feat(deployment)!: configurable init containers and Secret checksum lookup
The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources, security context and volume mounts could not be adjusted individually, and custom init containers could only be prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`. The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a free-form `container` definition. This allows custom containers at any position and makes the execution order explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to `deployment.gitea.securityContext` and `initContainers.resources` when unset. To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an arbitrary `image` dict instead of only `deployment.gitea.image`. The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their pre-upgrade state during rendering. Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering (`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The trade-offs are documented in the README so users can make an informed decision. BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a `container` key before or after the linked init containers in `deployment.initContainers` instead. BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep the rollout trigger on Secret changes. Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Copilot
@@ -48,6 +48,7 @@ image:
|
||||
- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
|
||||
- Each test must set all required values explicitly — do not rely on cross-test state.
|
||||
- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint`. Use `make yamllint` to run the linter.
|
||||
- The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
|
||||
|
||||
### Commits & PRs
|
||||
|
||||
|
||||
@@ -862,6 +862,30 @@ gitea:
|
||||
podAnnotations: {}
|
||||
```
|
||||
|
||||
### Secret checksum annotations
|
||||
|
||||
Each Secret of the chart has an `addSHASumAnnotation` option (disabled by default). It adds a
|
||||
`checksum/<secret>` pod annotation so that a change to the Secret triggers a rolling update of the
|
||||
Gitea pod.
|
||||
|
||||
The SHA sum is computed differently depending on where the Secret comes from:
|
||||
|
||||
- **Chart-managed Secrets** (`secrets.<secret>.existingSecret.enabled: false`): the SHA sum is
|
||||
computed from the manifest rendered by the chart. The cluster still holds the pre-upgrade state of
|
||||
that Secret during rendering, so it cannot be used as the source.
|
||||
- **User-provided Secrets** (`secrets.<secret>.existingSecret.enabled: true`): the content is unknown
|
||||
to the chart, so the Secret is looked up in the cluster via Helm's `lookup` function.
|
||||
|
||||
The lookup is the reason why the option is disabled by default:
|
||||
|
||||
- The credentials used by Helm need `get` permission on Secrets in the release namespace.
|
||||
- The lookup returns nothing during client-side rendering, for example with `helm template`, during
|
||||
`helm install --dry-run`, or with Argo CD unless the Helm chart is rendered against a live cluster.
|
||||
The annotation is still emitted, but its value stays constant and therefore no longer triggers a
|
||||
rollout. Keep `secrets.<secret>.addSHASumAnnotation: false` in that case and trigger rollouts by
|
||||
other means, for example with stakater's [reloader](https://github.com/stakater/Reloader) as
|
||||
described below.
|
||||
|
||||
## TLS certificate rotation
|
||||
|
||||
If Gitea uses TLS certificates that are mounted as a secret in the container file system, Gitea will not automatically apply them when the TLS certificates are rotated.
|
||||
@@ -999,37 +1023,87 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
|
||||
### deployment
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
|
||||
| `deployment.enabled` | Enable the deployment of Gitea. | `true` |
|
||||
| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` |
|
||||
| `deployment.labels` | Labels for the deployment | `{}` |
|
||||
| `deployment.affinity` | Affinity for the deployment. | `{}` |
|
||||
| `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` |
|
||||
| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` |
|
||||
| `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.gitea.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.gitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.gitea.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.gitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` |
|
||||
| `deployment.gitea.securityContext` | Security context of the Gitea container and the chart-managed init containers. | `{}` |
|
||||
| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.nodeSelector` | NodeSelector for the deployment | `{}` |
|
||||
| `deployment.priorityClassName` | priorityClassName for the deployment | `""` |
|
||||
| `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` |
|
||||
| `deployment.resources` | Resources is the total amount of CPU and Memory resources required by all containers in the pod. | `{}` |
|
||||
| `deployment.schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` |
|
||||
| `deployment.securityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` |
|
||||
| `deployment.strategy.type` | Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`. | `RollingUpdate` |
|
||||
| `deployment.strategy.rollingUpdate.maxSurge` | Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`. | `100%` |
|
||||
| `deployment.strategy.rollingUpdate.maxUnavailable` | Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`. | `0` |
|
||||
| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` |
|
||||
| `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` |
|
||||
| `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` |
|
||||
| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
|
||||
| `deployment.enabled` | Enable the deployment of Gitea. | `true` |
|
||||
| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` |
|
||||
| `deployment.labels` | Labels for the deployment | `{}` |
|
||||
| `deployment.affinity` | Affinity for the deployment. | `{}` |
|
||||
| `deployment.dnsConfig` | dnsConfig of the Gitea deployment. | `{}` |
|
||||
| `deployment.gitea.env` | Additional environment variables to pass to the Gitea container. | `[]` |
|
||||
| `deployment.gitea.envFrom` | List of environment variables mounted from configMaps or secrets for the Gitea container. | `[]` |
|
||||
| `deployment.gitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.gitea.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.gitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.gitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.gitea.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.gitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.gitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.gitea.resources` | Compute Resources required by Gitea container. Cannot be updated. | `nil` |
|
||||
| `deployment.gitea.securityContext` | Security context of the Gitea container. Used as fallback for the chart-managed init containers. | `{}` |
|
||||
| `deployment.gitea.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initContainers` | List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration. | `[]` |
|
||||
| `deployment.initDirectories.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initDirectories.envFrom` | List of environment variables mounted from configMaps or secrets for the initDirectories container. | `[]` |
|
||||
| `deployment.initDirectories.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initDirectories.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initDirectories.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initDirectories.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initDirectories.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initDirectories.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initDirectories.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initDirectories.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initDirectories.resources` | Compute Resources required by the initDirectories container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initDirectories.securityContext` | Security context of the initDirectories container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initDirectories.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initAppIni.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initAppIni.envFrom` | List of environment variables mounted from configMaps or secrets for the initAppIni container. | `[]` |
|
||||
| `deployment.initAppIni.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initAppIni.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initAppIni.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initAppIni.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initAppIni.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initAppIni.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initAppIni.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initAppIni.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initAppIni.resources` | Compute Resources required by the initAppIni container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initAppIni.securityContext` | Security context of the initAppIni container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initAppIni.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initConfigureGPG.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initConfigureGPG.envFrom` | List of environment variables mounted from configMaps or secrets for the initConfigureGPG container. | `[]` |
|
||||
| `deployment.initConfigureGPG.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initConfigureGPG.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initConfigureGPG.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initConfigureGPG.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initConfigureGPG.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initConfigureGPG.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initConfigureGPG.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGPG.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initConfigureGPG.resources` | Compute Resources required by the initConfigureGPG container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initConfigureGPG.securityContext` | Security context of the initConfigureGPG container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initConfigureGPG.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.initConfigureGitea.env` | Additional environment variables to pass to the init container. | `[]` |
|
||||
| `deployment.initConfigureGitea.envFrom` | List of environment variables mounted from configMaps or secrets for the initConfigureGitea container. | `[]` |
|
||||
| `deployment.initConfigureGitea.image.registry` | image registry, e.g. gcr.io,docker.io | `docker.gitea.com` |
|
||||
| `deployment.initConfigureGitea.image.repository` | Image to start for this pod | `gitea` |
|
||||
| `deployment.initConfigureGitea.image.tag` | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `deployment.initConfigureGitea.image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `deployment.initConfigureGitea.image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `deployment.initConfigureGitea.image.rootless` | Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher | `true` |
|
||||
| `deployment.initConfigureGitea.image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `deployment.initConfigureGitea.resources` | Compute Resources required by the initConfigureGitea container. Defaults to `initContainers.resources`. Cannot be updated. | `nil` |
|
||||
| `deployment.initConfigureGitea.securityContext` | Security context of the initConfigureGitea container. Defaults to `deployment.gitea.securityContext`. | `{}` |
|
||||
| `deployment.initConfigureGitea.volumeMounts` | Additional volume mounts. | `[]` |
|
||||
| `deployment.nodeSelector` | NodeSelector for the deployment | `{}` |
|
||||
| `deployment.priorityClassName` | priorityClassName for the deployment | `""` |
|
||||
| `deployment.replicas` | Number of replicas for the Gitea deployment. | `1` |
|
||||
| `deployment.resources` | Resources is the total amount of CPU and Memory resources required by all containers in the pod. | `{}` |
|
||||
| `deployment.schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` |
|
||||
| `deployment.securityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` |
|
||||
| `deployment.strategy.type` | Deployment strategy used to replace old pods, either `RollingUpdate` or `Recreate`. | `RollingUpdate` |
|
||||
| `deployment.strategy.rollingUpdate.maxSurge` | Number or percentage of pods that may be created above the desired replica count. Only used with `RollingUpdate`. | `100%` |
|
||||
| `deployment.strategy.rollingUpdate.maxUnavailable` | Number or percentage of pods that may be unavailable during the update. Only used with `RollingUpdate`. | `0` |
|
||||
| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` |
|
||||
| `deployment.tolerations` | Tolerations of the Gitea deployment. | `[]` |
|
||||
| `deployment.topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` |
|
||||
| `deployment.volumes` | Additional volumes to mount into the pods of the Gitea deployment. | `[]` |
|
||||
|
||||
### Gateway API
|
||||
|
||||
@@ -1112,51 +1186,55 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
|
||||
### Secrets
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `secrets.admin.enabled` | Create and keep the Gitea admin user in sync | `true` |
|
||||
| `secrets.admin.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` |
|
||||
| `secrets.admin.existingSecret.enabled` | Use an already existing Secret instead of creating the admin Secret | `false` |
|
||||
| `secrets.admin.existingSecret.secretName` | Name of the already existing admin Secret | `""` |
|
||||
| `secrets.admin.existingSecret.emailKey` | Key of the email address in the existing admin Secret | `email` |
|
||||
| `secrets.admin.existingSecret.passwordKey` | Key of the password in the existing admin Secret | `password` |
|
||||
| `secrets.admin.existingSecret.usernameKey` | Key of the username in the existing admin Secret | `username` |
|
||||
| `secrets.admin.new.annotations` | Annotations for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.labels` | Labels for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.email` | Email of the Gitea admin user | `gitea@local.domain` |
|
||||
| `secrets.admin.new.password` | Password of the Gitea admin user. | `r8sA8CPHD9!bt6d` |
|
||||
| `secrets.admin.new.username` | Username of the Gitea admin user | `gitea_admin` |
|
||||
| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` |
|
||||
| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` |
|
||||
| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` |
|
||||
| `secrets.config.new.labels` | Labels for the config Secret | `{}` |
|
||||
| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` |
|
||||
| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` |
|
||||
| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` |
|
||||
| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` |
|
||||
| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` |
|
||||
| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` |
|
||||
| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` |
|
||||
| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` |
|
||||
| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` |
|
||||
| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` |
|
||||
| `secrets.init.new.labels` | Labels for the init Secret | `{}` |
|
||||
| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` |
|
||||
| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` |
|
||||
| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` |
|
||||
| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` |
|
||||
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change | `true` |
|
||||
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` |
|
||||
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` |
|
||||
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` |
|
||||
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `secrets.admin.enabled` | Create and keep the Gitea admin user in sync | `true` |
|
||||
| `secrets.admin.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` |
|
||||
| `secrets.admin.existingSecret.enabled` | Use an already existing Secret instead of creating the admin Secret | `false` |
|
||||
| `secrets.admin.existingSecret.secretName` | Name of the already existing admin Secret | `""` |
|
||||
| `secrets.admin.existingSecret.emailKey` | Key of the email address in the existing admin Secret | `email` |
|
||||
| `secrets.admin.existingSecret.passwordKey` | Key of the password in the existing admin Secret | `password` |
|
||||
| `secrets.admin.existingSecret.usernameKey` | Key of the username in the existing admin Secret | `username` |
|
||||
| `secrets.admin.new.annotations` | Annotations for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.labels` | Labels for the admin Secret | `{}` |
|
||||
| `secrets.admin.new.email` | Email of the Gitea admin user | `gitea@local.domain` |
|
||||
| `secrets.admin.new.password` | Password of the Gitea admin user. | `r8sA8CPHD9!bt6d` |
|
||||
| `secrets.admin.new.username` | Username of the Gitea admin user | `gitea_admin` |
|
||||
| `secrets.config.enabled` | Enable mounting of the config Secret. | `true` |
|
||||
| `secrets.config.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.config.existingSecret.enabled` | Use an already existing Secret instead of creating the config Secret | `false` |
|
||||
| `secrets.config.existingSecret.secretName` | Name of the already existing config Secret | `""` |
|
||||
| `secrets.config.new.annotations` | Annotations for the config Secret | `{}` |
|
||||
| `secrets.config.new.labels` | Labels for the config Secret | `{}` |
|
||||
| `secrets.gpg.enabled` | Enable mounting of a GPG key to sign Git commits. | `false` |
|
||||
| `secrets.gpg.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.gpg.existingSecret.enabled` | Use an already existing Secret instead of creating the GPG key Secret | `false` |
|
||||
| `secrets.gpg.existingSecret.secretName` | Name of the already existing GPG key Secret | `""` |
|
||||
| `secrets.gpg.existingSecret.gpgHomeKey` | Key of the GPG home directory in the existing GPG key Secret | `gpgHome` |
|
||||
| `secrets.gpg.existingSecret.privateKeyKey` | Key of the private key in the existing GPG key Secret. | `privateKey` |
|
||||
| `secrets.gpg.new.annotations` | Annotations for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.labels` | Labels for the GPG key Secret | `{}` |
|
||||
| `secrets.gpg.new.gpgHome` | Path to the GPG home directory. | `/data/git/.gnupg` |
|
||||
| `secrets.gpg.new.privateKey` | Content of the private GPG key in armored format. | `""` |
|
||||
| `secrets.init.enabled` | Enable mounting of the init Secret. | `true` |
|
||||
| `secrets.init.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.init.existingSecret.enabled` | Use an already existing Secret instead of creating the init Secret | `false` |
|
||||
| `secrets.init.existingSecret.secretName` | Name of the already existing init Secret | `""` |
|
||||
| `secrets.init.new.annotations` | Annotations for the init Secret | `{}` |
|
||||
| `secrets.init.new.labels` | Labels for the init Secret | `{}` |
|
||||
| `secrets.inlineConfig.enabled` | Enable mounting of the inline configuration Secret. | `true` |
|
||||
| `secrets.inlineConfig.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.inlineConfig.existingSecret.enabled` | Use an already existing Secret instead of creating the inline configuration Secret | `false` |
|
||||
| `secrets.inlineConfig.existingSecret.secretName` | Name of the already existing inline configuration Secret | `""` |
|
||||
| `secrets.inlineConfig.new.annotations` | Annotations for the inline configuration Secret | `{}` |
|
||||
| `secrets.inlineConfig.new.labels` | Labels for the inline configuration Secret | `{}` |
|
||||
| `secrets.metrics.enabled` | Enable mounting of the metrics Secret. | `true` |
|
||||
| `secrets.metrics.addSHASumAnnotation` | Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false` |
|
||||
| `secrets.metrics.existingSecret.enabled` | Use an already existing Secret instead of creating the metrics Secret | `false` |
|
||||
| `secrets.metrics.existingSecret.secretName` | Name of the already existing metrics Secret | `""` |
|
||||
| `secrets.metrics.new.annotations` | Annotations for the metrics Secret | `{}` |
|
||||
| `secrets.metrics.new.labels` | Labels for the metrics Secret | `{}` |
|
||||
|
||||
### Service
|
||||
|
||||
@@ -1217,8 +1295,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
| `persistence.subPath` | Subdirectory of the volume to mount at | `nil` |
|
||||
| `persistence.volumeName` | Name of persistent volume in PVC | `""` |
|
||||
| `extraContainers` | Additional sidecar containers to run in the pod | `[]` |
|
||||
| `preExtraInitContainers` | Additional init containers to run in the pod before Gitea runs it owns init containers. | `[]` |
|
||||
| `postExtraInitContainers` | Additional init containers to run in the pod after Gitea runs it owns init containers. | `[]` |
|
||||
| `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` |
|
||||
| `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Gitea main container | `[]` |
|
||||
|
||||
|
||||
+17
-7
@@ -43,15 +43,25 @@ Create chart name and version as used by the chart label.
|
||||
Create image name and tag used by the deployment.
|
||||
*/}}
|
||||
{{- define "gitea.image" -}}
|
||||
{{- $fullOverride := .Values.deployment.gitea.image.fullOverride | default "" -}}
|
||||
{{- $registry := .Values.global.imageRegistry | default .Values.deployment.gitea.image.registry -}}
|
||||
{{- $repository := .Values.deployment.gitea.image.repository -}}
|
||||
{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create image name and tag from an arbitrary `image` dict.
|
||||
Arguments: (list $root $image)
|
||||
*/}}
|
||||
{{- define "gitea.image.name" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $image := index . 1 -}}
|
||||
{{- $fullOverride := $image.fullOverride | default "" -}}
|
||||
{{- $registry := $root.Values.global.imageRegistry | default $image.registry -}}
|
||||
{{- $repository := $image.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $tag := .Values.deployment.gitea.image.tag | default .Chart.AppVersion | toString -}}
|
||||
{{- $rootless := ternary "-rootless" "" (.Values.deployment.gitea.image.rootless) -}}
|
||||
{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}}
|
||||
{{- $rootless := ternary "-rootless" "" ($image.rootless) -}}
|
||||
{{- $digest := "" -}}
|
||||
{{- if .Values.deployment.gitea.image.digest }}
|
||||
{{- $digest = (printf "@%s" (.Values.deployment.gitea.image.digest | toString)) -}}
|
||||
{{- if $image.digest }}
|
||||
{{- $digest = (printf "@%s" ($image.digest | toString)) -}}
|
||||
{{- end -}}
|
||||
{{- if $fullOverride }}
|
||||
{{- printf "%s" $fullOverride -}}
|
||||
|
||||
@@ -6,6 +6,28 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initContainers */}}
|
||||
|
||||
{{- define "gitea.deployment.initContainers" -}}
|
||||
{{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }}
|
||||
{{- range $index, $entry := .Values.deployment.initContainers }}
|
||||
{{- if and (hasKey $entry "container") (hasKey $entry "link") }}
|
||||
{{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }}
|
||||
{{- else if hasKey $entry "container" }}
|
||||
{{- list $entry.container | toYaml | nindent 0 }}
|
||||
{{- else if hasKey $entry "link" }}
|
||||
{{- if not (has $entry.link $links) }}
|
||||
{{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }}
|
||||
{{- end }}
|
||||
{{- with include (printf "gitea.initContainer.%s" $entry.link) $ }}
|
||||
{{- nindent 0 . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.deployment.labels" -}}
|
||||
|
||||
@@ -0,0 +1,304 @@
|
||||
{{/* initDirectories */}}
|
||||
|
||||
{{- define "gitea.initContainer.initDirectories" -}}
|
||||
{{- $config := .Values.deployment.initDirectories -}}
|
||||
- name: init-directories
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.gpg.enabled }}
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
{{- end }}
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 4 }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initAppIni */}}
|
||||
|
||||
{{- define "gitea.initContainer.initAppIni" -}}
|
||||
{{- $config := .Values.deployment.initAppIni -}}
|
||||
- name: init-app-ini
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMP_EXISTING_ENVS_FILE
|
||||
value: /tmp/existing-envs
|
||||
- name: ENV_TO_INI_MOUNT_POINT
|
||||
value: /env-to-ini-mounts
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.additionalConfigFromEnvs }}
|
||||
{{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
{{- range $idx, $value := .Values.gitea.additionalConfigSources }}
|
||||
- name: additional-config-sources-{{ $idx }}
|
||||
mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 4 }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initConfigureGPG */}}
|
||||
|
||||
{{- define "gitea.initContainer.initConfigureGPG" -}}
|
||||
{{- $config := .Values.deployment.initConfigureGPG -}}
|
||||
{{- if .Values.secrets.gpg.enabled -}}
|
||||
- name: configure-gpg
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
{{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
- name: TMP_RAW_GPG_KEY
|
||||
value: /raw/private.asc
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: gpg-private-key
|
||||
mountPath: /raw
|
||||
readOnly: true
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* initConfigureGitea */}}
|
||||
|
||||
{{- define "gitea.initContainer.initConfigureGitea" -}}
|
||||
{{- $config := .Values.deployment.initConfigureGitea -}}
|
||||
- name: configure-gitea
|
||||
image: "{{ include "gitea.image.name" (list . $config.image) }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ $config.image.pullPolicy }}
|
||||
{{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
|
||||
securityContext:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if $config.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindDn
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindPassword
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- else }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
value: {{ $value.bindDn | quote }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
value: {{ $value.bindPassword | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_KEY_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: key
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_SECRET_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.admin.enabled }}
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.usernameKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.passwordKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.emailKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: {{ include "gitea.secret.admin.passwordMode" $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.env }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $config.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 4 }}
|
||||
{{- with $config.volumeMounts }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
|
||||
{{/* annotations */}}
|
||||
|
||||
{{- define "gitea.pod.annotations" -}}
|
||||
|
||||
{{/* secret - admin */}}
|
||||
{{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }}
|
||||
checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - config */}}
|
||||
{{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
|
||||
checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - gpg */}}
|
||||
{{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }}
|
||||
checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - init */}}
|
||||
{{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }}
|
||||
checksum/init: {{ include "gitea.secret.checksum" (list . "init") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - inlineConfig */}}
|
||||
{{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }}
|
||||
checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - metrics */}}
|
||||
{{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }}
|
||||
checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - ldap */}}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
|
||||
{{/* secret - oauth */}}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
|
||||
{{/* custom pod annotations */}}
|
||||
{{- with .Values.gitea.podAnnotations }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@@ -38,6 +38,27 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* checksums */}}
|
||||
|
||||
{{/*
|
||||
SHA sum of a Secret, used to trigger a rollout whenever its content changes.
|
||||
User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
|
||||
cluster still holds their pre-upgrade state.
|
||||
Arguments: (list $root $key)
|
||||
*/}}
|
||||
{{- define "gitea.secret.checksum" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $key := index . 1 -}}
|
||||
{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
|
||||
{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
|
||||
{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
|
||||
{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
|
||||
{{- else -}}
|
||||
{{- include (printf "%s/gitea/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.secret.admin.labels" -}}
|
||||
|
||||
@@ -26,34 +26,10 @@ spec:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with (include "gitea.pod.annotations" . | fromYaml) }}
|
||||
annotations:
|
||||
{{- if and .Values.secrets.admin.addSHASumAnnotation (not .Values.secrets.admin.existingSecret.enabled) }}
|
||||
checksum/admin: {{ include (print $.Template.BasePath "/gitea/secret_admin.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.config.addSHASumAnnotation (not .Values.secrets.config.existingSecret.enabled) }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/gitea/secret_config.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.gpg.addSHASumAnnotation (not .Values.secrets.gpg.existingSecret.enabled) }}
|
||||
checksum/gpg: {{ include (print $.Template.BasePath "/gitea/secret_gpg.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.init.addSHASumAnnotation (not .Values.secrets.init.existingSecret.enabled) }}
|
||||
checksum/init: {{ include (print $.Template.BasePath "/gitea/secret_init.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.inlineConfig.addSHASumAnnotation (not .Values.secrets.inlineConfig.existingSecret.enabled) }}
|
||||
checksum/inlineConfig: {{ include (print $.Template.BasePath "/gitea/secret_inlineConfig.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and .Values.secrets.metrics.addSHASumAnnotation (not .Values.secrets.metrics.existingSecret.enabled) }}
|
||||
checksum/metrics: {{ include (print $.Template.BasePath "/gitea/secret_metrics.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
{{- with .Values.gitea.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 8 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
@@ -63,7 +39,6 @@ spec:
|
||||
{{- $hostUsers := include "gitea.hostUsers" . | trim }}
|
||||
{{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
|
||||
{{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
|
||||
{{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
|
||||
{{- if .Values.deployment.schedulerName }}
|
||||
schedulerName: "{{ .Values.deployment.schedulerName }}"
|
||||
{{- end }}
|
||||
@@ -82,253 +57,7 @@ spec:
|
||||
{{- $securityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if .Values.preExtraInitContainers }}
|
||||
{{- toYaml .Values.preExtraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: init-directories
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.gpg.enabled }}
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
{{- if $containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
- name: init-app-ini
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMP_EXISTING_ENVS_FILE
|
||||
value: /tmp/existing-envs
|
||||
- name: ENV_TO_INI_MOUNT_POINT
|
||||
value: /env-to-ini-mounts
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.additionalConfigFromEnvs }}
|
||||
{{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
{{- range $idx, $value := .Values.gitea.additionalConfigSources }}
|
||||
- name: additional-config-sources-{{ $idx }}
|
||||
mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
{{- if $containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.secrets.gpg.enabled }}
|
||||
- name: configure-gpg
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
{{- if $commandInitContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $commandInitContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GNUPGHOME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "gitea.secret.gpg.name" . }}
|
||||
key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
|
||||
- name: TMP_RAW_GPG_KEY
|
||||
value: /raw/private.asc
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: gpg-private-key
|
||||
mountPath: /raw
|
||||
readOnly: true
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: configure-gitea
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
|
||||
{{- if $commandInitContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $commandInitContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.gitea.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindDn
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindPassword
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- else }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
value: {{ $value.bindDn | quote }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
value: {{ $value.bindPassword | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_KEY_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: key
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_SECRET_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.secrets.admin.enabled }}
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.usernameKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.passwordKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: {{ include "gitea.secret.admin.emailKey" . }}
|
||||
name: {{ include "gitea.secret.admin.name" . }}
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: {{ include "gitea.secret.admin.passwordMode" $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.postExtraInitContainers }}
|
||||
{{- toYaml .Values.postExtraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- include "gitea.deployment.initContainers" . | trim | nindent 8 }}
|
||||
terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
@@ -377,6 +106,10 @@ spec:
|
||||
{{- if .Values.deployment.gitea.env }}
|
||||
{{- toYaml .Values.deployment.gitea.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.deployment.gitea.envFrom }}
|
||||
envFrom:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ssh
|
||||
containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
|
||||
@@ -85,6 +85,16 @@
|
||||
{{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* POST EXTRA INIT CONTAINERS */}}
|
||||
{{- if .Values.postExtraInitContainers -}}
|
||||
{{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* PRE EXTRA INIT CONTAINERS */}}
|
||||
{{- if .Values.preExtraInitContainers -}}
|
||||
{{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* RESOURCES */}}
|
||||
{{- if .Values.resources -}}
|
||||
{{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}
|
||||
|
||||
@@ -11,29 +11,18 @@ templates:
|
||||
- templates/gitea/secret_inlineConfig.yaml
|
||||
- templates/gitea/secret_metrics.yaml
|
||||
tests:
|
||||
- it: adds a checksum annotation for every Secret by default
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: omits the checksum annotations when addSHASumAnnotation is disabled
|
||||
- it: omits the checksum annotations by default
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.addSHASumAnnotation: false
|
||||
secrets.config.addSHASumAnnotation: false
|
||||
secrets.gpg.addSHASumAnnotation: false
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
secrets.inlineConfig.addSHASumAnnotation: false
|
||||
secrets.metrics.addSHASumAnnotation: false
|
||||
secrets.admin.enabled: true
|
||||
secrets.config.enabled: true
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.new.privateKey: |
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
secrets.init.enabled: true
|
||||
secrets.inlineConfig.enabled: true
|
||||
secrets.metrics.enabled: true
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
@@ -48,33 +37,66 @@ tests:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.addSHASumAnnotation: true
|
||||
secrets.admin.enabled: true
|
||||
|
||||
secrets.config.addSHASumAnnotation: true
|
||||
secrets.config.enabled: true
|
||||
|
||||
secrets.gpg.addSHASumAnnotation: true
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.new.privateKey: |
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
|
||||
secrets.init.addSHASumAnnotation: true
|
||||
secrets.init.enabled: true
|
||||
|
||||
secrets.inlineConfig.addSHASumAnnotation: true
|
||||
secrets.inlineConfig.enabled: true
|
||||
|
||||
secrets.metrics.addSHASumAnnotation: true
|
||||
secrets.metrics.enabled: true
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/gpg"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: omits the checksum annotation of a single disabled Secret only
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
secrets.admin.addSHASumAnnotation: false
|
||||
secrets.admin.enabled: true
|
||||
|
||||
- it: omits the checksum annotations of Secrets provided by the user
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: custom-admin
|
||||
secrets.config.existingSecret.enabled: true
|
||||
secrets.config.existingSecret.secretName: custom-config
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
secrets.gpg.existingSecret.secretName: custom-gpg
|
||||
secrets.init.existingSecret.enabled: true
|
||||
secrets.init.existingSecret.secretName: custom-init
|
||||
secrets.inlineConfig.existingSecret.enabled: true
|
||||
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
|
||||
secrets.metrics.existingSecret.enabled: true
|
||||
secrets.metrics.existingSecret.secretName: custom-metrics
|
||||
secrets.config.addSHASumAnnotation: false
|
||||
secrets.config.enabled: true
|
||||
|
||||
secrets.gpg.addSHASumAnnotation: false
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.new.privateKey: |
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
|
||||
secrets.init.addSHASumAnnotation: false
|
||||
secrets.init.enabled: true
|
||||
|
||||
secrets.inlineConfig.addSHASumAnnotation: false
|
||||
secrets.inlineConfig.enabled: true
|
||||
|
||||
secrets.metrics.addSHASumAnnotation: false
|
||||
secrets.metrics.enabled: true
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
@@ -88,3 +110,49 @@ tests:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- notExists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
- it: adds the checksum of Secrets provided by the user
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
secrets.admin.enabled: true
|
||||
secrets.admin.addSHASumAnnotation: true
|
||||
secrets.admin.existingSecret.enabled: true
|
||||
secrets.admin.existingSecret.secretName: custom-admin
|
||||
|
||||
secrets.config.enabled: true
|
||||
secrets.config.addSHASumAnnotation: true
|
||||
secrets.config.existingSecret.enabled: true
|
||||
secrets.config.existingSecret.secretName: custom-config
|
||||
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.addSHASumAnnotation: true
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
secrets.gpg.existingSecret.secretName: custom-gpg
|
||||
|
||||
secrets.init.enabled: true
|
||||
secrets.init.addSHASumAnnotation: true
|
||||
secrets.init.existingSecret.enabled: true
|
||||
secrets.init.existingSecret.secretName: custom-init
|
||||
|
||||
secrets.inlineConfig.enabled: true
|
||||
secrets.inlineConfig.addSHASumAnnotation: true
|
||||
secrets.inlineConfig.existingSecret.enabled: true
|
||||
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
|
||||
|
||||
secrets.metrics.enabled: true
|
||||
secrets.metrics.addSHASumAnnotation: true
|
||||
secrets.metrics.existingSecret.enabled: true
|
||||
secrets.metrics.existingSecret.secretName: custom-metrics
|
||||
asserts:
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/admin"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/config"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/gpg"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/init"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/inlineConfig"]
|
||||
- exists:
|
||||
path: spec.template.metadata.annotations["checksum/metrics"]
|
||||
|
||||
@@ -83,6 +83,22 @@ tests:
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead."
|
||||
- it: fails when the removed `postExtraInitContainers` value is set
|
||||
set:
|
||||
postExtraInitContainers:
|
||||
- name: post-init-container
|
||||
image: docker.io/library/busybox
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead."
|
||||
- it: fails when the removed `preExtraInitContainers` value is set
|
||||
set:
|
||||
preExtraInitContainers:
|
||||
- name: pre-init-container
|
||||
image: docker.io/library/busybox
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead."
|
||||
- it: fails when the removed `resources` value is set
|
||||
set:
|
||||
resources:
|
||||
@@ -158,6 +174,12 @@ tests:
|
||||
foo: bar
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
postExtraInitContainers:
|
||||
- name: post-init-container
|
||||
image: docker.io/library/busybox
|
||||
preExtraInitContainers:
|
||||
- name: pre-init-container
|
||||
image: docker.io/library/busybox
|
||||
priorityClassName: high-priority
|
||||
replicaCount: 2
|
||||
resources:
|
||||
|
||||
@@ -37,12 +37,17 @@ tests:
|
||||
|
||||
- it: Render the deployment (extraInitContainers)
|
||||
set:
|
||||
postExtraInitContainers:
|
||||
- name: foo
|
||||
image: docker.io/library/busybox:latest
|
||||
preExtraInitContainers:
|
||||
- name: bar
|
||||
image: docker.io/library/busybox:latest
|
||||
deployment.initContainers:
|
||||
- container:
|
||||
name: bar
|
||||
image: docker.io/library/busybox:latest
|
||||
- link: "initDirectories"
|
||||
- link: "initAppIni"
|
||||
- link: "initConfigureGPG"
|
||||
- link: "initConfigureGitea"
|
||||
- container:
|
||||
name: foo
|
||||
image: docker.io/library/busybox:latest
|
||||
secrets.gpg.enabled: true
|
||||
secrets.gpg.existingSecret.enabled: true
|
||||
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
|
||||
@@ -54,15 +59,55 @@ tests:
|
||||
path: spec.template.spec.initContainers
|
||||
count: 6
|
||||
template: templates/gitea/deployment.yaml
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers
|
||||
content:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].name
|
||||
value: bar
|
||||
template: templates/gitea/deployment.yaml
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[5].name
|
||||
value: foo
|
||||
template: templates/gitea/deployment.yaml
|
||||
|
||||
- it: renders the chart-managed init containers in the configured order
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- link: "initConfigureGitea"
|
||||
- link: "initDirectories"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].name
|
||||
value: configure-gitea
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].name
|
||||
value: init-directories
|
||||
|
||||
- it: fails when an init container entry sets both container and link
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- link: "initDirectories"
|
||||
container:
|
||||
name: foo
|
||||
image: docker.io/library/busybox:latest
|
||||
template: templates/gitea/deployment.yaml
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers
|
||||
content:
|
||||
name: bar
|
||||
image: docker.io/library/busybox:latest
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "deployment.initContainers[0]: `container` and `link` are mutually exclusive"
|
||||
|
||||
- it: fails when an init container entry sets neither container nor link
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- name: foo
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "deployment.initContainers[0]: either `container` or `link` must be set"
|
||||
|
||||
- it: fails when an init container links to an unknown configuration
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initContainers:
|
||||
- link: "initSomething"
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: "deployment.initContainers[0]: unknown link `initSomething`, expected one of: initAppIni, initConfigureGPG, initConfigureGitea, initDirectories"
|
||||
|
||||
@@ -105,7 +105,11 @@ tests:
|
||||
- it: correctly renders floating tag references
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.gitea.image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
|
||||
# use non-quoted values on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
|
||||
deployment.gitea.image.tag: 1.21
|
||||
deployment.initDirectories.image.tag: 1.21
|
||||
deployment.initAppIni.image.tag: 1.21
|
||||
deployment.initConfigureGitea.image.tag: 1.21
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].image
|
||||
@@ -119,3 +123,18 @@ tests:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.gitea.com/gitea:1.21-rootless"
|
||||
- it: init containers use their own image configuration
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initDirectories.image.registry: "init.example.com"
|
||||
deployment.initDirectories.image.tag: "1.19.4"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].image
|
||||
value: "init.example.com/gitea:1.19.4-rootless"
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].image
|
||||
value: "docker.gitea.com/gitea:1.19.3-rootless"
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "docker.gitea.com/gitea:1.19.3-rootless"
|
||||
|
||||
@@ -0,0 +1,130 @@
|
||||
suite: deployment template (init container configuration)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/secret_admin.yaml
|
||||
- templates/gitea/secret_config.yaml
|
||||
- templates/gitea/secret_gpg.yaml
|
||||
- templates/gitea/secret_init.yaml
|
||||
- templates/gitea/secret_inlineConfig.yaml
|
||||
- templates/gitea/secret_metrics.yaml
|
||||
tests:
|
||||
- it: appends the per-container env
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initDirectories.env:
|
||||
- name: INIT_DIRECTORIES
|
||||
value: "1"
|
||||
deployment.gitea.env:
|
||||
- name: SHARED
|
||||
value: "1"
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[0].env
|
||||
content:
|
||||
name: INIT_DIRECTORIES
|
||||
value: "1"
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[0].env
|
||||
content:
|
||||
name: SHARED
|
||||
value: "1"
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers[1].env
|
||||
content:
|
||||
name: INIT_DIRECTORIES
|
||||
value: "1"
|
||||
|
||||
- it: renders the per-container envFrom
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initAppIni.envFrom:
|
||||
- secretRef:
|
||||
name: special-secret
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[0].envFrom
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].envFrom
|
||||
value:
|
||||
- secretRef:
|
||||
name: special-secret
|
||||
|
||||
- it: appends the per-container volumeMounts
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initConfigureGitea.volumeMounts:
|
||||
- name: my-configmap-volume
|
||||
mountPath: /configmap
|
||||
readOnly: true
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.initContainers[2].volumeMounts
|
||||
content:
|
||||
name: my-configmap-volume
|
||||
mountPath: /configmap
|
||||
readOnly: true
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers[0].volumeMounts
|
||||
content:
|
||||
name: my-configmap-volume
|
||||
mountPath: /configmap
|
||||
readOnly: true
|
||||
|
||||
- it: overrides the resources of a single init container
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.initDirectories.resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].resources
|
||||
value:
|
||||
requests:
|
||||
cpu: 500m
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].resources
|
||||
value:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
- it: overrides the security context of a single init container
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.gitea.securityContext:
|
||||
runAsUser: 1000
|
||||
deployment.initDirectories.securityContext:
|
||||
runAsUser: 2000
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].securityContext.runAsUser
|
||||
value: 2000
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].securityContext.runAsUser
|
||||
value: 1000
|
||||
|
||||
- it: renders the envFrom of the gitea container
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
deployment.gitea.envFrom:
|
||||
- configMapRef:
|
||||
name: special-config
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].envFrom
|
||||
value:
|
||||
- configMapRef:
|
||||
name: special-config
|
||||
|
||||
- it: omits envFrom when unset
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.spec.containers[0].envFrom
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[0].envFrom
|
||||
+334
-24
@@ -67,6 +67,13 @@ deployment:
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
|
||||
## @param deployment.gitea.envFrom List of environment variables mounted from configMaps or secrets for the gitea container.
|
||||
envFrom: []
|
||||
# - configMapRef:
|
||||
# name: special-config
|
||||
# - secretRef:
|
||||
# name: special-secret
|
||||
|
||||
## @param deployment.gitea.image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param deployment.gitea.image.repository Image to start for this pod
|
||||
## @param deployment.gitea.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
|
||||
@@ -101,7 +108,7 @@ deployment:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param deployment.gitea.securityContext Security context of the Gitea container and the chart-managed init containers.
|
||||
## @param deployment.gitea.securityContext Security context of the Gitea container. Used as fallback for the chart-managed init containers.
|
||||
securityContext: {}
|
||||
# allowPrivilegeEscalation: false
|
||||
# capabilities:
|
||||
@@ -126,6 +133,305 @@ deployment:
|
||||
# mountPath: /configmap
|
||||
# readOnly: true
|
||||
|
||||
## @param deployment.initContainers [array] List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration.
|
||||
initContainers:
|
||||
# - container:
|
||||
# command: [ "sh", "-c", "echo hello world" ]
|
||||
# image: "docker.io/library/busybox:latest"
|
||||
# name: pre-task
|
||||
- link: "initDirectories"
|
||||
- link: "initAppIni"
|
||||
- link: "initConfigureGPG"
|
||||
- link: "initConfigureGitea"
|
||||
# - container:
|
||||
# command: [ "sh", "-c", "echo hello world" ]
|
||||
# image: "docker.io/library/busybox:latest"
|
||||
# name: post-task
|
||||
|
||||
initDirectories:
|
||||
## @param deployment.initDirectories.env Additional environment variables to pass to the init container.
|
||||
env: []
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
|
||||
## @param deployment.initDirectories.envFrom List of environment variables mounted from configMaps or secrets for the initDirectories container.
|
||||
envFrom: []
|
||||
# - configMapRef:
|
||||
# name: special-config
|
||||
# - secretRef:
|
||||
# name: special-secret
|
||||
|
||||
## @param deployment.initDirectories.image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param deployment.initDirectories.image.repository Image to start for this pod
|
||||
## @param deployment.initDirectories.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
|
||||
## @param deployment.initDirectories.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
||||
## @param deployment.initDirectories.image.pullPolicy Image pull policy
|
||||
## @param deployment.initDirectories.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher
|
||||
## @param deployment.initDirectories.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initDirectories.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).**
|
||||
image:
|
||||
registry: "docker.gitea.com"
|
||||
repository: gitea
|
||||
tag: ""
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
rootless: true
|
||||
fullOverride: ""
|
||||
|
||||
## @param deployment.initDirectories.resources Compute Resources required by the initDirectories container. Defaults to `initContainers.resources`. Cannot be updated.
|
||||
## @skip deployment.initDirectories.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
|
||||
## @skip deployment.initDirectories.resources.limits Limits describes the maximum amount of compute resources allowed for this container.
|
||||
## @skip deployment.initDirectories.resources.requests Requests describes the minimum amount of compute resources required for this container.
|
||||
resources:
|
||||
# claims: []
|
||||
# - name: ""
|
||||
# request: ""
|
||||
# limits:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param deployment.initDirectories.securityContext Security context of the initDirectories container. Defaults to `deployment.gitea.securityContext`.
|
||||
securityContext: {}
|
||||
# allowPrivilegeEscalation: false
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# # Add the SYS_CHROOT capability for root and rootless images if you intend to
|
||||
# # run pods on nodes that use the container runtime cri-o. Otherwise, you will
|
||||
# # get an error message from the SSH server that it is not possible to read from
|
||||
# # the repository.
|
||||
# # https://gitea.com/gitea/helm-gitea/issues/161
|
||||
# add:
|
||||
# - SYS_CHROOT
|
||||
# privileged: false
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsGroup: 1000
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param deployment.initDirectories.volumeMounts Additional volume mounts.
|
||||
volumeMounts: []
|
||||
# - name: my-configmap-volume
|
||||
# mountPath: /configmap
|
||||
# readOnly: true
|
||||
|
||||
initAppIni:
|
||||
## @param deployment.initAppIni.env Additional environment variables to pass to the init container.
|
||||
env: []
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
|
||||
## @param deployment.initAppIni.envFrom List of environment variables mounted from configMaps or secrets for the initAppIni container.
|
||||
envFrom: []
|
||||
# - configMapRef:
|
||||
# name: special-config
|
||||
# - secretRef:
|
||||
# name: special-secret
|
||||
|
||||
## @param deployment.initAppIni.image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param deployment.initAppIni.image.repository Image to start for this pod
|
||||
## @param deployment.initAppIni.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
|
||||
## @param deployment.initAppIni.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
||||
## @param deployment.initAppIni.image.pullPolicy Image pull policy
|
||||
## @param deployment.initAppIni.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher
|
||||
## @param deployment.initAppIni.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initAppIni.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).**
|
||||
image:
|
||||
registry: "docker.gitea.com"
|
||||
repository: gitea
|
||||
tag: ""
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
rootless: true
|
||||
fullOverride: ""
|
||||
|
||||
## @param deployment.initAppIni.resources Compute Resources required by the initAppIni container. Defaults to `initContainers.resources`. Cannot be updated.
|
||||
## @skip deployment.initAppIni.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
|
||||
## @skip deployment.initAppIni.resources.limits Limits describes the maximum amount of compute resources allowed for this container.
|
||||
## @skip deployment.initAppIni.resources.requests Requests describes the minimum amount of compute resources required for this container.
|
||||
resources:
|
||||
# claims: []
|
||||
# - name: ""
|
||||
# request: ""
|
||||
# limits:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param deployment.initAppIni.securityContext Security context of the initAppIni container. Defaults to `deployment.gitea.securityContext`.
|
||||
securityContext: {}
|
||||
# allowPrivilegeEscalation: false
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# # Add the SYS_CHROOT capability for root and rootless images if you intend to
|
||||
# # run pods on nodes that use the container runtime cri-o. Otherwise, you will
|
||||
# # get an error message from the SSH server that it is not possible to read from
|
||||
# # the repository.
|
||||
# # https://gitea.com/gitea/helm-gitea/issues/161
|
||||
# add:
|
||||
# - SYS_CHROOT
|
||||
# privileged: false
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsGroup: 1000
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param deployment.initAppIni.volumeMounts Additional volume mounts.
|
||||
volumeMounts: []
|
||||
# - name: my-configmap-volume
|
||||
# mountPath: /configmap
|
||||
# readOnly: true
|
||||
|
||||
initConfigureGPG:
|
||||
## @param deployment.initConfigureGPG.env Additional environment variables to pass to the init container.
|
||||
env: []
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
|
||||
## @param deployment.initConfigureGPG.envFrom List of environment variables mounted from configMaps or secrets for the initConfigureGPG container.
|
||||
envFrom: []
|
||||
# - configMapRef:
|
||||
# name: special-config
|
||||
# - secretRef:
|
||||
# name: special-secret
|
||||
|
||||
## @param deployment.initConfigureGPG.image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param deployment.initConfigureGPG.image.repository Image to start for this pod
|
||||
## @param deployment.initConfigureGPG.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
|
||||
## @param deployment.initConfigureGPG.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
||||
## @param deployment.initConfigureGPG.image.pullPolicy Image pull policy
|
||||
## @param deployment.initConfigureGPG.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher
|
||||
## @param deployment.initConfigureGPG.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGPG.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).**
|
||||
image:
|
||||
registry: "docker.gitea.com"
|
||||
repository: gitea
|
||||
tag: ""
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
rootless: true
|
||||
fullOverride: ""
|
||||
|
||||
## @param deployment.initConfigureGPG.resources Compute Resources required by the initConfigureGPG container. Defaults to `initContainers.resources`. Cannot be updated.
|
||||
## @skip deployment.initConfigureGPG.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
|
||||
## @skip deployment.initConfigureGPG.resources.limits Limits describes the maximum amount of compute resources allowed for this container.
|
||||
## @skip deployment.initConfigureGPG.resources.requests Requests describes the minimum amount of compute resources required for this container.
|
||||
resources:
|
||||
# claims: []
|
||||
# - name: ""
|
||||
# request: ""
|
||||
# limits:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param deployment.initConfigureGPG.securityContext Security context of the initConfigureGPG container. Defaults to `deployment.gitea.securityContext`.
|
||||
securityContext: {}
|
||||
# allowPrivilegeEscalation: false
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# # Add the SYS_CHROOT capability for root and rootless images if you intend to
|
||||
# # run pods on nodes that use the container runtime cri-o. Otherwise, you will
|
||||
# # get an error message from the SSH server that it is not possible to read from
|
||||
# # the repository.
|
||||
# # https://gitea.com/gitea/helm-gitea/issues/161
|
||||
# add:
|
||||
# - SYS_CHROOT
|
||||
# privileged: false
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsGroup: 1000
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param deployment.initConfigureGPG.volumeMounts Additional volume mounts.
|
||||
volumeMounts: []
|
||||
# - name: my-configmap-volume
|
||||
# mountPath: /configmap
|
||||
# readOnly: true
|
||||
|
||||
initConfigureGitea:
|
||||
## @param deployment.initConfigureGitea.env Additional environment variables to pass to the init container.
|
||||
env: []
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
|
||||
## @param deployment.initConfigureGitea.envFrom List of environment variables mounted from configMaps or secrets for the initConfigureGitea container.
|
||||
envFrom: []
|
||||
# - configMapRef:
|
||||
# name: special-config
|
||||
# - secretRef:
|
||||
# name: special-secret
|
||||
|
||||
## @param deployment.initConfigureGitea.image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param deployment.initConfigureGitea.image.repository Image to start for this pod
|
||||
## @param deployment.initConfigureGitea.image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
|
||||
## @param deployment.initConfigureGitea.image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
||||
## @param deployment.initConfigureGitea.image.pullPolicy Image pull policy
|
||||
## @param deployment.initConfigureGitea.image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher
|
||||
## @param deployment.initConfigureGitea.image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.initConfigureGitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).**
|
||||
image:
|
||||
registry: "docker.gitea.com"
|
||||
repository: gitea
|
||||
tag: ""
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
rootless: true
|
||||
fullOverride: ""
|
||||
|
||||
## @param deployment.initConfigureGitea.resources Compute Resources required by the initConfigureGitea container. Defaults to `initContainers.resources`. Cannot be updated.
|
||||
## @skip deployment.initConfigureGitea.resources.claims Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
|
||||
## @skip deployment.initConfigureGitea.resources.limits Limits describes the maximum amount of compute resources allowed for this container.
|
||||
## @skip deployment.initConfigureGitea.resources.requests Requests describes the minimum amount of compute resources required for this container.
|
||||
resources:
|
||||
# claims: []
|
||||
# - name: ""
|
||||
# request: ""
|
||||
# limits:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# ephemeral: 100Mi
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param deployment.initConfigureGitea.securityContext Security context of the initConfigureGitea container. Defaults to `deployment.gitea.securityContext`.
|
||||
securityContext: {}
|
||||
# allowPrivilegeEscalation: false
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# # Add the SYS_CHROOT capability for root and rootless images if you intend to
|
||||
# # run pods on nodes that use the container runtime cri-o. Otherwise, you will
|
||||
# # get an error message from the SSH server that it is not possible to read from
|
||||
# # the repository.
|
||||
# # https://gitea.com/gitea/helm-gitea/issues/161
|
||||
# add:
|
||||
# - SYS_CHROOT
|
||||
# privileged: false
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsGroup: 1000
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param deployment.initConfigureGitea.volumeMounts Additional volume mounts.
|
||||
volumeMounts: []
|
||||
# - name: my-configmap-volume
|
||||
# mountPath: /configmap
|
||||
# readOnly: true
|
||||
|
||||
## @param deployment.nodeSelector NodeSelector for the deployment
|
||||
nodeSelector: {}
|
||||
|
||||
@@ -362,8 +668,8 @@ secrets:
|
||||
## @param secrets.admin.enabled Create and keep the Gitea admin user in sync
|
||||
enabled: true
|
||||
|
||||
## @param secrets.admin.addSHASumAnnotation Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change
|
||||
addSHASumAnnotation: true
|
||||
## @param secrets.admin.addSHASumAnnotation Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
|
||||
addSHASumAnnotation: false
|
||||
|
||||
## @param secrets.admin.passwordMode Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated
|
||||
passwordMode: keepUpdated
|
||||
@@ -393,8 +699,11 @@ secrets:
|
||||
username: gitea_admin
|
||||
|
||||
config:
|
||||
## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change
|
||||
addSHASumAnnotation: true
|
||||
## @param secrets.config.enabled Enable mounting of the config Secret.
|
||||
enabled: true
|
||||
|
||||
## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
|
||||
addSHASumAnnotation: false
|
||||
|
||||
## @param secrets.config.existingSecret.enabled Use an already existing Secret instead of creating the config Secret
|
||||
## @param secrets.config.existingSecret.secretName Name of the already existing config Secret
|
||||
@@ -412,8 +721,8 @@ secrets:
|
||||
## @param secrets.gpg.enabled Enable mounting of a GPG key to sign git commits.
|
||||
enabled: false
|
||||
|
||||
## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change
|
||||
addSHASumAnnotation: true
|
||||
## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
|
||||
addSHASumAnnotation: false
|
||||
|
||||
## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret
|
||||
## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret
|
||||
@@ -440,8 +749,11 @@ secrets:
|
||||
# -----END PGP PRIVATE KEY BLOCK-----
|
||||
|
||||
init:
|
||||
## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change
|
||||
addSHASumAnnotation: true
|
||||
## @param secrets.init.enabled Enable mounting of the init Secret.
|
||||
enabled: true
|
||||
|
||||
## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
|
||||
addSHASumAnnotation: false
|
||||
|
||||
## @param secrets.init.existingSecret.enabled Use an already existing Secret instead of creating the init Secret
|
||||
## @param secrets.init.existingSecret.secretName Name of the already existing init Secret
|
||||
@@ -456,8 +768,11 @@ secrets:
|
||||
labels: {}
|
||||
|
||||
inlineConfig:
|
||||
## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change
|
||||
addSHASumAnnotation: true
|
||||
## @param secrets.inlineConfig.enabled Enable mounting of the inline configuration Secret.
|
||||
enabled: true
|
||||
|
||||
## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
|
||||
addSHASumAnnotation: false
|
||||
|
||||
## @param secrets.inlineConfig.existingSecret.enabled Use an already existing Secret instead of creating the inline configuration Secret
|
||||
## @param secrets.inlineConfig.existingSecret.secretName Name of the already existing inline configuration Secret
|
||||
@@ -472,8 +787,11 @@ secrets:
|
||||
labels: {}
|
||||
|
||||
metrics:
|
||||
## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change
|
||||
addSHASumAnnotation: true
|
||||
## @param secrets.metrics.enabled Enable mounting of the metrics Secret.
|
||||
enabled: true
|
||||
|
||||
## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
|
||||
addSHASumAnnotation: false
|
||||
|
||||
## @param secrets.metrics.existingSecret.enabled Use an already existing Secret instead of creating the metrics Secret
|
||||
## @param secrets.metrics.existingSecret.secretName Name of the already existing metrics Secret
|
||||
@@ -598,17 +916,9 @@ extraContainers: []
|
||||
# image: busybox
|
||||
# command: [/bin/sh, -c, 'echo "Hello world"']
|
||||
|
||||
## @param preExtraInitContainers Additional init containers to run in the pod before gitea runs it owns init containers.
|
||||
preExtraInitContainers: []
|
||||
# - name: pre-init-container
|
||||
# image: docker.io/library/busybox
|
||||
# command: [ /bin/sh, -c, 'echo "Hello world! I am a pre init container."' ]
|
||||
|
||||
## @param postExtraInitContainers Additional init containers to run in the pod after gitea runs it owns init containers.
|
||||
postExtraInitContainers: []
|
||||
# - name: post-init-container
|
||||
# image: docker.io/library/busybox
|
||||
# command: [ /bin/sh, -c, 'echo "Hello world! I am a post init container."' ]
|
||||
## @deprecated The preExtraInitContainers and postExtraInitContainers variables have been replaced by
|
||||
## deployment.initContainers. Add an entry with a `container` key before or after the linked
|
||||
## chart-managed init containers to achieve the same result.
|
||||
|
||||
## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration.
|
||||
extraInitVolumeMounts: []
|
||||
|
||||
Reference in New Issue
Block a user