volker.raschekandCopilot
00ccfc6734
`securityContext` was deprecated when the chart split it into a pod-level and a container-level value. It only ever acted as a fallback for the runtime container: when the container-level value was empty, the deprecated map was used instead. That fallback silently changed behaviour depending on whether an unrelated value happened to be set, and it kept a third security-related values path alive next to `deployment.securityContext` and `deployment.gitea.securityContext`. With the fallback gone, `gitea.runtimeContainerSecurityContext` was identical to `gitea.containerSecurityContext`, so the helper was dropped and the Gitea container now reuses the shared one. A deprecation check fails the render when the removed value is still set, because silently ignoring it would drop `runAsUser`, `runAsNonRoot` or the capability set and let the container run with weaker restrictions than intended. BREAKING CHANGE: `securityContext` no longer exists. Use `deployment.securityContext` for the pod-level and `deployment.gitea.securityContext` for the container-level security context. Installations that still set `securityContext` will fail to render unless `checkDeprecation` is set to `false`. Co-authored-by: Copilot <copilot@github.com>
157 lines
5.6 KiB
YAML
157 lines
5.6 KiB
YAML
suite: deprecation template (deployment)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/gitea/deprecation.yaml
|
|
tests:
|
|
- it: renders nothing with the default values
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|
|
- it: fails when the removed `affinity` value is set
|
|
set:
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/os
|
|
operator: In
|
|
values:
|
|
- linux
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead."
|
|
- it: fails when the removed `containerSecurityContext` value is set
|
|
set:
|
|
containerSecurityContext:
|
|
runAsUser: 1000
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead."
|
|
- it: fails when the removed `deployment.env` value is set
|
|
set:
|
|
deployment.env:
|
|
- name: VARIABLE
|
|
value: my-value
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead."
|
|
- it: fails when the removed `dnsConfig` value is set
|
|
set:
|
|
dnsConfig:
|
|
nameservers:
|
|
- 192.0.2.1
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead."
|
|
- it: fails when the removed `nodeSelector` value is set
|
|
set:
|
|
nodeSelector:
|
|
foo: bar
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead."
|
|
- it: fails when the removed `priorityClassName` value is set
|
|
set:
|
|
priorityClassName: high-priority
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead."
|
|
- it: fails when the removed `podSecurityContext` value is set
|
|
set:
|
|
podSecurityContext:
|
|
fsGroup: 1000
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead."
|
|
- it: fails when the removed `resources` value is set
|
|
set:
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead."
|
|
- it: fails when the removed `replicaCount` value is set
|
|
set:
|
|
replicaCount: 2
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead."
|
|
- it: fails when the removed `schedulerName` value is set
|
|
set:
|
|
schedulerName: stork
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead."
|
|
- it: fails when the removed `securityContext` value is set
|
|
set:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead."
|
|
- it: fails when the removed `strategy` value is set
|
|
set:
|
|
strategy:
|
|
type: Recreate
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead."
|
|
- it: fails when the removed `tolerations` value is set
|
|
set:
|
|
tolerations:
|
|
- key: database/type
|
|
operator: Equal
|
|
value: postgres
|
|
effect: NoSchedule
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead."
|
|
- it: fails when the removed `topologySpreadConstraints` value is set
|
|
set:
|
|
topologySpreadConstraints:
|
|
- topologyKey: kubernetes.io/hostname
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead."
|
|
- it: skips the deprecation checks when `checkDeprecation` is disabled
|
|
set:
|
|
checkDeprecation: false
|
|
affinity:
|
|
nodeAffinity: {}
|
|
containerSecurityContext:
|
|
runAsUser: 1000
|
|
deployment.env:
|
|
- name: VARIABLE
|
|
value: my-value
|
|
dnsConfig:
|
|
nameservers:
|
|
- 192.0.2.1
|
|
nodeSelector:
|
|
foo: bar
|
|
podSecurityContext:
|
|
fsGroup: 1000
|
|
priorityClassName: high-priority
|
|
replicaCount: 2
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
schedulerName: stork
|
|
securityContext:
|
|
runAsUser: 1000
|
|
strategy:
|
|
type: Recreate
|
|
tolerations:
|
|
- key: database/type
|
|
operator: Equal
|
|
value: postgres
|
|
effect: NoSchedule
|
|
topologySpreadConstraints:
|
|
- topologyKey: kubernetes.io/hostname
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|