Move all password related data to secrets (#28)
Bump Chart version Move all password related data to secrets Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/28 Reviewed-by: techknowlogick <techknowlogick@gitea.io> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
luhahn
Lunny Xiao
parent
f7faa6699a
commit
1f95ae962c
4 changed files with 70 additions and 56 deletions
|
|
@ -2,7 +2,7 @@ apiVersion: v2
|
|||
name: gitea
|
||||
description: Gitea Helm chart for Kubernetes
|
||||
type: application
|
||||
version: 1.4.9
|
||||
version: 1.5.0
|
||||
appVersion: 1.12.4
|
||||
icon: https://docs.gitea.io/images/gitea.png
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,11 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
data:
|
||||
type: Opaque
|
||||
stringData:
|
||||
app.ini: |-
|
||||
{{- if not (hasKey .Values.gitea.config "cache") -}}
|
||||
{{- $_ := set .Values.gitea.config "cache" dict -}}
|
||||
|
|
|
|||
57
templates/gitea/init.yaml
Normal file
57
templates/gitea/init.yaml
Normal file
|
|
@ -0,0 +1,57 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}-init
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
init_gitea.sh: |-
|
||||
#!/bin/bash
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
mkdir -p /data/gitea/conf
|
||||
cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
|
||||
chmod a+rwx /data/gitea/conf/app.ini
|
||||
nc -v -w2 -z {{ include "db.servicename" . }} {{ include "db.port" . }} && \
|
||||
su git -c ' \
|
||||
set -x; \
|
||||
gitea migrate; \
|
||||
{{- if and .Values.gitea.admin.username .Values.gitea.admin.password }}
|
||||
gitea admin create-user --username {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}' --email {{ .Values.gitea.admin.email }} --admin \
|
||||
|| \
|
||||
gitea admin change-password --username {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}'; \
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap.enabled }}
|
||||
gitea admin auth add-ldap \
|
||||
--name {{ .Values.gitea.ldap.name | quote }} \
|
||||
--security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
|
||||
--host {{ .Values.gitea.ldap.host | quote }} \
|
||||
--port {{ .Values.gitea.ldap.port | int}} \
|
||||
--user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
|
||||
--user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
|
||||
--admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
|
||||
--email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
|
||||
--bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
|
||||
--bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
|
||||
--synchronize-users \
|
||||
--username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
|
||||
|| \
|
||||
( \
|
||||
export GITEA_AUTH_ID=$(gitea admin auth list | grep {{ .Values.gitea.ldap.name | quote }} | awk -F " " "{print \$1}"); \
|
||||
gitea admin auth update-ldap --id ${GITEA_AUTH_ID} \
|
||||
--name {{ .Values.gitea.ldap.name | quote }} \
|
||||
--security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
|
||||
--host {{ .Values.gitea.ldap.host | quote }} \
|
||||
--port {{ .Values.gitea.ldap.port | int}} \
|
||||
--user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
|
||||
--user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
|
||||
--admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
|
||||
--email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
|
||||
--bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
|
||||
--bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
|
||||
--synchronize-users \
|
||||
--username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
|
||||
) \
|
||||
{{- end }}
|
||||
'
|
||||
|
|
@ -25,58 +25,10 @@ spec:
|
|||
initContainers:
|
||||
- name: init
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.version }}"
|
||||
env:
|
||||
- name: SCRIPT
|
||||
value: &script |-
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
mkdir -p /data/gitea/conf
|
||||
cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
|
||||
chmod a+rwx /data/gitea/conf/app.ini
|
||||
nc -v -w2 -z {{ include "db.servicename" . }} {{ include "db.port" . }} && \
|
||||
su git -c ' \
|
||||
set -x; \
|
||||
gitea migrate; \
|
||||
{{- if and .Values.gitea.admin.username .Values.gitea.admin.password }}
|
||||
gitea admin create-user --username {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}' --email {{ .Values.gitea.admin.email }} --admin \
|
||||
|| \
|
||||
gitea admin change-password --username {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}'; \
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap.enabled }}
|
||||
gitea admin auth add-ldap \
|
||||
--name {{ .Values.gitea.ldap.name | quote }} \
|
||||
--security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
|
||||
--host {{ .Values.gitea.ldap.host | quote }} \
|
||||
--port {{ .Values.gitea.ldap.port | int}} \
|
||||
--user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
|
||||
--user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
|
||||
--admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
|
||||
--email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
|
||||
--bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
|
||||
--bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
|
||||
--synchronize-users \
|
||||
--username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
|
||||
|| \
|
||||
( \
|
||||
export GITEA_AUTH_ID=$(gitea admin auth list | grep {{ .Values.gitea.ldap.name | quote }} | awk -F " " "{print \$1}"); \
|
||||
gitea admin auth update-ldap --id ${GITEA_AUTH_ID} \
|
||||
--name {{ .Values.gitea.ldap.name | quote }} \
|
||||
--security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
|
||||
--host {{ .Values.gitea.ldap.host | quote }} \
|
||||
--port {{ .Values.gitea.ldap.port | int}} \
|
||||
--user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
|
||||
--user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
|
||||
--admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
|
||||
--email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
|
||||
--bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
|
||||
--bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
|
||||
--synchronize-users \
|
||||
--username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
|
||||
) \
|
||||
{{- end }}
|
||||
'
|
||||
command: ["/bin/sh",'-c', *script]
|
||||
command: ["/usr/sbin/init_gitea.sh"]
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: config
|
||||
mountPath: /etc/gitea/conf
|
||||
- name: data
|
||||
|
|
@ -134,9 +86,13 @@ spec:
|
|||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: init
|
||||
secret:
|
||||
secretName: {{ include "gitea.fullname" . }}-init
|
||||
defaultMode: 0777
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
secret:
|
||||
secretName: {{ include "gitea.fullname" . }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
|
|
|
|||
Loading…
Reference in a new issue