volker.raschekandCopilot
64c2f1a9cc
Both Secrets rendered their payload via `stringData`. That field is write-only: the API server decodes it into `data` and does not persist `stringData` itself. Helm's three-way merge therefore generates a deletion patch that targets `stringData`, while the live object only ever carries `data` - so a key that disappears from the rendered manifest is never pruned and survives every upgrade. Unlike the inline-config Secret fixed in #1110, the keys here are driven by the files in `scripts/init-containers/**` rather than by user values, so the bug is latent rather than acute. It still bites whenever a script is removed or renamed in the chart: the stale key stays in the Secret and keeps being mounted into the init containers. The two inline scripts of the init Secret were YAML block scalars and had to be moved into `define` blocks to be pipeable through `b64enc`. The bodies are dedented by four columns accordingly, and `trimAll "\n"` reproduces the chomping semantics of the previous `|-` scalars. Rendering was diffed against the previous revision for defaults, rootless, initPreScript, GPG, admin, LDAP, OAuth and all valkey variants - the decoded payloads are byte-identical, so no init script changes behaviour. Unit tests now read the payloads from `data.*` with `decodeBase64: true` and assert that `stringData` no longer exists, to catch a regression early. See: https://gitea.com/gitea/helm-gitea/issues/1109 See: https://gitea.com/gitea/helm-gitea/pulls/1110 Co-authored-by: Copilot <copilot@github.com>
59 lines
2.6 KiB
YAML
59 lines
2.6 KiB
YAML
{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
|
|
{{- $assertions := include "gitea.config.assertions" . -}}
|
|
{{- if not .Values.secrets.config.existingSecret.enabled -}}
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
{{- with (include "gitea.secret.config.annotations" .) }}
|
|
annotations:
|
|
{{- . | nindent 4 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "gitea.secret.config.labels" . | nindent 4 }}
|
|
name: {{ include "gitea.secret.config.name" . }}
|
|
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
|
type: Opaque
|
|
data:
|
|
{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
|
|
assertions: {{ $assertions | b64enc | quote }}
|
|
{{- end }}
|
|
|
|
{{- define "gitea.config.assertions" -}}
|
|
|
|
{{- /*assert that only one PG dep is enabled */ -}}
|
|
{{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
|
|
{{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
|
|
{{- end }}
|
|
|
|
{{- /* multiple replicas assertions */ -}}
|
|
{{- if gt (.Values.deployment.replicas | int) 1 -}}
|
|
{{- if .Values.gitea.config.cron -}}
|
|
{{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
|
|
{{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
|
|
{{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if eq (first .Values.persistence.new.accessModes) "ReadWriteOnce" -}}
|
|
{{- fail "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany." -}}
|
|
{{- end }}
|
|
{{- if .Values.gitea.config.indexer -}}
|
|
{{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
|
|
{{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
|
|
{{- end }}
|
|
{{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
|
|
{{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
|
|
{{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
|
|
{{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
|
|
{{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- end }}
|
|
{{- end }}
|