volker.raschekandCopilot
229ba12744
The admin user was the last piece of credential handling that lived outside of the `secrets` section. Worse, it was the
only credential the chart rendered as a plain environment variable value into the Deployment: unless an existing Secret
was referenced, username and password ended up in the pod spec in clear text, readable by anyone who can `get` or
`describe` the Deployment.
`gitea.admin` is therefore removed and fully replaced by `secrets.admin`:
gitea.admin.username -> secrets.admin.new.username
gitea.admin.password -> secrets.admin.new.password
gitea.admin.email -> secrets.admin.new.email
gitea.admin.passwordMode -> secrets.admin.passwordMode
gitea.admin.existingSecret -> secrets.admin.existingSecret.{enabled,secretName}
The chart now always creates a dedicated `<fullname>-admin` Secret and the Deployment consumes `GITEA_ADMIN_USERNAME`,
`GITEA_ADMIN_PASSWORD` and `GITEA_ADMIN_EMAIL` via `secretKeyRef`. This removes the clear text credentials from the pod
spec and makes the chart-managed and the externally provided case behave identically, which previously diverged.
The email address moved into the Secret as well. It used to be interpolated directly into the init script, so changing
it rewrote the init Secret, and an operator handing over admin credentials could not supply it. The key names of an
externally provided Secret are configurable via `secrets.admin.existingSecret.{emailKey,passwordKey,usernameKey}`,
because chart-defined key names cannot be assumed for Secrets managed by an external system such as a secret store.
Admin handling was previously skipped implicitly when neither an existing Secret nor a username and password were set.
This implicit behaviour is replaced by the explicit `secrets.admin.enabled` flag, so disabling it no longer requires
blanking out unrelated values.
`gitea.admin.passwordMode` validation moved from `_helpers.tpl` to `_secrets.tpl` as
`gitea.secret.admin.passwordMode` to keep all Secret related helpers in one place. `deprecation.yaml` fails the render
when `gitea.admin` is still set and points to `secrets.admin`.
New test suites cover the rendered admin Secret, the `secretKeyRef` wiring, custom key names of an existing Secret and
the password mode validation. The `secret_admin.yaml` template is registered in every suite that renders the Deployment,
as helm-unittest requires templates referenced via `$.Template.BasePath` to be listed explicitly.
BREAKING CHANGE: The `gitea.admin` object has been removed and is replaced by `secrets.admin`. Rendering fails if
`gitea.admin` is still set. Secrets referenced via `secrets.admin.existingSecret` now additionally require an `email`
key next to `username` and `password`.
Co-authored-by: Copilot <copilot@github.com>
933 lines
38 KiB
YAML
933 lines
38 KiB
YAML
# Default values for gitea.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
## @section Global
|
|
#
|
|
## @param global.imageRegistry global image registry override
|
|
## @param global.imagePullSecrets global image pull secrets override; can be extended by `imagePullSecrets`
|
|
## @param global.storageClass global storage class override
|
|
## @param global.hostAliases global hostAliases which will be added to the pod's hosts files
|
|
global:
|
|
imageRegistry: ""
|
|
## E.g.
|
|
## imagePullSecrets:
|
|
## - myRegistryKeySecretName
|
|
##
|
|
imagePullSecrets: []
|
|
storageClass: ""
|
|
hostAliases: []
|
|
# - ip: 192.168.137.2
|
|
# hostnames:
|
|
# - example.com
|
|
|
|
## @param namespace An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified
|
|
namespace: ""
|
|
|
|
## @param replicaCount number of replicas for the deployment
|
|
replicaCount: 1
|
|
|
|
## @section strategy
|
|
## @param strategy.type strategy type
|
|
## @param strategy.rollingUpdate.maxSurge maxSurge
|
|
## @param strategy.rollingUpdate.maxUnavailable maxUnavailable
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
rollingUpdate:
|
|
maxSurge: "100%"
|
|
maxUnavailable: 0
|
|
|
|
## @param clusterDomain cluster domain
|
|
clusterDomain: cluster.local
|
|
|
|
## @section Image
|
|
## @param image.registry image registry, e.g. gcr.io,docker.io
|
|
## @param image.repository Image to start for this pod
|
|
## @param image.tag Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.
|
|
## @param image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
|
## @param image.pullPolicy Image pull policy
|
|
## @param image.rootless Wether or not to pull the rootless version of Gitea, only works on Gitea 1.14.x or higher
|
|
## @param image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).**
|
|
image:
|
|
registry: "docker.gitea.com"
|
|
repository: gitea
|
|
# Overrides the image tag whose default is the chart appVersion.
|
|
tag: ""
|
|
digest: ""
|
|
pullPolicy: IfNotPresent
|
|
rootless: true
|
|
fullOverride: ""
|
|
|
|
## @param imagePullSecrets Secret to use for pulling the image
|
|
imagePullSecrets: []
|
|
|
|
## @section Security
|
|
# Security context is only usable with rootless image due to image design
|
|
## @param openshift.enabled Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API.
|
|
## @param openshift.hostUsers Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used.
|
|
openshift:
|
|
enabled: null
|
|
hostUsers: null
|
|
|
|
## @param podSecurityContext Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty.
|
|
podSecurityContext: {}
|
|
|
|
## @param containerSecurityContext Security context
|
|
containerSecurityContext: {}
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# # Add the SYS_CHROOT capability for root and rootless images if you intend to
|
|
# # run pods on nodes that use the container runtime cri-o. Otherwise, you will
|
|
# # get an error message from the SSH server that it is not possible to read from
|
|
# # the repository.
|
|
# # https://gitea.com/gitea/helm-gitea/issues/161
|
|
# add:
|
|
# - SYS_CHROOT
|
|
# privileged: false
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 1000
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
## @deprecated The securityContext variable has been split two:
|
|
## - containerSecurityContext
|
|
## - podSecurityContext.
|
|
## @param securityContext Run init and Gitea containers as a specific securityContext
|
|
securityContext: {}
|
|
|
|
## @param podDisruptionBudget Pod disruption budget
|
|
podDisruptionBudget: {}
|
|
# maxUnavailable: 1
|
|
# minAvailable: 1
|
|
|
|
## @section Service
|
|
service:
|
|
## @param service.http.type Kubernetes service type for web traffic
|
|
## @param service.http.port Port number for web traffic
|
|
## @param service.http.clusterIP ClusterIP setting for http autosetup for deployment is None
|
|
## @param service.http.loadBalancerIP LoadBalancer IP setting
|
|
## @param service.http.nodePort NodePort for http service
|
|
## @param service.http.externalTrafficPolicy If `service.http.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation
|
|
## @param service.http.externalIPs External IPs for service
|
|
## @param service.http.ipFamilyPolicy HTTP service dual-stack policy
|
|
## @param service.http.ipFamilies HTTP service dual-stack familiy selection,for dual-stack parameters see official kubernetes [dual-stack concept documentation](https://kubernetes.io/docs/concepts/services-networking/dual-stack/).
|
|
## @param service.http.loadBalancerSourceRanges Source range filter for http loadbalancer
|
|
## @param service.http.annotations HTTP service annotations
|
|
## @param service.http.labels HTTP service additional labels
|
|
## @param service.http.loadBalancerClass Loadbalancer class
|
|
http:
|
|
type: ClusterIP
|
|
port: 3000
|
|
clusterIP: None
|
|
loadBalancerIP:
|
|
nodePort:
|
|
externalTrafficPolicy:
|
|
externalIPs:
|
|
ipFamilyPolicy:
|
|
ipFamilies:
|
|
loadBalancerSourceRanges: []
|
|
annotations: {}
|
|
labels: {}
|
|
loadBalancerClass:
|
|
## @param service.ssh.type Kubernetes service type for ssh traffic
|
|
## @param service.ssh.port Port number for ssh traffic
|
|
## @param service.ssh.clusterIP ClusterIP setting for ssh autosetup for deployment is None
|
|
## @param service.ssh.loadBalancerIP LoadBalancer IP setting
|
|
## @param service.ssh.nodePort NodePort for ssh service
|
|
## @param service.ssh.externalTrafficPolicy If `service.ssh.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation
|
|
## @param service.ssh.externalIPs External IPs for service
|
|
## @param service.ssh.ipFamilyPolicy SSH service dual-stack policy
|
|
## @param service.ssh.ipFamilies SSH service dual-stack familiy selection,for dual-stack parameters see official kubernetes [dual-stack concept documentation](https://kubernetes.io/docs/concepts/services-networking/dual-stack/).
|
|
## @param service.ssh.hostPort HostPort for ssh service
|
|
## @param service.ssh.loadBalancerSourceRanges Source range filter for ssh loadbalancer
|
|
## @param service.ssh.annotations SSH service annotations
|
|
## @param service.ssh.labels SSH service additional labels
|
|
## @param service.ssh.loadBalancerClass Loadbalancer class
|
|
ssh:
|
|
type: ClusterIP
|
|
port: 22
|
|
clusterIP: None
|
|
loadBalancerIP:
|
|
nodePort:
|
|
externalTrafficPolicy:
|
|
externalIPs:
|
|
ipFamilyPolicy:
|
|
ipFamilies:
|
|
hostPort:
|
|
loadBalancerSourceRanges: []
|
|
annotations: {}
|
|
labels: {}
|
|
loadBalancerClass:
|
|
|
|
## @section Ingress
|
|
## @param ingress.enabled Enable ingress
|
|
## @param ingress.className DEPRECATED: Ingress class name.
|
|
## @param ingress.pathType Ingress Path Type
|
|
## @param ingress.annotations Ingress annotations
|
|
## @param ingress.hosts[0].host Default Ingress host
|
|
## @param ingress.hosts[0].paths[0].path Default Ingress path
|
|
## @param ingress.tls Ingress tls settings
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
pathType: Prefix
|
|
annotations: {}
|
|
hosts:
|
|
- host: git.example.com
|
|
paths:
|
|
- path: /
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - git.example.com
|
|
|
|
## @section Route
|
|
## @param route.enabled Enable OpenShift Route
|
|
## @param route.annotations Route annotations
|
|
## @param route.host Route host. When unset, OpenShift may generate one and Gitea URL defaults fall back to ingress/service values.
|
|
## @param route.path Route path
|
|
## @param route.wildcardPolicy Route wildcard policy
|
|
## @param route.tls.termination Route TLS termination type
|
|
## @param route.tls.insecureEdgeTerminationPolicy Route insecure edge termination policy
|
|
## @param route.tls.key Route TLS key
|
|
## @param route.tls.certificate Route TLS certificate
|
|
## @param route.tls.caCertificate Route TLS CA certificate
|
|
## @param route.tls.destinationCACertificate Route destination CA certificate
|
|
route:
|
|
enabled: false
|
|
annotations: {}
|
|
host: ""
|
|
path: ""
|
|
wildcardPolicy: None
|
|
tls:
|
|
termination:
|
|
insecureEdgeTerminationPolicy:
|
|
key:
|
|
certificate:
|
|
caCertificate:
|
|
destinationCACertificate:
|
|
|
|
## @section Gateway API
|
|
## See docs/gateway-api.md for full guidance.
|
|
gatewayAPI:
|
|
## @param gatewayAPI.enabled Enable deployment of Gateway API resources
|
|
enabled: false
|
|
|
|
core:
|
|
## @param gatewayAPI.core.backendTLSPolicy.enabled Render a BackendTLSPolicy resource for encrypted backend traffic
|
|
## @param gatewayAPI.core.backendTLSPolicy.annotations Annotations applied to the BackendTLSPolicy
|
|
## @param gatewayAPI.core.backendTLSPolicy.labels Additional labels applied to the BackendTLSPolicy
|
|
## @param gatewayAPI.core.backendTLSPolicy.targetRefs Target references for the BackendTLSPolicy. Defaults to the HTTP service.
|
|
## @param gatewayAPI.core.backendTLSPolicy.validation Validation configuration (required when enabled). See `docs/gateway-api.md`.
|
|
## @extra gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`.
|
|
## @extra gatewayAPI.core.backendTLSPolicy.validation.hostname Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`.
|
|
backendTLSPolicy:
|
|
enabled: false
|
|
annotations: {}
|
|
labels: {}
|
|
targetRefs: []
|
|
validation: {}
|
|
# caCertificateRefs:
|
|
# - name: gitea-ca
|
|
# group: ""
|
|
# kind: ConfigMap
|
|
# hostname: gitea-http
|
|
|
|
## @param gatewayAPI.core.httpRoute.enabled Render an HTTPRoute resource
|
|
## @param gatewayAPI.core.httpRoute.annotations Annotations applied to the HTTPRoute
|
|
## @param gatewayAPI.core.httpRoute.labels Additional labels applied to the HTTPRoute
|
|
## @param gatewayAPI.core.httpRoute.tls When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`.
|
|
## @param gatewayAPI.core.httpRoute.parentRefs Parent gateway references (required when enabled).
|
|
## @param gatewayAPI.core.httpRoute.hostnames List of hostnames for the HTTPRoute.
|
|
## @param gatewayAPI.core.httpRoute.rules Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service.
|
|
httpRoute:
|
|
enabled: false
|
|
annotations: {}
|
|
labels: {}
|
|
tls: false
|
|
parentRefs: []
|
|
# - group: gateway.networking.k8s.io
|
|
# kind: Gateway
|
|
# name: shared-gateway
|
|
# namespace: gateway-system
|
|
# sectionName: http
|
|
hostnames: []
|
|
# - git.example.com
|
|
rules: []
|
|
|
|
|
|
## @param gatewayAPI.core.tcpRoute.enabled Render a TCPRoute resource (typically for SSH)
|
|
## @param gatewayAPI.core.tcpRoute.annotations Annotations applied to the TCPRoute
|
|
## @param gatewayAPI.core.tcpRoute.labels Additional labels applied to the TCPRoute
|
|
## @param gatewayAPI.core.tcpRoute.parentRefs Parent gateway references (required when enabled).
|
|
## @param gatewayAPI.core.tcpRoute.rules Custom routing rules. Defaults to a rule targeting the SSH service.
|
|
tcpRoute:
|
|
enabled: false
|
|
annotations: {}
|
|
labels: {}
|
|
parentRefs: []
|
|
# - group: gateway.networking.k8s.io
|
|
# kind: Gateway
|
|
# name: shared-gateway
|
|
# namespace: gateway-system
|
|
# sectionName: ssh
|
|
rules: []
|
|
|
|
|
|
## NGINX Gateway Fabric specific resources. Only relevant when the upstream
|
|
## Gateway is backed by NGINX Gateway Fabric (nginx.org). Other implementations
|
|
## (Envoy Gateway, Cilium, ...) do not impose a default request body size limit.
|
|
nginx:
|
|
## @param gatewayAPI.nginx.clientSettingsPolicies.enabled Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit
|
|
## @param gatewayAPI.nginx.clientSettingsPolicies.annotations Annotations applied to the ClientSettingsPolicy
|
|
## @param gatewayAPI.nginx.clientSettingsPolicies.labels Additional labels applied to the ClientSettingsPolicy
|
|
## @param gatewayAPI.nginx.clientSettingsPolicies.targetRef Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute.
|
|
## @param gatewayAPI.nginx.clientSettingsPolicies.body Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`.
|
|
clientSettingsPolicies:
|
|
enabled: false
|
|
annotations: {}
|
|
labels: {}
|
|
targetRef: {}
|
|
body: {}
|
|
# maxSize: 100m
|
|
|
|
## @section deployment
|
|
#
|
|
## @param resources Kubernetes resources
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
## Use an alternate scheduler, e.g. "stork".
|
|
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
|
|
##
|
|
## @param schedulerName Use an alternate scheduler, e.g. "stork"
|
|
schedulerName: ""
|
|
|
|
## @param nodeSelector NodeSelector for the deployment
|
|
nodeSelector: {}
|
|
|
|
## @param tolerations Tolerations for the deployment
|
|
tolerations: []
|
|
|
|
## @param affinity Affinity for the deployment
|
|
affinity: {}
|
|
|
|
## @param topologySpreadConstraints TopologySpreadConstraints for the deployment
|
|
topologySpreadConstraints: []
|
|
|
|
## @param dnsConfig dnsConfig for the deployment
|
|
dnsConfig: {}
|
|
|
|
## @param priorityClassName priorityClassName for the deployment
|
|
priorityClassName: ""
|
|
|
|
## @param deployment.env Additional environment variables to pass to containers
|
|
## @param deployment.terminationGracePeriodSeconds How long to wait until forcefully kill the pod
|
|
## @param deployment.labels Labels for the deployment
|
|
## @param deployment.annotations Annotations for the Gitea deployment to be created
|
|
deployment:
|
|
env: []
|
|
# - name: VARIABLE
|
|
# value: my-value
|
|
terminationGracePeriodSeconds: 60
|
|
labels: {}
|
|
annotations: {}
|
|
|
|
## @section Secret
|
|
secrets:
|
|
admin:
|
|
## @param secrets.admin.enabled Create and keep the Gitea admin user in sync
|
|
enabled: true
|
|
|
|
## @param secrets.admin.addSHASumAnnotation Add a pod annotation with the SHA sum of the admin Secret to trigger a rollout on change
|
|
addSHASumAnnotation: true
|
|
|
|
## @param secrets.admin.passwordMode Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated
|
|
passwordMode: keepUpdated
|
|
|
|
## @param secrets.admin.existingSecret.enabled Use an already existing Secret instead of creating the admin Secret
|
|
## @param secrets.admin.existingSecret.secretName Name of the already existing admin Secret
|
|
## @param secrets.admin.existingSecret.emailKey Key of the email address in the existing admin Secret
|
|
## @param secrets.admin.existingSecret.passwordKey Key of the password in the existing admin Secret
|
|
## @param secrets.admin.existingSecret.usernameKey Key of the username in the existing admin Secret
|
|
existingSecret:
|
|
enabled: false
|
|
secretName: ""
|
|
emailKey: email
|
|
passwordKey: password
|
|
usernameKey: username
|
|
|
|
## @param secrets.admin.new.annotations Annotations for the admin Secret
|
|
## @param secrets.admin.new.labels Labels for the admin Secret
|
|
## @param secrets.admin.new.email Email of the Gitea admin user
|
|
## @param secrets.admin.new.password Password of the Gitea admin user
|
|
## @param secrets.admin.new.username Username of the Gitea admin user
|
|
new:
|
|
annotations: {}
|
|
labels: {}
|
|
email: gitea@local.domain
|
|
password: r8sA8CPHD9!bt6d
|
|
username: gitea_admin
|
|
|
|
config:
|
|
## @param secrets.config.addSHASumAnnotation Add a pod annotation with the SHA sum of the config Secret to trigger a rollout on change
|
|
addSHASumAnnotation: true
|
|
|
|
## @param secrets.config.existingSecret.enabled Use an already existing Secret instead of creating the config Secret
|
|
## @param secrets.config.existingSecret.secretName Name of the already existing config Secret
|
|
existingSecret:
|
|
enabled: false
|
|
secretName: ""
|
|
|
|
## @param secrets.config.new.annotations Annotations for the config Secret
|
|
## @param secrets.config.new.labels Labels for the config Secret
|
|
new:
|
|
annotations: {}
|
|
labels: {}
|
|
|
|
gpg:
|
|
## @param secrets.gpg.enabled Enable mounting of a GPG key to sign git commits.
|
|
enabled: false
|
|
|
|
## @param secrets.gpg.addSHASumAnnotation Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change
|
|
addSHASumAnnotation: true
|
|
|
|
## @param secrets.gpg.existingSecret.enabled Use an already existing Secret instead of creating the GPG key Secret
|
|
## @param secrets.gpg.existingSecret.secretName Name of the already existing GPG key Secret
|
|
## @param secrets.gpg.existingSecret.gpgHomeKey Key of the GPG home directory in the existing GPG key Secret
|
|
## @param secrets.gpg.existingSecret.privateKeyKey Key of the private key in the existing GPG key Secret.
|
|
existingSecret:
|
|
enabled: false
|
|
secretName: ""
|
|
gpgHomeKey: gpgHome
|
|
privateKeyKey: privateKey
|
|
|
|
## @param secrets.gpg.new.annotations Annotations for the GPG key Secret
|
|
## @param secrets.gpg.new.labels Labels for the GPG key Secret
|
|
## @param secrets.gpg.new.gpgHome Path to the GPG home directory.
|
|
## @param secrets.gpg.new.privateKey Content of the private GPG key in armored format.
|
|
new:
|
|
annotations: {}
|
|
labels: {}
|
|
gpgHome: /data/git/.gnupg
|
|
privateKey: ""
|
|
# privateKey: |-
|
|
# -----BEGIN PGP PRIVATE KEY BLOCK-----
|
|
# ...
|
|
# -----END PGP PRIVATE KEY BLOCK-----
|
|
|
|
init:
|
|
## @param secrets.init.addSHASumAnnotation Add a pod annotation with the SHA sum of the init Secret to trigger a rollout on change
|
|
addSHASumAnnotation: true
|
|
|
|
## @param secrets.init.existingSecret.enabled Use an already existing Secret instead of creating the init Secret
|
|
## @param secrets.init.existingSecret.secretName Name of the already existing init Secret
|
|
existingSecret:
|
|
enabled: false
|
|
secretName: ""
|
|
|
|
## @param secrets.init.new.annotations Annotations for the init Secret
|
|
## @param secrets.init.new.labels Labels for the init Secret
|
|
new:
|
|
annotations: {}
|
|
labels: {}
|
|
|
|
inlineConfig:
|
|
## @param secrets.inlineConfig.addSHASumAnnotation Add a pod annotation with the SHA sum of the inline configuration Secret to trigger a rollout on change
|
|
addSHASumAnnotation: true
|
|
|
|
## @param secrets.inlineConfig.existingSecret.enabled Use an already existing Secret instead of creating the inline configuration Secret
|
|
## @param secrets.inlineConfig.existingSecret.secretName Name of the already existing inline configuration Secret
|
|
existingSecret:
|
|
enabled: false
|
|
secretName: ""
|
|
|
|
## @param secrets.inlineConfig.new.annotations Annotations for the inline configuration Secret
|
|
## @param secrets.inlineConfig.new.labels Labels for the inline configuration Secret
|
|
new:
|
|
annotations: {}
|
|
labels: {}
|
|
|
|
metrics:
|
|
## @param secrets.metrics.addSHASumAnnotation Add a pod annotation with the SHA sum of the metrics Secret to trigger a rollout on change
|
|
addSHASumAnnotation: true
|
|
|
|
## @param secrets.metrics.existingSecret.enabled Use an already existing Secret instead of creating the metrics Secret
|
|
## @param secrets.metrics.existingSecret.secretName Name of the already existing metrics Secret
|
|
existingSecret:
|
|
enabled: false
|
|
secretName: ""
|
|
|
|
## @param secrets.metrics.new.annotations Annotations for the metrics Secret
|
|
## @param secrets.metrics.new.labels Labels for the metrics Secret
|
|
new:
|
|
annotations: {}
|
|
labels: {}
|
|
|
|
## @section ServiceAccount
|
|
|
|
## @param serviceAccount.create Enable the creation of a ServiceAccount
|
|
## @param serviceAccount.name Name of the created ServiceAccount, defaults to release name. Can also link to an externally provided ServiceAccount that should be used.
|
|
## @param serviceAccount.automountServiceAccountToken Enable/disable auto mounting of the service account token
|
|
## @param serviceAccount.imagePullSecrets Image pull secrets, available to the ServiceAccount
|
|
## @param serviceAccount.annotations Custom annotations for the ServiceAccount
|
|
## @param serviceAccount.labels Custom labels for the ServiceAccount
|
|
serviceAccount:
|
|
create: false
|
|
name: ""
|
|
automountServiceAccountToken: false
|
|
imagePullSecrets: []
|
|
# - name: private-registry-access
|
|
annotations: {}
|
|
labels: {}
|
|
|
|
## @section Persistence
|
|
#
|
|
## @param persistence.enabled Enable persistent storage
|
|
## @param persistence.create Whether to create the persistentVolumeClaim for shared storage
|
|
## @param persistence.mount Whether the persistentVolumeClaim should be mounted (even if not created)
|
|
## @param persistence.claimName Use an existing claim to store repository information
|
|
## @param persistence.size Size for persistence to store repo information
|
|
## @param persistence.accessModes AccessMode for persistence
|
|
## @param persistence.labels Labels for the persistence volume claim to be created
|
|
## @param persistence.annotations.helm.sh/resource-policy Resource policy for the persistence volume claim
|
|
## @param persistence.storageClass Name of the storage class to use
|
|
## @param persistence.subPath Subdirectory of the volume to mount at
|
|
## @param persistence.volumeName Name of persistent volume in PVC
|
|
persistence:
|
|
enabled: true
|
|
create: true
|
|
mount: true
|
|
claimName: gitea-shared-storage
|
|
size: 10Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
labels: {}
|
|
storageClass:
|
|
subPath:
|
|
volumeName: ""
|
|
annotations:
|
|
helm.sh/resource-policy: keep
|
|
|
|
## @param extraContainers Additional sidecar containers to run in the pod
|
|
extraContainers: []
|
|
# - name: sidecar-bob
|
|
# image: busybox
|
|
# command: [/bin/sh, -c, 'echo "Hello world"']
|
|
|
|
## @param preExtraInitContainers Additional init containers to run in the pod before gitea runs it owns init containers.
|
|
preExtraInitContainers: []
|
|
# - name: pre-init-container
|
|
# image: docker.io/library/busybox
|
|
# command: [ /bin/sh, -c, 'echo "Hello world! I am a pre init container."' ]
|
|
|
|
## @param postExtraInitContainers Additional init containers to run in the pod after gitea runs it owns init containers.
|
|
postExtraInitContainers: []
|
|
# - name: post-init-container
|
|
# image: docker.io/library/busybox
|
|
# command: [ /bin/sh, -c, 'echo "Hello world! I am a post init container."' ]
|
|
|
|
## @param extraVolumes Additional volumes to mount to the Gitea deployment
|
|
extraVolumes: []
|
|
# - name: postgres-ssl-vol
|
|
# secret:
|
|
# secretName: gitea-postgres-ssl
|
|
|
|
## @param extraContainerVolumeMounts Mounts that are only mapped into the Gitea runtime/main container, to e.g. override custom templates.
|
|
extraContainerVolumeMounts: []
|
|
|
|
## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration.
|
|
extraInitVolumeMounts: []
|
|
|
|
## @deprecated The extraVolumeMounts variable has been split two:
|
|
## - extraContainerVolumeMounts
|
|
## - extraInitVolumeMounts
|
|
## As an example, can be used to mount a client cert when connecting to an external Postgres server.
|
|
## @param extraVolumeMounts **DEPRECATED** Additional volume mounts for init containers and the Gitea main container
|
|
extraVolumeMounts: []
|
|
# - name: postgres-ssl-vol
|
|
# readOnly: true
|
|
# mountPath: "/pg-ssl"
|
|
|
|
## @section Init
|
|
## @param initPreScript Bash shell script copied verbatim to the start of the init-container.
|
|
initPreScript: ""
|
|
## @param initContainersScriptsVolumeMountPath Path to mount the scripts consumed from the Secrets
|
|
initContainersScriptsVolumeMountPath: "/usr/sbinx"
|
|
#
|
|
# initPreScript: |
|
|
# mkdir -p /data/git/.postgresql
|
|
# cp /pg-ssl/* /data/git/.postgresql/
|
|
# chown -R git:git /data/git/.postgresql/
|
|
# chmod 400 /data/git/.postgresql/postgresql.key
|
|
|
|
## @param initContainers.resources.limits initContainers.limits Kubernetes resource limits for init containers
|
|
## @param initContainers.resources.requests.cpu initContainers.requests.cpu Kubernetes cpu resource limits for init containers
|
|
## @param initContainers.resources.requests.memory initContainers.requests.memory Kubernetes memory resource limits for init containers
|
|
initContainers:
|
|
resources:
|
|
limits: {}
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
|
|
## @section Gitea
|
|
#
|
|
gitea:
|
|
## @param gitea.metrics.enabled Enable Gitea metrics
|
|
## @param gitea.metrics.token used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public.
|
|
## @param gitea.metrics.serviceMonitor.enabled Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally.
|
|
## @param gitea.metrics.serviceMonitor.interval Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used.
|
|
## @param gitea.metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping.
|
|
## @param gitea.metrics.serviceMonitor.scheme HTTP scheme to use for scraping. For example `http` or `https`. Default is http.
|
|
## @param gitea.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended. If not specified, global Prometheus scrape timeout is used.
|
|
## @param gitea.metrics.serviceMonitor.tlsConfig TLS configuration to use when scraping the metric endpoint by Prometheus.
|
|
metrics:
|
|
enabled: false
|
|
token:
|
|
serviceMonitor:
|
|
enabled: false
|
|
# additionalLabels:
|
|
# prometheus-release: prom1
|
|
interval: ""
|
|
relabelings: []
|
|
scheme: ""
|
|
scrapeTimeout: ""
|
|
tlsConfig: {}
|
|
|
|
## @param gitea.ldap LDAP configuration
|
|
ldap: []
|
|
# - name: "LDAP 1"
|
|
# existingSecret:
|
|
# securityProtocol:
|
|
# host:
|
|
# port:
|
|
# userSearchBase:
|
|
# userFilter:
|
|
# adminFilter:
|
|
# emailAttribute:
|
|
# bindDn:
|
|
# bindPassword:
|
|
# usernameAttribute:
|
|
# publicSSHKeyAttribute:
|
|
|
|
# Either specify inline `key` and `secret` or refer to them via `existingSecret`
|
|
## @param gitea.oauth OAuth configuration
|
|
oauth: []
|
|
# - name: 'OAuth 1'
|
|
# provider:
|
|
# key:
|
|
# secret:
|
|
# existingSecret:
|
|
# autoDiscoverUrl:
|
|
# useCustomUrls:
|
|
# customAuthUrl:
|
|
# customTokenUrl:
|
|
# customProfileUrl:
|
|
# customEmailUrl:
|
|
|
|
## @param gitea.config.server.SSH_PORT SSH port for rootlful Gitea image
|
|
## @param gitea.config.server.SSH_LISTEN_PORT SSH port for rootless Gitea image
|
|
config:
|
|
# APP_NAME: "Gitea: Git with a cup of tea"
|
|
# RUN_MODE: dev
|
|
server:
|
|
SSH_PORT: 22 # rootful image
|
|
SSH_LISTEN_PORT: 2222 # rootless image
|
|
#
|
|
# security:
|
|
# PASSWORD_COMPLEXITY: spec
|
|
|
|
## @param gitea.additionalConfigSources Additional configuration from secret or configmap
|
|
additionalConfigSources: []
|
|
# - secret:
|
|
# secretName: gitea-app-ini-oauth
|
|
# - configMap:
|
|
# name: gitea-app-ini-plaintext
|
|
|
|
## @param gitea.additionalConfigFromEnvs Additional configuration sources from environment variables
|
|
additionalConfigFromEnvs: []
|
|
|
|
## @param gitea.extraEnvSourceFile Source environment variables from a file during init container startup. This is especially useful for reading environment variable files generated by the Vault agent-injector.
|
|
## See the sample annotations below for reference.
|
|
## podAnnotations:
|
|
## vault.hashicorp.com/agent-inject: "true"
|
|
## vault.hashicorp.com/agent-init-first: "true"
|
|
## vault.hashicorp.com/agent-inject-secret-gitea: <path/to/secret>
|
|
## vault.hashicorp.com/agent-inject-template-gitea: |
|
|
## {{- with secret "path/to/secret" -}}
|
|
## export GITEA__database__HOST="{{ .Data.data.db_host }}"
|
|
## export GITEA__database__NAME="{{ .Data.data.db_name }}"
|
|
## export GITEA__database__USER="{{ .Data.data.db_user }}"
|
|
## export GITEA__database__PASSWD="{{ .Data.data.db_password }}"
|
|
## export GITEA__queue__CONN_STR="{{ .Data.data.kv_conn_string }}"
|
|
## export GITEA__session__PROVIDER_CONFIG="{{ .Data.data.kv_conn_string }}"
|
|
## export GITEA__cache__HOST="{{ .Data.data.kv_conn_string }}"
|
|
## export GITEA_ADMIN_USERNAME="{{ .Data.data.gitea_admin_user }}"
|
|
## export GITEA_ADMIN_PASSWORD="{{ .Data.data.gitea_admin_password }}"
|
|
## {{- end }}
|
|
|
|
# extraEnvSourceFile: /vault/secrets/gitea
|
|
extraEnvSourceFile:
|
|
|
|
## @param gitea.podAnnotations Annotations for the Gitea pod
|
|
podAnnotations: {}
|
|
|
|
## @param gitea.ssh.logLevel Configure OpenSSH's log level. Only available for root-based Gitea image.
|
|
ssh:
|
|
logLevel: "INFO"
|
|
|
|
## @section LivenessProbe
|
|
#
|
|
## @param gitea.livenessProbe.enabled Enable liveness probe
|
|
## @param gitea.livenessProbe.tcpSocket.port Port to probe for liveness
|
|
## @param gitea.livenessProbe.initialDelaySeconds Initial delay before liveness probe is initiated
|
|
## @param gitea.livenessProbe.timeoutSeconds Timeout for liveness probe
|
|
## @param gitea.livenessProbe.periodSeconds Period for liveness probe
|
|
## @param gitea.livenessProbe.successThreshold Success threshold for liveness probe
|
|
## @param gitea.livenessProbe.failureThreshold Failure threshold for liveness probe
|
|
# Modify the liveness probe for your needs or completely disable it by commenting out.
|
|
livenessProbe:
|
|
enabled: true
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 200
|
|
timeoutSeconds: 1
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
failureThreshold: 10
|
|
|
|
## @section ReadinessProbe
|
|
#
|
|
## @param gitea.readinessProbe.enabled Enable readiness probe
|
|
## @param gitea.readinessProbe.tcpSocket.port Port to probe for readiness
|
|
## @param gitea.readinessProbe.initialDelaySeconds Initial delay before readiness probe is initiated
|
|
## @param gitea.readinessProbe.timeoutSeconds Timeout for readiness probe
|
|
## @param gitea.readinessProbe.periodSeconds Period for readiness probe
|
|
## @param gitea.readinessProbe.successThreshold Success threshold for readiness probe
|
|
## @param gitea.readinessProbe.failureThreshold Failure threshold for readiness probe
|
|
# Modify the readiness probe for your needs or completely disable it by commenting out.
|
|
readinessProbe:
|
|
enabled: true
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
timeoutSeconds: 1
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
|
|
# # Uncomment the startup probe to enable and modify it for your needs.
|
|
## @section StartupProbe
|
|
#
|
|
## @param gitea.startupProbe.enabled Enable startup probe
|
|
## @param gitea.startupProbe.tcpSocket.port Port to probe for startup
|
|
## @param gitea.startupProbe.initialDelaySeconds Initial delay before startup probe is initiated
|
|
## @param gitea.startupProbe.timeoutSeconds Timeout for startup probe
|
|
## @param gitea.startupProbe.periodSeconds Period for startup probe
|
|
## @param gitea.startupProbe.successThreshold Success threshold for startup probe
|
|
## @param gitea.startupProbe.failureThreshold Failure threshold for startup probe
|
|
startupProbe:
|
|
enabled: false
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 60
|
|
timeoutSeconds: 1
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
failureThreshold: 10
|
|
|
|
## @section valkey
|
|
valkey:
|
|
## @param valkey.enabled Enable valkey standalone or replicated
|
|
enabled: false
|
|
|
|
## @param valkey.image.registry Image registry
|
|
## @param valkey.image.repository Image repository
|
|
## @param valkey.image.tag Image tag
|
|
image:
|
|
registry: docker.io
|
|
repository: valkey/valkey
|
|
tag: ""
|
|
|
|
## @param valkey.auth.enabled Enable ACL-based authentication
|
|
## @param valkey.auth.aclUsers.default.permissions ACL permissions for the default user
|
|
## @param valkey.auth.aclUsers.default.password Password for the default user
|
|
auth:
|
|
enabled: true
|
|
aclUsers:
|
|
default:
|
|
permissions: "~* &* +@all"
|
|
password: changeme
|
|
|
|
## @param valkey.service.port Port of Valkey service
|
|
service:
|
|
port: 6379
|
|
|
|
## @param valkey.dataStorage.enabled Enable persistence using Persistent Volume Claims.
|
|
## @param valkey.dataStorage.className Persistent Volume storage class.
|
|
## @param valkey.dataStorage.requestedSize Persistent Volume size.
|
|
dataStorage:
|
|
enabled: false
|
|
className: ""
|
|
requestedSize: 8Gi
|
|
|
|
## @param valkey.replica.enabled Enable replication
|
|
## @param valkey.replica.replicas Number of Valkey replica instances to deploy
|
|
## @param valkey.replica.persistence.size Persistent Volume size for replicas.
|
|
## @param valkey.replica.persistence.storageClass Persistent Volume storage class for replicas.
|
|
replica:
|
|
enabled: false
|
|
replicas: 3
|
|
persistence:
|
|
size: 8Gi
|
|
storageClass: ""
|
|
|
|
## @param valkey.metrics.enabled Enable Prometheus exporter sidecar
|
|
## @param valkey.metrics.exporter.image.registry Image registry
|
|
## @param valkey.metrics.exporter.image.repository Image repository
|
|
## @param valkey.metrics.exporter.image.tag Image tag
|
|
metrics:
|
|
enabled: false
|
|
exporter:
|
|
image:
|
|
registry: ghcr.io
|
|
repository: oliver006/redis_exporter
|
|
tag: ""
|
|
|
|
## @section PostgreSQL HA
|
|
postgresql-ha:
|
|
## @param postgresql-ha.enabled Enable PostgreSQL HA
|
|
enabled: true
|
|
|
|
## @param postgresql-ha.global.postgresql.database Name for a custom database to create (overrides `auth.database`)
|
|
## @param postgresql-ha.global.postgresql.username Name for a custom user to create (overrides `auth.username`)
|
|
## @param postgresql-ha.global.postgresql.password Name for a custom password to create (overrides `auth.password`)
|
|
global:
|
|
postgresql:
|
|
database: gitea
|
|
password: gitea
|
|
username: gitea
|
|
|
|
## @param postgresql-ha.metrics.image.repository Image repository, eg. `bitnamilegacy/postgres-exporter`.
|
|
metrics:
|
|
image:
|
|
repository: bitnamilegacy/postgres-exporter
|
|
|
|
## @param postgresql-ha.postgresql.image.repository Image repository, eg. `bitnamilegacy/postgresql-repmgr`.
|
|
## @param postgresql-ha.postgresql.repmgrPassword Repmgr Password
|
|
## @param postgresql-ha.postgresql.postgresPassword postgres Password
|
|
## @param postgresql-ha.postgresql.password Password for the `gitea` user (overrides `auth.password`)
|
|
postgresql:
|
|
image:
|
|
repository: bitnamilegacy/postgresql-repmgr
|
|
repmgrPassword: changeme2
|
|
postgresPassword: changeme1
|
|
password: changeme4
|
|
|
|
## @param postgresql-ha.pgpool.adminPassword pgpool adminPassword
|
|
## @param postgresql-ha.pgpool.image.repository Image repository, eg. `bitnamilegacy/pgpool`.
|
|
## @param postgresql-ha.pgpool.srCheckPassword pgpool srCheckPassword
|
|
pgpool:
|
|
adminPassword: changeme3
|
|
image:
|
|
repository: bitnamilegacy/pgpool
|
|
srCheckPassword: changeme4
|
|
|
|
## @param postgresql-ha.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
|
|
service:
|
|
ports:
|
|
postgresql: 5432
|
|
|
|
## @param postgresql-ha.persistence.enabled Enable persistence.
|
|
## @param postgresql-ha.persistence.storageClass Persistent Volume Storage Class.
|
|
## @param postgresql-ha.persistence.size PVC Storage Request for PostgreSQL HA volume
|
|
persistence:
|
|
enabled: true
|
|
storageClass: ""
|
|
size: 10Gi
|
|
|
|
## @param postgresql-ha.volumePermissions.image.repository Image repository, eg. `bitnamilegacy/os-shell`.
|
|
volumePermissions:
|
|
image:
|
|
repository: bitnamilegacy/os-shell
|
|
|
|
## @section PostgreSQL
|
|
postgresql:
|
|
## @param postgresql.enabled Enable PostgreSQL
|
|
enabled: false
|
|
|
|
## @param postgresql.global.postgresql.auth.password Password for the `gitea` user (overrides `auth.password`)
|
|
## @param postgresql.global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`)
|
|
## @param postgresql.global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`)
|
|
## @param postgresql.global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
|
|
global:
|
|
postgresql:
|
|
auth:
|
|
password: gitea
|
|
database: gitea
|
|
username: gitea
|
|
service:
|
|
ports:
|
|
postgresql: 5432
|
|
|
|
## @param postgresql.image.repository Image repository, eg. `bitnamilegacy/postgresql`.
|
|
image:
|
|
repository: bitnamilegacy/postgresql
|
|
|
|
primary:
|
|
## @param postgresql.primary.persistence.enabled Enable persistence.
|
|
## @param postgresql.primary.persistence.storageClass Persistent Volume storage class.
|
|
## @param postgresql.primary.persistence.size PVC Storage Request for PostgreSQL volume.
|
|
persistence:
|
|
enabled: true
|
|
storageClass: ""
|
|
size: 10Gi
|
|
|
|
readReplicas:
|
|
## @param postgresql.readReplicas.persistence.enabled Enable PostgreSQL read only data persistence using PVC.
|
|
## @param postgresql.readReplicas.persistence.storageClass Persistent Volume storage class.
|
|
## @param postgresql.readReplicas.persistence.size PVC Storage Request for PostgreSQL volume.
|
|
persistence:
|
|
enabled: true
|
|
storageClass: ""
|
|
size: ""
|
|
|
|
## @param postgresql.metrics.image.repository Image repository, eg. `bitnamilegacy/postgres-exporter`.
|
|
metrics:
|
|
image:
|
|
repository: bitnamilegacy/postgres-exporter
|
|
|
|
## @param postgresql.volumePermissions.image.repository Image repository, eg. `bitnamilegacy/os-shell`.
|
|
volumePermissions:
|
|
image:
|
|
repository: bitnamilegacy/os-shell
|
|
|
|
# By default, removed or moved settings that still remain in a user defined values.yaml will cause Helm to fail running the install/update.
|
|
# Set it to false to skip this basic validation check.
|
|
## @section Advanced
|
|
## @param checkDeprecation Set it to false to skip this basic validation check.
|
|
## @param test.enabled Set it to false to disable test-connection Pod.
|
|
## @param test.image.name Image name for the wget container used in the test-connection Pod.
|
|
## @param test.image.tag Image tag for the wget container used in the test-connection Pod.
|
|
checkDeprecation: true
|
|
test:
|
|
enabled: true
|
|
image:
|
|
name: busybox
|
|
tag: latest
|
|
|
|
## @param extraDeploy Array of extra objects to deploy with the release
|
|
##
|
|
extraDeploy: []
|