volker.raschekandCopilot
1b82a15b7f
The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade orchestration that a dedicated operator already solves. CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management, streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can be managed independently. Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users of `postgresql` or an external database are therefore unaffected. Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as `GITEA__database__PASSWD` instead of being written into the generated `app.ini`. BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with `pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog. Co-authored-by: Copilot <copilot@github.com>
76 lines
5.2 KiB
Markdown
76 lines
5.2 KiB
Markdown
# Gitea Helm Chart — Copilot Instructions
|
|
|
|
## Project Overview
|
|
|
|
Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, Valkey, and Valkey-cluster. The HA-ready database is provisioned as a CloudNativePG `Cluster` resource, the operator itself is not part of the chart.
|
|
|
|
## Build & Test
|
|
|
|
```bash
|
|
make missing-dot # Check if the @param annotations are missing a trailing dot.
|
|
make readme # Regenerate README.md parameter table + lint + link checker
|
|
make helm/unittest # Run Helm unit tests (helm-unittest plugin required)
|
|
make bash/unittest # Run bash/bats script tests (requires git submodule init)
|
|
```
|
|
|
|
Always run `make readme` after changing `values.yaml` `@param` annotations.
|
|
Always run `make helm/unittest` after changing templates or unit tests.
|
|
|
|
## Conventions
|
|
|
|
### values.yaml
|
|
|
|
- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
|
|
- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
|
|
- Top-level keys are sorted alphabetically within their section group.
|
|
- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
|
|
|
|
```yaml
|
|
image:
|
|
registry: docker.io
|
|
repository: library/busybox
|
|
tag: 0.1.0
|
|
```
|
|
|
|
### Templates
|
|
|
|
- Helm templates live in `templates/`. Helpers live in `templates/_helpers.tpl`.
|
|
- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
|
|
- Use `include "gitea.fullname"` for naming resources.
|
|
- Use `fail` for required-value validation with clear error messages referencing the full values path.
|
|
- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
|
|
- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
|
|
- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
|
|
- Use as prefix of YAML files the resource kind (e.g., `deployment.yaml` for `Deployment` resources). If there are multiple resources of the same kind, use a descriptive suffix (e.g., `deployment_metrics.yaml` for a `Deployment` related to metrics).
|
|
- Short names like `pvc` for Persistent Volume Claims or `svc` for Services are not allowed in file names or key names.
|
|
- Render `Secret` payloads as base64 `data` and never as `stringData`. The API server drops `stringData` and persists everything under `data`, so Helm's three-way merge cannot prune a key that was removed from the values — the stale key survives every upgrade. For example:
|
|
|
|
```yaml
|
|
data:
|
|
app.ini: {{ $config | b64enc }}
|
|
```
|
|
|
|
### Unit Tests
|
|
|
|
- Helm unit tests live in `unittests/helm/` mirroring the template structure. A suite belongs into the directory of the template it asserts on, never into the directory of a template it only renders as a side effect.
|
|
- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
|
|
- Name test files in camelCase after the scenario they cover (e.g. `signingEnabled.yaml`), use `basics.yaml` for the default scenario and do not repeat the directory name in the file name. The `make helm/unittest` glob only matches one directory level, so every suite must live in a subdirectory.
|
|
- Each test must set all required values explicitly — do not rely on cross-test state.
|
|
- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint.yaml`. Use `make yamllint` to run the linter.
|
|
- The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
|
|
- The `suite` title follows the pattern `Test <subject> <scenario>` (e.g. `Test deployment probes`). It must be unique across all suites, because `helm unittest` identifies a failing suite by this title.
|
|
- Each unit test must explicitly set a custom namespace and release name, rather than relying on defaults.
|
|
- Assert `Secret` content via `data.*` with `decodeBase64: true` and add a `notExists` assertion for `stringData`.
|
|
|
|
### Commits & PRs
|
|
|
|
- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
|
|
- See `CONTRIBUTING.md` for full PR requirements.
|
|
- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
|
|
- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
|
|
|
|
### Documentation
|
|
|
|
- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
|
|
- `README.md` parameter tables are auto-generated — never edit them manually.
|