volker.raschekandCopilot
4d82f17ce6
Until now the Secrets rendered by this chart were not configurable at all. Their labels were fixed to the chart defaults, they could not carry annotations, and there was no way to hand in a Secret that is managed outside of the chart - except for the GPG key, which had its own special case via `signing.existingSecret`. Users who manage their secrets with an external operator (e.g. External Secrets, Sealed Secrets) or who need annotations for tooling such as Reloader or Kyverno had no option but to fork the chart. A `secrets` section is introduced with one entry per Secret (config, gpg, init, inlineConfig, metrics), each offering: addSHASumAnnotation add a checksum annotation to the pod template (default: true) existingSecret.enabled reference a Secret that is not managed by this chart existingSecret.secretName name of that Secret new.annotations annotations for the Secret created by the chart new.labels additional labels for the Secret created by the chart The `new` sub-key keeps the properties of a chart-managed Secret clearly separated from the properties of a referenced one, so it is obvious which settings are ignored once `existingSecret` is enabled. `secretName` rather than `name` mirrors the field the value ends up in, the `secretName` of a pod volume. The `gitea.secret.*.name` helpers resolve to the user-provided name when `existingSecret` is enabled, which means the Deployment volumes and the ServiceMonitor credentials pick it up without further changes. Enabling `existingSecret` without a name fails the render with a message naming the full values path, because Helm would otherwise silently create a Secret under the referenced name and overwrite it. Only two of the five Secrets had a checksum annotation before, so changes to the init scripts, the GPG key or the metrics token did not trigger a rollout. Annotations for all five are now rendered, each gated by `addSHASumAnnotation` and skipped for Secrets the chart does not manage. Two side effects had to be preserved when a Secret is no longer rendered: - secret_config.yaml carries the HA assertions (RWX access mode, issue/repo indexer, mutually exclusive PostgreSQL dependencies) inside its `assertions` field. They are extracted into `gitea.config.assertions` and evaluated before the guard, otherwise providing an own config Secret would silently disable chart-wide validation. - secret_inlineConfig.yaml populates `.Values.gitea.config` as a side effect of `gitea.inline_configuration`. Without evaluating it, even NOTES.txt fails on `.Values.gitea.config.cache`. The include therefore runs independently of the guard as well. `signing.existingSecret` keeps working; `secrets.gpg.existingSecret` takes precedence over it. The error message raised for an enabled but unconfigured signing setup now lists all three options. Test suites rendering the Deployment have to declare the Secret templates it checksums, hence the added `templates:` entries. unittests/helm/deployment/extraInitContainers.yaml set `signing.enabled` without a key or an existing Secret - a combination that fails a real `helm install` and only went unnoticed because the Deployment never rendered secret_gpg.yaml before. Co-authored-by: Copilot <copilot@github.com>
64 lines
2.2 KiB
YAML
64 lines
2.2 KiB
YAML
suite: deployment template (HA)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/gitea/deployment.yaml
|
|
- templates/gitea/secret_config.yaml
|
|
- templates/gitea/secret_gpg.yaml
|
|
- templates/gitea/secret_init.yaml
|
|
- templates/gitea/secret_inlineConfig.yaml
|
|
- templates/gitea/secret_metrics.yaml
|
|
tests:
|
|
- it: fails with multiple replicas and "GIT_GC_REPOS" enabled
|
|
template: templates/gitea/secret_config.yaml
|
|
set:
|
|
replicaCount: 2
|
|
persistence:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
gitea:
|
|
config:
|
|
cron:
|
|
GIT_GC_REPOS:
|
|
ENABLED: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'."
|
|
- it: fails with multiple replicas and RWX file system not set
|
|
template: templates/gitea/secret_config.yaml
|
|
set:
|
|
replicaCount: 2
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany."
|
|
- it: fails with multiple replicas and bleve issue indexer
|
|
template: templates/gitea/secret_config.yaml
|
|
set:
|
|
replicaCount: 2
|
|
persistence:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
gitea:
|
|
config:
|
|
indexer:
|
|
ISSUE_INDEXER_TYPE: bleve
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)."
|
|
- it: fails with multiple replicas and bleve repo indexer
|
|
template: templates/gitea/secret_config.yaml
|
|
set:
|
|
replicaCount: 2
|
|
persistence:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
gitea:
|
|
config:
|
|
indexer:
|
|
REPO_INDEXER_TYPE: bleve
|
|
REPO_INDEXER_ENABLED: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled."
|