perfectra1nandperfectra1n
4631d42156
The inline-config Secret used `stringData`. The API server stores it as `data`, so a section removed from `gitea.config` was never pruned from the live Secret, and the init container kept writing it into `app.ini` on every start. With Gitea 28, a leftover `[webhook] ALLOWED_HOST_LIST` overrides `[security]`'s, which breaks webhooks to private hosts. This renders the Secret as base64 `data` instead. - `templates/secret_inlineConfig.yaml`: `stringData` → `data` (`b64enc`). - Unit tests read `data.*` with `decodeBase64: true`; adds a regression test asserting there is no `stringData`. Note: keys that are already stale from the `stringData` era survive the first upgrade to this version, because Helm's three-way merge never recorded them under `data`. Every removal after that is pruned. `make unittests-helm`: 261 passed. `helm lint` and `yamllint` are clean. Co-authored-by: perfectra1n <jonfuller2012@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: perfectra1n <49838+perfectra1n@noreply.gitea.com>
21 lines
762 B
YAML
21 lines
762 B
YAML
{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}}
|
|
{{- $inlineConfiguration := include "gitea.inline_configuration" . -}}
|
|
{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
{{- with (include "gitea.secret.inlineConfig.annotations" .) }}
|
|
annotations:
|
|
{{- . | nindent 4 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }}
|
|
name: {{ include "gitea.secret.inlineConfig.name" . }}
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
type: Opaque
|
|
data:
|
|
{{- range $key, $value := fromYaml $inlineConfiguration }}
|
|
{{ $key }}: {{ $value | b64enc | quote }}
|
|
{{- end }}
|
|
{{- end }} |