volker.raschekandCopilot
3535611d4d
The `signing` object was the last Secret-related configuration living outside of the `secrets` section introduced in the
previous commit. Keeping it separate meant that the GPG key Secret was the only one without configurable annotations,
labels and a proper `existingSecret` reference, and users had to learn two different conventions for the same concept.
`signing` is therefore removed and fully replaced by `secrets.gpg`:
signing.enabled -> secrets.gpg.enabled
signing.gpgHome -> secrets.gpg.new.gpgHome
signing.privateKey -> secrets.gpg.new.privateKey
signing.existingSecret -> secrets.gpg.existingSecret.{enabled,secretName}
`gpgHome` is now stored as a key inside the GPG key Secret and consumed via `secretKeyRef` instead of being rendered as
a plain environment variable value. This keeps the whole GPG configuration in a single object, so an operator can hand
over one Secret that fully describes the signing setup instead of splitting it across values and Secret data. The key
names of an externally provided Secret are configurable via `secrets.gpg.existingSecret.gpgHomeKey` and
`secrets.gpg.existingSecret.privateKeyKey`, because chart-defined key names cannot be assumed for Secrets that are
managed by an external system such as an operator or a secret store.
To avoid silently ignoring a now unknown value, `deprecation.yaml` fails the render when `signing` is still set and
points to `secrets.gpg`. As with the other deprecation guards it can be bypassed via `checkDeprecation: false`.
The unit tests are migrated accordingly and the `GNUPGHOME` assertions now verify the `secretKeyRef` shape. Two new
cases cover custom `gpgHomeKey` and `privateKeyKey` values of an existing Secret.
The README gains a `To 13.0.0` upgrade section documenting this change together with the `secrets.*` block and the
Secret renames of the preceding commits.
BREAKING CHANGE: The `signing` object has been removed and is replaced by `secrets.gpg`. Rendering fails if `signing`
is still set. Secrets referenced via `secrets.gpg.existingSecret` now additionally require a `gpgHome` key next to
`privateKey`.
Co-authored-by: Copilot <copilot@github.com>
87 lines
3.0 KiB
YAML
87 lines
3.0 KiB
YAML
suite: deployment template (extraEnvSourceFile)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/gitea/deployment.yaml
|
|
- templates/gitea/secret_config.yaml
|
|
- templates/gitea/secret_gpg.yaml
|
|
- templates/gitea/secret_init.yaml
|
|
- templates/gitea/secret_inlineConfig.yaml
|
|
- templates/gitea/secret_metrics.yaml
|
|
tests:
|
|
- it: uses direct execution when extraEnvSourceFile is not set
|
|
template: templates/gitea/deployment.yaml
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.initContainers[1].command
|
|
value: ["/usr/sbinx/config_environment.sh"]
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[1].args
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].command
|
|
value: ["/usr/sbinx/configure_gitea.sh"]
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[2].args
|
|
|
|
- it: sources env file in init-app-ini when extraEnvSourceFile is set
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
gitea:
|
|
extraEnvSourceFile: /vault/secrets/gitea
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.initContainers[1].command
|
|
value: ["/bin/bash", "-c"]
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[1].args[0]
|
|
pattern: source /vault/secrets/gitea
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[1].args[0]
|
|
pattern: config_environment\.sh
|
|
|
|
- it: sources env file in configure-gitea when extraEnvSourceFile is set
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
gitea:
|
|
extraEnvSourceFile: /vault/secrets/gitea
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].command
|
|
value: ["/bin/bash", "-c"]
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[2].args[0]
|
|
pattern: source /vault/secrets/gitea
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[2].args[0]
|
|
pattern: configure_gitea\.sh
|
|
|
|
- it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
secrets.gpg.enabled: true
|
|
secrets.gpg.existingSecret.enabled: true
|
|
secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
|
|
gitea:
|
|
extraEnvSourceFile: /vault/secrets/gitea
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].command
|
|
value: ["/bin/bash", "-c"]
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[2].args[0]
|
|
pattern: source /vault/secrets/gitea
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[2].args[0]
|
|
pattern: configure_gpg_environment\.sh
|
|
|
|
- it: includes file existence check in source command
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
gitea:
|
|
extraEnvSourceFile: /vault/secrets/gitea
|
|
asserts:
|
|
- matchRegex:
|
|
path: spec.template.spec.initContainers[1].args[0]
|
|
pattern: "test -f /vault/secrets/gitea"
|