volker.raschekandCopilot
1b82a15b7f
The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade orchestration that a dedicated operator already solves. CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management, streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can be managed independently. Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users of `postgresql` or an external database are therefore unaffected. Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as `GITEA__database__PASSWD` instead of being written into the generated `app.ini`. BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with `pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog. Co-authored-by: Copilot <copilot@github.com>
59 lines
2.6 KiB
YAML
59 lines
2.6 KiB
YAML
{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
|
|
{{- $assertions := include "gitea.config.assertions" . -}}
|
|
{{- if not .Values.secrets.config.existingSecret.enabled -}}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
{{- with (include "gitea.secret.config.annotations" .) }}
|
|
annotations:
|
|
{{- . | nindent 4 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "gitea.secret.config.labels" . | nindent 4 }}
|
|
name: {{ include "gitea.secret.config.name" . }}
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
type: Opaque
|
|
data:
|
|
{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
|
|
assertions: {{ $assertions | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.config.assertions" -}}
|
|
|
|
{{- /*assert that only one PG dep is enabled */ -}}
|
|
{{- if and (.Values.postgresql.enabled) (.Values.cloudnativePG.enabled) -}}
|
|
{{- fail "Only one of postgresql or cloudnativePG can be enabled at the same time." -}}
|
|
{{- end }}
|
|
|
|
{{- /* multiple replicas assertions */ -}}
|
|
{{- if gt (.Values.deployment.replicas | int) 1 -}}
|
|
{{- if .Values.gitea.config.cron -}}
|
|
{{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
|
|
{{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
|
|
{{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if eq (first .Values.persistence.new.accessModes) "ReadWriteOnce" -}}
|
|
{{- fail "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany." -}}
|
|
{{- end }}
|
|
{{- if .Values.gitea.config.indexer -}}
|
|
{{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
|
|
{{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
|
|
{{- end }}
|
|
{{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
|
|
{{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
|
|
{{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
|
|
{{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
|
|
{{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- end }}
|
|
{{- end }}
|