feat(deployment)!: configurable init containers and Secret checksum lookup
The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources, security context and volume mounts could not be adjusted individually, and custom init containers could only be prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`. The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a free-form `container` definition. This allows custom containers at any position and makes the execution order explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to `deployment.gitea.securityContext` and `initContainers.resources` when unset. To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an arbitrary `image` dict instead of only `deployment.gitea.image`. The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their pre-upgrade state during rendering. Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering (`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The trade-offs are documented in the README so users can make an informed decision. BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a `container` key before or after the linked init containers in `deployment.initContainers` instead. BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep the rollout trigger on Secret changes. Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Copilot
@@ -11,29 +11,18 @@ templates:
|
||||
- templates/gitea/secret_inlineConfig.yaml
|
||||
- templates/gitea/secret_metrics.yaml
|
||||
tests:
|
||||
- it: adds a checksum annotation for every Secret by default
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: omits the checksum annotations when addSHASumAnnotation is disabled
|
||||
- it: omits the checksum annotations by default
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.addSHASumAnnotation: false
|
||||
secrets.config.addSHASumAnnotation: false
|
||||
secrets.gpg.addSHASumAnnotation: false
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
secrets.inlineConfig.addSHASumAnnotation: false
|
||||
secrets.metrics.addSHASumAnnotation: false
|
||||
secrets.admin.enabled: true
|
||||
secrets.config.enabled: true
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.new.privateKey: |
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
secrets.init.enabled: true
|
||||
secrets.inlineConfig.enabled: true
|
||||
secrets.metrics.enabled: true
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
@@ -48,33 +37,66 @@ tests:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.addSHASumAnnotation: true
|
||||
secrets.admin.enabled: true
|
||||
|
||||
secrets.config.addSHASumAnnotation: true
|
||||
secrets.config.enabled: true
|
||||
|
||||
secrets.gpg.addSHASumAnnotation: true
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.new.privateKey: |
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
|
||||
secrets.init.addSHASumAnnotation: true
|
||||
secrets.init.enabled: true
|
||||
|
||||
secrets.inlineConfig.addSHASumAnnotation: true
|
||||
secrets.inlineConfig.enabled: true
|
||||
|
||||
secrets.metrics.addSHASumAnnotation: true
|
||||
secrets.metrics.enabled: true
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/gpg"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: omits the checksum annotation of a single disabled Secret only
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
secrets.admin.addSHASumAnnotation: false
|
||||
secrets.admin.enabled: true
|
||||
|
||||
- it: omits the checksum annotations of Secrets provided by the user
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: custom-admin
|
||||
secrets.config.existingSecret.enabled: true
|
||||
secrets.config.existingSecret.secretName: custom-config
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
secrets.gpg.existingSecret.secretName: custom-gpg
|
||||
secrets.init.existingSecret.enabled: true
|
||||
secrets.init.existingSecret.secretName: custom-init
|
||||
secrets.inlineConfig.existingSecret.enabled: true
|
||||
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
|
||||
secrets.metrics.existingSecret.enabled: true
|
||||
secrets.metrics.existingSecret.secretName: custom-metrics
|
||||
secrets.config.addSHASumAnnotation: false
|
||||
secrets.config.enabled: true
|
||||
|
||||
secrets.gpg.addSHASumAnnotation: false
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.new.privateKey: |
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
secrets.init.enabled: true
|
||||
|
||||
secrets.inlineConfig.addSHASumAnnotation: false
|
||||
secrets.inlineConfig.enabled: true
|
||||
|
||||
secrets.metrics.addSHASumAnnotation: false
|
||||
secrets.metrics.enabled: true
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
@@ -88,3 +110,49 @@ tests:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: adds the checksum of Secrets provided by the user
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.enabled: true
|
||||
secrets.admin.addSHASumAnnotation: true
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: custom-admin
|
||||
|
||||
secrets.config.enabled: true
|
||||
secrets.config.addSHASumAnnotation: true
|
||||
secrets.config.existingSecret.enabled: true
|
||||
secrets.config.existingSecret.secretName: custom-config
|
||||
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.addSHASumAnnotation: true
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
secrets.gpg.existingSecret.secretName: custom-gpg
|
||||
|
||||
secrets.init.enabled: true
|
||||
secrets.init.addSHASumAnnotation: true
|
||||
secrets.init.existingSecret.enabled: true
|
||||
secrets.init.existingSecret.secretName: custom-init
|
||||
|
||||
secrets.inlineConfig.enabled: true
|
||||
secrets.inlineConfig.addSHASumAnnotation: true
|
||||
secrets.inlineConfig.existingSecret.enabled: true
|
||||
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
|
||||
|
||||
secrets.metrics.enabled: true
|
||||
secrets.metrics.addSHASumAnnotation: true
|
||||
secrets.metrics.existingSecret.enabled: true
|
||||
secrets.metrics.existingSecret.secretName: custom-metrics
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/gpg"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
@@ -83,6 +83,22 @@ tests:
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead."
|
||||
- it: fails when the removed `postExtraInitContainers` value is set
|
||||
set:
|
||||
postExtraInitContainers:
|
||||
- name: post-init-container
|
||||
image: docker.io/library/busybox
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead."
|
||||
- it: fails when the removed `preExtraInitContainers` value is set
|
||||
set:
|
||||
preExtraInitContainers:
|
||||
- name: pre-init-container
|
||||
image: docker.io/library/busybox
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead."
|
||||
- it: fails when the removed `resources` value is set
|
||||
set:
|
||||
resources:
|
||||
@@ -158,6 +174,12 @@ tests:
|
||||
foo: bar
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
postExtraInitContainers:
|
||||
- name: post-init-container
|
||||
image: docker.io/library/busybox
|
||||
preExtraInitContainers:
|
||||
- name: pre-init-container
|
||||
image: docker.io/library/busybox
|
||||
priorityClassName: high-priority
|
||||
replicaCount: 2
|
||||
resources:
|
||||
|
||||
@@ -37,12 +37,17 @@ tests:
|
||||
|
||||
- it: Render the deployment (extraInitContainers)
|
||||
set:
|
||||
postExtraInitContainers:
|
||||
- name: foo
|
||||
image: docker.io/library/busybox:latest
|
||||
preExtraInitContainers:
|
||||
- name: bar
|
||||
image: docker.io/library/busybox:latest
|
||||
deployment.initContainers:
|
||||
- container:
|
||||
name: bar
|
||||
image: docker.io/library/busybox:latest
|
||||
- link: "initDirectories"
|
||||
- link: "initAppIni"
|
||||
- link: "initConfigureGPG"
|
||||
- link: "initConfigureGitea"
|
||||
- container:
|
||||
name: foo
|
||||
image: docker.io/library/busybox:latest
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
|
||||
@@ -54,15 +59,55 @@ tests:
|
||||
path: spec.template.spec.initContainers
|
||||
count: 6
|
||||
template: templates/gitea/deployment.yaml
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers
|
||||
content:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].name
|
||||
value: bar
|
||||
template: templates/gitea/deployment.yaml
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[5].name
|
||||
value: foo
|
||||
template: templates/gitea/deployment.yaml
|
||||
|
||||
- it: renders the chart-managed init containers in the configured order
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- link: "initConfigureGitea"
|
||||
- link: "initDirectories"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].name
|
||||
value: configure-gitea
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].name
|
||||
value: init-directories
|
||||
|
||||
- it: fails when an init container entry sets both container and link
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- link: "initDirectories"
|
||||
container:
|
||||
name: foo
|
||||
image: docker.io/library/busybox:latest
|
||||
template: templates/gitea/deployment.yaml
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers
|
||||
content:
|
||||
name: bar
|
||||
image: docker.io/library/busybox:latest
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "deployment.initContainers[0]: `container` and `link` are mutually exclusive"
|
||||
|
||||
- it: fails when an init container entry sets neither container nor link
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- name: foo
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "deployment.initContainers[0]: either `container` or `link` must be set"
|
||||
|
||||
- it: fails when an init container links to an unknown configuration
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- link: "initSomething"
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "deployment.initContainers[0]: unknown link `initSomething`, expected one of: initAppIni, initConfigureGPG, initConfigureGitea, initDirectories"
|
||||
|
||||
@@ -105,7 +105,11 @@ tests:
|
||||
- it: correctly renders floating tag references
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.gitea.image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
|
||||
# use non-quoted values on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
|
||||
deployment.gitea.image.tag: 1.21
|
||||
deployment.initDirectories.image.tag: 1.21
|
||||
deployment.initAppIni.image.tag: 1.21
|
||||
deployment.initConfigureGitea.image.tag: 1.21
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].image
|
||||
@@ -119,3 +123,18 @@ tests:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.gitea.com/gitea:1.21-rootless"
|
||||
- it: init containers use their own image configuration
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initDirectories.image.registry: "init.example.com"
|
||||
deployment.initDirectories.image.tag: "1.19.4"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].image
|
||||
value: "init.example.com/gitea:1.19.4-rootless"
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].image
|
||||
value: "docker.gitea.com/gitea:1.19.3-rootless"
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.gitea.com/gitea:1.19.3-rootless"
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
suite: deployment template (init container configuration)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
- templates/gitea/secret_inlineConfig.yaml
|
||||
- templates/gitea/secret_metrics.yaml
|
||||
tests:
|
||||
- it: appends the per-container env
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initDirectories.env:
|
||||
- name: INIT_DIRECTORIES
|
||||
value: "1"
|
||||
deployment.gitea.env:
|
||||
- name: SHARED
|
||||
value: "1"
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[0].env
|
||||
content:
|
||||
name: INIT_DIRECTORIES
|
||||
value: "1"
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[0].env
|
||||
content:
|
||||
name: SHARED
|
||||
value: "1"
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers[1].env
|
||||
content:
|
||||
name: INIT_DIRECTORIES
|
||||
value: "1"
|
||||
|
||||
- it: renders the per-container envFrom
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initAppIni.envFrom:
|
||||
- secretRef:
|
||||
name: special-secret
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[0].envFrom
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].envFrom
|
||||
value:
|
||||
- secretRef:
|
||||
name: special-secret
|
||||
|
||||
- it: appends the per-container volumeMounts
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initConfigureGitea.volumeMounts:
|
||||
- name: my-configmap-volume
|
||||
mountPath: /configmap
|
||||
readOnly: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].volumeMounts
|
||||
content:
|
||||
name: my-configmap-volume
|
||||
mountPath: /configmap
|
||||
readOnly: true
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers[0].volumeMounts
|
||||
content:
|
||||
name: my-configmap-volume
|
||||
mountPath: /configmap
|
||||
readOnly: true
|
||||
|
||||
- it: overrides the resources of a single init container
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initDirectories.resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].resources
|
||||
value:
|
||||
requests:
|
||||
cpu: 500m
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].resources
|
||||
value:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
- it: overrides the security context of a single init container
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.gitea.securityContext:
|
||||
runAsUser: 1000
|
||||
deployment.initDirectories.securityContext:
|
||||
runAsUser: 2000
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].securityContext.runAsUser
|
||||
value: 2000
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].securityContext.runAsUser
|
||||
value: 1000
|
||||
|
||||
- it: renders the envFrom of the gitea container
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.gitea.envFrom:
|
||||
- configMapRef:
|
||||
name: special-config
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].envFrom
|
||||
value:
|
||||
- configMapRef:
|
||||
name: special-config
|
||||
|
||||
- it: omits envFrom when unset
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.spec.containers[0].envFrom
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[0].envFrom
|
||||
Reference in New Issue
Block a user