASumAnnotation: false` in that case and trigger rollouts by + other means, for example with stakater's [reloader](https://github.com/stakater/Reloader) as + described below. + ## TLS certificate rotation If Gitea uses TLS certificates that are mounted as a secret in the container file system, Gitea will not automatically apply them when the TLS certificates are rotated. @@ -999,37 +1023,87 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo ### deployment -| Name | Description | Value | -| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | -| `deployment.enabled` | Enable the deployment of Gitea. | `true` | -| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` | -| `deployment.labels` | Labels for the deployment | `{}` | -| `deployment.affinity` | Affinity for the deployment. | `{}` | -| `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` | -| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` | -| `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` | -| `deployment.gitea.image.repository` | Image to start for this pod | `gitea` | -| `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | -| `deployment.gitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | -| `deployment.gitea.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `deployment.gitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` | -| `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | -| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` | -| `deployment.gitea.securityContext` | Security context of the Gitea container and the chart-managed init containers. | `{}` | -| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` | -| `deployment.nodeSelector` | NodeSelector for the deployment | `{}` | -| `deployment.priorityClassName` | priorityClassName for the deployment | `""` | -| `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` | -| `deployment.resources` | Resources is the total amount of CPU and Memory resources required by all containers in the pod. | `{}` | -| `deployment.schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` | -| `deployment.securityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` | -| `deployment.strategy.type` | Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`. | `RollingUpdate` | -| `deployment.strategy.rollingUpdate.maxSurge` | Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`. | `100%` | -| `deployment.strategy.rollingUpdate.maxUnavailable` | Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`. | `0` | -| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` | -| `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` | -| `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` | -| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` | +| Name | Description | Value | +| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | +| `deployment.enabled` | Enable the deployment of Gitea. | `true` | +| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` | +| `deployment.labels` | Labels for the deployment | `{}` | +| `deployment.affinity` | Affinity for the deployment. | `{}` | +| `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` | +| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` | +| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the Gitea container. | `[]` | +| `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` | +| `deployment.gitea.image.repository` | Image to start for this pod | `gitea` | +| `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | +| `deployment.gitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | +| `deployment.gitea.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `deployment.gitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` | +| `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | +| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` | +| `deployment.gitea.securityContext` | Security context of the Gitea container. Used as fallback for the chart-managed init containers. | `{}` | +| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` | +| `deployment.initContainers` | List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. | `[]` | +| `deployment.initDirectories.env` | Additional environment variables to pass to the init container. | `[]` | +| `deployment.initDirectories.envFrom` | List of environment variables mounted from configMaps or secrets for the initDirectories container. | `[]` | +| `deployment.initDirectories.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` | +| `deployment.initDirectories.image.repository` | Image to start for this pod | `gitea` | +| `deployment.initDirectories.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | +| `deployment.initDirectories.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | +| `deployment.initDirectories.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `deployment.initDirectories.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` | +| `deployment.initDirectories.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initDirectories.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | +| `deployment.initDirectories.resources` | Compute Resources required by the initDirectories container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` | +| `deployment.initDirectories.securityContext` | Security context of the initDirectories container. Defaults to `deployment.gitea.securityContext`. | `{}` | +| `deployment.initDirectories.volumeMounts` | Additional volume mounts. | `[]` | +| `deployment.initAppIni.env` | Additional environment variables to pass to the init container. | `[]` | +| `deployment.initAppIni.envFrom` | List of environment variables mounted from configMaps or secrets for the initAppIni container. | `[]` | +| `deployment.initAppIni.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` | +| `deployment.initAppIni.image.repository` | Image to start for this pod | `gitea` | +| `deployment.initAppIni.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | +| `deployment.initAppIni.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | +| `deployment.initAppIni.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `deployment.initAppIni.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` | +| `deployment.initAppIni.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initAppIni.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | +| `deployment.initAppIni.resources` | Compute Resources required by the initAppIni container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` | +| `deployment.initAppIni.securityContext` | Security context of the initAppIni container. Defaults to `deployment.gitea.securityContext`. | `{}` | +| `deployment.initAppIni.volumeMounts` | Additional volume mounts. | `[]` | +| `deployment.initConfigureGPG.env` | Additional environment variables to pass to the init container. | `[]` | +| `deployment.initConfigureGPG.envFrom` | List of environment variables mounted from configMaps or secrets for the initConfigureGPG container. | `[]` | +| `deployment.initConfigureGPG.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` | +| `deployment.initConfigureGPG.image.repository` | Image to start for this pod | `gitea` | +| `deployment.initConfigureGPG.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | +| `deployment.initConfigureGPG.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | +| `deployment.initConfigureGPG.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `deployment.initConfigureGPG.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` | +| `deployment.initConfigureGPG.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGPG.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | +| `deployment.initConfigureGPG.resources` | Compute Resources required by the initConfigureGPG container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` | +| `deployment.initConfigureGPG.securityContext` | Security context of the initConfigureGPG container. Defaults to `deployment.gitea.securityContext`. | `{}` | +| `deployment.initConfigureGPG.volumeMounts` | Additional volume mounts. | `[]` | +| `deployment.initConfigureGitea.env` | Additional environment variables to pass to the init container. | `[]` | +| `deployment.initConfigureGitea.envFrom` | List of environment variables mounted from configMaps or secrets for the initConfigureGitea container. | `[]` | +| `deployment.initConfigureGitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` | +| `deployment.initConfigureGitea.image.repository` | Image to start for this pod | `gitea` | +| `deployment.initConfigureGitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` | +| `deployment.initConfigureGitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` | +| `deployment.initConfigureGitea.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `deployment.initConfigureGitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` | +| `deployment.initConfigureGitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` | +| `deployment.initConfigureGitea.resources` | Compute Resources required by the initConfigureGitea container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` | +| `deployment.initConfigureGitea.securityContext` | Security context of the initConfigureGitea container. Defaults to `deployment.gitea.securityContext`. | `{}` | +| `deployment.initConfigureGitea.volumeMounts` | Additional volume mounts. | `[]` | +| `deployment.nodeSelector` | NodeSelector for the deployment | `{}` | +| `deployment.priorityClassName` | priorityClassName for the deployment | `""` | +| `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` | +| `deployment.resources` | Resources is the total amount of CPU and Memory resources required by all containers in the pod. | `{}` | +| `deployment.schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` | +| `deployment.securityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` | +| `deployment.strategy.type` | Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`. | `RollingUpdate` | +| `deployment.strategy.rollingUpdate.maxSurge` | Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`. | `100%` | +| `deployment.strategy.rollingUpdate.maxUnavailable` | Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`. | `0` | +| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` | +| `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` | +| `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` | +| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` | ### Gateway API @@ -1112,51 +1186,55 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo ### Secrets -| Name | Description | Value | -| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------- | -| `secrets.admin.enabled` | Create and keep the Gitea admin user in sync | `true` | -| `secrets.admin.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change | `true` | -| `secrets.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` | -| `secrets.admin.existingSecret.enabled` | Use an already existing Secret instead of creating the admin Secret | `false` | -| `secrets.admin.existingSecret.secretName` | Name of the already existing admin Secret | `""` | -| `secrets.admin.existingSecret.emailKey` | Key of the email address in the existing admin Secret | `email` | -| `secrets.admin.existingSecret.passwordKey` | Key of the password in the existing admin Secret | `password` | -| `secrets.admin.existingSecret.usernameKey` | Key of the username in the existing admin Secret | `username` | -| `secrets.admin.new.annotations` | Annotations for the admin Secret | `{}` | -| `secrets.admin.new.labels` | Labels for the admin Secret | `{}` | -| `secrets.admin.new.email` | Email of the Gitea admin user | `gitea@local.domain` | -| `secrets.admin.new.password` | Password of the Gitea admin user. | `r8sA8CPHD9!bt6d` | -| `secrets.admin.new.username` | Username of the Gitea admin user | `gitea_admin` | -| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` | -| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | -| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | -| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | -| `secrets.config.new.labels` | Labels for the config Secret | `{}` | -| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` | -| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` | -| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | -| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | -| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` | -| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` | -| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | -| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | -| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` | -| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` | -| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` | -| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | -| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | -| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | -| `secrets.init.new.labels` | Labels for the init Secret | `{}` | -| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` | -| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | -| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | -| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | -| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | -| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` | -| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | -| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | -| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | -| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | +| Name | Description | Value | +| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | +| `secrets.admin.enabled` | Create and keep the Gitea admin user in sync | `true` | +| `secrets.admin.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `secrets.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` | +| `secrets.admin.existingSecret.enabled` | Use an already existing Secret instead of creating the admin Secret | `false` | +| `secrets.admin.existingSecret.secretName` | Name of the already existing admin Secret | `""` | +| `secrets.admin.existingSecret.emailKey` | Key of the email address in the existing admin Secret | `email` | +| `secrets.admin.existingSecret.passwordKey` | Key of the password in the existing admin Secret | `password` | +| `secrets.admin.existingSecret.usernameKey` | Key of the username in the existing admin Secret | `username` | +| `secrets.admin.new.annotations` | Annotations for the admin Secret | `{}` | +| `secrets.admin.new.labels` | Labels for the admin Secret | `{}` | +| `secrets.admin.new.email` | Email of the Gitea admin user | `gitea@local.domain` | +| `secrets.admin.new.password` | Password of the Gitea admin user. | `r8sA8CPHD9!bt6d` | +| `secrets.admin.new.username` | Username of the Gitea admin user | `gitea_admin` | +| `secrets.config.enabled` | Enable mounting of the config Secret. | `true` | +| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` | +| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` | +| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` | +| `secrets.config.new.labels` | Labels for the config Secret | `{}` | +| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` | +| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` | +| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` | +| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` | +| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` | +| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` | +| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` | +| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` | +| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` | +| `secrets.init.enabled` | Enable mounting of the init Secret. | `true` | +| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` | +| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` | +| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` | +| `secrets.init.new.labels` | Labels for the init Secret | `{}` | +| `secrets.inlineConfig.enabled` | Enable mounting of the inline configuration Secret. | `true` | +| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` | +| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` | +| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` | +| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` | +| `secrets.metrics.enabled` | Enable mounting of the metrics Secret. | `true` | +| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` | +| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` | +| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` | +| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` | +| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` | ### Service @@ -1217,8 +1295,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo | `persistence.subPath` | Subdirectory of the volume to mount at | `nil` | | `persistence.volumeName` | Name of persistent volume in PVC | `""` | | `extraContainers` | Additional sidecar containers to run in the pod | `[]` | -| `preExtraInitContainers` | Additional init containers to run in the pod before Gitea runs it owns init containers. | `[]` | -| `postExtraInitContainers` | Additional init containers to run in the pod after Gitea runs it owns init containers. | `[]` | | `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` | | `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Gitea main container | `[]` | diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 3c049ed..7e38fdf 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -43,15 +43,25 @@ Create chart name and version as used by the chart label. Create image name and tag used by the deployment. */}} {{- define "gitea.image" -}} -{{- $fullOverride := .Values.deployment.gitea.image.fullOverride | default "" -}} -{{- $registry := .Values.global.imageRegistry | default .Values.deployment.gitea.image.registry -}} -{{- $repository := .Values.deployment.gitea.image.repository -}} +{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}} +{{- end -}} + +{{/* +Create image name and tag from an arbitrary `image` dict. +Arguments: (list $root $image) +*/}} +{{- define "gitea.image.name" -}} +{{- $root := index . 0 -}} +{{- $image := index . 1 -}} +{{- $fullOverride := $image.fullOverride | default "" -}} +{{- $registry := $root.Values.global.imageRegistry | default $image.registry -}} +{{- $repository := $image.repository -}} {{- $separator := ":" -}} -{{- $tag := .Values.deployment.gitea.image.tag | default .Chart.AppVersion | toString -}} -{{- $rootless := ternary "-rootless" "" (.Values.deployment.gitea.image.rootless) -}} +{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}} +{{- $rootless := ternary "-rootless" "" ($image.rootless) -}} {{- $digest := "" -}} -{{- if .Values.deployment.gitea.image.digest }} - {{- $digest = (printf "@%s" (.Values.deployment.gitea.image.digest | toString)) -}} +{{- if $image.digest }} + {{- $digest = (printf "@%s" ($image.digest | toString)) -}} {{- end -}} {{- if $fullOverride }} {{- printf "%s" $fullOverride -}} diff --git a/templates/gitea/_deployments.tpl b/templates/gitea/_deployments.tpl index 5089518..6aafe1f 100644 --- a/templates/gitea/_deployments.tpl +++ b/templates/gitea/_deployments.tpl @@ -6,6 +6,28 @@ {{- end }} {{- end }} +{{/* initContainers */}} + +{{- define "gitea.deployment.initContainers" -}} +{{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }} +{{- range $index, $entry := .Values.deployment.initContainers }} +{{- if and (hasKey $entry "container") (hasKey $entry "link") }} +{{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }} +{{- else if hasKey $entry "container" }} +{{- list $entry.container | toYaml | nindent 0 }} +{{- else if hasKey $entry "link" }} +{{- if not (has $entry.link $links) }} +{{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }} +{{- end }} +{{- with include (printf "gitea.initContainer.%s" $entry.link) $ }} +{{- nindent 0 . }} +{{- end }} +{{- else }} +{{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }} +{{- end }} +{{- end }} +{{- end }} + {{/* labels */}} {{- define "gitea.deployment.labels" -}} diff --git a/templates/gitea/_initContainers.tpl b/templates/gitea/_initContainers.tpl new file mode 100644 index 0000000..2f91207 --- /dev/null +++ b/templates/gitea/_initContainers.tpl @@ -0,0 +1,304 @@ +{{/* initDirectories */}} + +{{- define "gitea.initContainer.initDirectories" -}} +{{- $config := .Values.deployment.initDirectories -}} +- name: init-directories + image: "{{ include "gitea.image.name" (list . $config.image) }}" + imagePullPolicy: {{ $config.image.pullPolicy }} + command: + - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh" + env: + - name: GITEA_APP_INI + value: /data/gitea/conf/app.ini + - name: GITEA_CUSTOM + value: /data/gitea + - name: GITEA_WORK_DIR + value: /data + - name: GITEA_TEMP + value: /tmp/gitea + {{- if .Values.deployment.gitea.env }} + {{- toYaml .Values.deployment.gitea.env | nindent 4 }} + {{- end }} + {{- if .Values.secrets.gpg.enabled }} + - name: GNUPGHOME + valueFrom: + secretKeyRef: + name: {{ include "gitea.secret.gpg.name" . }} + key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} + {{- end }} + {{- with $config.env }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $config.envFrom }} + envFrom: + {{- toYaml . | nindent 4 }} + {{- end }} + volumeMounts: + - name: init + mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} + - name: temp + mountPath: /tmp + - name: data + mountPath: /data + {{- if .Values.persistence.subPath }} + subPath: {{ .Values.persistence.subPath }} + {{- end }} + {{- include "gitea.init-additional-mounts" . | nindent 4 }} + {{- with $config.volumeMounts }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }} + securityContext: + {{- . | nindent 4 }} + {{- end }} + resources: + {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }} +{{- end }} + +{{/* initAppIni */}} + +{{- define "gitea.initContainer.initAppIni" -}} +{{- $config := .Values.deployment.initAppIni -}} +- name: init-app-ini + image: "{{ include "gitea.image.name" (list . $config.image) }}" + imagePullPolicy: {{ $config.image.pullPolicy }} + {{- if .Values.gitea.extraEnvSourceFile }} + command: + - "/bin/bash" + - "-c" + args: + - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh" + {{- else }} + command: + - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh" + {{- end }} + env: + - name: GITEA_APP_INI + value: /data/gitea/conf/app.ini + - name: GITEA_CUSTOM + value: /data/gitea + - name: GITEA_WORK_DIR + value: /data + - name: GITEA_TEMP + value: /tmp/gitea + - name: TMP_EXISTING_ENVS_FILE + value: /tmp/existing-envs + - name: ENV_TO_INI_MOUNT_POINT + value: /env-to-ini-mounts + {{- if .Values.deployment.gitea.env }} + {{- toYaml .Values.deployment.gitea.env | nindent 4 }} + {{- end }} + {{- if .Values.gitea.additionalConfigFromEnvs }} + {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }} + {{- end }} + {{- with $config.env }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $config.envFrom }} + envFrom: + {{- toYaml . | nindent 4 }} + {{- end }} + volumeMounts: + - name: config + mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} + - name: temp + mountPath: /tmp + - name: data + mountPath: /data + {{- if .Values.persistence.subPath }} + subPath: {{ .Values.persistence.subPath }} + {{- end }} + - name: inline-config-sources + mountPath: /env-to-ini-mounts/inlines/ + {{- range $idx, $value := .Values.gitea.additionalConfigSources }} + - name: additional-config-sources-{{ $idx }} + mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/" + {{- end }} + {{- include "gitea.init-additional-mounts" . | nindent 4 }} + {{- with $config.volumeMounts }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }} + securityContext: + {{- . | nindent 4 }} + {{- end }} + resources: + {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }} +{{- end }} + +{{/* initConfigureGPG */}} + +{{- define "gitea.initContainer.initConfigureGPG" -}} +{{- $config := .Values.deployment.initConfigureGPG -}} +{{- if .Values.secrets.gpg.enabled -}} +- name: configure-gpg + image: "{{ include "gitea.image.name" (list . $config.image) }}" + {{- if .Values.gitea.extraEnvSourceFile }} + command: + - "/bin/bash" + - "-c" + args: + - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh" + {{- else }} + command: + - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh" + {{- end }} + imagePullPolicy: {{ $config.image.pullPolicy }} + {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }} + securityContext: + {{- . | nindent 4 }} + {{- end }} + env: + - name: GNUPGHOME + valueFrom: + secretKeyRef: + name: {{ include "gitea.secret.gpg.name" . }} + key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} + - name: TMP_RAW_GPG_KEY + value: /raw/private.asc + {{- with $config.env }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $config.envFrom }} + envFrom: + {{- toYaml . | nindent 4 }} + {{- end }} + volumeMounts: + - name: init + mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} + - name: data + mountPath: /data + {{- if .Values.persistence.subPath }} + subPath: {{ .Values.persistence.subPath }} + {{- end }} + - name: gpg-private-key + mountPath: /raw + readOnly: true + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 4 }} + {{- end }} + {{- with $config.volumeMounts }} + {{- toYaml . | nindent 4 }} + {{- end }} + resources: + {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }} +{{- end }} +{{- end }} + +{{/* initConfigureGitea */}} + +{{- define "gitea.initContainer.initConfigureGitea" -}} +{{- $config := .Values.deployment.initConfigureGitea -}} +- name: configure-gitea + image: "{{ include "gitea.image.name" (list . $config.image) }}" + {{- if .Values.gitea.extraEnvSourceFile }} + command: + - "/bin/bash" + - "-c" + args: + - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh" + {{- else }} + command: + - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh" + {{- end }} + imagePullPolicy: {{ $config.image.pullPolicy }} + {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }} + securityContext: + {{- . | nindent 4 }} + {{- end }} + env: + - name: GITEA_APP_INI + value: /data/gitea/conf/app.ini + - name: GITEA_CUSTOM + value: /data/gitea + - name: GITEA_WORK_DIR + value: /data + - name: GITEA_TEMP + value: /tmp/gitea + {{- if $config.image.rootless }} + - name: HOME + value: /data/gitea/git + {{- end }} + {{- if .Values.gitea.ldap }} + {{- range $idx, $value := .Values.gitea.ldap }} + {{- if $value.existingSecret }} + - name: GITEA_LDAP_BIND_DN_{{ $idx }} + valueFrom: + secretKeyRef: + key: bindDn + name: {{ $value.existingSecret }} + - name: GITEA_LDAP_PASSWORD_{{ $idx }} + valueFrom: + secretKeyRef: + key: bindPassword + name: {{ $value.existingSecret }} + {{- else }} + - name: GITEA_LDAP_BIND_DN_{{ $idx }} + value: {{ $value.bindDn | quote }} + - name: GITEA_LDAP_PASSWORD_{{ $idx }} + value: {{ $value.bindPassword | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.gitea.oauth }} + {{- range $idx, $value := .Values.gitea.oauth }} + {{- if $value.existingSecret }} + - name: GITEA_OAUTH_KEY_{{ $idx }} + valueFrom: + secretKeyRef: + key: key + name: {{ $value.existingSecret }} + - name: GITEA_OAUTH_SECRET_{{ $idx }} + valueFrom: + secretKeyRef: + key: secret + name: {{ $value.existingSecret }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.secrets.admin.enabled }} + - name: GITEA_ADMIN_USERNAME + valueFrom: + secretKeyRef: + key: {{ include "gitea.secret.admin.usernameKey" . }} + name: {{ include "gitea.secret.admin.name" . }} + - name: GITEA_ADMIN_PASSWORD + valueFrom: + secretKeyRef: + key: {{ include "gitea.secret.admin.passwordKey" . }} + name: {{ include "gitea.secret.admin.name" . }} + - name: GITEA_ADMIN_EMAIL + valueFrom: + secretKeyRef: + key: {{ include "gitea.secret.admin.emailKey" . }} + name: {{ include "gitea.secret.admin.name" . }} + - name: GITEA_ADMIN_PASSWORD_MODE + value: {{ include "gitea.secret.admin.passwordMode" $ }} + {{- end }} + {{- if .Values.deployment.gitea.env }} + {{- toYaml .Values.deployment.gitea.env | nindent 4 }} + {{- end }} + {{- with $config.env }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $config.envFrom }} + envFrom: + {{- toYaml . | nindent 4 }} + {{- end }} + volumeMounts: + - name: init + mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} + - name: temp + mountPath: /tmp + - name: data + mountPath: /data + {{- if .Values.persistence.subPath }} + subPath: {{ .Values.persistence.subPath }} + {{- end }} + {{- include "gitea.init-additional-mounts" . | nindent 4 }} + {{- with $config.volumeMounts }} + {{- toYaml . | nindent 4 }} + {{- end }} + resources: + {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }} +{{- end }} diff --git a/templates/gitea/_pods.tpl b/templates/gitea/_pods.tpl new file mode 100644 index 0000000..8b30928 --- /dev/null +++ b/templates/gitea/_pods.tpl @@ -0,0 +1,52 @@ +--- + +{{/* annotations */}} + +{{- define "gitea.pod.annotations" -}} + +{{/* secret - admin */}} +{{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }} +checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }} +{{- end }} + +{{/* secret - config */}} +{{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }} +checksum/config: {{ include "gitea.secret.checksum" (list . "config") }} +{{- end }} + +{{/* secret - gpg */}} +{{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }} +checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }} +{{- end }} + +{{/* secret - init */}} +{{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }} +checksum/init: {{ include "gitea.secret.checksum" (list . "init") }} +{{- end }} + +{{/* secret - inlineConfig */}} +{{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }} +checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }} +{{- end }} + +{{/* secret - metrics */}} +{{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }} +checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }} +{{- end }} + +{{/* secret - ldap */}} +{{- range $idx, $value := .Values.gitea.ldap }} +checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }} +{{- end }} + +{{/* secret - oauth */}} +{{- range $idx, $value := .Values.gitea.oauth }} +checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }} +{{- end }} + +{{/* custom pod annotations */}} +{{- with .Values.gitea.podAnnotations }} +{{ toYaml . }} +{{- end }} + +{{- end }} \ No newline at end of file diff --git a/templates/gitea/_secrets.tpl b/templates/gitea/_secrets.tpl index 1aa8aa5..fc17628 100644 --- a/templates/gitea/_secrets.tpl +++ b/templates/gitea/_secrets.tpl @@ -38,6 +38,27 @@ {{- end }} {{- end }} +{{/* checksums */}} + +{{/* +SHA sum of a Secret, used to trigger a rollout whenever its content changes. +User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the +cluster still holds their pre-upgrade state. +Arguments: (list $root $key) +*/}} +{{- define "gitea.secret.checksum" -}} +{{- $root := index . 0 -}} +{{- $key := index . 1 -}} +{{- if (index $root.Values.secrets $key).existingSecret.enabled -}} +{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}} +{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}} +{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}} +{{- else -}} +{{- include (printf "%s/gitea/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}} +{{- end -}} +{{- end }} + + {{/* labels */}} {{- define "gitea.secret.admin.labels" -}} diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml index 5a04098..42b40d2 100644 --- a/templates/gitea/deployment.yaml +++ b/templates/gitea/deployment.yaml @@ -26,34 +26,10 @@ spec: {{- include "gitea.selectorLabels" . | nindent 6 }} template: metadata: + {{- with (include "gitea.pod.annotations" . | fromYaml) }} annotations: - {{- if and .Values.secrets.admin.addSHASumAnnotation (not .Values.secrets.admin.existingSecret.enabled) }} - checksum/admin: {{ include (print $.Template.BasePath "/gitea/secret_admin.yaml") . | sha256sum }} - {{- end }} - {{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }} - checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }} - {{- end }} - {{- if and .Values.secrets.gpg.addSHASumAnnotation (not .Values.secrets.gpg.existingSecret.enabled) }} - checksum/gpg: {{ include (print $.Template.BasePath "/gitea/secret_gpg.yaml") . | sha256sum }} - {{- end }} - {{- if and .Values.secrets.init.addSHASumAnnotation (not .Values.secrets.init.existingSecret.enabled) }} - checksum/init: {{ include (print $.Template.BasePath "/gitea/secret_init.yaml") . | sha256sum }} - {{- end }} - {{- if and .Values.secrets.inlineConfig.addSHASumAnnotation (not .Values.secrets.inlineConfig.existingSecret.enabled) }} - checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }} - {{- end }} - {{- if and .Values.secrets.metrics.addSHASumAnnotation (not .Values.secrets.metrics.existingSecret.enabled) }} - checksum/metrics: {{ include (print $.Template.BasePath "/gitea/secret_metrics.yaml") . | sha256sum }} - {{- end }} - {{- range $idx, $value := .Values.gitea.ldap }} - checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }} - {{- end }} - {{- range $idx, $value := .Values.gitea.oauth }} - checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }} - {{- end }} - {{- with .Values.gitea.podAnnotations }} {{- toYaml . | nindent 8 }} - {{- end }} + {{- end }} labels: {{- include "gitea.labels" . | nindent 8 }} {{- if .Values.deployment.labels }} @@ -63,7 +39,6 @@ spec: {{- $hostUsers := include "gitea.hostUsers" . | trim }} {{- $securityContext := include "gitea.deployment.securityContext" . | trim }} {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }} - {{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }} {{- if .Values.deployment.schedulerName }} schedulerName: "{{ .Values.deployment.schedulerName }}" {{- end }} @@ -82,253 +57,7 @@ spec: {{- $securityContext | nindent 8 }} {{- end }} initContainers: - {{- if .Values.preExtraInitContainers }} - {{- toYaml .Values.preExtraInitContainers | nindent 8 }} - {{- end }} - - name: init-directories - image: "{{ include "gitea.image" . }}" - imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }} - command: - - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh" - env: - - name: GITEA_APP_INI - value: /data/gitea/conf/app.ini - - name: GITEA_CUSTOM - value: /data/gitea - - name: GITEA_WORK_DIR - value: /data - - name: GITEA_TEMP - value: /tmp/gitea - {{- if .Values.deployment.gitea.env }} - {{- toYaml .Values.deployment.gitea.env | nindent 12 }} - {{- end }} - {{- if .Values.secrets.gpg.enabled }} - - name: GNUPGHOME - valueFrom: - secretKeyRef: - name: {{ include "gitea.secret.gpg.name" . }} - key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} - {{- end }} - volumeMounts: - - name: init - mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} - - name: temp - mountPath: /tmp - - name: data - mountPath: /data - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - {{- include "gitea.init-additional-mounts" . | nindent 12 }} - {{- if $containerSecurityContext }} - securityContext: - {{- $containerSecurityContext | nindent 12 }} - {{- end }} - resources: - {{- toYaml .Values.initContainers.resources | nindent 12 }} - - name: init-app-ini - image: "{{ include "gitea.image" . }}" - imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }} - {{- if .Values.gitea.extraEnvSourceFile }} - command: - - "/bin/bash" - - "-c" - args: - - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh" - {{- else }} - command: - - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh" - {{- end }} - env: - - name: GITEA_APP_INI - value: /data/gitea/conf/app.ini - - name: GITEA_CUSTOM - value: /data/gitea - - name: GITEA_WORK_DIR - value: /data - - name: GITEA_TEMP - value: /tmp/gitea - - name: TMP_EXISTING_ENVS_FILE - value: /tmp/existing-envs - - name: ENV_TO_INI_MOUNT_POINT - value: /env-to-ini-mounts - {{- if .Values.deployment.gitea.env }} - {{- toYaml .Values.deployment.gitea.env | nindent 12 }} - {{- end }} - {{- if .Values.gitea.additionalConfigFromEnvs }} - {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }} - {{- end }} - volumeMounts: - - name: config - mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} - - name: temp - mountPath: /tmp - - name: data - mountPath: /data - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - name: inline-config-sources - mountPath: /env-to-ini-mounts/inlines/ - {{- range $idx, $value := .Values.gitea.additionalConfigSources }} - - name: additional-config-sources-{{ $idx }} - mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/" - {{- end }} - {{- include "gitea.init-additional-mounts" . | nindent 12 }} - {{- if $containerSecurityContext }} - securityContext: - {{- $containerSecurityContext | nindent 12 }} - {{- end }} - resources: - {{- toYaml .Values.initContainers.resources | nindent 12 }} - {{- if .Values.secrets.gpg.enabled }} - - name: configure-gpg - image: "{{ include "gitea.image" . }}" - {{- if .Values.gitea.extraEnvSourceFile }} - command: - - "/bin/bash" - - "-c" - args: - - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh" - {{- else }} - command: - - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh" - {{- end }} - imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }} - {{- if $commandInitContainerSecurityContext }} - securityContext: - {{- $commandInitContainerSecurityContext | nindent 12 }} - {{- end }} - env: - - name: GNUPGHOME - valueFrom: - secretKeyRef: - name: {{ include "gitea.secret.gpg.name" . }} - key: {{ include "gitea.secret.gpg.gpgHomeKey" . }} - - name: TMP_RAW_GPG_KEY - value: /raw/private.asc - volumeMounts: - - name: init - mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} - - name: data - mountPath: /data - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - name: gpg-private-key - mountPath: /raw - readOnly: true - {{- if .Values.extraVolumeMounts }} - {{- toYaml .Values.extraVolumeMounts | nindent 12 }} - {{- end }} - resources: - {{- toYaml .Values.initContainers.resources | nindent 12 }} - {{- end }} - - name: configure-gitea - image: "{{ include "gitea.image" . }}" - {{- if .Values.gitea.extraEnvSourceFile }} - command: - - "/bin/bash" - - "-c" - args: - - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh" - {{- else }} - command: - - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh" - {{- end }} - imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }} - {{- if $commandInitContainerSecurityContext }} - securityContext: - {{- $commandInitContainerSecurityContext | nindent 12 }} - {{- end }} - env: - - name: GITEA_APP_INI - value: /data/gitea/conf/app.ini - - name: GITEA_CUSTOM - value: /data/gitea - - name: GITEA_WORK_DIR - value: /data - - name: GITEA_TEMP - value: /tmp/gitea - {{- if .Values.deployment.gitea.image.rootless }} - - name: HOME - value: /data/gitea/git - {{- end }} - {{- if .Values.gitea.ldap }} - {{- range $idx, $value := .Values.gitea.ldap }} - {{- if $value.existingSecret }} - - name: GITEA_LDAP_BIND_DN_{{ $idx }} - valueFrom: - secretKeyRef: - key: bindDn - name: {{ $value.existingSecret }} - - name: GITEA_LDAP_PASSWORD_{{ $idx }} - valueFrom: - secretKeyRef: - key: bindPassword - name: {{ $value.existingSecret }} - {{- else }} - - name: GITEA_LDAP_BIND_DN_{{ $idx }} - value: {{ $value.bindDn | quote }} - - name: GITEA_LDAP_PASSWORD_{{ $idx }} - value: {{ $value.bindPassword | quote }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.gitea.oauth }} - {{- range $idx, $value := .Values.gitea.oauth }} - {{- if $value.existingSecret }} - - name: GITEA_OAUTH_KEY_{{ $idx }} - valueFrom: - secretKeyRef: - key: key - name: {{ $value.existingSecret }} - - name: GITEA_OAUTH_SECRET_{{ $idx }} - valueFrom: - secretKeyRef: - key: secret - name: {{ $value.existingSecret }} - {{- end }} - {{- end }} - {{- end }} - {{- if .Values.secrets.admin.enabled }} - - name: GITEA_ADMIN_USERNAME - valueFrom: - secretKeyRef: - key: {{ include "gitea.secret.admin.usernameKey" . }} - name: {{ include "gitea.secret.admin.name" . }} - - name: GITEA_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - key: {{ include "gitea.secret.admin.passwordKey" . }} - name: {{ include "gitea.secret.admin.name" . }} - - name: GITEA_ADMIN_EMAIL - valueFrom: - secretKeyRef: - key: {{ include "gitea.secret.admin.emailKey" . }} - name: {{ include "gitea.secret.admin.name" . }} - - name: GITEA_ADMIN_PASSWORD_MODE - value: {{ include "gitea.secret.admin.passwordMode" $ }} - {{- end }} - {{- if .Values.deployment.gitea.env }} - {{- toYaml .Values.deployment.gitea.env | nindent 12 }} - {{- end }} - volumeMounts: - - name: init - mountPath: {{ .Values.initContainersScriptsVolumeMountPath }} - - name: temp - mountPath: /tmp - - name: data - mountPath: /data - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - {{- include "gitea.init-additional-mounts" . | nindent 12 }} - resources: - {{- toYaml .Values.initContainers.resources | nindent 12 }} - {{- if .Values.postExtraInitContainers }} - {{- toYaml .Values.postExtraInitContainers | nindent 8 }} - {{- end }} + {{- include "gitea.deployment.initContainers" . | trim | nindent 8 }} terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }} containers: - name: {{ .Chart.Name }} @@ -377,6 +106,10 @@ spec: {{- if .Values.deployment.gitea.env }} {{- toYaml .Values.deployment.gitea.env | nindent 12 }} {{- end }} + {{- with .Values.deployment.gitea.envFrom }} + envFrom: + {{- toYaml . | nindent 12 }} + {{- end }} ports: - name: ssh containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }} diff --git a/templates/gitea/deprecation.yaml b/templates/gitea/deprecation.yaml index d7d573b..d244808 100644 --- a/templates/gitea/deprecation.yaml +++ b/templates/gitea/deprecation.yaml @@ -85,6 +85,16 @@ {{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}} {{- end -}} + {{/* POST EXTRA INIT CONTAINERS */}} + {{- if .Values.postExtraInitContainers -}} + {{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}} + {{- end -}} + + {{/* PRE EXTRA INIT CONTAINERS */}} + {{- if .Values.preExtraInitContainers -}} + {{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}} + {{- end -}} + {{/* RESOURCES */}} {{- if .Values.resources -}} {{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}} diff --git a/unittests/helm/deployment/checksum-annotations.yaml b/unittests/helm/deployment/checksum-annotations.yaml index 16e1904..3e0acda 100644 --- a/unittests/helm/deployment/checksum-annotations.yaml +++ b/unittests/helm/deployment/checksum-annotations.yaml @@ -11,29 +11,18 @@ templates: - templates/gitea/secret_inlineConfig.yaml - templates/gitea/secret_metrics.yaml tests: - - it: adds a checksum annotation for every Secret by default - template: templates/gitea/deployment.yaml - asserts: - - exists: - path: spec.template.metadata.annotations["checksum/admin"] - - exists: - path: spec.template.metadata.annotations["checksum/config"] - - exists: - path: spec.template.metadata.annotations["checksum/init"] - - exists: - path: spec.template.metadata.annotations["checksum/inlineConfig"] - - exists: - path: spec.template.metadata.annotations["checksum/metrics"] - - - it: omits the checksum annotations when addSHASumAnnotation is disabled + - it: omits the checksum annotations by default template: templates/gitea/deployment.yaml set: - secrets.admin.addSHASumAnnotation: false - secrets.config.addSHASumAnnotation: false - secrets.gpg.addSHASumAnnotation: false - secrets.init.addSHASumAnnotation: false - secrets.inlineConfig.addSHASumAnnotation: false - secrets.metrics.addSHASumAnnotation: false + secrets.admin.enabled: true + secrets.config.enabled: true + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: | + -----BEGIN PGP PRIVATE KEY BLOCK----- + -----END PGP PRIVATE KEY BLOCK----- + secrets.init.enabled: true + secrets.inlineConfig.enabled: true + secrets.metrics.enabled: true asserts: - notExists: path: spec.template.metadata.annotations["checksum/admin"] @@ -48,33 +37,66 @@ tests: - notExists: path: spec.template.metadata.annotations["checksum/metrics"] + - it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled + template: templates/gitea/deployment.yaml + set: + secrets.admin.addSHASumAnnotation: true + secrets.admin.enabled: true + + secrets.config.addSHASumAnnotation: true + secrets.config.enabled: true + + secrets.gpg.addSHASumAnnotation: true + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: | + -----BEGIN PGP PRIVATE KEY BLOCK----- + -----END PGP PRIVATE KEY BLOCK----- + + secrets.init.addSHASumAnnotation: true + secrets.init.enabled: true + + secrets.inlineConfig.addSHASumAnnotation: true + secrets.inlineConfig.enabled: true + + secrets.metrics.addSHASumAnnotation: true + secrets.metrics.enabled: true + asserts: + - exists: + path: spec.template.metadata.annotations["checksum/admin"] + - exists: + path: spec.template.metadata.annotations["checksum/config"] + - exists: + path: spec.template.metadata.annotations["checksum/gpg"] + - exists: + path: spec.template.metadata.annotations["checksum/init"] + - exists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - exists: + path: spec.template.metadata.annotations["checksum/metrics"] + - it: omits the checksum annotation of a single disabled Secret only template: templates/gitea/deployment.yaml set: - secrets.init.addSHASumAnnotation: false - asserts: - - exists: - path: spec.template.metadata.annotations["checksum/config"] - - notExists: - path: spec.template.metadata.annotations["checksum/init"] - - exists: - path: spec.template.metadata.annotations["checksum/inlineConfig"] + secrets.admin.addSHASumAnnotation: false + secrets.admin.enabled: true - - it: omits the checksum annotations of Secrets provided by the user - template: templates/gitea/deployment.yaml - set: - secrets.admin.existingSecret.enabled: true - secrets.admin.existingSecret.secretName: custom-admin - secrets.config.existingSecret.enabled: true - secrets.config.existingSecret.secretName: custom-config - secrets.gpg.existingSecret.enabled: true - secrets.gpg.existingSecret.secretName: custom-gpg - secrets.init.existingSecret.enabled: true - secrets.init.existingSecret.secretName: custom-init - secrets.inlineConfig.existingSecret.enabled: true - secrets.inlineConfig.existingSecret.secretName: custom-inline-config - secrets.metrics.existingSecret.enabled: true - secrets.metrics.existingSecret.secretName: custom-metrics + secrets.config.addSHASumAnnotation: false + secrets.config.enabled: true + + secrets.gpg.addSHASumAnnotation: false + secrets.gpg.enabled: true + secrets.gpg.new.privateKey: | + -----BEGIN PGP PRIVATE KEY BLOCK----- + -----END PGP PRIVATE KEY BLOCK----- + + secrets.init.addSHASumAnnotation: false + secrets.init.enabled: true + + secrets.inlineConfig.addSHASumAnnotation: false + secrets.inlineConfig.enabled: true + + secrets.metrics.addSHASumAnnotation: false + secrets.metrics.enabled: true asserts: - notExists: path: spec.template.metadata.annotations["checksum/admin"] @@ -88,3 +110,49 @@ tests: path: spec.template.metadata.annotations["checksum/inlineConfig"] - notExists: path: spec.template.metadata.annotations["checksum/metrics"] + + - it: adds the checksum of Secrets provided by the user + template: templates/gitea/deployment.yaml + set: + secrets.admin.enabled: true + secrets.admin.addSHASumAnnotation: true + secrets.admin.existingSecret.enabled: true + secrets.admin.existingSecret.secretName: custom-admin + + secrets.config.enabled: true + secrets.config.addSHASumAnnotation: true + secrets.config.existingSecret.enabled: true + secrets.config.existingSecret.secretName: custom-config + + secrets.gpg.enabled: true + secrets.gpg.addSHASumAnnotation: true + secrets.gpg.existingSecret.enabled: true + secrets.gpg.existingSecret.secretName: custom-gpg + + secrets.init.enabled: true + secrets.init.addSHASumAnnotation: true + secrets.init.existingSecret.enabled: true + secrets.init.existingSecret.secretName: custom-init + + secrets.inlineConfig.enabled: true + secrets.inlineConfig.addSHASumAnnotation: true + secrets.inlineConfig.existingSecret.enabled: true + secrets.inlineConfig.existingSecret.secretName: custom-inline-config + + secrets.metrics.enabled: true + secrets.metrics.addSHASumAnnotation: true + secrets.metrics.existingSecret.enabled: true + secrets.metrics.existingSecret.secretName: custom-metrics + asserts: + - exists: + path: spec.template.metadata.annotations["checksum/admin"] + - exists: + path: spec.template.metadata.annotations["checksum/config"] + - exists: + path: spec.template.metadata.annotations["checksum/gpg"] + - exists: + path: spec.template.metadata.annotations["checksum/init"] + - exists: + path: spec.template.metadata.annotations["checksum/inlineConfig"] + - exists: + path: spec.template.metadata.annotations["checksum/metrics"] diff --git a/unittests/helm/deployment/deprecations.yaml b/unittests/helm/deployment/deprecations.yaml index 5c9447f..42be631 100644 --- a/unittests/helm/deployment/deprecations.yaml +++ b/unittests/helm/deployment/deprecations.yaml @@ -83,6 +83,22 @@ tests: asserts: - failedTemplate: errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." + - it: fails when the removed `postExtraInitContainers` value is set + set: + postExtraInitContainers: + - name: post-init-container + image: docker.io/library/busybox + asserts: + - failedTemplate: + errorMessage: "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." + - it: fails when the removed `preExtraInitContainers` value is set + set: + preExtraInitContainers: + - name: pre-init-container + image: docker.io/library/busybox + asserts: + - failedTemplate: + errorMessage: "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." - it: fails when the removed `resources` value is set set: resources: @@ -158,6 +174,12 @@ tests: foo: bar podSecurityContext: fsGroup: 1000 + postExtraInitContainers: + - name: post-init-container + image: docker.io/library/busybox + preExtraInitContainers: + - name: pre-init-container + image: docker.io/library/busybox priorityClassName: high-priority replicaCount: 2 resources: diff --git a/unittests/helm/deployment/extraInitContainers.yaml b/unittests/helm/deployment/extraInitContainers.yaml index 3e8f1a9..0cbecf8 100644 --- a/unittests/helm/deployment/extraInitContainers.yaml +++ b/unittests/helm/deployment/extraInitContainers.yaml @@ -37,12 +37,17 @@ tests: - it: Render the deployment (extraInitContainers) set: - postExtraInitContainers: - - name: foo - image: docker.io/library/busybox:latest - preExtraInitContainers: - - name: bar - image: docker.io/library/busybox:latest + deployment.initContainers: + - container: + name: bar + image: docker.io/library/busybox:latest + - link: "initDirectories" + - link: "initAppIni" + - link: "initConfigureGPG" + - link: "initConfigureGitea" + - container: + name: foo + image: docker.io/library/busybox:latest secrets.gpg.enabled: true secrets.gpg.existingSecret.enabled: true secrets.gpg.existingSecret.secretName: "custom-gpg-secret" @@ -54,15 +59,55 @@ tests: path: spec.template.spec.initContainers count: 6 template: templates/gitea/deployment.yaml - - contains: - path: spec.template.spec.initContainers - content: + - equal: + path: spec.template.spec.initContainers[0].name + value: bar + template: templates/gitea/deployment.yaml + - equal: + path: spec.template.spec.initContainers[5].name + value: foo + template: templates/gitea/deployment.yaml + + - it: renders the chart-managed init containers in the configured order + template: templates/gitea/deployment.yaml + set: + deployment.initContainers: + - link: "initConfigureGitea" + - link: "initDirectories" + asserts: + - equal: + path: spec.template.spec.initContainers[0].name + value: configure-gitea + - equal: + path: spec.template.spec.initContainers[1].name + value: init-directories + + - it: fails when an init container entry sets both container and link + template: templates/gitea/deployment.yaml + set: + deployment.initContainers: + - link: "initDirectories" + container: name: foo image: docker.io/library/busybox:latest - template: templates/gitea/deployment.yaml - - contains: - path: spec.template.spec.initContainers - content: - name: bar - image: docker.io/library/busybox:latest - template: templates/gitea/deployment.yaml + asserts: + - failedTemplate: + errorMessage: "deployment.initContainers[0]: `container` and `link` are mutually exclusive" + + - it: fails when an init container entry sets neither container nor link + template: templates/gitea/deployment.yaml + set: + deployment.initContainers: + - name: foo + asserts: + - failedTemplate: + errorMessage: "deployment.initContainers[0]: either `container` or `link` must be set" + + - it: fails when an init container links to an unknown configuration + template: templates/gitea/deployment.yaml + set: + deployment.initContainers: + - link: "initSomething" + asserts: + - failedTemplate: + errorMessage: "deployment.initContainers[0]: unknown link `initSomething`, expected one of: initAppIni, initConfigureGPG, initConfigureGitea, initDirectories" diff --git a/unittests/helm/deployment/image-configuration.yaml b/unittests/helm/deployment/image-configuration.yaml index c614269..d463cd9 100644 --- a/unittests/helm/deployment/image-configuration.yaml +++ b/unittests/helm/deployment/image-configuration.yaml @@ -105,7 +105,11 @@ tests: - it: correctly renders floating tag references template: templates/gitea/deployment.yaml set: - deployment.gitea.image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631 + # use non-quoted values on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631 + deployment.gitea.image.tag: 1.21 + deployment.initDirectories.image.tag: 1.21 + deployment.initAppIni.image.tag: 1.21 + deployment.initConfigureGitea.image.tag: 1.21 asserts: - equal: path: spec.template.spec.initContainers[0].image @@ -119,3 +123,18 @@ tests: - equal: path: spec.template.spec.containers[0].image value: "docker.gitea.com/gitea:1.21-rootless" + - it: init containers use their own image configuration + template: templates/gitea/deployment.yaml + set: + deployment.initDirectories.image.registry: "init.example.com" + deployment.initDirectories.image.tag: "1.19.4" + asserts: + - equal: + path: spec.template.spec.initContainers[0].image + value: "init.example.com/gitea:1.19.4-rootless" + - equal: + path: spec.template.spec.initContainers[1].image + value: "docker.gitea.com/gitea:1.19.3-rootless" + - equal: + path: spec.template.spec.containers[0].image + value: "docker.gitea.com/gitea:1.19.3-rootless" diff --git a/unittests/helm/deployment/initContainerConfiguration.yaml b/unittests/helm/deployment/initContainerConfiguration.yaml new file mode 100644 index 0000000..c876c57 --- /dev/null +++ b/unittests/helm/deployment/initContainerConfiguration.yaml @@ -0,0 +1,130 @@ +suite: deployment template (init container configuration) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/deployment.yaml + - templates/gitea/secret_admin.yaml + - templates/gitea/secret_config.yaml + - templates/gitea/secret_gpg.yaml + - templates/gitea/secret_init.yaml + - templates/gitea/secret_inlineConfig.yaml + - templates/gitea/secret_metrics.yaml +tests: + - it: appends the per-container env + template: templates/gitea/deployment.yaml + set: + deployment.initDirectories.env: + - name: INIT_DIRECTORIES + value: "1" + deployment.gitea.env: + - name: SHARED + value: "1" + asserts: + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: INIT_DIRECTORIES + value: "1" + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: SHARED + value: "1" + - notContains: + path: spec.template.spec.initContainers[1].env + content: + name: INIT_DIRECTORIES + value: "1" + + - it: renders the per-container envFrom + template: templates/gitea/deployment.yaml + set: + deployment.initAppIni.envFrom: + - secretRef: + name: special-secret + asserts: + - notExists: + path: spec.template.spec.initContainers[0].envFrom + - equal: + path: spec.template.spec.initContainers[1].envFrom + value: + - secretRef: + name: special-secret + + - it: appends the per-container volumeMounts + template: templates/gitea/deployment.yaml + set: + deployment.initConfigureGitea.volumeMounts: + - name: my-configmap-volume + mountPath: /configmap + readOnly: true + asserts: + - contains: + path: spec.template.spec.initContainers[2].volumeMounts + content: + name: my-configmap-volume + mountPath: /configmap + readOnly: true + - notContains: + path: spec.template.spec.initContainers[0].volumeMounts + content: + name: my-configmap-volume + mountPath: /configmap + readOnly: true + + - it: overrides the resources of a single init container + template: templates/gitea/deployment.yaml + set: + deployment.initDirectories.resources: + requests: + cpu: 500m + asserts: + - equal: + path: spec.template.spec.initContainers[0].resources + value: + requests: + cpu: 500m + - equal: + path: spec.template.spec.initContainers[1].resources + value: + limits: {} + requests: + cpu: 100m + memory: 128Mi + + - it: overrides the security context of a single init container + template: templates/gitea/deployment.yaml + set: + deployment.gitea.securityContext: + runAsUser: 1000 + deployment.initDirectories.securityContext: + runAsUser: 2000 + asserts: + - equal: + path: spec.template.spec.initContainers[0].securityContext.runAsUser + value: 2000 + - equal: + path: spec.template.spec.initContainers[1].securityContext.runAsUser + value: 1000 + + - it: renders the envFrom of the gitea container + template: templates/gitea/deployment.yaml + set: + deployment.gitea.envFrom: + - configMapRef: + name: special-config + asserts: + - equal: + path: spec.template.spec.containers[0].envFrom + value: + - configMapRef: + name: special-config + + - it: omits envFrom when unset + template: templates/gitea/deployment.yaml + asserts: + - notExists: + path: spec.template.spec.containers[0].envFrom + - notExists: + path: spec.template.spec.initContainers[0].envFrom diff --git a/values.yaml b/values.yaml index fe01cea..29214a6 100644 --- a/values.yaml +++ b/values.yaml @@ -67,6 +67,13 @@ deployment: # - name: VARIABLE # value: my-value + ## @param deployment.gitea.envFrom List of environment variables mounted from configMaps or secrets for the gitea container. + envFrom: [] + # - configMapRef: + # name: special-config + # - secretRef: + # name: special-secret + ## @param deployment.gitea.image.registry image registry, e.g. gcr.io,docker.io ## @param deployment.gitea.image.repository Image to start for this pod ## @param deployment.gitea.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. @@ -101,7 +108,7 @@ deployment: # cpu: 100m # memory: 128Mi - ## @param deployment.gitea.securityContext Security context of the Gitea container and the chart-managed init containers. + ## @param deployment.gitea.securityContext Security context of the Gitea container. Used as fallback for the chart-managed init containers. securityContext: {} # allowPrivilegeEscalation: false # capabilities: @@ -126,6 +133,305 @@ deployment: # mountPath: /configmap # readOnly: true + ## @param deployment.initContainers [array] List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. + initContainers: + # - container: + # command: [ "sh", "-c", "echo hello world" ] + # image: "docker.io/library/busybox:latest" + # name: pre-task + - link: "initDirectories" + - link: "initAppIni" + - link: "initConfigureGPG" + - link: "initConfigureGitea" + # - container: + # command: [ "sh", "-c", "echo hello world" ] + # image: "docker.io/library/busybox:latest" + # name: post-task + + initDirectories: + ## @param deployment.initDirectories.env Additional environment variables to pass to the init container. + env: [] + # - name: VARIABLE + # value: my-value + + ## @param deployment.initDirectories.envFrom List of environment variables mounted from configMaps or secrets for the initDirectories container. + envFrom: [] + # - configMapRef: + # name: special-config + # - secretRef: + # name: special-secret + + ## @param deployment.initDirectories.image.registry image registry, e.g. gcr.io,docker.io + ## @param deployment.initDirectories.image.repository Image to start for this pod + ## @param deployment.initDirectories.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. + ## @param deployment.initDirectories.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` + ## @param deployment.initDirectories.image.pullPolicy Image pull policy + ## @param deployment.initDirectories.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher + ## @param deployment.initDirectories.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initDirectories.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** + image: + registry: "docker.gitea.com" + repository: gitea + tag: "" + digest: "" + pullPolicy: IfNotPresent + rootless: true + fullOverride: "" + + ## @param deployment.initDirectories.resources Compute Resources required by the initDirectories container. Defaults to `initContainers.resources`. Cannot be updated. + ## @skip deployment.initDirectories.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. + ## @skip deployment.initDirectories.resources.limits Limits describes the maximum amount of compute resources allowed for this container. + ## @skip deployment.initDirectories.resources.requests Requests describes the minimum amount of compute resources required for this container. + resources: + # claims: [] + # - name: "" + # request: "" + # limits: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + # requests: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + + ## @param deployment.initDirectories.securityContext Security context of the initDirectories container. Defaults to `deployment.gitea.securityContext`. + securityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # # Add the SYS_CHROOT capability for root and rootless images if you intend to + # # run pods on nodes that use the container runtime cri-o. Otherwise, you will + # # get an error message from the SSH server that it is not possible to read from + # # the repository. + # # https://gitea.com/gitea/helm-gitea/issues/161 + # add: + # - SYS_CHROOT + # privileged: false + # readOnlyRootFilesystem: true + # runAsGroup: 1000 + # runAsNonRoot: true + # runAsUser: 1000 + + ## @param deployment.initDirectories.volumeMounts Additional volume mounts. + volumeMounts: [] + # - name: my-configmap-volume + # mountPath: /configmap + # readOnly: true + + initAppIni: + ## @param deployment.initAppIni.env Additional environment variables to pass to the init container. + env: [] + # - name: VARIABLE + # value: my-value + + ## @param deployment.initAppIni.envFrom List of environment variables mounted from configMaps or secrets for the initAppIni container. + envFrom: [] + # - configMapRef: + # name: special-config + # - secretRef: + # name: special-secret + + ## @param deployment.initAppIni.image.registry image registry, e.g. gcr.io,docker.io + ## @param deployment.initAppIni.image.repository Image to start for this pod + ## @param deployment.initAppIni.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. + ## @param deployment.initAppIni.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` + ## @param deployment.initAppIni.image.pullPolicy Image pull policy + ## @param deployment.initAppIni.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher + ## @param deployment.initAppIni.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initAppIni.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** + image: + registry: "docker.gitea.com" + repository: gitea + tag: "" + digest: "" + pullPolicy: IfNotPresent + rootless: true + fullOverride: "" + + ## @param deployment.initAppIni.resources Compute Resources required by the initAppIni container. Defaults to `initContainers.resources`. Cannot be updated. + ## @skip deployment.initAppIni.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. + ## @skip deployment.initAppIni.resources.limits Limits describes the maximum amount of compute resources allowed for this container. + ## @skip deployment.initAppIni.resources.requests Requests describes the minimum amount of compute resources required for this container. + resources: + # claims: [] + # - name: "" + # request: "" + # limits: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + # requests: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + + ## @param deployment.initAppIni.securityContext Security context of the initAppIni container. Defaults to `deployment.gitea.securityContext`. + securityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # # Add the SYS_CHROOT capability for root and rootless images if you intend to + # # run pods on nodes that use the container runtime cri-o. Otherwise, you will + # # get an error message from the SSH server that it is not possible to read from + # # the repository. + # # https://gitea.com/gitea/helm-gitea/issues/161 + # add: + # - SYS_CHROOT + # privileged: false + # readOnlyRootFilesystem: true + # runAsGroup: 1000 + # runAsNonRoot: true + # runAsUser: 1000 + + ## @param deployment.initAppIni.volumeMounts Additional volume mounts. + volumeMounts: [] + # - name: my-configmap-volume + # mountPath: /configmap + # readOnly: true + + initConfigureGPG: + ## @param deployment.initConfigureGPG.env Additional environment variables to pass to the init container. + env: [] + # - name: VARIABLE + # value: my-value + + ## @param deployment.initConfigureGPG.envFrom List of environment variables mounted from configMaps or secrets for the initConfigureGPG container. + envFrom: [] + # - configMapRef: + # name: special-config + # - secretRef: + # name: special-secret + + ## @param deployment.initConfigureGPG.image.registry image registry, e.g. gcr.io,docker.io + ## @param deployment.initConfigureGPG.image.repository Image to start for this pod + ## @param deployment.initConfigureGPG.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. + ## @param deployment.initConfigureGPG.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` + ## @param deployment.initConfigureGPG.image.pullPolicy Image pull policy + ## @param deployment.initConfigureGPG.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher + ## @param deployment.initConfigureGPG.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGPG.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** + image: + registry: "docker.gitea.com" + repository: gitea + tag: "" + digest: "" + pullPolicy: IfNotPresent + rootless: true + fullOverride: "" + + ## @param deployment.initConfigureGPG.resources Compute Resources required by the initConfigureGPG container. Defaults to `initContainers.resources`. Cannot be updated. + ## @skip deployment.initConfigureGPG.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. + ## @skip deployment.initConfigureGPG.resources.limits Limits describes the maximum amount of compute resources allowed for this container. + ## @skip deployment.initConfigureGPG.resources.requests Requests describes the minimum amount of compute resources required for this container. + resources: + # claims: [] + # - name: "" + # request: "" + # limits: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + # requests: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + + ## @param deployment.initConfigureGPG.securityContext Security context of the initConfigureGPG container. Defaults to `deployment.gitea.securityContext`. + securityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # # Add the SYS_CHROOT capability for root and rootless images if you intend to + # # run pods on nodes that use the container runtime cri-o. Otherwise, you will + # # get an error message from the SSH server that it is not possible to read from + # # the repository. + # # https://gitea.com/gitea/helm-gitea/issues/161 + # add: + # - SYS_CHROOT + # privileged: false + # readOnlyRootFilesystem: true + # runAsGroup: 1000 + # runAsNonRoot: true + # runAsUser: 1000 + + ## @param deployment.initConfigureGPG.volumeMounts Additional volume mounts. + volumeMounts: [] + # - name: my-configmap-volume + # mountPath: /configmap + # readOnly: true + + initConfigureGitea: + ## @param deployment.initConfigureGitea.env Additional environment variables to pass to the init container. + env: [] + # - name: VARIABLE + # value: my-value + + ## @param deployment.initConfigureGitea.envFrom List of environment variables mounted from configMaps or secrets for the initConfigureGitea container. + envFrom: [] + # - configMapRef: + # name: special-config + # - secretRef: + # name: special-secret + + ## @param deployment.initConfigureGitea.image.registry image registry, e.g. gcr.io,docker.io + ## @param deployment.initConfigureGitea.image.repository Image to start for this pod + ## @param deployment.initConfigureGitea.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. + ## @param deployment.initConfigureGitea.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` + ## @param deployment.initConfigureGitea.image.pullPolicy Image pull policy + ## @param deployment.initConfigureGitea.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher + ## @param deployment.initConfigureGitea.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** + image: + registry: "docker.gitea.com" + repository: gitea + tag: "" + digest: "" + pullPolicy: IfNotPresent + rootless: true + fullOverride: "" + + ## @param deployment.initConfigureGitea.resources Compute Resources required by the initConfigureGitea container. Defaults to `initContainers.resources`. Cannot be updated. + ## @skip deployment.initConfigureGitea.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. + ## @skip deployment.initConfigureGitea.resources.limits Limits describes the maximum amount of compute resources allowed for this container. + ## @skip deployment.initConfigureGitea.resources.requests Requests describes the minimum amount of compute resources required for this container. + resources: + # claims: [] + # - name: "" + # request: "" + # limits: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + # requests: + # ephemeral: 100Mi + # cpu: 100m + # memory: 128Mi + + ## @param deployment.initConfigureGitea.securityContext Security context of the initConfigureGitea container. Defaults to `deployment.gitea.securityContext`. + securityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # # Add the SYS_CHROOT capability for root and rootless images if you intend to + # # run pods on nodes that use the container runtime cri-o. Otherwise, you will + # # get an error message from the SSH server that it is not possible to read from + # # the repository. + # # https://gitea.com/gitea/helm-gitea/issues/161 + # add: + # - SYS_CHROOT + # privileged: false + # readOnlyRootFilesystem: true + # runAsGroup: 1000 + # runAsNonRoot: true + # runAsUser: 1000 + + ## @param deployment.initConfigureGitea.volumeMounts Additional volume mounts. + volumeMounts: [] + # - name: my-configmap-volume + # mountPath: /configmap + # readOnly: true + ## @param deployment.nodeSelector NodeSelector for the deployment nodeSelector: {} @@ -362,8 +668,8 @@ secrets: ## @param secrets.admin.enabled Create and keep the Gitea admin user in sync enabled: true - ## @param secrets.admin.addSHASumAnnotation Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change - addSHASumAnnotation: true + ## @param secrets.admin.addSHASumAnnotation Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false ## @param secrets.admin.passwordMode Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated passwordMode: keepUpdated @@ -393,8 +699,11 @@ secrets: username: gitea_admin config: - ## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change - addSHASumAnnotation: true + ## @param secrets.config.enabled Enable mounting of the config Secret. + enabled: true + + ## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false ## @param secrets.config.existingSecret.enabled Use an already existing Secret instead of creating the config Secret ## @param secrets.config.existingSecret.secretName Name of the already existing config Secret @@ -412,8 +721,8 @@ secrets: ## @param secrets.gpg.enabled Enable mounting of a GPG key to sign git commits. enabled: false - ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change - addSHASumAnnotation: true + ## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false ## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret ## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret @@ -440,8 +749,11 @@ secrets: # -----END PGP PRIVATE KEY BLOCK----- init: - ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change - addSHASumAnnotation: true + ## @param secrets.init.enabled Enable mounting of the init Secret. + enabled: true + + ## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false ## @param secrets.init.existingSecret.enabled Use an already existing Secret instead of creating the init Secret ## @param secrets.init.existingSecret.secretName Name of the already existing init Secret @@ -456,8 +768,11 @@ secrets: labels: {} inlineConfig: - ## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change - addSHASumAnnotation: true + ## @param secrets.inlineConfig.enabled Enable mounting of the inline configuration Secret. + enabled: true + + ## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false ## @param secrets.inlineConfig.existingSecret.enabled Use an already existing Secret instead of creating the inline configuration Secret ## @param secrets.inlineConfig.existingSecret.secretName Name of the already existing inline configuration Secret @@ -472,8 +787,11 @@ secrets: labels: {} metrics: - ## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change - addSHASumAnnotation: true + ## @param secrets.metrics.enabled Enable mounting of the metrics Secret. + enabled: true + + ## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). + addSHASumAnnotation: false ## @param secrets.metrics.existingSecret.enabled Use an already existing Secret instead of creating the metrics Secret ## @param secrets.metrics.existingSecret.secretName Name of the already existing metrics Secret @@ -598,17 +916,9 @@ extraContainers: [] # image: busybox # command: [/bin/sh, -c, 'echo "Hello world"'] -## @param preExtraInitContainers Additional init containers to run in the pod before gitea runs it owns init containers. -preExtraInitContainers: [] -# - name: pre-init-container -# image: docker.io/library/busybox -# command: [ /bin/sh, -c, 'echo "Hello world! I am a pre init container."' ] - -## @param postExtraInitContainers Additional init containers to run in the pod after gitea runs it owns init containers. -postExtraInitContainers: [] -# - name: post-init-container -# image: docker.io/library/busybox -# command: [ /bin/sh, -c, 'echo "Hello world! I am a post init container."' ] +## @deprecated The preExtraInitContainers and postExtraInitContainers variables have been replaced by +## deployment.initContainers. Add an entry with a `container` key before or after the linked +## chart-managed init containers to achieve the same result. ## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. extraInitVolumeMounts: []