volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 2 Pull Requests 6 Actions Packages Projects Releases Wiki Activity
Files
6d68d448943e88fc9d61ba3e49f0244c24729741
helm-gitea/unittests/helm/deployment/checksumAnnotations.yaml
T
volker.raschekandCopilot 1b82a15b7f feat!: replace postgresql-ha with CloudNativePG 
The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>
2026-10-04 00:18:34 +02:00

169 lines
6.0 KiB
YAML
Raw Blame History

suite: Test deployment checksum annotations
release:
name: gitea-unittests
namespace: testing
templates:
- templates/deployment.yaml
- templates/secret_admin.yaml
- templates/secret_cloudnativePG.yaml
- templates/secret_config.yaml
- templates/secret_gpg.yaml
- templates/secret_init.yaml
- templates/secret_inlineConfig.yaml
- templates/secret_metrics.yaml
tests:
- it: "Omit the checksum annotations by default"
template: templates/deployment.yaml
set:
cloudnativePG.enabled: true
secrets.admin.enabled: true
secrets.config.enabled: true
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: |
-----BEGIN PGP PRIVATE KEY BLOCK-----
-----END PGP PRIVATE KEY BLOCK-----
secrets.init.enabled: true
secrets.inlineConfig.enabled: true
secrets.metrics.enabled: true
asserts:
- notExists:
path: spec.template.metadata.annotations["checksum/admin"]
- notExists:
path: spec.template.metadata.annotations["checksum/cloudnativePG"]
- notExists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/gpg"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- notExists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- notExists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: "Add a checksum annotation for every Secret when addSHASumAnnotation is enabled"
template: templates/deployment.yaml
set:
cloudnativePG.credentials.addSHASumAnnotation: true
cloudnativePG.enabled: true
secrets.admin.addSHASumAnnotation: true
secrets.admin.enabled: true
secrets.config.addSHASumAnnotation: true
secrets.config.enabled: true
secrets.gpg.addSHASumAnnotation: true
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: |
-----BEGIN PGP PRIVATE KEY BLOCK-----
-----END PGP PRIVATE KEY BLOCK-----
secrets.init.addSHASumAnnotation: true
secrets.init.enabled: true
secrets.inlineConfig.addSHASumAnnotation: true
secrets.inlineConfig.enabled: true
secrets.metrics.addSHASumAnnotation: true
secrets.metrics.enabled: true
asserts:
- exists:
path: spec.template.metadata.annotations["checksum/admin"]
- exists:
path: spec.template.metadata.annotations["checksum/cloudnativePG"]
- exists:
path: spec.template.metadata.annotations["checksum/config"]
- exists:
path: spec.template.metadata.annotations["checksum/gpg"]
- exists:
path: spec.template.metadata.annotations["checksum/init"]
- exists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- exists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: "Omit the checksum annotation of a single disabled Secret only"
template: templates/deployment.yaml
set:
secrets.admin.addSHASumAnnotation: false
secrets.admin.enabled: true
secrets.config.addSHASumAnnotation: false
secrets.config.enabled: true
secrets.gpg.addSHASumAnnotation: false
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: |
-----BEGIN PGP PRIVATE KEY BLOCK-----
-----END PGP PRIVATE KEY BLOCK-----
secrets.init.addSHASumAnnotation: false
secrets.init.enabled: true
secrets.inlineConfig.addSHASumAnnotation: false
secrets.inlineConfig.enabled: true
secrets.metrics.addSHASumAnnotation: false
secrets.metrics.enabled: true
asserts:
- notExists:
path: spec.template.metadata.annotations["checksum/admin"]
- notExists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/gpg"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- notExists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- notExists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: "Add the checksum of Secrets provided by the user"
template: templates/deployment.yaml
set:
secrets.admin.enabled: true
secrets.admin.addSHASumAnnotation: true
secrets.admin.existingSecret.enabled: true
secrets.admin.existingSecret.secretName: custom-admin
secrets.config.enabled: true
secrets.config.addSHASumAnnotation: true
secrets.config.existingSecret.enabled: true
secrets.config.existingSecret.secretName: custom-config
secrets.gpg.enabled: true
secrets.gpg.addSHASumAnnotation: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: custom-gpg
secrets.init.enabled: true
secrets.init.addSHASumAnnotation: true
secrets.init.existingSecret.enabled: true
secrets.init.existingSecret.secretName: custom-init
secrets.inlineConfig.enabled: true
secrets.inlineConfig.addSHASumAnnotation: true
secrets.inlineConfig.existingSecret.enabled: true
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
secrets.metrics.enabled: true
secrets.metrics.addSHASumAnnotation: true
secrets.metrics.existingSecret.enabled: true
secrets.metrics.existingSecret.secretName: custom-metrics
asserts:
- exists:
path: spec.template.metadata.annotations["checksum/admin"]
- exists:
path: spec.template.metadata.annotations["checksum/config"]
- exists:
path: spec.template.metadata.annotations["checksum/gpg"]
- exists:
path: spec.template.metadata.annotations["checksum/init"]
- exists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- exists:
path: spec.template.metadata.annotations["checksum/metrics"]
Reference in New Issue View Git Blame Copy Permalink