Compare commits
23
Commits
main
..
0cc67cb360
| Author | SHA1 | Date | |
|---|---|---|---|
 CSRBot
|
0cc67cb360
|
||
|
CSRBotandCSRBot
|
76f4030f88 | ||
|
CSRBotandCSRBot
|
e57afebdde | ||
|
CSRBotandCSRBot
|
127fc891df | ||
|
CSRBotandCSRBot
|
8d0c8a99c6 | ||
|
CSRBotandCSRBot
|
856f154992 | ||
|
CSRBotandCSRBot
|
8df1a7c4a4 | ||
|
CSRBotandCSRBot
|
897baa4691 | ||
|
CSRBotandCSRBot
|
e597209986 | ||
|
CSRBotandCSRBot
|
f7d16c8b1a | ||
|
CSRBotandCSRBot
|
9783483311 | ||
|
CSRBotandCSRBot
|
cd05169800 | ||
|
CSRBotandCSRBot
|
03d4b5f0cb | ||
|
CSRBotandCSRBot
|
99fd476b6f | ||
|
CSRBotandCSRBot
|
c53077e3ca | ||
|
CSRBotandCSRBot
|
e1c20cc124 | ||
|
CSRBotandCSRBot
|
7d6792c7e8 | ||
|
CSRBotandCSRBot
|
5bea54ae3f | ||
|
CSRBotandCSRBot
|
c6f7dc8d7d | ||
|
CSRBotandCSRBot
|
f1e8bc0ec8 | ||
|
CSRBotandCSRBot
|
a361e3c2a3 | ||
|
CSRBotandCSRBot
|
c11c5303fc | ||
|
CSRBotandCSRBot
|
6ac57abdba |
@@ -8,12 +8,12 @@ on:
|
||||
jobs:
|
||||
changelog:
|
||||
runs-on: ubuntu-latest
|
||||
container: docker.io/thegeeklab/git-sv:2.1.3
|
||||
container: docker.io/thegeeklab/git-sv:2.0.11
|
||||
steps:
|
||||
- name: install tools
|
||||
run: |
|
||||
apk add -q --update --no-cache nodejs curl jq sed
|
||||
- uses: actions/checkout@v7.0.0
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Generate upcoming changelog
|
||||
|
||||
@@ -11,9 +11,9 @@ on:
|
||||
jobs:
|
||||
check-and-test:
|
||||
runs-on: ubuntu-latest
|
||||
container: docker.io/commitlint/commitlint:21.2.1
|
||||
container: commitlint/commitlint:20.5.1
|
||||
steps:
|
||||
- uses: actions/checkout@v7.0.0
|
||||
- uses: actions/checkout@v6
|
||||
- name: check PR title
|
||||
run: |
|
||||
echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json
|
||||
|
||||
@@ -9,7 +9,7 @@ jobs:
|
||||
generate-chart-publish:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v7.0.0
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -21,13 +21,22 @@ jobs:
|
||||
- name: Install helm
|
||||
env:
|
||||
# renovate: datasource=docker depName=alpine/helm
|
||||
HELM_VERSION: "3.21.3"
|
||||
HELM_VERSION: "3.20.2"
|
||||
run: |
|
||||
curl --fail --location --output /dev/stdout --silent --show-error https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
|
||||
mv linux-$(dpkg --print-architecture)/helm /usr/local/bin/
|
||||
rm --force --recursive linux-$(dpkg --print-architecture) helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz
|
||||
helm version
|
||||
|
||||
- name: Install yq
|
||||
env:
|
||||
YQ_VERSION: v4.45.4 # renovate: datasource=github-releases depName=mikefarah/yq
|
||||
run: |
|
||||
curl --fail --location --output /dev/stdout --silent --show-error https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
|
||||
mv yq_linux_$(dpkg --print-architecture) /usr/local/bin
|
||||
rm --force --recursive yq_linux_$(dpkg --print-architecture) yq_linux_$(dpkg --print-architecture).tar.gz
|
||||
yq --version
|
||||
|
||||
- name: Install docker-ce via apt
|
||||
run: |
|
||||
install -m 0755 -d /etc/apt/keyrings
|
||||
@@ -44,14 +53,20 @@ jobs:
|
||||
|
||||
- name: Import GPG key
|
||||
id: import_gpg
|
||||
uses: https://github.com/crazy-max/ghaction-import-gpg@v7
|
||||
uses: https://github.com/crazy-max/ghaction-import-gpg@v6
|
||||
with:
|
||||
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
|
||||
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
|
||||
fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
|
||||
|
||||
- name: Add Artifacthub.io annotations
|
||||
uses: volker-raschek/ah-annotations@v0.2.0
|
||||
run: |
|
||||
NEW_TAG="$(git tag --sort=-version:refname | head --lines 1)"
|
||||
OLD_TAG="$(git tag --sort=-version:refname | head --lines 2 | tail --lines 1)"
|
||||
.gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
|
||||
|
||||
- name: Print Chart.yaml
|
||||
run: cat Chart.yaml
|
||||
|
||||
# Using helm gpg plugin as 'helm package --sign' has issues with gpg2: https://github.com/helm/helm/issues/2843
|
||||
- name: package chart
|
||||
@@ -70,25 +85,26 @@ jobs:
|
||||
helm push gitea/gitea-${GITHUB_REF#refs/tags/v}.tgz oci://registry-1.docker.io/giteacharts
|
||||
helm registry logout registry-1.docker.io
|
||||
|
||||
- name: Copy files to Cloudflare R2
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
|
||||
AWS_DEFAULT_REGION: auto
|
||||
CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
|
||||
CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
|
||||
- name: aws credential configure
|
||||
uses: https://github.com/aws-actions/configure-aws-credentials@v5
|
||||
with:
|
||||
aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
|
||||
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
||||
aws-region: ${{ secrets.AWS_REGION }}
|
||||
|
||||
- name: Copy files to S3 and clear cache
|
||||
run: |
|
||||
aws s3 sync gitea/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com
|
||||
aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET}}/charts/
|
||||
|
||||
release-gitea:
|
||||
needs: generate-chart-publish
|
||||
runs-on: ubuntu-latest
|
||||
container: docker.io/thegeeklab/git-sv:2.1.3
|
||||
container: docker.io/thegeeklab/git-sv:2.0.11
|
||||
steps:
|
||||
- name: install tools
|
||||
run: |
|
||||
apk add -q --update --no-cache nodejs
|
||||
- uses: actions/checkout@v7.0.0
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-tags: true
|
||||
fetch-depth: 0
|
||||
|
||||
@@ -10,32 +10,27 @@ on:
|
||||
|
||||
env:
|
||||
# renovate: datasource=github-releases depName=helm-unittest/helm-unittest
|
||||
HELM_UNITTEST_VERSION: "v1.1.1"
|
||||
HELM_UNITTEST_VERSION: "v1.0.3"
|
||||
|
||||
jobs:
|
||||
check-and-test:
|
||||
runs-on: ubuntu-latest
|
||||
container: docker.io/alpine/helm:4.2.3
|
||||
container: alpine/helm:3.20.2
|
||||
steps:
|
||||
- name: install tools
|
||||
run: |
|
||||
apk update
|
||||
apk add --update bash make nodejs npm yamllint ncurses
|
||||
- uses: actions/checkout@v7.0.0
|
||||
- name: define helm repositories
|
||||
run: |
|
||||
helm repo add bitnami https://charts.bitnami.com/bitnami
|
||||
helm repo add valkey https://valkey.io/valkey-helm
|
||||
helm repo update
|
||||
- uses: actions/checkout@v6
|
||||
- name: install chart dependencies
|
||||
run: helm dependency build
|
||||
- name: lint
|
||||
run: helm lint .
|
||||
run: helm lint
|
||||
- name: template
|
||||
run: helm template --debug gitea-helm .
|
||||
- name: prepare unit test environment
|
||||
run: |
|
||||
helm plugin install --verify=false --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
|
||||
helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
|
||||
git submodule update --init --recursive
|
||||
- name: unit tests
|
||||
env:
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
# Gitea Helm Chart — Copilot Instructions
|
||||
|
||||
## Project Overview
|
||||
|
||||
Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster.
|
||||
|
||||
## Build & Test
|
||||
|
||||
```bash
|
||||
make readme # Regenerate README.md parameter table + lint
|
||||
make unittests-helm # Run Helm unit tests (helm-unittest plugin required)
|
||||
make unittests-bash # Run bash/bats script tests (requires git submodule init)
|
||||
make unittests # Both of the above
|
||||
```
|
||||
|
||||
Always run `make readme` after changing `values.yaml` `@param` annotations.
|
||||
Always run `make unittests-helm` after changing templates or unit tests.
|
||||
|
||||
## Conventions
|
||||
|
||||
### values.yaml
|
||||
|
||||
- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
|
||||
- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
|
||||
- Top-level keys are sorted alphabetically within their section group.
|
||||
- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
|
||||
|
||||
```yaml
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: library/busybox
|
||||
tag: 0.1.0
|
||||
```
|
||||
|
||||
### Templates
|
||||
|
||||
- Helm templates live in `templates/gitea/`. Helpers live in `templates/_helpers.tpl`.
|
||||
- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
|
||||
- Use `include "gitea.fullname"` for naming resources.
|
||||
- Use `fail` for required-value validation with clear error messages referencing the full values path.
|
||||
- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
|
||||
- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
|
||||
- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
|
||||
|
||||
### Unit Tests
|
||||
|
||||
- Helm unit tests live in `unittests/helm/` mirroring the template structure.
|
||||
- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
|
||||
- Each test must set all required values explicitly — do not rely on cross-test state.
|
||||
- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint`. Use `make yamllint` to run the linter.
|
||||
|
||||
### Commits & PRs
|
||||
|
||||
- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
|
||||
- See `CONTRIBUTING.md` for full PR requirements.
|
||||
- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
|
||||
- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
|
||||
|
||||
### Documentation
|
||||
|
||||
- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
|
||||
- `README.md` parameter tables are auto-generated — never edit them manually.
|
||||
Vendored
+1
-5
@@ -1,11 +1,7 @@
|
||||
{
|
||||
"yaml.schemas": {
|
||||
"https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
|
||||
"https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.3/schema/helm-testsuite.json": [
|
||||
"/unittests/**/*.yaml"
|
||||
],
|
||||
"https://docs.renovatebot.com/renovate-schema.json":[
|
||||
"renovate.json",
|
||||
"renovate.json5"
|
||||
]
|
||||
},
|
||||
"yaml.schemaStore.enable": true,
|
||||
|
||||
+1
-1
@@ -1 +1 @@
|
||||
* @volker.raschek @ChristopherHX
|
||||
* @rossigee @volker.raschek @ChristopherHX
|
||||
|
||||
+7
-4
@@ -5,8 +5,11 @@ dependencies:
|
||||
- name: postgresql-ha
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 16.3.2
|
||||
- name: valkey-cluster
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 3.0.24
|
||||
- name: valkey
|
||||
repository: https://valkey.io/valkey-helm
|
||||
version: 0.10.0
|
||||
digest: sha256:1afecbf0d4fc9f48e31417573d4bed7e0ac7848040b9e0c5f3989ada9d1f944f
|
||||
generated: "2026-07-20T19:52:11.548874634+02:00"
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 3.0.31
|
||||
digest: sha256:ceb6a1890cfdc2627abb85d3e2a4baa64d30afd21dcfabce978a824a67f0a2bb
|
||||
generated: "2025-08-30T00:03:04.59764502Z"
|
||||
|
||||
+12
-3
@@ -3,7 +3,8 @@ name: gitea
|
||||
description: Gitea Helm chart for Kubernetes
|
||||
type: application
|
||||
version: 0.0.0
|
||||
appVersion: 1.27.2
|
||||
# renovate datasource=github-releases depName=go-gitea/gitea extractVersion=^v(?<version>.*)$
|
||||
appVersion: 1.26.1
|
||||
icon: https://gitea.com/assets/img/logo.svg
|
||||
|
||||
annotations:
|
||||
@@ -25,6 +26,9 @@ sources:
|
||||
- https://docker.gitea.com/gitea
|
||||
|
||||
maintainers:
|
||||
# https://gitea.com/rossigee
|
||||
- name: Ross Golder
|
||||
email: ross@golder.org
|
||||
# https://gitea.com/volker.raschek
|
||||
- name: Markus Pesch
|
||||
email: markus.pesch+apps@cryptic.systems
|
||||
@@ -46,8 +50,13 @@ dependencies:
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 16.3.2
|
||||
condition: postgresql-ha.enabled
|
||||
# https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml
|
||||
- name: valkey-cluster
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 3.0.24
|
||||
condition: valkey-cluster.enabled
|
||||
# https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
|
||||
- name: valkey
|
||||
repository: https://valkey.io/valkey-helm
|
||||
version: 0.10.0
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 3.0.31
|
||||
condition: valkey.enabled
|
||||
|
||||
@@ -43,8 +43,6 @@
|
||||
- [Security](#security)
|
||||
- [Service](#service)
|
||||
- [Ingress](#ingress)
|
||||
- [Route](#route)
|
||||
- [Gateway API](#gateway-api)
|
||||
- [deployment](#deployment)
|
||||
- [ServiceAccount](#serviceaccount)
|
||||
- [Persistence](#persistence-1)
|
||||
@@ -54,6 +52,7 @@
|
||||
- [LivenessProbe](#livenessprobe)
|
||||
- [ReadinessProbe](#readinessprobe)
|
||||
- [StartupProbe](#startupprobe)
|
||||
- [valkey-cluster](#valkey-cluster)
|
||||
- [valkey](#valkey)
|
||||
- [PostgreSQL HA](#postgresql-ha)
|
||||
- [PostgreSQL](#postgresql)
|
||||
@@ -97,13 +96,14 @@ Users can also configure their own external providers via the configuration.
|
||||
These dependencies are enabled by default:
|
||||
|
||||
- PostgreSQL HA ([Bitnami PostgreSQL-HA](https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml))
|
||||
- Valkey ([Official Valkey Helm Chart](https://github.com/valkey-io/valkey-helm))
|
||||
- Valkey-Cluster ([Bitnami Valkey-Cluster](https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml))
|
||||
|
||||
### Non-HA Dependencies
|
||||
|
||||
Alternatively, the following non-HA replacements are available:
|
||||
|
||||
- PostgreSQL ([Bitnami PostgreSQL](https://github.com/bitnami/charts/blob/main/bitnami/postgresql/Chart.yaml))
|
||||
- Valkey ([Bitnami Valkey](https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml))
|
||||
|
||||
### Dependency Versioning
|
||||
|
||||
@@ -121,7 +121,8 @@ Please double-check the image repository and available tags in the sub-chart:
|
||||
|
||||
- [PostgreSQL-HA](https://hub.docker.com/r/bitnami/postgresql-repmgr/tags)
|
||||
- [PostgreSQL](https://hub.docker.com/r/bitnami/postgresql/tags)
|
||||
- [Valkey](https://hub.docker.com/r/valkey/valkey/tags)
|
||||
- [Valkey Cluster](https://hub.docker.com/r/bitnami/valkey-cluster/tags)
|
||||
- [Valkey](https://hub.docker.com/r/bitnami/valkey/tags)
|
||||
|
||||
and look up the image tag which fits your needs on Dockerhub.
|
||||
|
||||
@@ -279,42 +280,6 @@ If `.Values.image.rootless: true`, then the following will occur. In case you us
|
||||
|
||||
[see deployment.yaml](./templates/gitea/deployment.yaml) template inside container "env" declarations
|
||||
|
||||
#### OpenShift Compatibility
|
||||
|
||||
When installing on OpenShift, enable the compatibility profile so chart-managed pods render SCC-safe defaults and the Gitea init containers stop forcing `runAsUser: 1000`:
|
||||
|
||||
```yaml
|
||||
openshift:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
When enabled, the chart applies `allowPrivilegeEscalation: false`, drops all
|
||||
Linux capabilities, sets `runAsNonRoot: true`, uses
|
||||
`seccompProfile.type: RuntimeDefault`, and leaves `hostUsers` unset unless
|
||||
`openshift.hostUsers` is explicitly overridden.
|
||||
|
||||
The deployment keeps the existing vanilla Kubernetes behavior when OpenShift
|
||||
compatibility is disabled. Auto-detection relies on the
|
||||
`security.openshift.io/v1/SecurityContextConstraints` API, so set
|
||||
`openshift.enabled: true` explicitly when rendering outside a live cluster.
|
||||
|
||||
If you also want to expose Gitea through an OpenShift Route, enable the optional Route resource:
|
||||
|
||||
```yaml
|
||||
route:
|
||||
enabled: true
|
||||
host: git.apps.example.com
|
||||
tls:
|
||||
termination: edge
|
||||
```
|
||||
|
||||
When `route.host` is set, the chart uses it for `DOMAIN`, `SSH_DOMAIN`, and `ROOT_URL`. Setting `route.tls.termination` also switches the default `ROOT_URL` scheme to `https`.
|
||||
|
||||
#### Gateway API
|
||||
|
||||
The chart can also expose Gitea through Gateway API resources (`HTTPRoute`, `TCPRoute`, `BackendTLSPolicy`, and optionally `Gateway`).
|
||||
See [docs/gateway-api.md](docs/gateway-api.md) for the full guide, including how routes interact with `ROOT_URL`/`DOMAIN` resolution and recommended topologies.
|
||||
|
||||
#### Session, Cache and Queue
|
||||
|
||||
The session, cache and queue settings are set to use the built-in Valkey Cluster sub-chart dependency.
|
||||
@@ -323,7 +288,7 @@ If Valkey Cluster is disabled, the chart will fall back to the Gitea defaults wh
|
||||
While these will work and even not cause immediate issues after startup, **they are not recommended for production use**.
|
||||
Reasons being that a single pod will take on all the work for `session` and `cache` tasks in its available memory.
|
||||
It is likely that the pod will run out of memory or will face substantial memory spikes, depending on the workload.
|
||||
External tools such as `valkey` or `memcached` handle these workloads much better.
|
||||
External tools such as `valkey-cluster` or `memcached` handle these workloads much better.
|
||||
|
||||
### Single-Pod Configurations
|
||||
|
||||
@@ -336,6 +301,8 @@ If HA is not needed/desired, the following configurations can be used to deploy
|
||||
<summary>values.yml</summary>
|
||||
|
||||
```yaml
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: true
|
||||
postgresql:
|
||||
@@ -367,6 +334,8 @@ If HA is not needed/desired, the following configurations can be used to deploy
|
||||
<summary>values.yml</summary>
|
||||
|
||||
```yaml
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
postgresql:
|
||||
@@ -412,7 +381,7 @@ gitea:
|
||||
```
|
||||
|
||||
This would mount the two additional volumes (`oauth` and `some-additionals`) from different sources to the init container where the _app.ini_ gets updated.
|
||||
All files mounted that way will be read and converted to environment variables and then added to the _app.ini_ using [Gitea config edit-ini](https://docs.gitea.com/administration/config-cheat-sheet#use-environment-variables-to-setup-gitea).
|
||||
All files mounted that way will be read and converted to environment variables and then added to the _app.ini_ using [environment-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini).
|
||||
|
||||
The key of such additional source represents the section inside the _app.ini_.
|
||||
The value for each key can be multiline ini-like definitions.
|
||||
@@ -453,10 +422,10 @@ Users are able to define their own environment variables, which are loaded into
|
||||
We also support to directly interact with the generated _app.ini_.
|
||||
|
||||
To inject self defined variables into the _app.ini_ a certain format needs to be honored.
|
||||
This is described in detail on the [Gitea config edit-ini](https://docs.gitea.com/administration/config-cheat-sheet#use-environment-variables-to-setup-gitea) page.
|
||||
This is described in detail on the [env-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini) page.
|
||||
|
||||
Prior to Gitea 1.20 and Chart 9.0.0 the helm chart had a custom prefix `ENV_TO_INI`.
|
||||
After the support for a custom prefix was removed in Gitea core, the prefix was changed to `GITEA`.
|
||||
After the support for a custom prefix was removed in Gite core, the prefix was changed to `GITEA`.
|
||||
|
||||
For example a database setting needs to have the following format:
|
||||
|
||||
@@ -569,13 +538,19 @@ More about this issue [under this link](https://gitea.com/gitea/helm-gitea/issue
|
||||
|
||||
### Cache
|
||||
|
||||
The cache handling is done via `valkey` (via the [official Valkey Helm chart](https://github.com/valkey-io/valkey-helm)) by default.
|
||||
The cache handling is done via `valkey-cluster` (via the `bitnami` chart) by default.
|
||||
This deployment is HA-ready but can also be used for single-pod deployments.
|
||||
By default, 6 replicas are deployed for a working `valkey-cluster` deployment.
|
||||
Many cloud providers offer a managed valkey service, which can be used instead of the built-in `valkey-cluster`.
|
||||
|
||||
```yaml
|
||||
valkey:
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
⚠️ The valkey charts [do not work well with special characters in the password](https://gitea.com/gitea/helm-chart/issues/690).
|
||||
Consider omitting such or open an issue in the Bitnami repo and let us know once this got fixed.
|
||||
|
||||
### Persistence
|
||||
|
||||
Gitea will be deployed as a deployment.
|
||||
@@ -1000,14 +975,12 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
|
||||
### Security
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ----- |
|
||||
| `openshift.enabled` | Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API. | `nil` |
|
||||
| `openshift.hostUsers` | Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used. | `nil` |
|
||||
| `podSecurityContext` | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty. | `{}` |
|
||||
| `containerSecurityContext` | Security context | `{}` |
|
||||
| `securityContext` | Run init and Gitea containers as a specific securityContext | `{}` |
|
||||
| `podDisruptionBudget` | Pod disruption budget | `{}` |
|
||||
| Name | Description | Value |
|
||||
| ---------------------------- | --------------------------------------------------------------- | ------ |
|
||||
| `podSecurityContext.fsGroup` | Set the shared file system group for all containers in the pod. | `1000` |
|
||||
| `containerSecurityContext` | Security context | `{}` |
|
||||
| `securityContext` | Run init and Gitea containers as a specific securityContext | `{}` |
|
||||
| `podDisruptionBudget` | Pod disruption budget | `{}` |
|
||||
|
||||
### Service
|
||||
|
||||
@@ -1053,52 +1026,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
| `ingress.hosts[0].paths[0].path` | Default Ingress path | `/` |
|
||||
| `ingress.tls` | Ingress tls settings | `[]` |
|
||||
|
||||
### Route
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `route.enabled` | Enable OpenShift Route | `false` |
|
||||
| `route.annotations` | Route annotations | `{}` |
|
||||
| `route.host` | Route host. When unset, OpenShift may generate one and Gitea URL defaults fall back to ingress/service values. | `""` |
|
||||
| `route.path` | Route path | `""` |
|
||||
| `route.wildcardPolicy` | Route wildcard policy | `None` |
|
||||
| `route.tls.termination` | Route TLS termination type | `nil` |
|
||||
| `route.tls.insecureEdgeTerminationPolicy` | Route insecure edge termination policy | `nil` |
|
||||
| `route.tls.key` | Route TLS key | `nil` |
|
||||
| `route.tls.certificate` | Route TLS certificate | `nil` |
|
||||
| `route.tls.caCertificate` | Route TLS CA certificate | `nil` |
|
||||
| `route.tls.destinationCACertificate` | Route destination CA certificate | `nil` |
|
||||
|
||||
### Gateway API
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `gatewayAPI.enabled` | Enable deployment of Gateway API resources | `false` |
|
||||
| `gatewayAPI.core.backendTLSPolicy.enabled` | Render a BackendTLSPolicy resource for encrypted backend traffic | `false` |
|
||||
| `gatewayAPI.core.backendTLSPolicy.annotations` | Annotations applied to the BackendTLSPolicy | `{}` |
|
||||
| `gatewayAPI.core.backendTLSPolicy.labels` | Additional labels applied to the BackendTLSPolicy | `{}` |
|
||||
| `gatewayAPI.core.backendTLSPolicy.targetRefs` | Target references for the BackendTLSPolicy. Defaults to the HTTP service. | `[]` |
|
||||
| `gatewayAPI.core.backendTLSPolicy.validation` | Validation configuration (required when enabled). See `docs/gateway-api.md`. | `{}` |
|
||||
| `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`. | |
|
||||
| `gatewayAPI.core.backendTLSPolicy.validation.hostname` | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. | |
|
||||
| `gatewayAPI.core.httpRoute.enabled` | Render an HTTPRoute resource | `false` |
|
||||
| `gatewayAPI.core.httpRoute.annotations` | Annotations applied to the HTTPRoute | `{}` |
|
||||
| `gatewayAPI.core.httpRoute.labels` | Additional labels applied to the HTTPRoute | `{}` |
|
||||
| `gatewayAPI.core.httpRoute.tls` | When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`. | `false` |
|
||||
| `gatewayAPI.core.httpRoute.parentRefs` | Parent gateway references (required when enabled). | `[]` |
|
||||
| `gatewayAPI.core.httpRoute.hostnames` | List of hostnames for the HTTPRoute. | `[]` |
|
||||
| `gatewayAPI.core.httpRoute.rules` | Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service. | `[]` |
|
||||
| `gatewayAPI.core.tcpRoute.enabled` | Render a TCPRoute resource (typically for SSH) | `false` |
|
||||
| `gatewayAPI.core.tcpRoute.annotations` | Annotations applied to the TCPRoute | `{}` |
|
||||
| `gatewayAPI.core.tcpRoute.labels` | Additional labels applied to the TCPRoute | `{}` |
|
||||
| `gatewayAPI.core.tcpRoute.parentRefs` | Parent gateway references (required when enabled). | `[]` |
|
||||
| `gatewayAPI.core.tcpRoute.rules` | Custom routing rules. Defaults to a rule targeting the SSH service. | `[]` |
|
||||
| `gatewayAPI.nginx.clientSettingsPolicies.enabled` | Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit | `false` |
|
||||
| `gatewayAPI.nginx.clientSettingsPolicies.annotations` | Annotations applied to the ClientSettingsPolicy | `{}` |
|
||||
| `gatewayAPI.nginx.clientSettingsPolicies.labels` | Additional labels applied to the ClientSettingsPolicy | `{}` |
|
||||
| `gatewayAPI.nginx.clientSettingsPolicies.targetRef` | Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute. | `{}` |
|
||||
| `gatewayAPI.nginx.clientSettingsPolicies.body` | Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`. | `{}` |
|
||||
|
||||
### deployment
|
||||
|
||||
| Name | Description | Value |
|
||||
@@ -1171,30 +1098,29 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
|
||||
### Gitea
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `gitea.admin.username` | Username for the Gitea admin user | `gitea_admin` |
|
||||
| `gitea.admin.existingSecret` | Use an existing secret to store admin user credentials | `nil` |
|
||||
| `gitea.admin.password` | Password for the Gitea admin user | `r8sA8CPHD9!bt6d` |
|
||||
| `gitea.admin.email` | Email for the Gitea admin user | `gitea@local.domain` |
|
||||
| `gitea.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` |
|
||||
| `gitea.metrics.enabled` | Enable Gitea metrics | `false` |
|
||||
| `gitea.metrics.token` | used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public. | `nil` |
|
||||
| `gitea.metrics.serviceMonitor.enabled` | Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally. | `false` |
|
||||
| `gitea.metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. | `""` |
|
||||
| `gitea.metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping. | `[]` |
|
||||
| `gitea.metrics.serviceMonitor.scheme` | HTTP scheme to use for scraping. For example `http` or `https`. Default is http. | `""` |
|
||||
| `gitea.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended. If not specified, global Prometheus scrape timeout is used. | `""` |
|
||||
| `gitea.metrics.serviceMonitor.tlsConfig` | TLS configuration to use when scraping the metric endpoint by Prometheus. | `{}` |
|
||||
| `gitea.ldap` | LDAP configuration | `[]` |
|
||||
| `gitea.oauth` | OAuth configuration | `[]` |
|
||||
| `gitea.config.server.SSH_PORT` | SSH port for rootlful Gitea image | `22` |
|
||||
| `gitea.config.server.SSH_LISTEN_PORT` | SSH port for rootless Gitea image | `2222` |
|
||||
| `gitea.additionalConfigSources` | Additional configuration from secret or configmap | `[]` |
|
||||
| `gitea.additionalConfigFromEnvs` | Additional configuration sources from environment variables | `[]` |
|
||||
| `gitea.extraEnvSourceFile` | Source environment variables from a file during init container startup. This is especially useful for reading environment variable files generated by the Vault agent-injector. | `nil` |
|
||||
| `gitea.podAnnotations` | Annotations for the Gitea pod | `{}` |
|
||||
| `gitea.ssh.logLevel` | Configure OpenSSH's log level. Only available for root-based Gitea image. | `INFO` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | -------------------- |
|
||||
| `gitea.admin.username` | Username for the Gitea admin user | `gitea_admin` |
|
||||
| `gitea.admin.existingSecret` | Use an existing secret to store admin user credentials | `nil` |
|
||||
| `gitea.admin.password` | Password for the Gitea admin user | `r8sA8CPHD9!bt6d` |
|
||||
| `gitea.admin.email` | Email for the Gitea admin user | `gitea@local.domain` |
|
||||
| `gitea.admin.passwordMode` | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated | `keepUpdated` |
|
||||
| `gitea.metrics.enabled` | Enable Gitea metrics | `false` |
|
||||
| `gitea.metrics.token` | used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public. | `nil` |
|
||||
| `gitea.metrics.serviceMonitor.enabled` | Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally. | `false` |
|
||||
| `gitea.metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used. | `""` |
|
||||
| `gitea.metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping. | `[]` |
|
||||
| `gitea.metrics.serviceMonitor.scheme` | HTTP scheme to use for scraping. For example `http` or `https`. Default is http. | `""` |
|
||||
| `gitea.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended. If not specified, global Prometheus scrape timeout is used. | `""` |
|
||||
| `gitea.metrics.serviceMonitor.tlsConfig` | TLS configuration to use when scraping the metric endpoint by Prometheus. | `{}` |
|
||||
| `gitea.ldap` | LDAP configuration | `[]` |
|
||||
| `gitea.oauth` | OAuth configuration | `[]` |
|
||||
| `gitea.config.server.SSH_PORT` | SSH port for rootlful Gitea image | `22` |
|
||||
| `gitea.config.server.SSH_LISTEN_PORT` | SSH port for rootless Gitea image | `2222` |
|
||||
| `gitea.additionalConfigSources` | Additional configuration from secret or configmap | `[]` |
|
||||
| `gitea.additionalConfigFromEnvs` | Additional configuration sources from environment variables | `[]` |
|
||||
| `gitea.podAnnotations` | Annotations for the Gitea pod | `{}` |
|
||||
| `gitea.ssh.logLevel` | Configure OpenSSH's log level. Only available for root-based Gitea image. | `INFO` |
|
||||
|
||||
### LivenessProbe
|
||||
|
||||
@@ -1232,29 +1158,48 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
|
||||
| `gitea.startupProbe.successThreshold` | Success threshold for startup probe | `1` |
|
||||
| `gitea.startupProbe.failureThreshold` | Failure threshold for startup probe | `10` |
|
||||
|
||||
### valkey-cluster
|
||||
|
||||
Valkey cluster and [Valkey](#valkey) cannot be enabled at the same time.
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------ |
|
||||
| `valkey-cluster.enabled` | Enable valkey cluster | `true` |
|
||||
| `valkey-cluster.usePassword` | Whether to use password authentication. | `false` |
|
||||
| `valkey-cluster.usePasswordFiles` | Whether to mount passwords as files instead of environment variables. | `false` |
|
||||
| `valkey-cluster.image.repository` | Image repository, eg. `bitnamilegacy/valkey-cluster`. | `bitnamilegacy/valkey-cluster` |
|
||||
| `valkey-cluster.cluster.nodes` | Number of valkey cluster master nodes | `3` |
|
||||
| `valkey-cluster.cluster.replicas` | Number of valkey cluster master node replicas | `0` |
|
||||
| `valkey-cluster.metrics.image.repository` | Image repository, eg. `bitnamilegacy/redis-exporter`. | `bitnamilegacy/redis-exporter` |
|
||||
| `valkey-cluster.persistence.enabled` | Enable persistence on Valkey replicas nodes using Persistent Volume Claims. | `true` |
|
||||
| `valkey-cluster.persistence.storageClass` | Persistent Volume storage class. | `""` |
|
||||
| `valkey-cluster.persistence.size` | Persistent Volume size. | `8Gi` |
|
||||
| `valkey-cluster.service.ports.valkey` | Port of Valkey service | `6379` |
|
||||
| `valkey-cluster.sysctlImage.repository` | Image repository, eg. `bitnamilegacy/os-shell`. | `bitnamilegacy/os-shell` |
|
||||
| `valkey-cluster.volumePermissions.image.repository` | Image repository, eg. `bitnamilegacy/os-shell`. | `bitnamilegacy/os-shell` |
|
||||
|
||||
### valkey
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | -------------------------------------------------- | -------------------------- |
|
||||
| `valkey.enabled` | Enable valkey standalone or replicated | `false` |
|
||||
| `valkey.image.registry` | Image registry | `docker.io` |
|
||||
| `valkey.image.repository` | Image repository | `valkey/valkey` |
|
||||
| `valkey.image.tag` | Image tag | `""` |
|
||||
| `valkey.auth.enabled` | Enable ACL-based authentication | `true` |
|
||||
| `valkey.auth.aclUsers.default.permissions` | ACL permissions for the default user | `~* &* +@all` |
|
||||
| `valkey.auth.aclUsers.default.password` | Password for the default user | `changeme` |
|
||||
| `valkey.service.port` | Port of Valkey service | `6379` |
|
||||
| `valkey.dataStorage.enabled` | Enable persistence using Persistent Volume Claims. | `false` |
|
||||
| `valkey.dataStorage.className` | Persistent Volume storage class. | `""` |
|
||||
| `valkey.dataStorage.requestedSize` | Persistent Volume size. | `8Gi` |
|
||||
| `valkey.replica.enabled` | Enable replication | `false` |
|
||||
| `valkey.replica.replicas` | Number of Valkey replica instances to deploy | `3` |
|
||||
| `valkey.replica.persistence.size` | Persistent Volume size for replicas. | `8Gi` |
|
||||
| `valkey.replica.persistence.storageClass` | Persistent Volume storage class for replicas. | `""` |
|
||||
| `valkey.metrics.enabled` | Enable Prometheus exporter sidecar | `false` |
|
||||
| `valkey.metrics.exporter.image.registry` | Image registry | `ghcr.io` |
|
||||
| `valkey.metrics.exporter.image.repository` | Image repository | `oliver006/redis_exporter` |
|
||||
| `valkey.metrics.exporter.image.tag` | Image tag | `""` |
|
||||
Valkey and [Valkey cluster](#valkey-cluster) cannot be enabled at the same time.
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------- |
|
||||
| `valkey.enabled` | Enable valkey standalone or replicated | `false` |
|
||||
| `valkey.architecture` | Whether to use standalone or replication | `standalone` |
|
||||
| `valkey.kubectl.image.repository` | Image repository, eg. `bitnamilegacy/kubectl`. | `bitnamilegacy/kubectl` |
|
||||
| `valkey.image.repository` | Image repository, eg. `bitnamilegacy/valkey`. | `bitnamilegacy/valkey` |
|
||||
| `valkey.global.valkey.password` | Required password | `changeme` |
|
||||
| `valkey.master.count` | Number of Valkey master instances to deploy | `1` |
|
||||
| `valkey.master.service.ports.valkey` | Port of Valkey service | `6379` |
|
||||
| `valkey.metrics.image.repository` | Image repository, eg. `bitnamilegacy/redis-exporter`. | `bitnamilegacy/redis-exporter` |
|
||||
| `valkey.primary.persistence.enabled` | Enable persistence on Valkey replicas nodes using Persistent Volume Claims. | `true` |
|
||||
| `valkey.primary.persistence.storageClass` | Persistent Volume storage class. | `""` |
|
||||
| `valkey.primary.persistence.size` | Persistent Volume size. | `8Gi` |
|
||||
| `valkey.replica.persistence.enabled` | Enable persistence on Valkey replicas nodes using Persistent Volume Claims. | `true` |
|
||||
| `valkey.replica.persistence.storageClass` | Persistent Volume storage class. | `""` |
|
||||
| `valkey.replica.persistence.size` | Persistent Volume size. | `8Gi` |
|
||||
| `valkey.sentinel.image.repository` | Image repository, eg. `bitnamilegacy/sentinel`. | `bitnamilegacy/valkey-sentinel` |
|
||||
| `valkey.volumePermissions.image.repository` | Image repository, eg. `bitnamilegacy/os-shell`. | `bitnamilegacy/os-shell` |
|
||||
|
||||
### PostgreSQL HA
|
||||
|
||||
@@ -1582,7 +1527,7 @@ mariadb:
|
||||
|
||||
### App.ini generation <!-- omit from toc -->
|
||||
|
||||
The app.ini generation has changed and now uses the `gitea config edit-ini` subcommand introduced in Gitea 1.26.
|
||||
The app.ini generation has changed and now utilizes the environment-to-ini script provided by newer Gitea versions.
|
||||
This change ensures, that the app.ini is now persistent.
|
||||
|
||||
### Secret Key generation <!-- omit from toc -->
|
||||
|
||||
@@ -1,267 +0,0 @@
|
||||
# Gateway API
|
||||
|
||||
This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
|
||||
alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
|
||||
are rendered:
|
||||
|
||||
- `HTTPRoute` — required for HTTP traffic
|
||||
- `TCPRoute` — optional, typically for SSH (port 22)
|
||||
- `BackendTLSPolicy` — optional, for encrypted backend traffic
|
||||
- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
|
||||
|
||||
All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
|
||||
|
||||
The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
| Resource | API version | Status (as of writing) |
|
||||
| ---------------------- | ------------------------------------ | ---------------------- |
|
||||
| `HTTPRoute` | `gateway.networking.k8s.io/v1` | GA |
|
||||
| `TCPRoute` | `gateway.networking.k8s.io/v1alpha2` | Experimental |
|
||||
| `BackendTLSPolicy` | `gateway.networking.k8s.io/v1` | GA (v1.2+) |
|
||||
| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1` | NGINX Gateway Fabric |
|
||||
|
||||
## Common topology
|
||||
|
||||
Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
|
||||
|
||||
```yaml
|
||||
gatewayAPI:
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
tls: true # the shared Gateway terminates TLS
|
||||
hostnames:
|
||||
- git.example.com
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: shared-gateway
|
||||
namespace: gateway-system
|
||||
sectionName: https-gitea # pin to a specific listener (see below)
|
||||
tcpRoute:
|
||||
enabled: true
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: shared-gateway
|
||||
namespace: gateway-system
|
||||
sectionName: ssh
|
||||
```
|
||||
|
||||
With this configuration:
|
||||
|
||||
- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
|
||||
- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
|
||||
- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
|
||||
- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
|
||||
|
||||
### Why `sectionName` matters
|
||||
|
||||
Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
|
||||
that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
|
||||
to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
|
||||
(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
|
||||
side typically looks like:
|
||||
|
||||
```yaml
|
||||
listeners:
|
||||
- name: https-gitea
|
||||
port: 443
|
||||
protocol: HTTPS
|
||||
hostname: git.example.com
|
||||
tls:
|
||||
certificateRefs:
|
||||
- name: git-example-com-tls
|
||||
allowedRoutes:
|
||||
kinds:
|
||||
- kind: HTTPRoute
|
||||
namespaces:
|
||||
from: Selector
|
||||
selector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: gitea
|
||||
- name: ssh
|
||||
port: 22
|
||||
protocol: TCP
|
||||
allowedRoutes:
|
||||
kinds:
|
||||
- kind: TCPRoute
|
||||
namespaces:
|
||||
from: Selector
|
||||
selector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: gitea
|
||||
```
|
||||
|
||||
### Sharing a hostname between HTTP and SSH
|
||||
|
||||
HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
|
||||
clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
|
||||
and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
|
||||
extra configuration.
|
||||
|
||||
If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
|
||||
cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
|
||||
|
||||
```yaml
|
||||
gitea:
|
||||
config:
|
||||
server:
|
||||
SSH_DOMAIN: gitea-ssh.example.com
|
||||
```
|
||||
|
||||
## BackendTLSPolicy
|
||||
|
||||
Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
|
||||
`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
|
||||
verify the backend certificate before forwarding the request.
|
||||
|
||||
### Configuring Gitea to serve HTTPS directly
|
||||
|
||||
Gitea serves HTTPS via three `[server]` app.ini options
|
||||
([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
|
||||
cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths:
|
||||
|
||||
```yaml
|
||||
gitea:
|
||||
config:
|
||||
server:
|
||||
PROTOCOL: https
|
||||
CERT_FILE: /etc/gitea-tls/tls.crt
|
||||
KEY_FILE: /etc/gitea-tls/tls.key
|
||||
|
||||
extraVolumes:
|
||||
- name: gitea-tls
|
||||
secret:
|
||||
secretName: gitea-backend-tls # cert-manager-issued Secret, etc.
|
||||
extraContainerVolumeMounts:
|
||||
- name: gitea-tls
|
||||
mountPath: /etc/gitea-tls
|
||||
readOnly: true
|
||||
```
|
||||
|
||||
- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
|
||||
official image); absolute paths are clearer.
|
||||
- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
|
||||
- For chained certs, the server cert comes first, intermediates after.
|
||||
- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
|
||||
(3000 by default) is now speaking HTTPS instead of HTTP.
|
||||
|
||||
### BackendTLSPolicy example
|
||||
|
||||
Verify the backend with a CA bundle stored in a `ConfigMap`:
|
||||
|
||||
```yaml
|
||||
gatewayAPI:
|
||||
core:
|
||||
backendTLSPolicy:
|
||||
enabled: true
|
||||
validation:
|
||||
hostname: gitea.svc.cluster.local
|
||||
caCertificateRefs:
|
||||
- name: gitea-backend-ca
|
||||
group: ""
|
||||
kind: ConfigMap
|
||||
```
|
||||
|
||||
This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
|
||||
(`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
|
||||
API; the template fails fast if omitted.
|
||||
|
||||
### System CA trust and explicit targetRefs
|
||||
|
||||
To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
|
||||
and `targetRefs`:
|
||||
|
||||
```yaml
|
||||
gatewayAPI:
|
||||
core:
|
||||
backendTLSPolicy:
|
||||
enabled: true
|
||||
targetRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: gitea-sidecar
|
||||
validation:
|
||||
hostname: sidecar.gitea.svc.cluster.local
|
||||
wellKnownCACertificates: System
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
|
||||
- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
|
||||
(otherwise stick with `caCertificateRefs`).
|
||||
- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
|
||||
`sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
|
||||
|
||||
## Raising the request body size limit (NGINX Gateway Fabric)
|
||||
|
||||
NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
|
||||
Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
|
||||
images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
|
||||
`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
|
||||
API. NGINX Gateway Fabric instead reads the limit from a
|
||||
[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
|
||||
|
||||
This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
|
||||
**not** impose a default request body size limit, so large uploads work without any extra configuration —
|
||||
leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
|
||||
|
||||
```yaml
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
body:
|
||||
maxSize: 100m # bytes, or with a k / m / g suffix; 0 disables the limit
|
||||
```
|
||||
|
||||
This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
|
||||
(`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
|
||||
template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
|
||||
are supported too.
|
||||
|
||||
To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
|
||||
override `targetRef`:
|
||||
|
||||
```yaml
|
||||
gatewayAPI:
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
targetRef:
|
||||
group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: shared-gateway
|
||||
body:
|
||||
maxSize: 100m
|
||||
```
|
||||
|
||||
Notes:
|
||||
|
||||
- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
|
||||
attaching it to an `HTTPRoute` scopes it to that route only.
|
||||
- The policy must live in the same namespace as its `targetRef`.
|
||||
- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
|
||||
`[packages]` sections) — raising the proxy limit alone is not always sufficient.
|
||||
|
||||
## Interaction with `ingress` and `route`
|
||||
|
||||
The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
|
||||
|
||||
1. `route.host` (when `route.enabled`)
|
||||
2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
|
||||
3. First `ingress.hosts[0].host`
|
||||
4. The in-cluster Service DNS name
|
||||
|
||||
Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
|
||||
|
||||
## SSH considerations
|
||||
|
||||
- `TCPRoute` is still experimental. Many production-grade implementations support it (Envoy Gateway, Istio, Kgateway, NGINX Gateway Fabric), but you should verify before relying on it.
|
||||
- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
|
||||
- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.
|
||||
Generated
+71
-101
@@ -8,7 +8,7 @@
|
||||
"license": "MIT",
|
||||
"devDependencies": {
|
||||
"@bitnami/readme-generator-for-helm": "^2.5.0",
|
||||
"markdownlint-cli": "^0.49.0"
|
||||
"markdownlint-cli": "^0.48.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=16.0.0",
|
||||
@@ -33,9 +33,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@types/debug": {
|
||||
"version": "4.1.13",
|
||||
"resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
|
||||
"integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
|
||||
"version": "4.1.12",
|
||||
"resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
|
||||
"integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
@@ -91,9 +91,9 @@
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/brace-expansion": {
|
||||
"version": "1.1.16",
|
||||
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
|
||||
"integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
|
||||
"version": "1.1.12",
|
||||
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
|
||||
"integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
@@ -280,9 +280,9 @@
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/get-east-asian-width": {
|
||||
"version": "1.6.0",
|
||||
"resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz",
|
||||
"integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==",
|
||||
"version": "1.5.0",
|
||||
"resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz",
|
||||
"integrity": "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
@@ -402,20 +402,10 @@
|
||||
}
|
||||
},
|
||||
"node_modules/js-yaml": {
|
||||
"version": "4.2.0",
|
||||
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
|
||||
"integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
|
||||
"version": "4.1.1",
|
||||
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
|
||||
"integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/puzrin"
|
||||
},
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/nodeca"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"argparse": "^2.0.1"
|
||||
@@ -442,9 +432,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/katex": {
|
||||
"version": "0.16.47",
|
||||
"resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
|
||||
"integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
|
||||
"version": "0.16.38",
|
||||
"resolved": "https://registry.npmjs.org/katex/-/katex-0.16.38.tgz",
|
||||
"integrity": "sha512-cjHooZUmIAUmDsHBN+1n8LaZdpmbj03LtYeYPyuYB7OuloiaeaV6N4LcfjcnHVzGWjVQmKrxxTrpDcmSzEZQwQ==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
"https://opencollective.com/katex",
|
||||
@@ -469,52 +459,32 @@
|
||||
}
|
||||
},
|
||||
"node_modules/linkify-it": {
|
||||
"version": "5.0.2",
|
||||
"resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz",
|
||||
"integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==",
|
||||
"version": "5.0.0",
|
||||
"resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz",
|
||||
"integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/puzrin"
|
||||
},
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/markdown-it"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"uc.micro": "^2.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/lodash": {
|
||||
"version": "4.18.1",
|
||||
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
|
||||
"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
|
||||
"version": "4.17.23",
|
||||
"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
|
||||
"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/markdown-it": {
|
||||
"version": "14.2.0",
|
||||
"resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.2.0.tgz",
|
||||
"integrity": "sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ==",
|
||||
"version": "14.1.1",
|
||||
"resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
|
||||
"integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/puzrin"
|
||||
},
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/markdown-it"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"argparse": "^2.0.1",
|
||||
"entities": "^4.4.0",
|
||||
"linkify-it": "^5.0.1",
|
||||
"linkify-it": "^5.0.0",
|
||||
"mdurl": "^2.0.0",
|
||||
"punycode.js": "^2.3.1",
|
||||
"uc.micro": "^2.1.0"
|
||||
@@ -538,9 +508,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/markdownlint": {
|
||||
"version": "0.41.0",
|
||||
"resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.41.0.tgz",
|
||||
"integrity": "sha512-xMUI3ChBuRuxuLF4ENvCZyS8z/+Jly1coUcZwErKLIB3sDj7ojpaTBa1e9YVPhSN4jGEIjYGQCldbTJS/hqS+A==",
|
||||
"version": "0.40.0",
|
||||
"resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.40.0.tgz",
|
||||
"integrity": "sha512-UKybllYNheWac61Ia7T6fzuQNDZimFIpCg2w6hHjgV1Qu0w1TV0LlSgryUGzM0bkKQCBhy2FDhEELB73Kb0kAg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
@@ -552,40 +522,40 @@
|
||||
"micromark-extension-gfm-table": "2.1.1",
|
||||
"micromark-extension-math": "3.1.0",
|
||||
"micromark-util-types": "2.0.2",
|
||||
"string-width": "8.2.1"
|
||||
"string-width": "8.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=22"
|
||||
"node": ">=20"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/DavidAnson"
|
||||
}
|
||||
},
|
||||
"node_modules/markdownlint-cli": {
|
||||
"version": "0.49.0",
|
||||
"resolved": "https://registry.npmjs.org/markdownlint-cli/-/markdownlint-cli-0.49.0.tgz",
|
||||
"integrity": "sha512-vS5tWq5W91Gg33LD4pyAaXPclnz/sRvo6/RGOyDQjQ3eds2DkK6H4szUuE0M9TiRB/u/VBx1gtd9Ktrtx5WlSA==",
|
||||
"version": "0.48.0",
|
||||
"resolved": "https://registry.npmjs.org/markdownlint-cli/-/markdownlint-cli-0.48.0.tgz",
|
||||
"integrity": "sha512-NkZQNu2E0Q5qLEEHwWj674eYISTLD4jMHkBzDobujXd1kv+yCxi8jOaD/rZoQNW1FBBMMGQpuW5So8B51N/e0A==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"commander": "~15.0.0",
|
||||
"commander": "~14.0.3",
|
||||
"deep-extend": "~0.6.0",
|
||||
"ignore": "~7.0.5",
|
||||
"js-yaml": "~4.2.0",
|
||||
"js-yaml": "~4.1.1",
|
||||
"jsonc-parser": "~3.3.1",
|
||||
"jsonpointer": "~5.0.1",
|
||||
"markdown-it": "~14.2.0",
|
||||
"markdownlint": "~0.41.0",
|
||||
"minimatch": "~10.2.5",
|
||||
"markdown-it": "~14.1.1",
|
||||
"markdownlint": "~0.40.0",
|
||||
"minimatch": "~10.2.4",
|
||||
"run-con": "~1.3.2",
|
||||
"smol-toml": "~1.6.1",
|
||||
"tinyglobby": "~0.2.17"
|
||||
"smol-toml": "~1.6.0",
|
||||
"tinyglobby": "~0.2.15"
|
||||
},
|
||||
"bin": {
|
||||
"markdownlint": "markdownlint.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=22"
|
||||
"node": ">=20"
|
||||
}
|
||||
},
|
||||
"node_modules/markdownlint-cli/node_modules/balanced-match": {
|
||||
@@ -599,9 +569,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/markdownlint-cli/node_modules/brace-expansion": {
|
||||
"version": "5.0.7",
|
||||
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
|
||||
"integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
|
||||
"version": "5.0.4",
|
||||
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz",
|
||||
"integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
@@ -612,23 +582,23 @@
|
||||
}
|
||||
},
|
||||
"node_modules/markdownlint-cli/node_modules/commander": {
|
||||
"version": "15.0.0",
|
||||
"resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
|
||||
"integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
|
||||
"version": "14.0.3",
|
||||
"resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
|
||||
"integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=22.12.0"
|
||||
"node": ">=20"
|
||||
}
|
||||
},
|
||||
"node_modules/markdownlint-cli/node_modules/minimatch": {
|
||||
"version": "10.2.5",
|
||||
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
|
||||
"integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
|
||||
"version": "10.2.4",
|
||||
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
|
||||
"integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
|
||||
"dev": true,
|
||||
"license": "BlueOak-1.0.0",
|
||||
"dependencies": {
|
||||
"brace-expansion": "^5.0.5"
|
||||
"brace-expansion": "^5.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": "18 || 20 || >=22"
|
||||
@@ -1251,9 +1221,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/picomatch": {
|
||||
"version": "4.0.5",
|
||||
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
|
||||
"integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
|
||||
"version": "4.0.3",
|
||||
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
|
||||
"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
@@ -1300,9 +1270,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/smol-toml": {
|
||||
"version": "1.6.1",
|
||||
"resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.1.tgz",
|
||||
"integrity": "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==",
|
||||
"version": "1.6.0",
|
||||
"resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz",
|
||||
"integrity": "sha512-4zemZi0HvTnYwLfrpk/CF9LOd9Lt87kAt50GnqhMpyF9U3poDAP2+iukq2bZsO/ufegbYehBkqINbsWxj4l4cw==",
|
||||
"dev": true,
|
||||
"license": "BSD-3-Clause",
|
||||
"engines": {
|
||||
@@ -1313,14 +1283,14 @@
|
||||
}
|
||||
},
|
||||
"node_modules/string-width": {
|
||||
"version": "8.2.1",
|
||||
"resolved": "https://registry.npmjs.org/string-width/-/string-width-8.2.1.tgz",
|
||||
"integrity": "sha512-IIaP0g3iy9Cyy18w3M9YcaDudujEAVHKt3a3QJg1+sr/oX96TbaGUubG0hJyCjCBThFH+tFpcIyoUHUn1ogaLA==",
|
||||
"version": "8.1.0",
|
||||
"resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.0.tgz",
|
||||
"integrity": "sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"get-east-asian-width": "^1.5.0",
|
||||
"strip-ansi": "^7.1.2"
|
||||
"get-east-asian-width": "^1.3.0",
|
||||
"strip-ansi": "^7.1.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=20"
|
||||
@@ -1359,14 +1329,14 @@
|
||||
}
|
||||
},
|
||||
"node_modules/tinyglobby": {
|
||||
"version": "0.2.17",
|
||||
"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
|
||||
"integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
|
||||
"version": "0.2.15",
|
||||
"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
|
||||
"integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"fdir": "^6.5.0",
|
||||
"picomatch": "^4.0.4"
|
||||
"picomatch": "^4.0.3"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=12.0.0"
|
||||
@@ -1390,9 +1360,9 @@
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/yaml": {
|
||||
"version": "2.9.0",
|
||||
"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
|
||||
"integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
|
||||
"version": "2.8.2",
|
||||
"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
|
||||
"integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
|
||||
"dev": true,
|
||||
"license": "ISC",
|
||||
"bin": {
|
||||
|
||||
+1
-1
@@ -14,6 +14,6 @@
|
||||
},
|
||||
"devDependencies": {
|
||||
"@bitnami/readme-generator-for-helm": "^2.5.0",
|
||||
"markdownlint-cli": "^0.49.0"
|
||||
"markdownlint-cli": "^0.48.0"
|
||||
}
|
||||
}
|
||||
+52
-56
@@ -1,55 +1,51 @@
|
||||
{
|
||||
$schema: "https://docs.renovatebot.com/renovate-schema.json",
|
||||
$schema: 'https://docs.renovatebot.com/renovate-schema.json',
|
||||
extends: [
|
||||
"gitea>gitea/renovate-config",
|
||||
"helpers:pinGitHubActionDigests",
|
||||
":automergeMinor",
|
||||
"schedule:automergeDaily",
|
||||
"schedule:weekends",
|
||||
'gitea>gitea/renovate-config',
|
||||
':automergeMinor',
|
||||
'schedule:automergeDaily',
|
||||
'schedule:weekends',
|
||||
],
|
||||
labels: [
|
||||
"kind/dependency",
|
||||
'kind/dependency',
|
||||
],
|
||||
digest: {
|
||||
automerge: true,
|
||||
},
|
||||
automergeStrategy: "squash",
|
||||
"git-submodules": {
|
||||
automergeStrategy: 'squash',
|
||||
'git-submodules': {
|
||||
enabled: true,
|
||||
},
|
||||
customManagers: [
|
||||
{
|
||||
description: "Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions",
|
||||
customType: "regex",
|
||||
description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
|
||||
customType: 'regex',
|
||||
managerFilePatterns: [
|
||||
"/.gitea/workflows/.+\\.ya?ml$/",
|
||||
'/.gitea/workflows/.+\\.ya?ml$/',
|
||||
],
|
||||
matchStrings: [
|
||||
"# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s",
|
||||
'# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
|
||||
],
|
||||
},
|
||||
{
|
||||
description: "Detect helm-unittest yaml schema file",
|
||||
customType: "regex",
|
||||
description: 'Detect helm-unittest yaml schema file',
|
||||
customType: 'regex',
|
||||
managerFilePatterns: [
|
||||
"/.vscode/settings\\.json$/",
|
||||
'/.vscode/settings\\.json$/',
|
||||
],
|
||||
matchStrings: [
|
||||
"https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json",
|
||||
'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
|
||||
],
|
||||
datasourceTemplate: "github-releases",
|
||||
datasourceTemplate: 'github-releases',
|
||||
},
|
||||
{
|
||||
description: "Automatically detect new Gitea releases",
|
||||
customType: "regex",
|
||||
datasourceTemplate: "github-releases",
|
||||
depNameTemplate: "gitea/gitea",
|
||||
extractVersionTemplate: "^v(?<version>.*)$",
|
||||
description: 'Automatically detect new Gitea releases',
|
||||
customType: 'regex',
|
||||
managerFilePatterns: [
|
||||
"/(^|/)Chart\\.ya?ml$/",
|
||||
'/(^|/)Chart\\.yaml$/',
|
||||
],
|
||||
matchStrings: [
|
||||
"^appVersion:\\s+[\"']?(?<currentVersion>\\S+)[\"']?$",
|
||||
'# renovate datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) extractVersion=(?<extractVersion>\\S+)\\nappVersion:\\s?(?<currentValue>\\S+)\\n',
|
||||
],
|
||||
},
|
||||
],
|
||||
@@ -58,78 +54,78 @@
|
||||
"commitMessageAction": "update",
|
||||
"commitMessageTopic": "lockfiles",
|
||||
schedule: [
|
||||
"at any time",
|
||||
'at any time',
|
||||
]
|
||||
},
|
||||
packageRules: [
|
||||
{
|
||||
groupName: "subcharts (minor & patch)",
|
||||
groupName: 'subcharts (minor & patch)',
|
||||
matchManagers: [
|
||||
"helmv3",
|
||||
'helmv3',
|
||||
],
|
||||
matchUpdateTypes: [
|
||||
"minor",
|
||||
"patch",
|
||||
"digest",
|
||||
'minor',
|
||||
'patch',
|
||||
'digest',
|
||||
],
|
||||
},
|
||||
{
|
||||
groupName: "bats testing framework",
|
||||
groupName: 'bats testing framework',
|
||||
matchManagers: [
|
||||
"git-submodules",
|
||||
'git-submodules',
|
||||
],
|
||||
matchUpdateTypes: [
|
||||
"minor",
|
||||
"patch",
|
||||
"digest",
|
||||
'minor',
|
||||
'patch',
|
||||
'digest',
|
||||
],
|
||||
},
|
||||
{
|
||||
groupName: "workflow dependencies (minor & patch)",
|
||||
groupName: 'workflow dependencies (minor & patch)',
|
||||
matchManagers: [
|
||||
"github-actions",
|
||||
"npm",
|
||||
"custom.regex",
|
||||
'github-actions',
|
||||
'npm',
|
||||
'custom.regex',
|
||||
],
|
||||
matchUpdateTypes: [
|
||||
"minor",
|
||||
"patch",
|
||||
"digest",
|
||||
'minor',
|
||||
'patch',
|
||||
'digest',
|
||||
],
|
||||
matchFileNames: [
|
||||
"!Chart.yaml",
|
||||
'!Chart.yaml',
|
||||
],
|
||||
},
|
||||
{
|
||||
description: "Update README.md on changes in values.yaml",
|
||||
description: 'Update README.md on changes in values.yaml',
|
||||
matchManagers: [
|
||||
"helm-values",
|
||||
'helm-values',
|
||||
],
|
||||
postUpgradeTasks: {
|
||||
commands: [
|
||||
"install-tool node",
|
||||
"make readme",
|
||||
'install-tool node',
|
||||
'make readme',
|
||||
],
|
||||
fileFilters: [
|
||||
"README.md",
|
||||
'README.md',
|
||||
],
|
||||
executionMode: "update",
|
||||
executionMode: 'update',
|
||||
},
|
||||
},
|
||||
{
|
||||
description: "Override changelog url for Helm image, to have release notes in our PRs",
|
||||
description: 'Override changelog url for Helm image, to have release notes in our PRs',
|
||||
matchDepNames: [
|
||||
"alpine/helm",
|
||||
'alpine/helm',
|
||||
],
|
||||
changelogUrl: "https://github.com/helm/helm",
|
||||
changelogUrl: 'https://github.com/helm/helm',
|
||||
},
|
||||
{
|
||||
description: "Bump Gitea as fast as possible - not only on weekends",
|
||||
description: 'Bump Gitea as fast as possible - not only on weekends',
|
||||
matchDepNames: [
|
||||
"go-gitea/gitea",
|
||||
'go-gitea/gitea',
|
||||
],
|
||||
schedule: [
|
||||
"at any time",
|
||||
'at any time',
|
||||
],
|
||||
},
|
||||
],
|
||||
|
||||
@@ -78,6 +78,7 @@ function env2ini::reload_preset_envs() {
|
||||
rm $TMP_EXISTING_ENVS_FILE
|
||||
}
|
||||
|
||||
|
||||
function env2ini::process_config_file() {
|
||||
local config_file="${1}"
|
||||
local section="$(basename "${config_file}")"
|
||||
@@ -150,4 +151,4 @@ if [ -f ${GITEA_APP_INI} ]; then
|
||||
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||
fi
|
||||
|
||||
gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
|
||||
environment-to-ini -o $GITEA_APP_INI
|
||||
|
||||
+1
-8
@@ -1,12 +1,5 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.route.enabled }}
|
||||
{{- if .Values.route.host }}
|
||||
{{ include "gitea.public_protocol" . }}://{{ tpl .Values.route.host . }}{{ .Values.route.path }}
|
||||
{{- else }}
|
||||
export ROUTE_HOST=$(kubectl get route --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} -o jsonpath="{.spec.host}")
|
||||
echo {{ include "gitea.public_protocol" . }}://$ROUTE_HOST{{ .Values.route.path }}
|
||||
{{- end }}
|
||||
{{- else if .Values.ingress.enabled }}
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
|
||||
+21
-106
@@ -76,87 +76,6 @@ imagePullSecrets:
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true when OpenShift compatibility defaults should be rendered.
|
||||
If openshift.enabled is unset, auto-detect via the SCC API.
|
||||
*/}}
|
||||
{{- define "gitea.openshift.enabled" -}}
|
||||
{{- if kindIs "bool" .Values.openshift.enabled -}}
|
||||
{{ ternary "true" "false" .Values.openshift.enabled }}
|
||||
{{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" -}}
|
||||
true
|
||||
{{- else -}}
|
||||
false
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the pod's hostUsers setting when OpenShift compatibility is enabled.
|
||||
*/}}
|
||||
{{- define "gitea.hostUsers" -}}
|
||||
{{- if eq (include "gitea.openshift.enabled" . | trim) "true" -}}
|
||||
{{- if kindIs "bool" .Values.openshift.hostUsers -}}
|
||||
{{ ternary "true" "false" .Values.openshift.hostUsers }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
|
||||
*/}}
|
||||
{{- define "gitea.podSecurityContext" -}}
|
||||
{{- $podSecurityContext := deepCopy .Values.podSecurityContext -}}
|
||||
{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $podSecurityContext "fsGroup")) -}}
|
||||
{{- $_ := set $podSecurityContext "fsGroup" 1000 -}}
|
||||
{{- end -}}
|
||||
{{- if gt (len $podSecurityContext) 0 -}}
|
||||
{{ toYaml $podSecurityContext }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Render container securityContext with OpenShift restricted SCC defaults when enabled.
|
||||
*/}}
|
||||
{{- define "gitea.containerSecurityContext" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $containerSecurityContext := deepCopy (index . 1) -}}
|
||||
{{- if eq (include "gitea.openshift.enabled" $root | trim) "true" -}}
|
||||
{{- $containerSecurityContext = mergeOverwrite (dict
|
||||
"allowPrivilegeEscalation" false
|
||||
"capabilities" (dict "drop" (list "ALL"))
|
||||
"runAsNonRoot" true
|
||||
"seccompProfile" (dict "type" "RuntimeDefault")
|
||||
) $containerSecurityContext -}}
|
||||
{{- end -}}
|
||||
{{- if gt (len $containerSecurityContext) 0 -}}
|
||||
{{ toYaml $containerSecurityContext }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Render the securityContext for init containers that execute Gitea/GPG commands.
|
||||
These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
|
||||
*/}}
|
||||
{{- define "gitea.commandInitContainerSecurityContext" -}}
|
||||
{{- $root := index . 0 -}}
|
||||
{{- $containerSecurityContext := deepCopy (index . 1) -}}
|
||||
{{- if and (ne (include "gitea.openshift.enabled" $root | trim) "true") (not (hasKey $containerSecurityContext "runAsUser")) -}}
|
||||
{{- $_ := set $containerSecurityContext "runAsUser" 1000 -}}
|
||||
{{- end -}}
|
||||
{{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Render the runtime container securityContext while honoring the deprecated securityContext value.
|
||||
*/}}
|
||||
{{- define "gitea.runtimeContainerSecurityContext" -}}
|
||||
{{- $containerSecurityContext := deepCopy .Values.containerSecurityContext -}}
|
||||
{{- if and (eq (len $containerSecurityContext) 0) .Values.securityContext -}}
|
||||
{{- $containerSecurityContext = deepCopy .Values.securityContext -}}
|
||||
{{- end -}}
|
||||
{{- include "gitea.containerSecurityContext" (list . $containerSecurityContext) -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Storage Class
|
||||
@@ -215,20 +134,28 @@ app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "valkey.dns" -}}
|
||||
{{- if (index .Values "valkey").enabled -}}
|
||||
{{- printf "redis://:%s@%s-valkey.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index (index .Values "valkey").auth.aclUsers "default").password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").service.port -}}
|
||||
{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
|
||||
{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
|
||||
{{- else if (index .Values "valkey-cluster").enabled -}}
|
||||
{{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
|
||||
{{- else if (index .Values "valkey").enabled -}}
|
||||
{{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "valkey.port" -}}
|
||||
{{- if (index .Values "valkey").enabled -}}
|
||||
{{ (index .Values "valkey").service.port }}
|
||||
{{- if (index .Values "valkey-cluster").enabled -}}
|
||||
{{ (index .Values "valkey-cluster").service.ports.valkey }}
|
||||
{{- else if (index .Values "valkey").enabled -}}
|
||||
{{ (index .Values "valkey").master.service.ports.valkey }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "valkey.servicename" -}}
|
||||
{{- if (index .Values "valkey").enabled -}}
|
||||
{{- printf "%s-valkey.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- if (index .Values "valkey-cluster").enabled -}}
|
||||
{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- else if (index .Values "valkey").enabled -}}
|
||||
{{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -236,18 +163,6 @@ app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.public_hostname" -}}
|
||||
{{- if and .Values.route.enabled .Values.route.host -}}
|
||||
{{ tpl .Values.route.host . }}
|
||||
{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
|
||||
{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
|
||||
{{- else if gt (len .Values.ingress.hosts) 0 -}}
|
||||
{{ tpl (index .Values.ingress.hosts 0).host $ }}
|
||||
{{- else -}}
|
||||
{{ include "gitea.default_domain" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.ldap_settings" -}}
|
||||
{{- $idx := index . 0 }}
|
||||
{{- $values := index . 1 }}
|
||||
@@ -298,11 +213,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.public_protocol" -}}
|
||||
{{- if and .Values.route.enabled .Values.route.tls.termination -}}
|
||||
https
|
||||
{{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
|
||||
https
|
||||
{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
|
||||
{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
|
||||
https
|
||||
{{- else -}}
|
||||
{{ .Values.gitea.config.server.PROTOCOL }}
|
||||
@@ -395,7 +306,7 @@ https
|
||||
{{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
|
||||
{{- end -}}
|
||||
{{- /* valkey queue */ -}}
|
||||
{{- if (index .Values "valkey").enabled -}}
|
||||
{{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
|
||||
@@ -435,7 +346,11 @@ https
|
||||
{{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
|
||||
{{- end -}}
|
||||
{{- if not (.Values.gitea.config.server.DOMAIN) -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.public_hostname" .) -}}
|
||||
{{- if gt (len .Values.ingress.hosts) 0 -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.server.ROOT_URL -}}
|
||||
{{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/* annotations */}}
|
||||
|
||||
{{- define "gitea.backendTLSPolicy.annotations" -}}
|
||||
{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
|
||||
{{- toYaml . -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* enabled */}}
|
||||
|
||||
{{- define "gitea.backendTLSPolicy.enabled" -}}
|
||||
{{- if and .Values.gatewayAPI.enabled
|
||||
.Values.gatewayAPI.core.backendTLSPolicy.enabled
|
||||
-}}
|
||||
true
|
||||
{{- else -}}
|
||||
false
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.backendTLSPolicy.labels" -}}
|
||||
{{ include "gitea.labels" . }}
|
||||
{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,30 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/* annotations */}}
|
||||
|
||||
{{- define "gitea.clientSettingsPolicies.annotations" -}}
|
||||
{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
|
||||
{{- toYaml . -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* enabled */}}
|
||||
|
||||
{{- define "gitea.clientSettingsPolicies.enabled" -}}
|
||||
{{- if and .Values.gatewayAPI.enabled
|
||||
.Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
|
||||
-}}
|
||||
true
|
||||
{{- else -}}
|
||||
false
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.clientSettingsPolicies.labels" -}}
|
||||
{{ include "gitea.labels" . }}
|
||||
{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,30 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/* annotations */}}
|
||||
|
||||
{{- define "gitea.httpRoute.annotations" -}}
|
||||
{{- with .Values.gatewayAPI.core.httpRoute.annotations }}
|
||||
{{- toYaml . -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* enabled */}}
|
||||
|
||||
{{- define "gitea.httpRoute.enabled" -}}
|
||||
{{- if and .Values.gatewayAPI.enabled
|
||||
.Values.gatewayAPI.core.httpRoute.enabled
|
||||
-}}
|
||||
true
|
||||
{{- else -}}
|
||||
false
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.httpRoute.labels" -}}
|
||||
{{ include "gitea.labels" . }}
|
||||
{{- with .Values.gatewayAPI.core.httpRoute.labels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,11 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/* names */}}
|
||||
|
||||
{{- define "gitea.service.http.name" -}}
|
||||
{{ include "gitea.fullname" . }}-http
|
||||
{{- end }}
|
||||
|
||||
{{- define "gitea.service.ssh.name" -}}
|
||||
{{ include "gitea.fullname" . }}-ssh
|
||||
{{- end }}
|
||||
@@ -1,30 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/* annotations */}}
|
||||
|
||||
{{- define "gitea.tcpRoute.annotations" -}}
|
||||
{{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
|
||||
{{- toYaml . -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* enabled */}}
|
||||
|
||||
{{- define "gitea.tcpRoute.enabled" -}}
|
||||
{{- if and .Values.gatewayAPI.enabled
|
||||
.Values.gatewayAPI.core.tcpRoute.enabled
|
||||
-}}
|
||||
true
|
||||
{{- else -}}
|
||||
false
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{/* labels */}}
|
||||
|
||||
{{- define "gitea.tcpRoute.labels" -}}
|
||||
{{ include "gitea.labels" . }}
|
||||
{{- with .Values.gatewayAPI.core.tcpRoute.labels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,30 +0,0 @@
|
||||
{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
|
||||
{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
|
||||
{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: BackendTLSPolicy
|
||||
metadata:
|
||||
{{- with (include "gitea.backendTLSPolicy.annotations" .) }}
|
||||
annotations:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.backendTLSPolicy.labels" .) }}
|
||||
labels:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
spec:
|
||||
targetRefs:
|
||||
{{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
|
||||
{{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
|
||||
{{- else }}
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: {{ include "gitea.service.http.name" . }}
|
||||
{{- end }}
|
||||
validation:
|
||||
{{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,3 @@
|
||||
{{- if .Values.actions -}}
|
||||
{{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
|
||||
{{- end -}}
|
||||
@@ -1,30 +0,0 @@
|
||||
{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
|
||||
{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
|
||||
{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: gateway.nginx.org/v1alpha1
|
||||
kind: ClientSettingsPolicy
|
||||
metadata:
|
||||
{{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
|
||||
annotations:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.clientSettingsPolicies.labels" .) }}
|
||||
labels:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
spec:
|
||||
targetRef:
|
||||
{{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
|
||||
{{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
|
||||
{{- else }}
|
||||
group: gateway.networking.k8s.io
|
||||
kind: HTTPRoute
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
{{- end }}
|
||||
body:
|
||||
{{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -43,11 +43,6 @@ spec:
|
||||
{{- toYaml .Values.deployment.labels | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $hostUsers := include "gitea.hostUsers" . | trim }}
|
||||
{{- $podSecurityContext := include "gitea.podSecurityContext" . | trim }}
|
||||
{{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.containerSecurityContext)) | trim }}
|
||||
{{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.containerSecurityContext)) | trim }}
|
||||
{{- $runtimeContainerSecurityContext := include "gitea.runtimeContainerSecurityContext" . | trim }}
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: "{{ .Values.schedulerName }}"
|
||||
{{- end }}
|
||||
@@ -57,14 +52,9 @@ spec:
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
{{- if $hostUsers }}
|
||||
hostUsers: {{ $hostUsers }}
|
||||
{{- end }}
|
||||
{{- include "gitea.images.pullSecrets" . | nindent 6 }}
|
||||
{{- if $podSecurityContext }}
|
||||
securityContext:
|
||||
{{- $podSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
{{- if .Values.preExtraInitContainers }}
|
||||
{{- toYaml .Values.preExtraInitContainers | nindent 8 }}
|
||||
@@ -101,25 +91,15 @@ spec:
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
{{- if $containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
- name: init-app-ini
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
{{- end }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
@@ -156,30 +136,23 @@ spec:
|
||||
mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
{{- if $containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $containerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: configure-gpg
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $commandInitContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $commandInitContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
|
||||
{{- $csc := deepCopy .Values.containerSecurityContext -}}
|
||||
{{- if not (hasKey $csc "runAsUser") -}}
|
||||
{{- $_ := set $csc "runAsUser" 1000 -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $csc | nindent 12 }}
|
||||
env:
|
||||
- name: GNUPGHOME
|
||||
value: {{ .Values.signing.gpgHome }}
|
||||
@@ -204,21 +177,16 @@ spec:
|
||||
{{- end }}
|
||||
- name: configure-gitea
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
{{- if .Values.gitea.extraEnvSourceFile }}
|
||||
command:
|
||||
- "/bin/bash"
|
||||
- "-c"
|
||||
args:
|
||||
- "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- else }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if $commandInitContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $commandInitContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
|
||||
{{- $csc := deepCopy .Values.containerSecurityContext -}}
|
||||
{{- if not (hasKey $csc "runAsUser") -}}
|
||||
{{- $_ := set $csc "runAsUser" 1000 -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $csc | nindent 12 }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
@@ -376,10 +344,13 @@ spec:
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if $runtimeContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $runtimeContainerSecurityContext | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- /* Honor the deprecated securityContext variable when defined */ -}}
|
||||
{{- if .Values.containerSecurityContext -}}
|
||||
{{ toYaml .Values.containerSecurityContext | nindent 12 -}}
|
||||
{{- else -}}
|
||||
{{ toYaml .Values.securityContext | nindent 12 -}}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
|
||||
@@ -1,15 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{- toYaml .Values.service.http.annotations | nindent 4 }}
|
||||
name: {{ include "gitea.fullname" . }}-http
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- if .Values.service.http.labels }}
|
||||
{{- toYaml .Values.service.http.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "gitea.service.http.name" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
annotations:
|
||||
{{- toYaml .Values.service.http.annotations | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.http.type }}
|
||||
{{- if eq .Values.service.http.type "LoadBalancer" }}
|
||||
@@ -1,42 +0,0 @@
|
||||
{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
{{- with (include "gitea.httpRoute.annotations" .) }}
|
||||
annotations:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.httpRoute.labels" .) }}
|
||||
labels:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
spec:
|
||||
parentRefs:
|
||||
{{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
|
||||
{{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
|
||||
{{- else }}
|
||||
{{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
|
||||
{{- end }}
|
||||
{{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
|
||||
hostnames:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.gatewayAPI.core.httpRoute.rules }}
|
||||
{{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
|
||||
{{- else }}
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: {{ include "gitea.service.http.name" . }}
|
||||
port: {{ .Values.service.http.port }}
|
||||
weight: 1
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -36,7 +36,7 @@ spec:
|
||||
pathType: {{ default "Prefix" $.Values.ingress.pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "gitea.service.http.name" $ }}
|
||||
name: {{ $fullName }}-http
|
||||
port:
|
||||
number: {{ $httpPort }}
|
||||
{{- else }}
|
||||
@@ -44,7 +44,7 @@ spec:
|
||||
pathType: {{ .pathType | default "Prefix" }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "gitea.service.http.name" $ }}
|
||||
name: {{ $fullName }}-http
|
||||
port:
|
||||
number: {{ $httpPort }}
|
||||
{{- end }}
|
||||
@@ -54,7 +54,7 @@ spec:
|
||||
pathType: "Prefix"
|
||||
backend:
|
||||
service:
|
||||
name: {{ include "gitea.service.http.name" $ }}
|
||||
name: {{ $fullName }}-http
|
||||
port:
|
||||
number: {{ $httpPort }}
|
||||
{{- end }}
|
||||
|
||||
@@ -123,7 +123,7 @@ stringData:
|
||||
# should add it to prevent requiring frequent admin password resets.
|
||||
local -a change_args
|
||||
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||
if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
|
||||
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||
change_args+=(--must-change-password=false)
|
||||
fi
|
||||
gitea admin user change-password "${change_args[@]}"
|
||||
|
||||
@@ -1,52 +0,0 @@
|
||||
{{- if .Values.route.enabled -}}
|
||||
{{- $fullName := include "gitea.fullname" . -}}
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- with .Values.route.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.route.host }}
|
||||
host: {{ tpl .Values.route.host . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.route.path }}
|
||||
path: {{ tpl .Values.route.path . | quote }}
|
||||
{{- end }}
|
||||
to:
|
||||
kind: Service
|
||||
name: {{ include "gitea.service.http.name" . }}
|
||||
port:
|
||||
targetPort: http
|
||||
wildcardPolicy: {{ .Values.route.wildcardPolicy }}
|
||||
{{- with .Values.route.tls }}
|
||||
{{- if .termination }}
|
||||
tls:
|
||||
termination: {{ .termination }}
|
||||
{{- if .insecureEdgeTerminationPolicy }}
|
||||
insecureEdgeTerminationPolicy: {{ .insecureEdgeTerminationPolicy }}
|
||||
{{- end }}
|
||||
{{- if .key }}
|
||||
key: |
|
||||
{{- .key | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .certificate }}
|
||||
certificate: |
|
||||
{{- .certificate | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .caCertificate }}
|
||||
caCertificate: |
|
||||
{{- .caCertificate | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .destinationCACertificate }}
|
||||
destinationCACertificate: |
|
||||
{{- .destinationCACertificate | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1,15 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
{{- toYaml .Values.service.ssh.annotations | nindent 4 }}
|
||||
name: {{ include "gitea.fullname" . }}-ssh
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- if .Values.service.ssh.labels }}
|
||||
{{- toYaml .Values.service.ssh.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "gitea.service.ssh.name" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
annotations:
|
||||
{{- toYaml .Values.service.ssh.annotations | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.ssh.type }}
|
||||
{{- if eq .Values.service.ssh.type "LoadBalancer" }}
|
||||
@@ -1,34 +0,0 @@
|
||||
{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1alpha2
|
||||
kind: TCPRoute
|
||||
metadata:
|
||||
{{- with (include "gitea.tcpRoute.annotations" .) }}
|
||||
annotations:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with (include "gitea.tcpRoute.labels" .) }}
|
||||
labels:
|
||||
{{- . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
spec:
|
||||
parentRefs:
|
||||
{{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
|
||||
{{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
|
||||
{{- else }}
|
||||
{{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.gatewayAPI.core.tcpRoute.rules }}
|
||||
{{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
|
||||
{{- else }}
|
||||
- backendRefs:
|
||||
- group: ""
|
||||
kind: Service
|
||||
name: {{ include "gitea.service.ssh.name" . }}
|
||||
port: {{ .Values.service.ssh.port }}
|
||||
weight: 1
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -9,19 +9,10 @@ metadata:
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
{{- $hostUsers := include "gitea.hostUsers" . | trim }}
|
||||
{{- $testContainerSecurityContext := include "gitea.containerSecurityContext" (list . (dict)) | trim }}
|
||||
{{- if $hostUsers }}
|
||||
hostUsers: {{ $hostUsers }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: wget
|
||||
image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
|
||||
{{- if $testContainerSecurityContext }}
|
||||
securityContext:
|
||||
{{- $testContainerSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
command: ['wget']
|
||||
args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}']
|
||||
args: ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
|
||||
restartPolicy: Never
|
||||
{{- end }}
|
||||
|
||||
+1
-1
Submodule unittests/bash/bats updated: 5f12b31721...d9faff0d7b
Submodule unittests/bash/test_helper/bats-mock updated: 9c239d6a10...2bf742180b
@@ -9,51 +9,27 @@ function setup() {
|
||||
export GITEA_APP_INI="$BATS_TEST_TMPDIR/app.ini"
|
||||
export TMP_EXISTING_ENVS_FILE="$BATS_TEST_TMPDIR/existing-envs"
|
||||
export ENV_TO_INI_MOUNT_POINT="$BATS_TEST_TMPDIR/env-to-ini-mounts"
|
||||
export GITEA_EDIT_INI_EXPECTED=0
|
||||
export PATH="$BATS_TEST_TMPDIR/bin:$PATH"
|
||||
|
||||
mkdir -p "$BATS_TEST_TMPDIR/bin"
|
||||
cat >"$BATS_TEST_TMPDIR/bin/gitea" <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
case "$*" in
|
||||
'generate secret INTERNAL_TOKEN')
|
||||
echo 'mocked-internal-token'
|
||||
;;
|
||||
'generate secret SECRET_KEY')
|
||||
echo 'mocked-secret-key'
|
||||
;;
|
||||
'generate secret JWT_SECRET')
|
||||
echo 'mocked-jwt-secret'
|
||||
;;
|
||||
'generate secret LFS_JWT_SECRET')
|
||||
echo 'mocked-lfs-jwt-secret'
|
||||
;;
|
||||
"config edit-ini --apply-env --config $GITEA_APP_INI --out $GITEA_APP_INI")
|
||||
if [ "$GITEA_EDIT_INI_EXPECTED" -eq 1 ]; then
|
||||
echo 'Stubbed gitea config edit-ini was called!'
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo 'Unexpected gitea config edit-ini invocation' >&2
|
||||
exit 127
|
||||
;;
|
||||
*)
|
||||
echo "Unexpected gitea invocation: $*" >&2
|
||||
exit 127
|
||||
;;
|
||||
esac
|
||||
EOF
|
||||
chmod +x "$BATS_TEST_TMPDIR/bin/gitea"
|
||||
stub gitea \
|
||||
"generate secret INTERNAL_TOKEN : echo 'mocked-internal-token'" \
|
||||
"generate secret SECRET_KEY : echo 'mocked-secret-key'" \
|
||||
"generate secret JWT_SECRET : echo 'mocked-jwt-secret'" \
|
||||
"generate secret LFS_JWT_SECRET : echo 'mocked-lfs-jwt-secret'"
|
||||
}
|
||||
|
||||
function teardown() {
|
||||
:
|
||||
unstub gitea
|
||||
# This condition exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
|
||||
if [ $ENV_TO_INI_EXPECTED -eq 1 ]; then
|
||||
unstub environment-to-ini
|
||||
fi
|
||||
}
|
||||
|
||||
function expect_gitea_config_edit_ini_call() {
|
||||
export GITEA_EDIT_INI_EXPECTED=1
|
||||
# This function exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
|
||||
function expect_environment_to_ini_call() {
|
||||
export ENV_TO_INI_EXPECTED=1
|
||||
stub environment-to-ini \
|
||||
"-o $GITEA_APP_INI : echo 'Stubbed environment-to-ini was called!'"
|
||||
}
|
||||
|
||||
function execute_test_script() {
|
||||
@@ -80,18 +56,18 @@ function write_mounted_file() {
|
||||
}
|
||||
|
||||
@test "works as expected when nothing is configured" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
run $PROJECT_ROOT/scripts/init-containers/config/config_environment.sh
|
||||
|
||||
assert_success
|
||||
assert_line '...Initial secrets generated'
|
||||
assert_line 'Reloading preset envs...'
|
||||
assert_line '=== All configuration sources loaded ==='
|
||||
assert_line 'Stubbed gitea config edit-ini was called!'
|
||||
assert_line 'Stubbed environment-to-ini was called!'
|
||||
}
|
||||
|
||||
@test "exports initial secrets" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
run execute_test_script
|
||||
|
||||
assert_success
|
||||
@@ -102,7 +78,7 @@ function write_mounted_file() {
|
||||
}
|
||||
|
||||
@test "does NOT export initial secrets when app.ini already exists" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
touch $GITEA_APP_INI
|
||||
|
||||
run execute_test_script
|
||||
@@ -116,7 +92,7 @@ function write_mounted_file() {
|
||||
}
|
||||
|
||||
@test "ensures that preset environment variables take precedence over auto-generated ones" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
|
||||
|
||||
run execute_test_script
|
||||
@@ -126,7 +102,7 @@ function write_mounted_file() {
|
||||
}
|
||||
|
||||
@test "ensures that preset environment variables take precedence over mounted ones" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
|
||||
write_mounted_file "inlines" "oauth2" "$(cat << EOF
|
||||
JWT_SECRET=inline-jwt-secret
|
||||
@@ -141,7 +117,7 @@ EOF
|
||||
}
|
||||
|
||||
@test "ensures that additionals take precedence over inlines" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
write_mounted_file "inlines" "oauth2" "$(cat << EOF
|
||||
JWT_SECRET=inline-jwt-secret
|
||||
EOF
|
||||
@@ -160,7 +136,7 @@ EOF
|
||||
}
|
||||
|
||||
@test "ensures that dotted/dashed sections are properly masked" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
|
||||
WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
|
||||
EOF
|
||||
@@ -176,7 +152,7 @@ EOF
|
||||
##### THIS IS A BUG, BUT I WANT IT TO BE COVERED BY TESTS #####
|
||||
###############################################################
|
||||
@test "ensures uppercase section and setting names (🐞)" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
export GITEA__oauth2__JwT_Secret="pre-defined-jwt-secret"
|
||||
write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
|
||||
WORK_IN_progress_PREFIXES=WIP:,[WIP]
|
||||
@@ -191,7 +167,7 @@ EOF
|
||||
}
|
||||
|
||||
@test "treats top-level configuration as section-less" {
|
||||
expect_gitea_config_edit_ini_call
|
||||
expect_environment_to_ini_call
|
||||
write_mounted_file "inlines" "_generals_" "$(cat << EOF
|
||||
APP_NAME=Hello top-level configuration
|
||||
RUN_MODE=dev
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
suite: Check if actions raises an error
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: fails when trying to configure actions due to removal
|
||||
set:
|
||||
actions:
|
||||
enabled: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9.
|
||||
@@ -3,9 +3,26 @@ release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: "cache is configured correctly for valkey-cluster"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: stringData.cache
|
||||
value: |-
|
||||
ADAPTER=redis
|
||||
HOST=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
|
||||
- it: "cache is configured correctly for valkey"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: true
|
||||
asserts:
|
||||
@@ -14,11 +31,13 @@ tests:
|
||||
path: stringData.cache
|
||||
value: |-
|
||||
ADAPTER=redis
|
||||
HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
HOST=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
|
||||
- it: "cache is configured correctly for 'memory' when valkey is disabled"
|
||||
- it: "cache is configured correctly for 'memory' when valkey (or valkey-cluster) is disabled"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
@@ -29,9 +48,11 @@ tests:
|
||||
ADAPTER=memory
|
||||
HOST=
|
||||
|
||||
- it: "cache can be customized when valkey is disabled"
|
||||
- it: "cache can be customized when valkey (or valkey-cluster) is disabled"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
gitea.config.cache.ADAPTER: custom-adapter
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
suite: config template | config_environment.sh
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: uses `gitea config edit-ini` to write app.ini from environment variables
|
||||
template: templates/gitea/config.yaml
|
||||
asserts:
|
||||
- documentIndex: 1
|
||||
matchRegex:
|
||||
path: stringData["config_environment.sh"]
|
||||
pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
|
||||
@@ -3,9 +3,26 @@ release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: "queue is configured correctly for valkey-cluster"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: stringData.queue
|
||||
value: |-
|
||||
CONN_STR=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
TYPE=redis
|
||||
|
||||
- it: "queue is configured correctly for valkey"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: true
|
||||
asserts:
|
||||
@@ -13,12 +30,14 @@ tests:
|
||||
equal:
|
||||
path: stringData.queue
|
||||
value: |-
|
||||
CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
CONN_STR=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
TYPE=redis
|
||||
|
||||
- it: "queue is configured correctly for 'levelDB' when valkey is disabled"
|
||||
- it: "queue is configured correctly for 'levelDB' when valkey (and valkey-cluster) is disabled"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
@@ -29,9 +48,11 @@ tests:
|
||||
CONN_STR=
|
||||
TYPE=level
|
||||
|
||||
- it: "queue can be customized when valkey is disabled"
|
||||
- it: "queue can be customized when valkey (and valkey-cluster) are disabled"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
gitea.config.queue.TYPE: custom-type
|
||||
|
||||
@@ -65,94 +65,3 @@ tests:
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=http://provided.example.com
|
||||
|
||||
################################################
|
||||
|
||||
- it: "[route enabled] uses route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
route:
|
||||
enabled: true
|
||||
host: route.example.com
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nDOMAIN=route.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nSSH_DOMAIN=route.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=http://route.example.com
|
||||
|
||||
################################################
|
||||
|
||||
- it: "[route tls termination] uses https for ROOT_URL"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
route:
|
||||
enabled: true
|
||||
host: route.example.com
|
||||
tls:
|
||||
termination: edge
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=https://route.example.com
|
||||
|
||||
################################################
|
||||
|
||||
- it: "[HTTPRoute enabled] uses first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
ingress:
|
||||
hosts: []
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
hostnames:
|
||||
- gw.example.com
|
||||
parentRefs:
|
||||
- name: shared-gateway
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nDOMAIN=gw.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nSSH_DOMAIN=gw.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=http://gw.example.com
|
||||
|
||||
################################################
|
||||
|
||||
- it: "[HTTPRoute tls] switches ROOT_URL to https"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
ingress:
|
||||
hosts: []
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
tls: true
|
||||
hostnames:
|
||||
- gw.example.com
|
||||
parentRefs:
|
||||
- name: shared-gateway
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=https://gw.example.com
|
||||
|
||||
@@ -3,9 +3,26 @@ release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: "session is configured correctly for valkey-cluster"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: stringData.session
|
||||
value: |-
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
|
||||
- it: "session is configured correctly for valkey"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: true
|
||||
asserts:
|
||||
@@ -14,11 +31,13 @@ tests:
|
||||
path: stringData.session
|
||||
value: |-
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
|
||||
- it: "session is configured correctly for 'memory' when valkey is disabled"
|
||||
- it: "session is configured correctly for 'memory' when valkey (and valkey-cluster) is disabled"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
@@ -29,9 +48,11 @@ tests:
|
||||
PROVIDER=memory
|
||||
PROVIDER_CONFIG=
|
||||
|
||||
- it: "session can be customized when valkey is disabled"
|
||||
- it: "session can be customized when valkey (and valkey-cluster) is disabled"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
gitea.config.session.PROVIDER: custom-provider
|
||||
|
||||
@@ -112,15 +112,6 @@ tests:
|
||||
matchRegex:
|
||||
path: stringData.database
|
||||
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
|
||||
- it: "[gitea] connects to pgpool service with custom cluster domain"
|
||||
set:
|
||||
clusterDomain: my-special-cluster.local
|
||||
template: templates/gitea/config.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.database
|
||||
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
|
||||
- it: "[gitea] connects to configured database"
|
||||
template: templates/gitea/config.yaml
|
||||
asserts:
|
||||
|
||||
@@ -71,15 +71,6 @@ tests:
|
||||
matchRegex:
|
||||
path: stringData.database
|
||||
pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
|
||||
- it: "[gitea] connects to postgresql service with custom cluster domain"
|
||||
set:
|
||||
clusterDomain: my-special-cluster.local
|
||||
template: templates/gitea/config.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.database
|
||||
pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234
|
||||
- it: "[gitea] connects to configured database"
|
||||
template: templates/gitea/config.yaml
|
||||
asserts:
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
suite: Dependency checks | Customization integrity | valkey-cluster
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
set:
|
||||
valkey:
|
||||
enabled: false
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
usePassword: false
|
||||
cluster:
|
||||
nodes: 5
|
||||
replicas: 2
|
||||
tests:
|
||||
- it: "[valkey-cluster] configures correct nodes/replicas"
|
||||
template: charts/valkey-cluster/templates/valkey-statefulset.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: spec.replicas
|
||||
value: 5
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: spec.template.spec.containers[0].args[0]
|
||||
pattern: VALKEY_CLUSTER_REPLICAS="2"
|
||||
- it: "[valkey-cluster] support auth-less connections"
|
||||
asserts:
|
||||
- template: charts/valkey-cluster/templates/secret.yaml
|
||||
hasDocuments:
|
||||
count: 0
|
||||
- template: charts/valkey-cluster/templates/valkey-statefulset.yaml
|
||||
documentIndex: 0
|
||||
contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: ALLOW_EMPTY_PASSWORD
|
||||
value: "yes"
|
||||
- it: "[valkey-cluster] support auth-full connections"
|
||||
set:
|
||||
valkey-cluster:
|
||||
usePassword: true
|
||||
asserts:
|
||||
- template: charts/valkey-cluster/templates/secret.yaml
|
||||
containsDocument:
|
||||
kind: Secret
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-valkey-cluster
|
||||
namespace: testing
|
||||
- template: charts/valkey-cluster/templates/valkey-statefulset.yaml
|
||||
documentIndex: 0
|
||||
contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: REDISCLI_AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-unittests-valkey-cluster
|
||||
key: valkey-password
|
||||
- template: charts/valkey-cluster/templates/valkey-statefulset.yaml
|
||||
documentIndex: 0
|
||||
contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: REDISCLI_AUTH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-unittests-valkey-cluster
|
||||
key: valkey-password
|
||||
- it: "[valkey-cluster] renders the referenced service"
|
||||
template: charts/valkey-cluster/templates/headless-svc.yaml
|
||||
asserts:
|
||||
- containsDocument:
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-valkey-cluster-headless
|
||||
namespace: testing
|
||||
- documentIndex: 0
|
||||
contains:
|
||||
path: spec.ports
|
||||
content:
|
||||
name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
- it: "[gitea] waits for valkey-cluster to be up and running"
|
||||
template: templates/gitea/init.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData["configure_gitea.sh"]
|
||||
pattern: nc -vz -w2 gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local 6379
|
||||
@@ -3,50 +3,50 @@ release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: true
|
||||
auth:
|
||||
enabled: true
|
||||
aclUsers:
|
||||
default:
|
||||
permissions: "~* &* +@all"
|
||||
password: gitea-password
|
||||
architecture: standalone
|
||||
global:
|
||||
valkey:
|
||||
password: gitea-password
|
||||
master:
|
||||
count: 2
|
||||
tests:
|
||||
- it: "[valkey] valkey.auth.aclUsers.default.password is applied as expected"
|
||||
- it: "[valkey] configures correct 'master' nodes"
|
||||
template: charts/valkey/templates/primary/application.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: spec.replicas
|
||||
value: 1
|
||||
- it: "[valkey] valkey.global.valkey.password is applied as expected"
|
||||
template: charts/valkey/templates/secret.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
equal:
|
||||
path: data.default-password
|
||||
path: data["valkey-password"]
|
||||
value: "Z2l0ZWEtcGFzc3dvcmQ="
|
||||
- it: "[valkey] renders the referenced service"
|
||||
template: charts/valkey/templates/service.yaml
|
||||
template: charts/valkey/templates/headless-svc.yaml
|
||||
asserts:
|
||||
- containsDocument:
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-valkey
|
||||
name: gitea-unittests-valkey-headless
|
||||
namespace: testing
|
||||
- documentIndex: 0
|
||||
contains:
|
||||
path: spec.ports
|
||||
content:
|
||||
name: tcp
|
||||
name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp
|
||||
protocol: TCP
|
||||
targetPort: redis
|
||||
- it: "[gitea] waits for valkey to be up and running"
|
||||
template: templates/gitea/init.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData["configure_gitea.sh"]
|
||||
pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
|
||||
- it: "[gitea] waits for valkey to be up and running with custom cluster domain"
|
||||
set:
|
||||
clusterDomain: my-special-cluster.local
|
||||
template: templates/gitea/init.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData["configure_gitea.sh"]
|
||||
pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379
|
||||
pattern: nc -vz -w2 gitea-unittests-valkey-headless.testing.svc.cluster.local 6379
|
||||
|
||||
@@ -29,9 +29,24 @@ tests:
|
||||
path: spec.template.spec.containers[0].image
|
||||
# IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
|
||||
pattern: bitnamilegacy/postgresql:17.+$
|
||||
- it: "[valkey] ensures we detect major image version upgrades"
|
||||
template: charts/valkey/templates/deploy_valkey.yaml
|
||||
- it: "[valkey-cluster] ensures we detect major image version upgrades"
|
||||
template: charts/valkey-cluster/templates/valkey-statefulset.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
valkey:
|
||||
enabled: false
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: spec.template.spec.containers[0].image
|
||||
# IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
|
||||
pattern: bitnamilegacy/valkey-cluster:8.+$
|
||||
- it: "[valkey] ensures we detect major image version upgrades"
|
||||
template: charts/valkey/templates/primary/application.yaml
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: true
|
||||
asserts:
|
||||
@@ -39,4 +54,4 @@ tests:
|
||||
matchRegex:
|
||||
path: spec.template.spec.containers[0].image
|
||||
# IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
|
||||
pattern: valkey/valkey:9.+$
|
||||
pattern: bitnamilegacy/valkey:8.+$
|
||||
|
||||
@@ -1,82 +0,0 @@
|
||||
suite: deployment template (extraEnvSourceFile)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: uses direct execution when extraEnvSourceFile is not set
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].command
|
||||
value: ["/usr/sbinx/config_environment.sh"]
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[1].args
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].command
|
||||
value: ["/usr/sbinx/configure_gitea.sh"]
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[2].args
|
||||
|
||||
- it: sources env file in init-app-ini when extraEnvSourceFile is set
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
gitea:
|
||||
extraEnvSourceFile: /vault/secrets/gitea
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].command
|
||||
value: ["/bin/bash", "-c"]
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[1].args[0]
|
||||
pattern: source /vault/secrets/gitea
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[1].args[0]
|
||||
pattern: config_environment\.sh
|
||||
|
||||
- it: sources env file in configure-gitea when extraEnvSourceFile is set
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
gitea:
|
||||
extraEnvSourceFile: /vault/secrets/gitea
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].command
|
||||
value: ["/bin/bash", "-c"]
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[2].args[0]
|
||||
pattern: source /vault/secrets/gitea
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[2].args[0]
|
||||
pattern: configure_gitea\.sh
|
||||
|
||||
- it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
existingSecret: "custom-gpg-secret"
|
||||
gitea:
|
||||
extraEnvSourceFile: /vault/secrets/gitea
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].command
|
||||
value: ["/bin/bash", "-c"]
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[2].args[0]
|
||||
pattern: source /vault/secrets/gitea
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[2].args[0]
|
||||
pattern: configure_gpg_environment\.sh
|
||||
|
||||
- it: includes file existence check in source command
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
gitea:
|
||||
extraEnvSourceFile: /vault/secrets/gitea
|
||||
asserts:
|
||||
- matchRegex:
|
||||
path: spec.template.spec.initContainers[1].args[0]
|
||||
pattern: "test -f /vault/secrets/gitea"
|
||||
@@ -1,106 +0,0 @@
|
||||
suite: deployment template (openshift)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: renders openshift-compatible defaults for chart-managed containers
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
openshift.enabled: true
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.spec.hostUsers
|
||||
- notExists:
|
||||
path: spec.template.spec.securityContext
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[0].securityContext
|
||||
value:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[1].securityContext
|
||||
value:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].securityContext
|
||||
value:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].securityContext
|
||||
value:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
- it: does not force runAsUser 1000 for command init containers on OpenShift
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
openshift.enabled: true
|
||||
signing.enabled: true
|
||||
signing.existingSecret: custom-gpg-secret
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
||||
- notExists:
|
||||
path: spec.template.spec.initContainers[3].securityContext.runAsUser
|
||||
|
||||
- it: preserves explicit pod and container security context overrides on OpenShift
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
openshift:
|
||||
enabled: true
|
||||
hostUsers: true
|
||||
podSecurityContext:
|
||||
fsGroup: 1000620000
|
||||
containerSecurityContext:
|
||||
runAsUser: 1000620000
|
||||
runAsGroup: 1000620000
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.hostUsers
|
||||
value: true
|
||||
- equal:
|
||||
path: spec.template.spec.securityContext
|
||||
value:
|
||||
fsGroup: 1000620000
|
||||
- equal:
|
||||
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
||||
value: 1000620000
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].securityContext.runAsGroup
|
||||
value: 1000620000
|
||||
|
||||
- it: renders an explicit hostUsers=false override on OpenShift
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
openshift:
|
||||
enabled: true
|
||||
hostUsers: false
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.hostUsers
|
||||
value: false
|
||||
@@ -1,13 +1,13 @@
|
||||
suite: sshService / httpService template (Services configuration)
|
||||
suite: ssh-svc / http-svc template (Services configuration)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/sshService.yaml
|
||||
- templates/gitea/httpService.yaml
|
||||
- templates/gitea/ssh-svc.yaml
|
||||
- templates/gitea/http-svc.yaml
|
||||
tests:
|
||||
- it: supports adding custom labels to sshService
|
||||
template: templates/gitea/sshService.yaml
|
||||
- it: supports adding custom labels to ssh-svc
|
||||
template: templates/gitea/ssh-svc.yaml
|
||||
set:
|
||||
service:
|
||||
ssh:
|
||||
@@ -19,7 +19,7 @@ tests:
|
||||
value: "testvalue"
|
||||
|
||||
- it: keeps existing labels (ssh)
|
||||
template: templates/gitea/sshService.yaml
|
||||
template: templates/gitea/ssh-svc.yaml
|
||||
set:
|
||||
service:
|
||||
ssh:
|
||||
@@ -28,8 +28,8 @@ tests:
|
||||
- exists:
|
||||
path: metadata.labels["app"]
|
||||
|
||||
- it: supports adding custom labels to httpService
|
||||
template: templates/gitea/httpService.yaml
|
||||
- it: supports adding custom labels to http-svc
|
||||
template: templates/gitea/http-svc.yaml
|
||||
set:
|
||||
service:
|
||||
http:
|
||||
@@ -41,7 +41,7 @@ tests:
|
||||
value: "testvalue"
|
||||
|
||||
- it: keeps existing labels (http)
|
||||
template: templates/gitea/httpService.yaml
|
||||
template: templates/gitea/http-svc.yaml
|
||||
set:
|
||||
service:
|
||||
http:
|
||||
@@ -51,7 +51,7 @@ tests:
|
||||
path: metadata.labels["app"]
|
||||
|
||||
- it: render service.ssh.loadBalancerClass if set and type is LoadBalancer
|
||||
template: templates/gitea/sshService.yaml
|
||||
template: templates/gitea/ssh-svc.yaml
|
||||
set:
|
||||
service:
|
||||
ssh:
|
||||
@@ -73,7 +73,7 @@ tests:
|
||||
value: ["1.2.3.4/32", "5.6.7.8/32"]
|
||||
|
||||
- it: does not render when loadbalancer properties are set but type is not loadBalancerClass
|
||||
template: templates/gitea/httpService.yaml
|
||||
template: templates/gitea/http-svc.yaml
|
||||
set:
|
||||
service:
|
||||
http:
|
||||
@@ -92,7 +92,7 @@ tests:
|
||||
path: spec.loadBalancerSourceRanges
|
||||
|
||||
- it: does not render loadBalancerClass by default even when type is LoadBalancer
|
||||
template: templates/gitea/httpService.yaml
|
||||
template: templates/gitea/http-svc.yaml
|
||||
set:
|
||||
service:
|
||||
http:
|
||||
@@ -107,8 +107,8 @@ tests:
|
||||
|
||||
- it: both ssh and http services exist
|
||||
templates:
|
||||
- templates/gitea/sshService.yaml
|
||||
- templates/gitea/httpService.yaml
|
||||
- templates/gitea/ssh-svc.yaml
|
||||
- templates/gitea/http-svc.yaml
|
||||
asserts:
|
||||
- matchRegex:
|
||||
path: metadata.name
|
||||
|
||||
@@ -1,89 +0,0 @@
|
||||
suite: Test Gateway API backendTLSPolicy.yaml
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/backendTLSPolicy.yaml
|
||||
tests:
|
||||
- it: should not render when gatewayAPI.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: false
|
||||
core:
|
||||
backendTLSPolicy:
|
||||
enabled: true
|
||||
validation:
|
||||
hostname: git.internal
|
||||
caCertificateRefs:
|
||||
- name: gitea-ca
|
||||
group: ""
|
||||
kind: ConfigMap
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should not render when backendTLSPolicy.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
gatewayAPI.core.backendTLSPolicy.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should render a BackendTLSPolicy targeting the http Service by default
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
backendTLSPolicy:
|
||||
enabled: true
|
||||
validation:
|
||||
hostname: git.internal
|
||||
caCertificateRefs:
|
||||
- name: gitea-ca
|
||||
group: ""
|
||||
kind: ConfigMap
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: BackendTLSPolicy
|
||||
- equal:
|
||||
path: apiVersion
|
||||
value: gateway.networking.k8s.io/v1
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: gitea-unittests
|
||||
- equal:
|
||||
path: spec.targetRefs[0].name
|
||||
value: gitea-unittests-http
|
||||
- equal:
|
||||
path: spec.targetRefs[0].kind
|
||||
value: Service
|
||||
- equal:
|
||||
path: spec.validation.hostname
|
||||
value: git.internal
|
||||
|
||||
- it: should fail when validation is missing
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
backendTLSPolicy:
|
||||
enabled: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: gatewayAPI.core.backendTLSPolicy.validation is required
|
||||
|
||||
- it: should fail when validation is an empty dict
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
backendTLSPolicy:
|
||||
enabled: true
|
||||
validation: {}
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: gatewayAPI.core.backendTLSPolicy.validation is required
|
||||
@@ -1,105 +0,0 @@
|
||||
suite: Test Gateway API clientSettingsPolicy.yaml
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/clientSettingsPolicy.yaml
|
||||
tests:
|
||||
- it: should not render when gatewayAPI.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: false
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
body:
|
||||
maxSize: 100m
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should not render when clientSettingsPolicies.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
gatewayAPI.nginx.clientSettingsPolicies.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should render a ClientSettingsPolicy targeting the HTTPRoute by default
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
body:
|
||||
maxSize: 100m
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: ClientSettingsPolicy
|
||||
- equal:
|
||||
path: apiVersion
|
||||
value: gateway.nginx.org/v1alpha1
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: gitea-unittests
|
||||
- equal:
|
||||
path: spec.targetRef.group
|
||||
value: gateway.networking.k8s.io
|
||||
- equal:
|
||||
path: spec.targetRef.kind
|
||||
value: HTTPRoute
|
||||
- equal:
|
||||
path: spec.targetRef.name
|
||||
value: gitea-unittests
|
||||
- equal:
|
||||
path: spec.body.maxSize
|
||||
value: 100m
|
||||
|
||||
- it: should honor a custom targetRef
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
targetRef:
|
||||
group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: shared-gateway
|
||||
body:
|
||||
maxSize: 100m
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.targetRef.kind
|
||||
value: Gateway
|
||||
- equal:
|
||||
path: spec.targetRef.name
|
||||
value: shared-gateway
|
||||
|
||||
- it: should fail when body is missing
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: gatewayAPI.nginx.clientSettingsPolicies.body is required
|
||||
|
||||
- it: should fail when body is an empty dict
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
nginx:
|
||||
clientSettingsPolicies:
|
||||
enabled: true
|
||||
body: {}
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: gatewayAPI.nginx.clientSettingsPolicies.body is required
|
||||
@@ -1,117 +0,0 @@
|
||||
suite: Test Gateway API httpRoute.yaml
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/httpRoute.yaml
|
||||
tests:
|
||||
- it: should not render when gatewayAPI.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: false
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
hostnames:
|
||||
- git.example.com
|
||||
parentRefs:
|
||||
- name: shared-gateway
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should not render when httpRoute.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
gatewayAPI.core.httpRoute.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should render a single HTTPRoute with default rule
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
annotations:
|
||||
example.io/owner: gitea
|
||||
hostnames:
|
||||
- git.example.com
|
||||
parentRefs:
|
||||
- name: shared-gateway
|
||||
namespace: gateway-system
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: HTTPRoute
|
||||
- equal:
|
||||
path: apiVersion
|
||||
value: gateway.networking.k8s.io/v1
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: gitea-unittests
|
||||
- equal:
|
||||
path: metadata.annotations["example.io/owner"]
|
||||
value: gitea
|
||||
- equal:
|
||||
path: spec.parentRefs[0].name
|
||||
value: shared-gateway
|
||||
- equal:
|
||||
path: spec.parentRefs[0].namespace
|
||||
value: gateway-system
|
||||
- equal:
|
||||
path: spec.hostnames[0]
|
||||
value: git.example.com
|
||||
- equal:
|
||||
path: spec.rules[0].matches[0].path.value
|
||||
value: /
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].group
|
||||
value: ""
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].kind
|
||||
value: Service
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].name
|
||||
value: gitea-unittests-http
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].port
|
||||
value: 3000
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].weight
|
||||
value: 1
|
||||
|
||||
- it: should fail when parentRefs missing
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
hostnames:
|
||||
- git.example.com
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: gatewayAPI.core.httpRoute.parentRefs is required
|
||||
|
||||
- it: hostname tpl rendering
|
||||
set:
|
||||
global:
|
||||
giteaHostName: gitea.tpl.example.com
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
httpRoute:
|
||||
enabled: true
|
||||
hostnames:
|
||||
- "{{ .Values.global.giteaHostName }}"
|
||||
parentRefs:
|
||||
- name: gw
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.hostnames[0]
|
||||
value: gitea.tpl.example.com
|
||||
@@ -1,79 +0,0 @@
|
||||
suite: Test Gateway API tcpRoute.yaml
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/tcpRoute.yaml
|
||||
tests:
|
||||
- it: should not render when gatewayAPI.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: false
|
||||
core:
|
||||
tcpRoute:
|
||||
enabled: true
|
||||
parentRefs:
|
||||
- name: shared-gateway
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should not render when tcpRoute.enabled is false
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
gatewayAPI.core.tcpRoute.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
|
||||
- it: should render a TCPRoute defaulting to the SSH service
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
tcpRoute:
|
||||
enabled: true
|
||||
parentRefs:
|
||||
- name: shared-gateway
|
||||
sectionName: ssh
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- isKind:
|
||||
of: TCPRoute
|
||||
- equal:
|
||||
path: apiVersion
|
||||
value: gateway.networking.k8s.io/v1alpha2
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: gitea-unittests
|
||||
- equal:
|
||||
path: spec.parentRefs[0].sectionName
|
||||
value: ssh
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].group
|
||||
value: ""
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].kind
|
||||
value: Service
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].name
|
||||
value: gitea-unittests-ssh
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].port
|
||||
value: 22
|
||||
- equal:
|
||||
path: spec.rules[0].backendRefs[0].weight
|
||||
value: 1
|
||||
|
||||
- it: should fail when parentRefs missing
|
||||
set:
|
||||
gatewayAPI:
|
||||
enabled: true
|
||||
core:
|
||||
tcpRoute:
|
||||
enabled: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: gatewayAPI.core.tcpRoute.parentRefs is required
|
||||
@@ -1,58 +0,0 @@
|
||||
suite: Test route.yaml
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/route.yaml
|
||||
tests:
|
||||
- it: should create route when route.enabled is true
|
||||
set:
|
||||
route:
|
||||
enabled: true
|
||||
host: git.apps.example.com
|
||||
path: /
|
||||
annotations:
|
||||
haproxy.router.openshift.io/timeout: 5m
|
||||
tls:
|
||||
termination: edge
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: gitea-unittests
|
||||
- equal:
|
||||
path: metadata.annotations["haproxy.router.openshift.io/timeout"]
|
||||
value: 5m
|
||||
- equal:
|
||||
path: spec.host
|
||||
value: git.apps.example.com
|
||||
- equal:
|
||||
path: spec.path
|
||||
value: /
|
||||
- equal:
|
||||
path: spec.to.kind
|
||||
value: Service
|
||||
- equal:
|
||||
path: spec.to.name
|
||||
value: gitea-unittests-http
|
||||
- equal:
|
||||
path: spec.port.targetPort
|
||||
value: http
|
||||
- equal:
|
||||
path: spec.wildcardPolicy
|
||||
value: None
|
||||
- equal:
|
||||
path: spec.tls.termination
|
||||
value: edge
|
||||
- equal:
|
||||
path: spec.tls.insecureEdgeTerminationPolicy
|
||||
value: Redirect
|
||||
|
||||
- it: should not create route when route.enabled is false
|
||||
set:
|
||||
route.enabled: false
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
@@ -1,33 +0,0 @@
|
||||
suite: test connection template
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/tests/test-http-connection.yaml
|
||||
tests:
|
||||
- it: renders openshift-compatible defaults for the test pod
|
||||
set:
|
||||
openshift.enabled: true
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.hostUsers
|
||||
- equal:
|
||||
path: spec.containers[0].securityContext
|
||||
value:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
- it: renders an explicit hostUsers=false override for the test pod
|
||||
set:
|
||||
openshift:
|
||||
enabled: true
|
||||
hostUsers: false
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.hostUsers
|
||||
value: false
|
||||
@@ -0,0 +1,14 @@
|
||||
suite: Values conflicting checks
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: fails when trying to configure valkey and valkey-cluster the same time
|
||||
set:
|
||||
valkey-cluster:
|
||||
enabled: true
|
||||
valkey:
|
||||
enabled: true
|
||||
asserts:
|
||||
- failedTemplate:
|
||||
errorMessage: valkey and valkey-cluster cannot be enabled at the same time. Please only choose one.
|
||||
+122
-193
@@ -62,14 +62,9 @@ imagePullSecrets: []
|
||||
|
||||
## @section Security
|
||||
# Security context is only usable with rootless image due to image design
|
||||
## @param openshift.enabled Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API.
|
||||
## @param openshift.hostUsers Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used.
|
||||
openshift:
|
||||
enabled: null
|
||||
hostUsers: null
|
||||
|
||||
## @param podSecurityContext Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty.
|
||||
podSecurityContext: {}
|
||||
## @param podSecurityContext.fsGroup Set the shared file system group for all containers in the pod.
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
## @param containerSecurityContext Security context
|
||||
containerSecurityContext: {}
|
||||
@@ -182,120 +177,11 @@ ingress:
|
||||
# hosts:
|
||||
# - git.example.com
|
||||
|
||||
## @section Route
|
||||
## @param route.enabled Enable OpenShift Route
|
||||
## @param route.annotations Route annotations
|
||||
## @param route.host Route host. When unset, OpenShift may generate one and Gitea URL defaults fall back to ingress/service values.
|
||||
## @param route.path Route path
|
||||
## @param route.wildcardPolicy Route wildcard policy
|
||||
## @param route.tls.termination Route TLS termination type
|
||||
## @param route.tls.insecureEdgeTerminationPolicy Route insecure edge termination policy
|
||||
## @param route.tls.key Route TLS key
|
||||
## @param route.tls.certificate Route TLS certificate
|
||||
## @param route.tls.caCertificate Route TLS CA certificate
|
||||
## @param route.tls.destinationCACertificate Route destination CA certificate
|
||||
route:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
host: ""
|
||||
path: ""
|
||||
wildcardPolicy: None
|
||||
tls:
|
||||
termination:
|
||||
insecureEdgeTerminationPolicy:
|
||||
key:
|
||||
certificate:
|
||||
caCertificate:
|
||||
destinationCACertificate:
|
||||
|
||||
## @section Gateway API
|
||||
## See docs/gateway-api.md for full guidance.
|
||||
gatewayAPI:
|
||||
## @param gatewayAPI.enabled Enable deployment of Gateway API resources
|
||||
enabled: false
|
||||
|
||||
core:
|
||||
## @param gatewayAPI.core.backendTLSPolicy.enabled Render a BackendTLSPolicy resource for encrypted backend traffic
|
||||
## @param gatewayAPI.core.backendTLSPolicy.annotations Annotations applied to the BackendTLSPolicy
|
||||
## @param gatewayAPI.core.backendTLSPolicy.labels Additional labels applied to the BackendTLSPolicy
|
||||
## @param gatewayAPI.core.backendTLSPolicy.targetRefs Target references for the BackendTLSPolicy. Defaults to the HTTP service.
|
||||
## @param gatewayAPI.core.backendTLSPolicy.validation Validation configuration (required when enabled). See `docs/gateway-api.md`.
|
||||
## @extra gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`.
|
||||
## @extra gatewayAPI.core.backendTLSPolicy.validation.hostname Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`.
|
||||
backendTLSPolicy:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
targetRefs: []
|
||||
validation: {}
|
||||
# caCertificateRefs:
|
||||
# - name: gitea-ca
|
||||
# group: ""
|
||||
# kind: ConfigMap
|
||||
# hostname: gitea-http
|
||||
|
||||
## @param gatewayAPI.core.httpRoute.enabled Render an HTTPRoute resource
|
||||
## @param gatewayAPI.core.httpRoute.annotations Annotations applied to the HTTPRoute
|
||||
## @param gatewayAPI.core.httpRoute.labels Additional labels applied to the HTTPRoute
|
||||
## @param gatewayAPI.core.httpRoute.tls When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`.
|
||||
## @param gatewayAPI.core.httpRoute.parentRefs Parent gateway references (required when enabled).
|
||||
## @param gatewayAPI.core.httpRoute.hostnames List of hostnames for the HTTPRoute.
|
||||
## @param gatewayAPI.core.httpRoute.rules Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service.
|
||||
httpRoute:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
tls: false
|
||||
parentRefs: []
|
||||
# - group: gateway.networking.k8s.io
|
||||
# kind: Gateway
|
||||
# name: shared-gateway
|
||||
# namespace: gateway-system
|
||||
# sectionName: http
|
||||
hostnames: []
|
||||
# - git.example.com
|
||||
rules: []
|
||||
|
||||
|
||||
## @param gatewayAPI.core.tcpRoute.enabled Render a TCPRoute resource (typically for SSH)
|
||||
## @param gatewayAPI.core.tcpRoute.annotations Annotations applied to the TCPRoute
|
||||
## @param gatewayAPI.core.tcpRoute.labels Additional labels applied to the TCPRoute
|
||||
## @param gatewayAPI.core.tcpRoute.parentRefs Parent gateway references (required when enabled).
|
||||
## @param gatewayAPI.core.tcpRoute.rules Custom routing rules. Defaults to a rule targeting the SSH service.
|
||||
tcpRoute:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
parentRefs: []
|
||||
# - group: gateway.networking.k8s.io
|
||||
# kind: Gateway
|
||||
# name: shared-gateway
|
||||
# namespace: gateway-system
|
||||
# sectionName: ssh
|
||||
rules: []
|
||||
|
||||
|
||||
## NGINX Gateway Fabric specific resources. Only relevant when the upstream
|
||||
## Gateway is backed by NGINX Gateway Fabric (nginx.org). Other implementations
|
||||
## (Envoy Gateway, Cilium, ...) do not impose a default request body size limit.
|
||||
nginx:
|
||||
## @param gatewayAPI.nginx.clientSettingsPolicies.enabled Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit
|
||||
## @param gatewayAPI.nginx.clientSettingsPolicies.annotations Annotations applied to the ClientSettingsPolicy
|
||||
## @param gatewayAPI.nginx.clientSettingsPolicies.labels Additional labels applied to the ClientSettingsPolicy
|
||||
## @param gatewayAPI.nginx.clientSettingsPolicies.targetRef Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute.
|
||||
## @param gatewayAPI.nginx.clientSettingsPolicies.body Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`.
|
||||
clientSettingsPolicies:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
labels: {}
|
||||
targetRef: {}
|
||||
body: {}
|
||||
# maxSize: 100m
|
||||
|
||||
## @section deployment
|
||||
#
|
||||
## @param resources Kubernetes resources
|
||||
resources: {}
|
||||
resources:
|
||||
{}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
@@ -336,9 +222,10 @@ priorityClassName: ""
|
||||
## @param deployment.labels Labels for the deployment
|
||||
## @param deployment.annotations Annotations for the Gitea deployment to be created
|
||||
deployment:
|
||||
env: []
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
env:
|
||||
[]
|
||||
# - name: VARIABLE
|
||||
# value: my-value
|
||||
terminationGracePeriodSeconds: 60
|
||||
labels: {}
|
||||
annotations: {}
|
||||
@@ -505,7 +392,8 @@ gitea:
|
||||
tlsConfig: {}
|
||||
|
||||
## @param gitea.ldap LDAP configuration
|
||||
ldap: []
|
||||
ldap:
|
||||
[]
|
||||
# - name: "LDAP 1"
|
||||
# existingSecret:
|
||||
# securityProtocol:
|
||||
@@ -522,7 +410,8 @@ gitea:
|
||||
|
||||
# Either specify inline `key` and `secret` or refer to them via `existingSecret`
|
||||
## @param gitea.oauth OAuth configuration
|
||||
oauth: []
|
||||
oauth:
|
||||
[]
|
||||
# - name: 'OAuth 1'
|
||||
# provider:
|
||||
# key:
|
||||
@@ -557,28 +446,6 @@ gitea:
|
||||
## @param gitea.additionalConfigFromEnvs Additional configuration sources from environment variables
|
||||
additionalConfigFromEnvs: []
|
||||
|
||||
## @param gitea.extraEnvSourceFile Source environment variables from a file during init container startup. This is especially useful for reading environment variable files generated by the Vault agent-injector.
|
||||
## See the sample annotations below for reference.
|
||||
## podAnnotations:
|
||||
## vault.hashicorp.com/agent-inject: "true"
|
||||
## vault.hashicorp.com/agent-init-first: "true"
|
||||
## vault.hashicorp.com/agent-inject-secret-gitea: <path/to/secret>
|
||||
## vault.hashicorp.com/agent-inject-template-gitea: |
|
||||
## {{- with secret "path/to/secret" -}}
|
||||
## export GITEA__database__HOST="{{ .Data.data.db_host }}"
|
||||
## export GITEA__database__NAME="{{ .Data.data.db_name }}"
|
||||
## export GITEA__database__USER="{{ .Data.data.db_user }}"
|
||||
## export GITEA__database__PASSWD="{{ .Data.data.db_password }}"
|
||||
## export GITEA__queue__CONN_STR="{{ .Data.data.kv_conn_string }}"
|
||||
## export GITEA__session__PROVIDER_CONFIG="{{ .Data.data.kv_conn_string }}"
|
||||
## export GITEA__cache__HOST="{{ .Data.data.kv_conn_string }}"
|
||||
## export GITEA_ADMIN_USERNAME="{{ .Data.data.gitea_admin_user }}"
|
||||
## export GITEA_ADMIN_PASSWORD="{{ .Data.data.gitea_admin_password }}"
|
||||
## {{- end }}
|
||||
|
||||
# extraEnvSourceFile: /vault/secrets/gitea
|
||||
extraEnvSourceFile:
|
||||
|
||||
## @param gitea.podAnnotations Annotations for the Gitea pod
|
||||
podAnnotations: {}
|
||||
|
||||
@@ -646,63 +513,125 @@ gitea:
|
||||
successThreshold: 1
|
||||
failureThreshold: 10
|
||||
|
||||
## @section valkey-cluster
|
||||
## @descriptionStart
|
||||
## Valkey cluster and [Valkey](#valkey) cannot be enabled at the same time.
|
||||
## @descriptionEnd
|
||||
valkey-cluster:
|
||||
## @param valkey-cluster.enabled Enable valkey cluster
|
||||
# ⚠️ The valkey charts do not work well with special characters in the password (<https://gitea.com/gitea/helm-chart/issues/690>).
|
||||
# Consider omitting such or open an issue in the Bitnami repo and let us know once this got fixed.
|
||||
## @param valkey-cluster.usePassword Whether to use password authentication.
|
||||
## @param valkey-cluster.usePasswordFiles Whether to mount passwords as files instead of environment variables.
|
||||
enabled: true
|
||||
usePassword: false
|
||||
usePasswordFiles: false
|
||||
|
||||
## @param valkey-cluster.image.repository Image repository, eg. `bitnamilegacy/valkey-cluster`.
|
||||
image:
|
||||
repository: bitnamilegacy/valkey-cluster
|
||||
|
||||
## @param valkey-cluster.cluster.nodes Number of valkey cluster master nodes
|
||||
## @param valkey-cluster.cluster.replicas Number of valkey cluster master node replicas
|
||||
cluster:
|
||||
nodes: 3 # default: 6
|
||||
replicas: 0 # default: 1
|
||||
|
||||
## @param valkey-cluster.metrics.image.repository Image repository, eg. `bitnamilegacy/redis-exporter`.
|
||||
metrics:
|
||||
image:
|
||||
repository: bitnamilegacy/redis-exporter
|
||||
|
||||
## @param valkey-cluster.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims.
|
||||
## @param valkey-cluster.persistence.storageClass Persistent Volume storage class.
|
||||
## @param valkey-cluster.persistence.size Persistent Volume size.
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: ""
|
||||
size: 8Gi
|
||||
|
||||
## @param valkey-cluster.service.ports.valkey Port of Valkey service
|
||||
service:
|
||||
ports:
|
||||
valkey: 6379
|
||||
|
||||
## @param valkey-cluster.sysctlImage.repository Image repository, eg. `bitnamilegacy/os-shell`.
|
||||
sysctlImage:
|
||||
repository: bitnamilegacy/os-shell
|
||||
|
||||
## @param valkey-cluster.volumePermissions.image.repository Image repository, eg. `bitnamilegacy/os-shell`.
|
||||
volumePermissions:
|
||||
image:
|
||||
repository: bitnamilegacy/os-shell
|
||||
|
||||
|
||||
## @section valkey
|
||||
|
||||
## @descriptionStart
|
||||
## Valkey and [Valkey cluster](#valkey-cluster) cannot be enabled at the same time.
|
||||
## @descriptionEnd
|
||||
valkey:
|
||||
## @param valkey.enabled Enable valkey standalone or replicated
|
||||
## @param valkey.architecture Whether to use standalone or replication
|
||||
enabled: false
|
||||
architecture: standalone
|
||||
|
||||
## @param valkey.image.registry Image registry
|
||||
## @param valkey.image.repository Image repository
|
||||
## @param valkey.image.tag Image tag
|
||||
## @param valkey.kubectl.image.repository Image repository, eg. `bitnamilegacy/kubectl`.
|
||||
kubectl:
|
||||
image:
|
||||
repository: bitnamilegacy/kubectl
|
||||
|
||||
## @param valkey.image.repository Image repository, eg. `bitnamilegacy/valkey`.
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: valkey/valkey
|
||||
tag: ""
|
||||
repository: bitnamilegacy/valkey
|
||||
|
||||
## @param valkey.auth.enabled Enable ACL-based authentication
|
||||
## @param valkey.auth.aclUsers.default.permissions ACL permissions for the default user
|
||||
## @param valkey.auth.aclUsers.default.password Password for the default user
|
||||
auth:
|
||||
enabled: true
|
||||
aclUsers:
|
||||
default:
|
||||
permissions: "~* &* +@all"
|
||||
password: changeme
|
||||
# ⚠️ The valkey charts do not work well with special characters in the password (<https://gitea.com/gitea/helm-chart/issues/690>).
|
||||
# Consider omitting such or open an issue in the Bitnami repo and let us know once this got fixed.
|
||||
## @param valkey.global.valkey.password Required password
|
||||
global:
|
||||
valkey:
|
||||
password: changeme
|
||||
|
||||
## @param valkey.service.port Port of Valkey service
|
||||
service:
|
||||
port: 6379
|
||||
## @param valkey.master.count Number of Valkey master instances to deploy
|
||||
## @param valkey.master.service.ports.valkey Port of Valkey service
|
||||
master:
|
||||
count: 1
|
||||
service:
|
||||
ports:
|
||||
valkey: 6379
|
||||
|
||||
## @param valkey.dataStorage.enabled Enable persistence using Persistent Volume Claims.
|
||||
## @param valkey.dataStorage.className Persistent Volume storage class.
|
||||
## @param valkey.dataStorage.requestedSize Persistent Volume size.
|
||||
dataStorage:
|
||||
enabled: false
|
||||
className: ""
|
||||
requestedSize: 8Gi
|
||||
|
||||
## @param valkey.replica.enabled Enable replication
|
||||
## @param valkey.replica.replicas Number of Valkey replica instances to deploy
|
||||
## @param valkey.replica.persistence.size Persistent Volume size for replicas.
|
||||
## @param valkey.replica.persistence.storageClass Persistent Volume storage class for replicas.
|
||||
replica:
|
||||
enabled: false
|
||||
replicas: 3
|
||||
persistence:
|
||||
size: 8Gi
|
||||
storageClass: ""
|
||||
|
||||
## @param valkey.metrics.enabled Enable Prometheus exporter sidecar
|
||||
## @param valkey.metrics.exporter.image.registry Image registry
|
||||
## @param valkey.metrics.exporter.image.repository Image repository
|
||||
## @param valkey.metrics.exporter.image.tag Image tag
|
||||
## @param valkey.metrics.image.repository Image repository, eg. `bitnamilegacy/redis-exporter`.
|
||||
metrics:
|
||||
enabled: false
|
||||
exporter:
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: oliver006/redis_exporter
|
||||
tag: ""
|
||||
image:
|
||||
repository: bitnamilegacy/redis-exporter
|
||||
|
||||
primary:
|
||||
## @param valkey.primary.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims.
|
||||
## @param valkey.primary.persistence.storageClass Persistent Volume storage class.
|
||||
## @param valkey.primary.persistence.size Persistent Volume size.
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: ""
|
||||
size: 8Gi
|
||||
|
||||
replica:
|
||||
## @param valkey.replica.persistence.enabled Enable persistence on Valkey replicas nodes using Persistent Volume Claims.
|
||||
## @param valkey.replica.persistence.storageClass Persistent Volume storage class.
|
||||
## @param valkey.replica.persistence.size Persistent Volume size.
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: ""
|
||||
size: 8Gi
|
||||
|
||||
## @param valkey.sentinel.image.repository Image repository, eg. `bitnamilegacy/sentinel`.
|
||||
sentinel:
|
||||
image:
|
||||
repository: bitnamilegacy/valkey-sentinel
|
||||
|
||||
## @param valkey.volumePermissions.image.repository Image repository, eg. `bitnamilegacy/os-shell`.
|
||||
volumePermissions:
|
||||
image:
|
||||
repository: bitnamilegacy/os-shell
|
||||
|
||||
## @section PostgreSQL HA
|
||||
postgresql-ha:
|
||||
|
||||
Reference in New Issue
Block a user