perfectra1nandperfectra1n
4631d42156
The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts. This renders the Secret as base64 `data` instead. - `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`). - Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`. Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned. `make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean. Co-authored-by: perfectra1n <jonfuller2012@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com>
176 lines
4.9 KiB
YAML
176 lines
4.9 KiB
YAML
suite: config template | server section (domain related)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
tests:
|
|
- it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
|
template: templates/secret_inlineConfig.yaml
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nDOMAIN=git.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nSSH_DOMAIN=git.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=http://git.example.com
|
|
|
|
################################################
|
|
|
|
- it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
|
template: templates/secret_inlineConfig.yaml
|
|
set:
|
|
ingress:
|
|
hosts: []
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
|
|
|
|
################################################
|
|
|
|
- it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
|
template: templates/secret_inlineConfig.yaml
|
|
set:
|
|
gitea.config.server.DOMAIN: provided.example.com
|
|
ingress:
|
|
hosts:
|
|
- host: non-used.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nDOMAIN=provided.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nSSH_DOMAIN=provided.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=http://provided.example.com
|
|
|
|
################################################
|
|
|
|
- it: "[route enabled] uses route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
|
template: templates/secret_inlineConfig.yaml
|
|
set:
|
|
route:
|
|
enabled: true
|
|
host: route.example.com
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nDOMAIN=route.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nSSH_DOMAIN=route.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=http://route.example.com
|
|
|
|
################################################
|
|
|
|
- it: "[route tls termination] uses https for ROOT_URL"
|
|
template: templates/secret_inlineConfig.yaml
|
|
set:
|
|
route:
|
|
enabled: true
|
|
host: route.example.com
|
|
tls:
|
|
termination: edge
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=https://route.example.com
|
|
|
|
################################################
|
|
|
|
- it: "[HTTPRoute enabled] uses first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
|
template: templates/secret_inlineConfig.yaml
|
|
set:
|
|
ingress:
|
|
hosts: []
|
|
gatewayAPI:
|
|
enabled: true
|
|
core:
|
|
httpRoute:
|
|
enabled: true
|
|
hostnames:
|
|
- gw.example.com
|
|
parentRefs:
|
|
- name: shared-gateway
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nDOMAIN=gw.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nSSH_DOMAIN=gw.example.com
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=http://gw.example.com
|
|
|
|
################################################
|
|
|
|
- it: "[HTTPRoute tls] switches ROOT_URL to https"
|
|
template: templates/secret_inlineConfig.yaml
|
|
set:
|
|
ingress:
|
|
hosts: []
|
|
gatewayAPI:
|
|
enabled: true
|
|
core:
|
|
httpRoute:
|
|
enabled: true
|
|
tls: true
|
|
hostnames:
|
|
- gw.example.com
|
|
parentRefs:
|
|
- name: shared-gateway
|
|
asserts:
|
|
- documentIndex: 0
|
|
matchRegex:
|
|
path: data.server
|
|
decodeBase64: true
|
|
pattern: \nROOT_URL=https://gw.example.com
|