volker.raschek/helm-gitea
1
0
Fork 0
Code Issues 3 Pull Requests 7 Actions Packages Projects Releases Wiki Activity
Files
e17a4e7a7b2f5e2a626719fa084c53854ddb454b
helm-gitea/unittests/helm/deployment/checksum-annotations.yaml
T
volker.raschekandCopilot e8f3a058ce feat(deployment)!: configurable init containers and Secret checksum lookup 
The chart-managed init containers were hardcoded inside `deployment.yaml`. Their image, environment, resources,
security context and volume mounts could not be adjusted individually, and custom init containers could only be
prepended or appended as a whole via `preExtraInitContainers`/`postExtraInitContainers`.

The init containers are now rendered from `deployment.initContainers`, an ordered list whose entries either `link` a
chart-managed init container (`initDirectories`, `initAppIni`, `initConfigureGPG`, `initConfigureGitea`) or provide a
free-form `container` definition. This allows custom containers at any position and makes the execution order
explicit. Each linked init container has its own configuration block in `values.yaml` and falls back to
`deployment.gitea.securityContext` and `initContainers.resources` when unset.

To support per-container images, `gitea.image` was split into the generic helper `gitea.image.name`, which renders an
arbitrary `image` dict instead of only `deployment.gitea.image`.

The pod annotations moved from `deployment.yaml` into the new helper `gitea.pod.annotations`. The SHA sum annotations
now also cover user-provided Secrets: their content is unknown to the chart, so the Secret is read from the cluster via
Helm's `lookup` function. Chart-managed Secrets keep using the rendered manifest, because the cluster still holds their
pre-upgrade state during rendering.

Because `lookup` requires `get` permission on Secrets and silently returns nothing during client-side rendering
(`helm template`, `--dry-run`, Argo CD without a live cluster), `addSHASumAnnotation` now defaults to `false`. The
trade-offs are documented in the README so users can make an informed decision.

BREAKING CHANGE: `preExtraInitContainers` and `postExtraInitContainers` have been removed. Add an entry with a
`container` key before or after the linked init containers in `deployment.initContainers` instead.

BREAKING CHANGE: `secrets.<secret>.addSHASumAnnotation` now defaults to `false`. Set it to `true` explicitly to keep
the rollout trigger on Secret changes.

Co-authored-by: Copilot <copilot@github.com>
2026-09-13 19:11:28 +02:00

159 lines
5.7 KiB
YAML
Raw Blame History

suite: deployment template (checksum annotations)
release:
name: gitea-unittests
namespace: testing
templates:
- templates/gitea/deployment.yaml
- templates/gitea/secret_admin.yaml
- templates/gitea/secret_config.yaml
- templates/gitea/secret_gpg.yaml
- templates/gitea/secret_init.yaml
- templates/gitea/secret_inlineConfig.yaml
- templates/gitea/secret_metrics.yaml
tests:
- it: omits the checksum annotations by default
template: templates/gitea/deployment.yaml
set:
secrets.admin.enabled: true
secrets.config.enabled: true
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: |
-----BEGIN PGP PRIVATE KEY BLOCK-----
-----END PGP PRIVATE KEY BLOCK-----
secrets.init.enabled: true
secrets.inlineConfig.enabled: true
secrets.metrics.enabled: true
asserts:
- notExists:
path: spec.template.metadata.annotations["checksum/admin"]
- notExists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/gpg"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- notExists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- notExists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled
template: templates/gitea/deployment.yaml
set:
secrets.admin.addSHASumAnnotation: true
secrets.admin.enabled: true
secrets.config.addSHASumAnnotation: true
secrets.config.enabled: true
secrets.gpg.addSHASumAnnotation: true
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: |
-----BEGIN PGP PRIVATE KEY BLOCK-----
-----END PGP PRIVATE KEY BLOCK-----
secrets.init.addSHASumAnnotation: true
secrets.init.enabled: true
secrets.inlineConfig.addSHASumAnnotation: true
secrets.inlineConfig.enabled: true
secrets.metrics.addSHASumAnnotation: true
secrets.metrics.enabled: true
asserts:
- exists:
path: spec.template.metadata.annotations["checksum/admin"]
- exists:
path: spec.template.metadata.annotations["checksum/config"]
- exists:
path: spec.template.metadata.annotations["checksum/gpg"]
- exists:
path: spec.template.metadata.annotations["checksum/init"]
- exists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- exists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: omits the checksum annotation of a single disabled Secret only
template: templates/gitea/deployment.yaml
set:
secrets.admin.addSHASumAnnotation: false
secrets.admin.enabled: true
secrets.config.addSHASumAnnotation: false
secrets.config.enabled: true
secrets.gpg.addSHASumAnnotation: false
secrets.gpg.enabled: true
secrets.gpg.new.privateKey: |
-----BEGIN PGP PRIVATE KEY BLOCK-----
-----END PGP PRIVATE KEY BLOCK-----
secrets.init.addSHASumAnnotation: false
secrets.init.enabled: true
secrets.inlineConfig.addSHASumAnnotation: false
secrets.inlineConfig.enabled: true
secrets.metrics.addSHASumAnnotation: false
secrets.metrics.enabled: true
asserts:
- notExists:
path: spec.template.metadata.annotations["checksum/admin"]
- notExists:
path: spec.template.metadata.annotations["checksum/config"]
- notExists:
path: spec.template.metadata.annotations["checksum/gpg"]
- notExists:
path: spec.template.metadata.annotations["checksum/init"]
- notExists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- notExists:
path: spec.template.metadata.annotations["checksum/metrics"]
- it: adds the checksum of Secrets provided by the user
template: templates/gitea/deployment.yaml
set:
secrets.admin.enabled: true
secrets.admin.addSHASumAnnotation: true
secrets.admin.existingSecret.enabled: true
secrets.admin.existingSecret.secretName: custom-admin
secrets.config.enabled: true
secrets.config.addSHASumAnnotation: true
secrets.config.existingSecret.enabled: true
secrets.config.existingSecret.secretName: custom-config
secrets.gpg.enabled: true
secrets.gpg.addSHASumAnnotation: true
secrets.gpg.existingSecret.enabled: true
secrets.gpg.existingSecret.secretName: custom-gpg
secrets.init.enabled: true
secrets.init.addSHASumAnnotation: true
secrets.init.existingSecret.enabled: true
secrets.init.existingSecret.secretName: custom-init
secrets.inlineConfig.enabled: true
secrets.inlineConfig.addSHASumAnnotation: true
secrets.inlineConfig.existingSecret.enabled: true
secrets.inlineConfig.existingSecret.secretName: custom-inline-config
secrets.metrics.enabled: true
secrets.metrics.addSHASumAnnotation: true
secrets.metrics.existingSecret.enabled: true
secrets.metrics.existingSecret.secretName: custom-metrics
asserts:
- exists:
path: spec.template.metadata.annotations["checksum/admin"]
- exists:
path: spec.template.metadata.annotations["checksum/config"]
- exists:
path: spec.template.metadata.annotations["checksum/gpg"]
- exists:
path: spec.template.metadata.annotations["checksum/init"]
- exists:
path: spec.template.metadata.annotations["checksum/inlineConfig"]
- exists:
path: spec.template.metadata.annotations["checksum/metrics"]
Reference in New Issue View Git Blame Copy Permalink