volker.raschekandCopilot
64c2f1a9cc
Both Secrets rendered their payload via `stringData`. That field is write-only: the API server decodes it into `data` and does not persist `stringData` itself. Helm's three-way merge therefore generates a deletion patch that targets `stringData`, while the live object only ever carries `data` - so a key that disappears from the rendered manifest is never pruned and survives every upgrade. Unlike the inline-config Secret fixed in #1110, the keys here are driven by the files in `scripts/init-containers/**` rather than by user values, so the bug is latent rather than acute. It still bites whenever a script is removed or renamed in the chart: the stale key stays in the Secret and keeps being mounted into the init containers. The two inline scripts of the init Secret were YAML block scalars and had to be moved into `define` blocks to be pipeable through `b64enc`. The bodies are dedented by four columns accordingly, and `trimAll "\n"` reproduces the chomping semantics of the previous `|-` scalars. Rendering was diffed against the previous revision for defaults, rootless, initPreScript, GPG, admin, LDAP, OAuth and all valkey variants - the decoded payloads are byte-identical, so no init script changes behaviour. Unit tests now read the payloads from `data.*` with `decodeBase64: true` and assert that `stringData` no longer exists, to catch a regression early. See: https://gitea.com/gitea/helm-gitea/issues/1109 See: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: Copilot <copilot@github.com>
84 lines
2.5 KiB
YAML
84 lines
2.5 KiB
YAML
suite: Init template
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/secret_init.yaml
|
|
tests:
|
|
- it: runs gpg in batch mode
|
|
set:
|
|
deployment.gitea.image.rootless: false
|
|
secrets.gpg.enabled: true
|
|
secrets.gpg.new.privateKey: |-
|
|
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
|
{placeholder}
|
|
-----END PGP PRIVATE KEY BLOCK-----
|
|
asserts:
|
|
- equal:
|
|
path: data["configure_gpg_environment.sh"]
|
|
decodeBase64: true
|
|
value: |
|
|
#!/usr/bin/env bash
|
|
set -eu
|
|
|
|
gpg --batch --import "$TMP_RAW_GPG_KEY"
|
|
- it: skips gpg script block for disabled signing
|
|
set:
|
|
deployment.gitea.image.rootless: false
|
|
asserts:
|
|
- equal:
|
|
path: data["init_directory_structure.sh"]
|
|
decodeBase64: true
|
|
value: |-
|
|
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
chown -v 1000:1000 /data
|
|
mkdir -pv /data/git/.ssh
|
|
chmod -Rv 700 /data/git/.ssh
|
|
[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
|
|
|
|
# prepare temp directory structure
|
|
mkdir -pv "${GITEA_TEMP}"
|
|
chown -v 1000:1000 "${GITEA_TEMP}"
|
|
chmod -v ug+rwx "${GITEA_TEMP}"
|
|
- it: adds gpg script block for enabled signing
|
|
set:
|
|
deployment.gitea.image.rootless: false
|
|
secrets.gpg.enabled: true
|
|
secrets.gpg.new.privateKey: |-
|
|
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
|
{placeholder}
|
|
-----END PGP PRIVATE KEY BLOCK-----
|
|
asserts:
|
|
- equal:
|
|
path: data["init_directory_structure.sh"]
|
|
decodeBase64: true
|
|
value: |-
|
|
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
chown -v 1000:1000 /data
|
|
mkdir -pv /data/git/.ssh
|
|
chmod -Rv 700 /data/git/.ssh
|
|
[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
|
|
|
|
# prepare temp directory structure
|
|
mkdir -pv "${GITEA_TEMP}"
|
|
chown -v 1000:1000 "${GITEA_TEMP}"
|
|
chmod -v ug+rwx "${GITEA_TEMP}"
|
|
|
|
if [ ! -d "${GNUPGHOME}" ]; then
|
|
mkdir -pv "${GNUPGHOME}"
|
|
chmod -v 700 "${GNUPGHOME}"
|
|
chown -v 1000:1000 "${GNUPGHOME}"
|
|
fi
|
|
- it: renders data, not stringData, so removed keys are pruned on upgrade
|
|
set:
|
|
deployment.gitea.image.rootless: false
|
|
asserts:
|
|
- notExists:
|
|
path: stringData
|
|
- exists:
|
|
path: data["init_directory_structure.sh"]
|