volker.raschekandCopilot
e8f3a058ce
The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources, security context and volume mounts could not be adjusted individually, and custom init containers could only be prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`. The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a free-form `container` definition. This allows custom containers at any position and makes the execution order explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to `deployment.gitea.securityContext` and `initContainers.resources` when unset. To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an arbitrary `image` dict instead of only `deployment.gitea.image`. The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their pre-upgrade state during rendering. Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering (`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The trade-offs are documented in the README so users can make an informed decision. BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a `container` key before or after the linked init containers in `deployment.initContainers` instead. BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep the rollout trigger on Secret changes. Co-authored-by: Copilot <copilot@github.com>
207 lines
6.1 KiB
Smarty
207 lines
6.1 KiB
Smarty
{{/* vim: set filetype=mustache: */}}
|
|
|
|
{{/* annotations */}}
|
|
|
|
{{- define "gitea.secret.admin.annotations" -}}
|
|
{{- with .Values.secrets.admin.new.annotations }}
|
|
{{- toYaml . -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.config.annotations" -}}
|
|
{{- with .Values.secrets.config.new.annotations }}
|
|
{{- toYaml . -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.gpg.annotations" -}}
|
|
{{- with .Values.secrets.gpg.new.annotations }}
|
|
{{- toYaml . -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.init.annotations" -}}
|
|
{{- with .Values.secrets.init.new.annotations }}
|
|
{{- toYaml . -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.inlineConfig.annotations" -}}
|
|
{{- with .Values.secrets.inlineConfig.new.annotations }}
|
|
{{- toYaml . -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.metrics.annotations" -}}
|
|
{{- with .Values.secrets.metrics.new.annotations }}
|
|
{{- toYaml . -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/* checksums */}}
|
|
|
|
{{/*
|
|
SHA sum of a Secret, used to trigger a rollout whenever its content changes.
|
|
User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
|
|
cluster still holds their pre-upgrade state.
|
|
Arguments: (list $root $key)
|
|
*/}}
|
|
{{- define "gitea.secret.checksum" -}}
|
|
{{- $root := index . 0 -}}
|
|
{{- $key := index . 1 -}}
|
|
{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
|
|
{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
|
|
{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
|
|
{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
|
|
{{- else -}}
|
|
{{- include (printf "%s/gitea/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
|
|
{{/* labels */}}
|
|
|
|
{{- define "gitea.secret.admin.labels" -}}
|
|
{{ include "gitea.labels" . }}
|
|
{{- with .Values.secrets.admin.new.labels }}
|
|
{{ toYaml . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.config.labels" -}}
|
|
{{ include "gitea.labels" . }}
|
|
{{- with .Values.secrets.config.new.labels }}
|
|
{{ toYaml . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.gpg.labels" -}}
|
|
{{ include "gitea.labels" . }}
|
|
{{- with .Values.secrets.gpg.new.labels }}
|
|
{{ toYaml . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.init.labels" -}}
|
|
{{ include "gitea.labels" . }}
|
|
{{- with .Values.secrets.init.new.labels }}
|
|
{{ toYaml . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.inlineConfig.labels" -}}
|
|
{{ include "gitea.labels" . }}
|
|
{{- with .Values.secrets.inlineConfig.new.labels }}
|
|
{{ toYaml . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.metrics.labels" -}}
|
|
{{ include "gitea.labels" . }}
|
|
{{- with .Values.secrets.metrics.new.labels }}
|
|
{{ toYaml . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/* names */}}
|
|
|
|
{{- define "gitea.secret.admin.name" -}}
|
|
{{- if .Values.secrets.admin.existingSecret.enabled -}}
|
|
{{ required "`secrets.admin.existingSecret.secretName` must be set when `secrets.admin.existingSecret.enabled` is enabled" .Values.secrets.admin.existingSecret.secretName }}
|
|
{{- else -}}
|
|
{{ include "gitea.fullname" . }}-admin
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.config.name" -}}
|
|
{{- if .Values.secrets.config.existingSecret.enabled -}}
|
|
{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
|
|
{{- else -}}
|
|
{{ include "gitea.fullname" . }}-config
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.gpg.name" -}}
|
|
{{- if .Values.secrets.gpg.existingSecret.enabled -}}
|
|
{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
|
|
{{- else -}}
|
|
{{ include "gitea.fullname" . }}-gpg-key
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.init.name" -}}
|
|
{{- if .Values.secrets.init.existingSecret.enabled -}}
|
|
{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }}
|
|
{{- else -}}
|
|
{{ include "gitea.fullname" . }}-init
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.inlineConfig.name" -}}
|
|
{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}}
|
|
{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }}
|
|
{{- else -}}
|
|
{{ include "gitea.fullname" . }}-inline-config
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.metrics.name" -}}
|
|
{{- if .Values.secrets.metrics.existingSecret.enabled -}}
|
|
{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }}
|
|
{{- else -}}
|
|
{{ include "gitea.fullname" . }}-metrics
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{/* keys */}}
|
|
|
|
{{- define "gitea.secret.admin.emailKey" -}}
|
|
{{- if .Values.secrets.admin.existingSecret.enabled -}}
|
|
{{ .Values.secrets.admin.existingSecret.emailKey }}
|
|
{{- else -}}
|
|
email
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.admin.passwordKey" -}}
|
|
{{- if .Values.secrets.admin.existingSecret.enabled -}}
|
|
{{ .Values.secrets.admin.existingSecret.passwordKey }}
|
|
{{- else -}}
|
|
password
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.admin.usernameKey" -}}
|
|
{{- if .Values.secrets.admin.existingSecret.enabled -}}
|
|
{{ .Values.secrets.admin.existingSecret.usernameKey }}
|
|
{{- else -}}
|
|
username
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.gpg.gpgHomeKey" -}}
|
|
{{- if .Values.secrets.gpg.existingSecret.enabled -}}
|
|
{{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
|
|
{{- else -}}
|
|
gpgHome
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.secret.gpg.privateKeyKey" -}}
|
|
{{- if .Values.secrets.gpg.existingSecret.enabled -}}
|
|
{{ .Values.secrets.gpg.existingSecret.privateKeyKey }}
|
|
{{- else -}}
|
|
privateKey
|
|
{{- end -}}
|
|
{{- end }}
|
|
|
|
{{/* misc */}}
|
|
|
|
{{- define "gitea.secret.admin.passwordMode" -}}
|
|
{{- if has .Values.secrets.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
|
|
{{ .Values.secrets.admin.passwordMode }}
|
|
{{- else -}}
|
|
{{ printf "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.secrets.admin.passwordMode | fail }}
|
|
{{- end -}}
|
|
{{- end }}
|