volker.raschekandCopilot
552fe8c56e
The `templates/gitea` subdirectory did not group anything meaningful, since every template of this chart belongs to Gitea. It only duplicated the chart name in every path and forced the unit tests to spell out `templates/gitea/<name>.yaml`, while `_helpers.tpl` and `NOTES.txt` already lived directly in `templates`. All templates now live in `templates`, which matches the layout of the bundled sub-charts and the Helm defaults. The checksum helper in `templates/_secrets.tpl` built its include path from `$root.Template.BasePath` and therefore carried the subdirectory in a `printf` format string instead of a literal path. Without adjusting it the chart failed to render with "no template gitea/templates/gitea/secret_config.yaml associated with template gotpl". Co-authored-by: Copilot <copilot@github.com>
116 lines
3.4 KiB
YAML
116 lines
3.4 KiB
YAML
suite: deployment template (openshift)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/deployment.yaml
|
|
- templates/secret_admin.yaml
|
|
- templates/secret_config.yaml
|
|
- templates/secret_gpg.yaml
|
|
- templates/secret_init.yaml
|
|
- templates/secret_inlineConfig.yaml
|
|
- templates/secret_metrics.yaml
|
|
tests:
|
|
- it: renders openshift-compatible defaults for chart-managed containers
|
|
template: templates/deployment.yaml
|
|
set:
|
|
openshift.enabled: true
|
|
asserts:
|
|
- notExists:
|
|
path: spec.template.spec.hostUsers
|
|
- notExists:
|
|
path: spec.template.spec.securityContext
|
|
- equal:
|
|
path: spec.template.spec.initContainers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.initContainers[1].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
- it: does not force runAsUser 1000 for command init containers on OpenShift
|
|
template: templates/deployment.yaml
|
|
set:
|
|
openshift.enabled: true
|
|
secrets.gpg.enabled: true
|
|
secrets.gpg.existingSecret.enabled: true
|
|
secrets.gpg.existingSecret.secretName: custom-gpg-secret
|
|
asserts:
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[3].securityContext.runAsUser
|
|
|
|
- it: preserves explicit pod and container security context overrides on OpenShift
|
|
template: templates/deployment.yaml
|
|
set:
|
|
openshift:
|
|
enabled: true
|
|
deployment:
|
|
hostUsers: true
|
|
securityContext:
|
|
fsGroup: 1000620000
|
|
gitea:
|
|
securityContext:
|
|
runAsUser: 1000620000
|
|
runAsGroup: 1000620000
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.hostUsers
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1000620000
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
|
value: 1000620000
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.runAsGroup
|
|
value: 1000620000
|
|
|
|
- it: renders an explicit hostUsers=false override on OpenShift
|
|
template: templates/deployment.yaml
|
|
set:
|
|
openshift:
|
|
enabled: true
|
|
deployment:
|
|
hostUsers: false
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.hostUsers
|
|
value: false
|