perfectra1nandperfectra1n
4631d42156
The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts. This renders the Secret as base64 `data` instead. - `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`). - Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`. Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned. `make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean. Co-authored-by: perfectra1n <jonfuller2012@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com>
144 lines
5.0 KiB
YAML
144 lines
5.0 KiB
YAML
suite: Dependency checks | Customization integrity | postgresql-ha
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
set:
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: true
|
|
global:
|
|
postgresql:
|
|
database: gitea-database
|
|
password: gitea-password
|
|
username: gitea-username
|
|
postgresql:
|
|
repmgrPassword: custom-password-repmgr
|
|
postgresPassword: custom-password-postgres
|
|
password: custom-password-overwritten-by-global-postgresql-password
|
|
pgpool:
|
|
adminPassword: custom-password-pgpool
|
|
srCheckPassword: custom-password-sr-check
|
|
service:
|
|
ports:
|
|
postgresql: 1234
|
|
persistence:
|
|
size: 1337Mi
|
|
tests:
|
|
- it: "[postgresql-ha] DB settings are applied as expected"
|
|
template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: POSTGRES_DB
|
|
value: "gitea-database"
|
|
- documentIndex: 0
|
|
contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: POSTGRES_USER
|
|
value: "gitea-username"
|
|
- it: "[postgresql-ha] DB passwords are applied as expected"
|
|
template: charts/postgresql-ha/templates/postgresql/secrets.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["repmgr-password"]
|
|
value: "Y3VzdG9tLXBhc3N3b3JkLXJlcG1ncg=="
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["postgres-password"]
|
|
value: "Y3VzdG9tLXBhc3N3b3JkLXBvc3RncmVz"
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["password"]
|
|
value: "Z2l0ZWEtcGFzc3dvcmQ=" # postgresql-ha.postgresql.password is overwritten by postgresql-ha.global.postgresql.password and should not be referenced here
|
|
- it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
|
|
template: charts/postgresql-ha/templates/pgpool/secrets.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["admin-password"]
|
|
value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
|
|
- it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
|
|
template: charts/postgresql-ha/templates/pgpool/secrets.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["admin-password"]
|
|
value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
|
|
- it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
|
|
template: charts/postgresql-ha/templates/pgpool/secrets.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["admin-password"]
|
|
value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
|
|
- it: "[postgresql-ha] pgpool.srCheckPassword is applied as expected"
|
|
template: charts/postgresql-ha/templates/pgpool/secrets.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: data["sr-check-password"]
|
|
value: "Y3VzdG9tLXBhc3N3b3JkLXNyLWNoZWNr"
|
|
- it: "[postgresql-ha] persistence.size is applied as expected"
|
|
template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
|
|
value: "1337Mi"
|
|
- it: "[postgresql-ha] service.ports.postgresql is applied as expected"
|
|
template: charts/postgresql-ha/templates/pgpool/service.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
equal:
|
|
path: spec.ports[0].port
|
|
value: 1234
|
|
- it: "[postgresql-ha] renders the referenced service"
|
|
template: charts/postgresql-ha/templates/pgpool/service.yaml
|
|
asserts:
|
|
- containsDocument:
|
|
kind: Service
|
|
apiVersion: v1
|
|
name: gitea-unittests-postgresql-ha-pgpool
|
|
namespace: testing
|
|
- it: "[gitea] connects to pgpool service"
|
|
template: templates/secret_inlineConfig.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.database
|
|
decodeBase64: true
|
|
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
|
|
- it: "[gitea] connects to pgpool service with custom cluster domain"
|
|
set:
|
|
clusterDomain: my-special-cluster.local
|
|
template: templates/secret_inlineConfig.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.database
|
|
decodeBase64: true
|
|
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
|
|
- it: "[gitea] connects to configured database"
|
|
template: templates/secret_inlineConfig.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.database
|
|
decodeBase64: true
|
|
pattern: NAME=gitea-database
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.database
|
|
decodeBase64: true
|
|
pattern: USER=gitea-username
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.database
|
|
decodeBase64: true
|
|
pattern: PASSWD=gitea-password
|