feat(deployment)!: configurable init containers and Secret checksum lookup
The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources, security context and volume mounts could not be adjusted individually, and custom init containers could only be prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`. The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a free-form `container` definition. This allows custom containers at any position and makes the execution order explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to `deployment.gitea.securityContext` and `initContainers.resources` when unset. To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an arbitrary `image` dict instead of only `deployment.gitea.image`. The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their pre-upgrade state during rendering. Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering (`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The trade-offs are documented in the README so users can make an informed decision. BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a `container` key before or after the linked init containers in `deployment.initContainers` instead. BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep the rollout trigger on Secret changes. Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Copilot
@@ -862,6 +862,30 @@ gitea:
|
||||
podAnnotations: {}
|
||||
```
|
||||
|
||||
### Secret checksum annotations
|
||||
|
||||
Each Secret of the chart has an `addSHASumAnnotation` option (disabled by default). It adds a
|
||||
`checksum/<secret>` pod annotation so that a change to the Secret triggers a rolling update of the
|
||||
Gitea pod.
|
||||
|
||||
The SHA sum is computed differently depending on where the Secret comes from:
|
||||
|
||||
- **Chart-managed Secrets** (`secrets.<secret>.existingSecret.enabled: false`): the SHA sum is
|
||||
computed from the manifest rendered by the chart. The cluster still holds the pre-upgrade state of
|
||||
that Secret during rendering, so it cannot be used as the source.
|
||||
- **User-provided Secrets** (`secrets.<secret>.existingSecret.enabled: true`): the content is unknown
|
||||
to the chart, so the Secret is looked up in the cluster via Helm's `lookup` function.
|
||||
|
||||
The lookup is the reason why the option is disabled by default:
|
||||
|
||||
- The credentials used by Helm need `get` permission on Secrets in the release namespace.
|
||||
- The lookup returns nothing during client-side rendering, for example with `helm template`, during
|
||||
`helm install --dry-run`, or with Argo CD unless the Helm chart is rendered against a live cluster.
|
||||
The annotation is still emitted, but its value stays constant and therefore no longer triggers a
|
||||
rollout. Keep `secrets.<secret>.addSHASumAnnotation: false` in that case and trigger rollouts by
|
||||
other means, for example with stakater's [reloader](https://github.com/stakater/Reloader) as
|
||||
described below.
|
||||
|
||||
## TLS certificate rotation
|
||||
|
||||
If Gitea uses TLS certificates that are mounted as a secret in the container file system, Gitea will not automatically apply them when the TLS certificates are rotated.
|
||||
@@ -999,37 +1023,87 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
|
||||
### deployment
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
|
||||
| `deployment.enabled` | Enable the deployment of Gitea. | `true` |
|
||||
| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` |
|
||||
| `deployment.labels` | Labels for the deployment | `{}` |
|
||||
| `deployment.affinity` | Affinity for the deployment. | `{}` |
|
||||
| `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` |
|
||||
| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` |
|
||||
| `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.gitea.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.gitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.gitea.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.gitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` |
|
||||
| `deployment.gitea.securityContext` | Security context of the Gitea container and the chart-managed init containers. | `{}` |
|
||||
| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.nodeSelector` | NodeSelector for the deployment | `{}` |
|
||||
| `deployment.priorityClassName` | priorityClassName for the deployment | `""` |
|
||||
| `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` |
|
||||
| `deployment.resources` | Resources is the total amount of CPU and Memory resources required by all containers in the pod. | `{}` |
|
||||
| `deployment.schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` |
|
||||
| `deployment.securityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` |
|
||||
| `deployment.strategy.type` | Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`. | `RollingUpdate` |
|
||||
| `deployment.strategy.rollingUpdate.maxSurge` | Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`. | `100%` |
|
||||
| `deployment.strategy.rollingUpdate.maxUnavailable` | Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`. | `0` |
|
||||
| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` |
|
||||
| `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` |
|
||||
| `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` |
|
||||
| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
|
||||
| `deployment.enabled` | Enable the deployment of Gitea. | `true` |
|
||||
| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` |
|
||||
| `deployment.labels` | Labels for the deployment | `{}` |
|
||||
| `deployment.affinity` | Affinity for the deployment. | `{}` |
|
||||
| `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` |
|
||||
| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` |
|
||||
| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the Gitea container. | `[]` |
|
||||
| `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.gitea.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.gitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.gitea.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.gitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` |
|
||||
| `deployment.gitea.securityContext` | Security context of the Gitea container. Used as fallback for the chart-managed init containers. | `{}` |
|
||||
| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initContainers` | List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. | `[]` |
|
||||
| `deployment.initDirectories.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initDirectories.envFrom` | List of environment variables mounted from configMaps or secrets for the initDirectories container. | `[]` |
|
||||
| `deployment.initDirectories.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initDirectories.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initDirectories.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initDirectories.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initDirectories.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initDirectories.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initDirectories.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initDirectories.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initDirectories.resources` | Compute Resources required by the initDirectories container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initDirectories.securityContext` | Security context of the initDirectories container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initDirectories.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initAppIni.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initAppIni.envFrom` | List of environment variables mounted from configMaps or secrets for the initAppIni container. | `[]` |
|
||||
| `deployment.initAppIni.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initAppIni.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initAppIni.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initAppIni.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initAppIni.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initAppIni.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initAppIni.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initAppIni.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initAppIni.resources` | Compute Resources required by the initAppIni container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initAppIni.securityContext` | Security context of the initAppIni container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initAppIni.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initConfigureGPG.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initConfigureGPG.envFrom` | List of environment variables mounted from configMaps or secrets for the initConfigureGPG container. | `[]` |
|
||||
| `deployment.initConfigureGPG.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initConfigureGPG.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initConfigureGPG.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initConfigureGPG.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initConfigureGPG.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initConfigureGPG.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initConfigureGPG.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGPG.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initConfigureGPG.resources` | Compute Resources required by the initConfigureGPG container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initConfigureGPG.securityContext` | Security context of the initConfigureGPG container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initConfigureGPG.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initConfigureGitea.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initConfigureGitea.envFrom` | List of environment variables mounted from configMaps or secrets for the initConfigureGitea container. | `[]` |
|
||||
| `deployment.initConfigureGitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initConfigureGitea.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initConfigureGitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initConfigureGitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initConfigureGitea.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initConfigureGitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initConfigureGitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initConfigureGitea.resources` | Compute Resources required by the initConfigureGitea container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initConfigureGitea.securityContext` | Security context of the initConfigureGitea container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initConfigureGitea.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.nodeSelector` | NodeSelector for the deployment | `{}` |
|
||||
| `deployment.priorityClassName` | priorityClassName for the deployment | `""` |
|
||||
| `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` |
|
||||
| `deployment.resources` | Resources is the total amount of CPU and Memory resources required by all containers in the pod. | `{}` |
|
||||
| `deployment.schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` |
|
||||
| `deployment.securityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` |
|
||||
| `deployment.strategy.type` | Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`. | `RollingUpdate` |
|
||||
| `deployment.strategy.rollingUpdate.maxSurge` | Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`. | `100%` |
|
||||
| `deployment.strategy.rollingUpdate.maxUnavailable` | Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`. | `0` |
|
||||
| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` |
|
||||
| `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` |
|
||||
| `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` |
|
||||
| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` |
|
||||
|
||||
### Gateway API
|
||||
|
||||
@@ -1112,51 +1186,55 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
|
||||
### Secrets
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `secrets.admin.enabled` | Create and keep the Gitea admin user in sync | `true` |
|
||||
| `secrets.admin.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` |
|
||||
| `secrets.admin.existingSecret.enabled` | Use an already existing Secret instead of creating the admin Secret | `false` |
|
||||
| `secrets.admin.existingSecret.secretName` | Name of the already existing admin Secret | `""` |
|
||||
| `secrets.admin.existingSecret.emailKey` | Key of the email address in the existing admin Secret | `email` |
|
||||
| `secrets.admin.existingSecret.passwordKey` | Key of the password in the existing admin Secret | `password` |
|
||||
| `secrets.admin.existingSecret.usernameKey` | Key of the username in the existing admin Secret | `username` |
|
||||
| `secrets.admin.new.annotations` | Annotations for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.labels` | Labels for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.email` | Email of the Gitea admin user | `gitea@local.domain` |
|
||||
| `secrets.admin.new.password` | Password of the Gitea admin user. | `r8sA8CPHD9!bt6d` |
|
||||
| `secrets.admin.new.username` | Username of the Gitea admin user | `gitea_admin` |
|
||||
| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` |
|
||||
| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` |
|
||||
| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` |
|
||||
| `secrets.config.new.labels` | Labels for the config Secret | `{}` |
|
||||
| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` |
|
||||
| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` |
|
||||
| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` |
|
||||
| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` |
|
||||
| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` |
|
||||
| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` |
|
||||
| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` |
|
||||
| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` |
|
||||
| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` |
|
||||
| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` |
|
||||
| `secrets.init.new.labels` | Labels for the init Secret | `{}` |
|
||||
| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` |
|
||||
| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` |
|
||||
| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` |
|
||||
| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` |
|
||||
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` |
|
||||
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` |
|
||||
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` |
|
||||
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `secrets.admin.enabled` | Create and keep the Gitea admin user in sync | `true` |
|
||||
| `secrets.admin.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` |
|
||||
| `secrets.admin.existingSecret.enabled` | Use an already existing Secret instead of creating the admin Secret | `false` |
|
||||
| `secrets.admin.existingSecret.secretName` | Name of the already existing admin Secret | `""` |
|
||||
| `secrets.admin.existingSecret.emailKey` | Key of the email address in the existing admin Secret | `email` |
|
||||
| `secrets.admin.existingSecret.passwordKey` | Key of the password in the existing admin Secret | `password` |
|
||||
| `secrets.admin.existingSecret.usernameKey` | Key of the username in the existing admin Secret | `username` |
|
||||
| `secrets.admin.new.annotations` | Annotations for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.labels` | Labels for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.email` | Email of the Gitea admin user | `gitea@local.domain` |
|
||||
| `secrets.admin.new.password` | Password of the Gitea admin user. | `r8sA8CPHD9!bt6d` |
|
||||
| `secrets.admin.new.username` | Username of the Gitea admin user | `gitea_admin` |
|
||||
| `secrets.config.enabled` | Enable mounting of the config Secret. | `true` |
|
||||
| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` |
|
||||
| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` |
|
||||
| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` |
|
||||
| `secrets.config.new.labels` | Labels for the config Secret | `{}` |
|
||||
| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` |
|
||||
| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` |
|
||||
| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` |
|
||||
| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` |
|
||||
| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` |
|
||||
| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` |
|
||||
| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` |
|
||||
| `secrets.init.enabled` | Enable mounting of the init Secret. | `true` |
|
||||
| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` |
|
||||
| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` |
|
||||
| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` |
|
||||
| `secrets.init.new.labels` | Labels for the init Secret | `{}` |
|
||||
| `secrets.inlineConfig.enabled` | Enable mounting of the inline configuration Secret. | `true` |
|
||||
| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` |
|
||||
| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` |
|
||||
| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` |
|
||||
| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` |
|
||||
| `secrets.metrics.enabled` | Enable mounting of the metrics Secret. | `true` |
|
||||
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` |
|
||||
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` |
|
||||
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` |
|
||||
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` |
|
||||
|
||||
### Service
|
||||
|
||||
@@ -1217,8 +1295,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
| `persistence.subPath` | Subdirectory of the volume to mount at | `nil` |
|
||||
| `persistence.volumeName` | Name of persistent volume in PVC | `""` |
|
||||
| `extraContainers` | Additional sidecar containers to run in the pod | `[]` |
|
||||
| `preExtraInitContainers` | Additional init containers to run in the pod before Gitea runs it owns init containers. | `[]` |
|
||||
| `postExtraInitContainers` | Additional init containers to run in the pod after Gitea runs it owns init containers. | `[]` |
|
||||
| `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` |
|
||||
| `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Gitea main container | `[]` |
|
||||
|
||||
|
||||
Reference in New Issue
Block a user