feat(deployment)!: configurable init containers and Secret checksum lookup
The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources, security context and volume mounts could not be adjusted individually, and custom init containers could only be prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`. The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a free-form `container` definition. This allows custom containers at any position and makes the execution order explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to `deployment.gitea.securityContext` and `initContainers.resources` when unset. To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an arbitrary `image` dict instead of only `deployment.gitea.image`. The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their pre-upgrade state during rendering. Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering (`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The trade-offs are documented in the README so users can make an informed decision. BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a `container` key before or after the linked init containers in `deployment.initContainers` instead. BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep the rollout trigger on Secret changes. Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Copilot
+17
-7
@@ -43,15 +43,25 @@ Create chart name and version as used by the chart label.
|
||||
Create image name and tag used by the deployment.
|
||||
*/}}
|
||||
{{- define "gitea.image" -}}
|
||||
{{- $fullOverride := .Values.deployment.gitea.image.fullOverride | default "" -}}
|
||||
{{- $registry := .Values.global.imageRegistry | default .Values.deployment.gitea.image.registry -}}
|
||||
{{- $repository := .Values.deployment.gitea.image.repository -}}
|
||||
{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create image name and tag from an arbitrary `image` dict.
|
||||
Arguments: (list $root $image)
|
||||
*/}}
|
||||
{{- define "gitea.image.name" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $image := index . 1 -}}
|
||||
{{- $fullOverride := $image.fullOverride | default "" -}}
|
||||
{{- $registry := $root.Values.global.imageRegistry | default $image.registry -}}
|
||||
{{- $repository := $image.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $tag := .Values.deployment.gitea.image.tag | default .Chart.AppVersion | toString -}}
|
||||
{{- $rootless := ternary "-rootless" "" (.Values.deployment.gitea.image.rootless) -}}
|
||||
{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}}
|
||||
{{- $rootless := ternary "-rootless" "" ($image.rootless) -}}
|
||||
{{- $digest := "" -}}
|
||||
{{- if .Values.deployment.gitea.image.digest }}
|
||||
{{- $digest = (printf "@%s" (.Values.deployment.gitea.image.digest | toString)) -}}
|
||||
{{- if $image.digest }}
|
||||
{{- $digest = (printf "@%s" ($image.digest | toString)) -}}
|
||||
{{- end -}}
|
||||
{{- if $fullOverride }}
|
||||
{{- printf "%s" $fullOverride -}}
|
||||
|
||||
@@ -6,6 +6,28 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initContainers */}}
|
||||
|
||||
{{- define "gitea.deployment.initContainers" -}}
|
||||
{{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }}
|
||||
{{- range $index, $entry := .Values.deployment.initContainers }}
|
||||
{{- if and (hasKey $entry "container") (hasKey $entry "link") }}
|
||||
{{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }}
|
||||
{{- else if hasKey $entry "container" }}
|
||||
{{- list $entry.container | toYaml | nindent 0 }}
|
||||
{{- else if hasKey $entry "link" }}
|
||||
{{- if not (has $entry.link $links) }}
|
||||
{{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }}
|
||||
{{- end }}
|
||||
{{- with include (printf "gitea.initContainer.%s" $entry.link) $ }}
|
||||
{{- nindent 0 . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.deployment.labels" -}}
|
||||
|
||||
@@ -0,0 +1,304 @@
|
||||
{{/* initDirectories */}}
|
||||
|
||||
{{- define "gitea.initContainer.initDirectories" -}}
|
||||
{{- $config := .Values.deployment.initDirectories -}}
|
||||
- name: init-directories
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.gpg.enabled }}
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
{{- end }}
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 4 }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initAppIni */}}
|
||||
|
||||
{{- define "gitea.initContainer.initAppIni" -}}
|
||||
{{- $config := .Values.deployment.initAppIni -}}
|
||||
- name: init-app-ini
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMP_EXISTING_ENVS_FILE
|
||||
value: /tmp/existing-envs
|
||||
- name: ENV_TO_INI_MOUNT_POINT
|
||||
value: /env-to-ini-mounts
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.additionalConfigFromEnvs }}
|
||||
{{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
{{- range $idx, $value := .Values.gitea.additionalConfigSources }}
|
||||
- name: additional-config-sources-{{ $idx }}
|
||||
mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 4 }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initConfigureGPG */}}
|
||||
|
||||
{{- define "gitea.initContainer.initConfigureGPG" -}}
|
||||
{{- $config := .Values.deployment.initConfigureGPG -}}
|
||||
{{- if .Values.secrets.gpg.enabled -}}
|
||||
- name: configure-gpg
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
{{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
- name: TMP_RAW_GPG_KEY
|
||||
value: /raw/private.asc
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: gpg-private-key
|
||||
mountPath: /raw
|
||||
readOnly: true
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initConfigureGitea */}}
|
||||
|
||||
{{- define "gitea.initContainer.initConfigureGitea" -}}
|
||||
{{- $config := .Values.deployment.initConfigureGitea -}}
|
||||
- name: configure-gitea
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
{{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if $config.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindDn
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindPassword
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- else }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
value: {{ $value.bindDn | quote }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
value: {{ $value.bindPassword | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_KEY_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: key
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_SECRET_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.admin.enabled }}
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.usernameKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.passwordKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.emailKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: {{ include "gitea.secret.admin.passwordMode" $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 4 }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
|
||||
{{/* annotations */}}
|
||||
|
||||
{{- define "gitea.pod.annotations" -}}
|
||||
|
||||
{{/* secret - admin */}}
|
||||
{{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }}
|
||||
checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - config */}}
|
||||
{{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
|
||||
checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - gpg */}}
|
||||
{{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }}
|
||||
checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - init */}}
|
||||
{{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }}
|
||||
checksum/init: {{ include "gitea.secret.checksum" (list . "init") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - inlineConfig */}}
|
||||
{{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }}
|
||||
checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - metrics */}}
|
||||
{{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }}
|
||||
checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - ldap */}}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - oauth */}}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
|
||||
{{/* custom pod annotations */}}
|
||||
{{- with .Values.gitea.podAnnotations }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@@ -38,6 +38,27 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* checksums */}}
|
||||
|
||||
{{/*
|
||||
SHA sum of a Secret, used to trigger a rollout whenever its content changes.
|
||||
User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
|
||||
cluster still holds their pre-upgrade state.
|
||||
Arguments: (list $root $key)
|
||||
*/}}
|
||||
{{- define "gitea.secret.checksum" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $key := index . 1 -}}
|
||||
{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
|
||||
{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
|
||||
{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
|
||||
{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
|
||||
{{- else -}}
|
||||
{{- include (printf "%s/gitea/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.secret.admin.labels" -}}
|
||||
|
||||
@@ -26,34 +26,10 @@ spec:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with (include "gitea.pod.annotations" . | fromYaml) }}
|
||||
annotations:
|
||||
{{- if and .Values.secrets.admin.addSHASumAnnotation (not .Values.secrets.admin.existingSecret.enabled) }}
|
||||
checksum/admin: {{ include (print $.Template.BasePath "/gitea/secret_admin.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.gpg.addSHASumAnnotation (not .Values.secrets.gpg.existingSecret.enabled) }}
|
||||
checksum/gpg: {{ include (print $.Template.BasePath "/gitea/secret_gpg.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.init.addSHASumAnnotation (not .Values.secrets.init.existingSecret.enabled) }}
|
||||
checksum/init: {{ include (print $.Template.BasePath "/gitea/secret_init.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.inlineConfig.addSHASumAnnotation (not .Values.secrets.inlineConfig.existingSecret.enabled) }}
|
||||
checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.metrics.addSHASumAnnotation (not .Values.secrets.metrics.existingSecret.enabled) }}
|
||||
checksum/metrics: {{ include (print $.Template.BasePath "/gitea/secret_metrics.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
{{- with .Values.gitea.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 8 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
@@ -63,7 +39,6 @@ spec:
|
||||
{{- $hostUsers := include "gitea.hostUsers" . | trim }}
|
||||
{{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
|
||||
{{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
|
||||
{{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
|
||||
{{- if .Values.deployment.schedulerName }}
|
||||
schedulerName: "{{ .Values.deployment.schedulerName }}"
|
||||
{{- end }}
|
||||
@@ -82,253 +57,7 @@ spec:
|
||||
{{- $securityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.preExtraInitContainers }}
|
||||
{{- toYaml .Values.preExtraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: init-directories
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.gpg.enabled }}
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
{{- if $containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
- name: init-app-ini
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMP_EXISTING_ENVS_FILE
|
||||
value: /tmp/existing-envs
|
||||
- name: ENV_TO_INI_MOUNT_POINT
|
||||
value: /env-to-ini-mounts
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.additionalConfigFromEnvs }}
|
||||
{{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
{{- range $idx, $value := .Values.gitea.additionalConfigSources }}
|
||||
- name: additional-config-sources-{{ $idx }}
|
||||
mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
{{- if $containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.secrets.gpg.enabled }}
|
||||
- name: configure-gpg
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
{{- if $commandInitContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $commandInitContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
- name: TMP_RAW_GPG_KEY
|
||||
value: /raw/private.asc
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: gpg-private-key
|
||||
mountPath: /raw
|
||||
readOnly: true
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: configure-gitea
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
{{- if $commandInitContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $commandInitContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.gitea.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindDn
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindPassword
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- else }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
value: {{ $value.bindDn | quote }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
value: {{ $value.bindPassword | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_KEY_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: key
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_SECRET_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.admin.enabled }}
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.usernameKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.passwordKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.emailKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: {{ include "gitea.secret.admin.passwordMode" $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.postExtraInitContainers }}
|
||||
{{- toYaml .Values.postExtraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "gitea.deployment.initContainers" . | trim | nindent 8 }}
|
||||
terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
@@ -377,6 +106,10 @@ spec:
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.deployment.gitea.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ssh
|
||||
containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
|
||||
@@ -85,6 +85,16 @@
|
||||
{{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* POST EXTRA INIT CONTAINERS */}}
|
||||
{{- if .Values.postExtraInitContainers -}}
|
||||
{{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* PRE EXTRA INIT CONTAINERS */}}
|
||||
{{- if .Values.preExtraInitContainers -}}
|
||||
{{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* RESOURCES */}}
|
||||
{{- if .Values.resources -}}
|
||||
{{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}
|
||||
|
||||
Reference in New Issue
Block a user