volker.raschekandCopilot
377306b418
`podSecurityContext` and `containerSecurityContext` are both Deployment-scoped: the former is rendered into `spec.template.spec.securityContext`, the latter into the securityContext of the Gitea container and the chart-managed init containers. Keeping them at the top level hid that pod/container distinction behind a naming convention and separated them from the other pod- and container-scoped settings that already live under `deployment` and `deployment.gitea`. `podSecurityContext` therefore becomes `deployment.securityContext` and `containerSecurityContext` becomes `deployment.gitea.securityContext`, which makes the scope obvious from the values path alone and continues the consolidation started with `deployment.gitea.env`, `deployment.gitea.resources` and `deployment.gitea.image`. The template helpers keep their argument-based signatures, because `gitea.containerSecurityContext` is also used by the Helm test pod and is not bound to a single values path. Both removed keys are covered by the deprecation check so that a silently dropped security context cannot lead to containers unexpectedly running as root or without the configured capability set. BREAKING CHANGE: `podSecurityContext` and `containerSecurityContext` no longer exist. Use `deployment.securityContext` and `deployment.gitea.securityContext` instead. Installations that still set the old keys will fail to render unless `checkDeprecation` is set to `false`. Co-authored-by: Copilot <copilot@github.com>
115 lines
3.5 KiB
YAML
115 lines
3.5 KiB
YAML
suite: deployment template (openshift)
|
|
release:
|
|
name: gitea-unittests
|
|
namespace: testing
|
|
templates:
|
|
- templates/gitea/deployment.yaml
|
|
- templates/gitea/secret_admin.yaml
|
|
- templates/gitea/secret_config.yaml
|
|
- templates/gitea/secret_gpg.yaml
|
|
- templates/gitea/secret_init.yaml
|
|
- templates/gitea/secret_inlineConfig.yaml
|
|
- templates/gitea/secret_metrics.yaml
|
|
tests:
|
|
- it: renders openshift-compatible defaults for chart-managed containers
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift.enabled: true
|
|
asserts:
|
|
- notExists:
|
|
path: spec.template.spec.hostUsers
|
|
- notExists:
|
|
path: spec.template.spec.securityContext
|
|
- equal:
|
|
path: spec.template.spec.initContainers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.initContainers[1].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext
|
|
value:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
- it: does not force runAsUser 1000 for command init containers on OpenShift
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift.enabled: true
|
|
secrets.gpg.enabled: true
|
|
secrets.gpg.existingSecret.enabled: true
|
|
secrets.gpg.existingSecret.secretName: custom-gpg-secret
|
|
asserts:
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
|
- notExists:
|
|
path: spec.template.spec.initContainers[3].securityContext.runAsUser
|
|
|
|
- it: preserves explicit pod and container security context overrides on OpenShift
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift:
|
|
enabled: true
|
|
hostUsers: true
|
|
deployment:
|
|
securityContext:
|
|
fsGroup: 1000620000
|
|
gitea:
|
|
securityContext:
|
|
runAsUser: 1000620000
|
|
runAsGroup: 1000620000
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.hostUsers
|
|
value: true
|
|
- equal:
|
|
path: spec.template.spec.securityContext
|
|
value:
|
|
fsGroup: 1000620000
|
|
- equal:
|
|
path: spec.template.spec.initContainers[2].securityContext.runAsUser
|
|
value: 1000620000
|
|
- equal:
|
|
path: spec.template.spec.containers[0].securityContext.runAsGroup
|
|
value: 1000620000
|
|
|
|
- it: renders an explicit hostUsers=false override on OpenShift
|
|
template: templates/gitea/deployment.yaml
|
|
set:
|
|
openshift:
|
|
enabled: true
|
|
hostUsers: false
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.hostUsers
|
|
value: false
|