DevFW-CICD/forgejo-helm
16
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'main' into helm-sign

Browse source
This commit is contained in:
pat-s 2023-05-02 16:17:04 +02:00
commit 2198bbe43e
No known key found for this signature in database
GPG key ID: 3C6318841EF78925
11 changed files with 236 additions and 284 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

103
.drone.yml
View file

@ -1,103 +0,0 @@
# ---
# kind: pipeline
# type: docker
# name: lint
# platform:
# os: linux
# arch: arm64
# steps:
# - name: helm lint
# pull: always
# image: alpine:3.17
# commands:
# - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
# - helm lint
# - name: helm template
# pull: always
# image: alpine:3.17
# commands:
# - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
# - helm dependency update
# - helm template --debug gitea-helm .
# - name: helm unittests
# pull: always
# image: alpine:3.17
# commands:
# - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make helm git bash
# - helm plugin install https://github.com/helm-unittest/helm-unittest
# - helm dependency update
# - make unittests
# - name: verify readme
# pull: always
# image: alpine:3.17
# commands:
# - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make npm git
# - make readme
# - git diff --exit-code --name-only README.md
# - name: yaml lint
# pull: always
# image: cytopia/yamllint:alpine-1
# commands:
# - yamllint -f colored .
kind: pipeline
type: docker
name: release-version
platform:
os: linux
arch: arm64
trigger:
event:
- push
steps:
- name: generate-chart
pull: always
image: alpine:3.17
environment:
GPGSIGN_KEY:
from_secret: gpgsign_key
GPGSIGN_PASSPHRASE:
from_secret: gpgsign_passphrase
commands:
- apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
- apk add --no-cache curl
- apk add --no-cache gnupg
# - echo $GPGSIGN_KEY > private.key && echo $GPGSIGN_PASSPHRASE > passphrase.txt && gpg --batch --passphrase-file=passphrase.txt --import private.key && rm private.key passphrase.txt
- echo $GPGSIGN_PASSPHRASE > passphrase.txt && echo $GPGSIGN_KEY | gpg --batch --passphrase-file=passphrase.txt --import
- helm dependency update
- helm package --sign --key 'Gitea' --keyring ~/.gnupg/secring.gpg --version "${DRONE_TAG##v}" ./
- mkdir gitea
- mv gitea*.tgz gitea/
- curl -L -o gitea/index.yaml https://dl.gitea.io/charts/index.yaml
- helm repo index gitea/ --url https://dl.gitea.io/charts --merge gitea/index.yaml
# - name: upload-chart
# pull: always
# image: plugins/s3:latest
# settings:
# acl:
# from_secret: aws_s3_acl
# region:
# from_secret: aws_s3_region
# bucket:
# from_secret: aws_s3_bucket
# endpoint:
# from_secret: aws_s3_endpoint
# path_style:
# from_secret: aws_s3_path_style
# access_key:
# from_secret: aws_access_key_id
# secret_key:
# from_secret: aws_secret_access_key
# source: gitea/*
# target: /charts
# strip_prefix: gitea/

42
.gitea/workflows/release-version.yml Normal file
View file

@ -0,0 +1,42 @@
name: generate-chart
on:
push:
tags:
- "*"
jobs:
generate-chart-publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: install tools
run: |
apt update -y
apt install -y curl
curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | tee /usr/share/keyrings/helm.gpg > /dev/null
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | tee /etc/apt/sources.list.d/helm-stable-debian.list
apt update -y
apt install -y python helm python3-pip apt-transport-https
pip install awscli
- name: package chart
run: |
helm dependency update
helm package --version "${GITHUB_REF#refs/tags/v}" ./
mkdir gitea
mv gitea*.tgz gitea/
curl -L -o gitea/index.yaml https://dl.gitea.com/charts/index.yaml
helm repo index gitea/ --url https://dl.gitea.io/charts --merge gitea/index.yaml
- name: aws credential configure
uses: https://github.com/aws-actions/configure-aws-credentials@v2
with:
aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_REGION }}
- name: install aws cli
run: |
apt update -y &&
pip install awscli
- name: Copy files to S3 and clear cache
run: |
aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET}}/charts/

36
.gitea/workflows/test-pr.yml Normal file
View file

@ -0,0 +1,36 @@
name: check-and-test
on:
- pull_request
jobs:
check-and-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: install tools
run: |
apt update -y
apt install -y curl make
curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | tee /usr/share/keyrings/helm.gpg > /dev/null
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | tee /etc/apt/sources.list.d/helm-stable-debian.list
apt update -y
apt install -y helm python3-pip
pip install yamllint
- name: dependency update
run: helm dependency update
- name: lint
run: helm lint
- name: template
run: |
helm template --debug gitea-helm .
- name: unit tests
run: |
helm plugin install --version 0.3.1 https://github.com/helm-unittest/helm-unittest
make unittests
- name: verify readme
run: |
make readme
git diff --exit-code --name-only README.md
- name: yaml lint
uses: https://github.com/ibiqlik/action-yamllint@v3

8
Chart.lock
View file

@ -1,9 +1,9 @@
dependencies: dependencies:
- name: memcached - name: memcached
repository: oci://registry-1.docker.io/bitnamicharts repository: oci://registry-1.docker.io/bitnamicharts
version: 6.3.13 version: 6.3.14
- name: postgresql - name: postgresql
repository: oci://registry-1.docker.io/bitnamicharts repository: oci://registry-1.docker.io/bitnamicharts
version: 12.2.6 version: 12.4.1
digest: sha256:7a37054b0ae841314b1e309fec6f1edc0f22f77161ee915ebfb1ce011457884c digest: sha256:02d4846bf416038a42658dbca8f8001d0e3ce967b00e990048f8d420065c33fd
generated: "2023-03-28T21:20:51.230043+02:00" generated: "2023-04-28T09:32:05.295167+02:00"

9
Chart.yaml
View file

@ -3,7 +3,7 @@ name: gitea
description: Gitea Helm chart for Kubernetes description: Gitea Helm chart for Kubernetes
type: application type: application
version: 0.0.0 version: 0.0.0
appVersion: 1.19.1 appVersion: 1.19.2
icon: https://docs.gitea.io/images/gitea.png icon: https://docs.gitea.io/images/gitea.png
keywords: keywords:
@ -34,12 +34,13 @@ maintainers:
# Bitnami charts are served from GitHub CDN - See https://github.com/bitnami/charts/issues/10539 for details # Bitnami charts are served from GitHub CDN - See https://github.com/bitnami/charts/issues/10539 for details
dependencies: dependencies:
# OCI registry: https://blog.bitnami.com/2023/01/bitnami-helm-charts-available-as-oci.html (2023-01) # OCI registry: https://blog.bitnami.com/2023/01/bitnami-helm-charts-available-as-oci.html (2023-01)
# Chart release date: 2023-03 # Chart release date: 2023-04
- name: memcached - name: memcached
repository: oci://registry-1.docker.io/bitnamicharts repository: oci://registry-1.docker.io/bitnamicharts
version: 6.3.13 version: 6.3.14
condition: memcached.enabled condition: memcached.enabled
# Chart release date: 2023-04
- name: postgresql - name: postgresql
repository: oci://registry-1.docker.io/bitnamicharts repository: oci://registry-1.docker.io/bitnamicharts
version: 12.2.6 version: 12.4.1
condition: postgresql.enabled condition: postgresql.enabled

293
README.md
View file

@ -1,15 +1,13 @@
# Gitea Helm Chart # Gitea Helm Chart
[Gitea](https://gitea.io/en-us/) is a community managed lightweight code hosting [Gitea](https://gitea.io/en-us/) is a community managed lightweight code hosting solution written in Go.
solution written in Go. It is published under the MIT license. It is published under the MIT license.
## Introduction ## Introduction
This helm chart has taken some inspiration from [jfelten's helm This helm chart has taken some inspiration from [jfelten's helm chart](https://github.com/jfelten/gitea-helm-chart).
chart](https://github.com/jfelten/gitea-helm-chart). But takes a completely But takes a completely different approach in providing a database and cache with dependencies.
different approach in providing a database and cache with dependencies. Additionally, this chart provides LDAP and admin user configuration with values, as well as being deployed as a statefulset to retain stored repositories.
Additionally, this chart provides LDAP and admin user configuration with values,
as well as being deployed as a statefulset to retain stored repositories.
## Update and versioning policy ## Update and versioning policy
@ -29,9 +27,8 @@ Yet most often no issues will be encountered and the chart maintainers aim to co
## Dependencies ## Dependencies
Gitea can be run with an external database and cache. This chart provides those Gitea can be run with an external database and cache.
dependencies, which can be enabled, or disabled via This chart provides those dependencies, which can be enabled, or disabled via configuration.
configuration.
Dependencies: Dependencies:
@ -46,8 +43,7 @@ helm repo update
helm install gitea gitea-charts/gitea helm install gitea gitea-charts/gitea
``` ```
When upgrading, please refer to the [Upgrading](#upgrading) section at the bottom When upgrading, please refer to the [Upgrading](#upgrading) section at the bottom of this document for major and breaking changes.
of this document for major and breaking changes.
## Prerequisites ## Prerequisites
@ -59,8 +55,8 @@ of this document for major and breaking changes.
### Gitea Configuration ### Gitea Configuration
Gitea offers lots of configuration options. This is fully described in the Gitea offers lots of configuration options.
[Gitea Cheat Sheet](https://docs.gitea.io/en-us/config-cheat-sheet/). This is fully described in the [Gitea Cheat Sheet](https://docs.gitea.io/en-us/config-cheat-sheet/).
```yaml ```yaml
gitea: gitea:
@ -74,18 +70,17 @@ gitea:
### Default Configuration ### Default Configuration
This chart will set a few defaults in the Gitea configuration based on the This chart will set a few defaults in the Gitea configuration based on the service and ingress settings.
service and ingress settings. All defaults can be overwritten in `gitea.config`. All defaults can be overwritten in `gitea.config`.
INSTALL_LOCK is always set to true, since we want to configure Gitea with this INSTALL_LOCK is always set to true, since we want to configure Gitea with this helm chart and everything is taken care of.
helm chart and everything is taken care of.
_All default settings are made directly in the generated app.ini, not in the Values._ _All default settings are made directly in the generated app.ini, not in the Values._
#### Database defaults #### Database defaults
If a builtIn database is enabled the database configuration is set If a builtIn database is enabled the database configuration is set automatically.
automatically. For example, PostgreSQL builtIn will appear in the app.ini as: For example, PostgreSQL builtIn will appear in the app.ini as:
```ini ```ini
[database] [database]
@ -98,8 +93,8 @@ USER = gitea
#### Memcached defaults #### Memcached defaults
Memcached is handled the exact same way as database builtIn. Once Memcached Memcached is handled the exact same way as database builtIn.
builtIn is enabled, this chart will generate the following part in the `app.ini`: Once Memcached builtIn is enabled, this chart will generate the following part in the `app.ini`:
```ini ```ini
[cache] [cache]
@ -110,9 +105,9 @@ HOST = RELEASE-NAME-memcached.default.svc.cluster.local:11211
#### Server defaults #### Server defaults
The server defaults are a bit more complex. If ingress is `enabled`, the The server defaults are a bit more complex.
`ROOT_URL`, `DOMAIN` and `SSH_DOMAIN` will be set accordingly. `HTTP_PORT` If ingress is `enabled`, the `ROOT_URL`, `DOMAIN` and `SSH_DOMAIN` will be set accordingly.
always defaults to `3000` as well as `SSH_PORT` to `22`. `HTTP_PORT` always defaults to `3000` as well as `SSH_PORT` to `22`.
```ini ```ini
[server] [server]
@ -141,14 +136,11 @@ ENABLED = false
> **The [generic](https://docs.gitea.io/en-us/config-cheat-sheet/#overall-default) > **The [generic](https://docs.gitea.io/en-us/config-cheat-sheet/#overall-default)
> section cannot be defined that way.** > section cannot be defined that way.**
Some settings inside _app.ini_ (like passwords or whole authentication configurations) Some settings inside _app.ini_ (like passwords or whole authentication configurations) must be considered sensitive and therefore should not be passed via plain text inside the _values.yaml_ file.
must be considered sensitive and therefore should not be passed via plain text In times of _GitOps_ the values.yaml could be stored in a Git repository where sensitive data should never be accessible.
inside the _values.yaml_ file. In times of _GitOps_ the values.yaml could be stored
in a Git repository where sensitive data should never be accessible.
The Helm Chart supports this approach and let the user define custom sources like The Helm Chart supports this approach and let the user define custom sources like
Kubernetes Secrets to be loaded as environment variables during _app.ini_ creation Kubernetes Secrets to be loaded as environment variables during _app.ini_ creation or update.
or update.
```yaml ```yaml
gitea: gitea:
@ -161,8 +153,7 @@ gitea:
This would mount the two additional volumes (`oauth` and `some-additionals`) This would mount the two additional volumes (`oauth` and `some-additionals`)
from different sources to the init containerwhere the _app.ini_ gets updated. from different sources to the init containerwhere the _app.ini_ gets updated.
All files mounted that way will be read and converted to environment variables All files mounted that way will be read and converted to environment variables and then added to the _app.ini_ using [environment-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini).
and then added to the _app.ini_ using [environment-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini).
The key of such additional source represents the section inside the _app.ini_. The key of such additional source represents the section inside the _app.ini_.
The value for each key can be multiline ini-like definitions. The value for each key can be multiline ini-like definitions.
@ -199,19 +190,15 @@ stringData:
#### User defined environment variables in app.ini #### User defined environment variables in app.ini
Users are able to define their own environment variables, Users are able to define their own environment variables, which are loaded into the containers.
which are loaded into the containers. We also support to We also support to directly interact with the generated _app.ini_.
directly interact with the generated _app.ini_.
To inject self defined variables into the _app.ini_ a To inject self defined variables into the _app.ini_ a certain format needs to be honored.
certain format needs to be honored. This is This is described in detail on the [env-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini) page.
described in detail on the [env-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini)
page.
Note that the Prefix on this helm chart is `ENV_TO_INI`. Note that the Prefix on this helm chart is `ENV_TO_INI`.
For example a database setting needs to have the following For example a database setting needs to have the following format:
format:
```yaml ```yaml
gitea: gitea:
@ -228,8 +215,8 @@ gitea:
Priority (highest to lowest) for defining app.ini variables: Priority (highest to lowest) for defining app.ini variables:
1. Environment variables prefixed with `ENV_TO_INI` 1. Environment variables prefixed with `ENV_TO_INI`
2. Additional config sources 1. Additional config sources
3. Values defined in `gitea.config` 1. Values defined in `gitea.config`
### External Database ### External Database
@ -255,7 +242,8 @@ postgresql:
### Ports and external url ### Ports and external url
By default port `3000` is used for web traffic and `22` for ssh. Those can be changed: By default port `3000` is used for web traffic and `22` for ssh.
Those can be changed:
```yaml ```yaml
service: service:
@ -265,15 +253,14 @@ service:
port: 22 port: 22
``` ```
This helm chart automatically configures the clone urls to use the correct This helm chart automatically configures the clone urls to use the correct ports.
ports. You can change these ports by hand using the `gitea.config` dict. However You can change these ports by hand using the `gitea.config` dict.
you should know what you're doing. However you should know what you're doing.
### ClusterIP ### ClusterIP
By default the clusterIP will be set to None, which is the default for headless By default the `clusterIP` will be set to `None`, which is the default for headless services.
services. However if you want to omit the clusterIP field in the service, use However if you want to omit the clusterIP field in the service, use the following values:
the following values:
```yaml ```yaml
service: service:
@ -289,9 +276,8 @@ service:
### SSH and Ingress ### SSH and Ingress
If you're using ingress and want to use SSH, keep in mind, that ingress is not If you're using ingress and want to use SSH, keep in mind, that ingress is not able to forward SSH Ports.
able to forward SSH Ports. You will need a LoadBalancer like `metallb` and a You will need a LoadBalancer like `metallb` and a setting in your ssh service annotations.
setting in your ssh service annotations.
```yaml ```yaml
service: service:
@ -302,8 +288,8 @@ service:
### SSH on crio based kubernetes cluster ### SSH on crio based kubernetes cluster
If you use crio as container runtime it is not possible to read from a remote If you use `crio` as container runtime it is not possible to read from a remote repository.
repository. You should get an error message like this: You should get an error message like this:
```bash ```bash
$ git clone git@k8s-demo.internal:admin/test.git $ git clone git@k8s-demo.internal:admin/test.git
@ -320,15 +306,15 @@ More about this issue [here](https://gitea.com/gitea/helm-chart/issues/161).
### Cache ### Cache
This helm chart can use a built in cache. The default is Memcached from bitnami. This helm chart can use a built in cache.
The default is Memcached from bitnami.
```yaml ```yaml
memcached: memcached:
enabled: true enabled: true
``` ```
If the built in cache should not be used simply configure the cache in If the built in cache should not be used simply configure the cache in `gitea.config`.
`gitea.config`.
```yaml ```yaml
gitea: gitea:
@ -342,15 +328,14 @@ gitea:
### Persistence ### Persistence
Gitea will be deployed as a statefulset. By simply enabling the persistence and Gitea will be deployed as a statefulset.
setting the storage class according to your cluster everything else will be By simply enabling the persistence and setting the storage class according to your cluster everything else will be taken care of.
taken care of. The following example will create a PVC as a part of the The following example will create a PVC as a part of the statefulset.
statefulset. This PVC will not be deleted even if you uninstall the chart. This PVC will not be deleted even if you uninstall the chart.
Please note, that an empty storageClass in the persistence will result in Please note, that an empty storageClass in the persistence will result in kubernetes using your default storage class.
kubernetes using your default storage class.
If you want to use your own storageClass define it as followed: If you want to use your own storage class define it as follows:
```yaml ```yaml
persistence: persistence:
@ -358,8 +343,7 @@ persistence:
storageClass: myOwnStorageClass storageClass: myOwnStorageClass
``` ```
When using PostgreSQL as dependency, this will also be deployed as a statefulset When using PostgreSQL as dependency, this will also be deployed as a statefulset by default.
by default.
If you want to manage your own PVC you can simply pass the PVC name to the chart. If you want to manage your own PVC you can simply pass the PVC name to the chart.
@ -383,10 +367,11 @@ postgresql:
### Admin User ### Admin User
This chart enables you to create a default admin user. It is also possible to This chart enables you to create a default admin user.
update the password for this user by upgrading or redeloying the chart. It is It is also possible to update the password for this user by upgrading or redeloying the chart.
not possible to delete an admin user after it has been created. This has to be It is not possible to delete an admin user after it has been created.
done in the ui. You cannot use `admin` as username. This has to be done in the ui.
You cannot use `admin` as username.
```yaml ```yaml
gitea: gitea:
@ -439,7 +424,7 @@ gitea:
publicSSHKeyAttribute: publicSSHKey publicSSHKeyAttribute: publicSSHKey
``` ```
You can also use an existing secret to set the bindDn and bindPassword: You can also use an existing secret to set the `bindDn` and `bindPassword`:
```yaml ```yaml
apiVersion: v1 apiVersion: v1
@ -459,9 +444,9 @@ gitea:
... ...
``` ```
⚠️ Some options are just flags and therefore don't have any values. If they ⚠️ Some options are just flags and therefore don't have any values.
are defined in `gitea.ldap` configuration, they will be passed to the Gitea CLI If they are defined in `gitea.ldap` configuration, they will be passed to the Gitea CLI without any value.
without any value. Affected options: Affected options:
- notActive - notActive
- skipTlsVerify - skipTlsVerify
@ -471,9 +456,9 @@ without any value. Affected options:
### OAuth2 Settings ### OAuth2 Settings
Like the admin user, OAuth2 settings can be updated and disabled but not Like the admin user, OAuth2 settings can be updated and disabled but not deleted.
deleted. Deleting OAuth2 settings has to be done in the ui. All OAuth2 values, Deleting OAuth2 settings has to be done in the ui.
which are documented [here](https://docs.gitea.io/en-us/command-line/#admin), are All OAuth2 values, which are documented [here](https://docs.gitea.io/en-us/command-line/#admin), are
available. available.
Multiple OAuth2 sources can be configured with additional OAuth list items. Multiple OAuth2 sources can be configured with additional OAuth list items.
@ -516,15 +501,12 @@ gitea:
## Configure commit signing ## Configure commit signing
When using the rootless image the gpg key folder is not persistent by When using the rootless image the gpg key folder is not persistent by default.
default. If you consider using signed commits for internal Gitea activities If you consider using signed commits for internal Gitea activities (e.g. initial commit), you'd need to provide a signing key.
(e.g. initial commit), you'd need to provide a signing key. Prior to Prior to [PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be re-imported once the container got replaced by another.
[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be
re-imported once the container got replaced by another.
The mentioned PR introduced a new configuration object `signing` allowing you to The mentioned PR introduced a new configuration object `signing` allowing you to configure prerequisites for commit signing.
configure prerequisites for commit signing. By default this section is disabled By default this section is disabled to maintain backwards compatibility.
to maintain backwards compatibility.
```yaml ```yaml
signing: signing:
@ -532,9 +514,8 @@ signing:
gpgHome: /data/git/.gnupg gpgHome: /data/git/.gnupg
``` ```
Regardless of the used container image the `signing` object allows to specify a Regardless of the used container image the `signing` object allows to specify a private gpg key.
private gpg key. Either using the `signing.privateKey` to define the key inline, Either using the `signing.privateKey` to define the key inline, or refer to an existing secret containing the key data by using `signing.existingSecret`.
or refer to an existing secret containing the key data by using `signing.existingSecret`.
```yaml ```yaml
apiVersion: v1 apiVersion: v1
@ -554,19 +535,15 @@ signing:
existingSecret: custom-gitea-gpg-key existingSecret: custom-gitea-gpg-key
``` ```
To use the gpg key, Gitea needs to be configured accordingly. A detailed description To use the gpg key, Gitea needs to be configured accordingly.
can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration). A detailed description can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration).
### Metrics and profiling ### Metrics and profiling
A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling endpoints on port 6060 can be enabled under `gitea`.
endpoints on port 6060 can be enabled under `gitea`. Beware that the metrics Beware that the metrics endpoint is exposed via the ingress, manage access using ingress annotations for example.
endpoint is exposed via the ingress, manage access using ingress annotations for
example.
To deploy the `ServiceMonitor`, you first need to ensure that you have deployed To deploy the `ServiceMonitor`, you first need to ensure that you have deployed `prometheus-operator` and its [CRDs](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions).
`prometheus-operator` and its
[CRDs](https://github.com/prometheus-operator/prometheus-operator#customresourcedefinitions).
```yaml ```yaml
gitea: gitea:
@ -779,7 +756,7 @@ gitea:
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------------- | ---------------------------------------------------------------- | ------- | | ------------------------------------------------------- | ---------------------------------------------------------------- | ------- |
| `postgresql.enabled` | Enable PostgreSQL | `true` | | `postgresql.enabled` | Enable PostgreSQL | `true` |
| `postgresql.global.postgresql.auth.password` | Password for the "Gitea" user (overrides `auth.password`) | `gitea` | | `postgresql.global.postgresql.auth.password` | Password for the `gitea` user (overrides `auth.password`) | `gitea` |
| `postgresql.global.postgresql.auth.database` | Name for a custom database to create (overrides `auth.database`) | `gitea` | | `postgresql.global.postgresql.auth.database` | Name for a custom database to create (overrides `auth.database`) | `gitea` |
| `postgresql.global.postgresql.auth.username` | Name for a custom user to create (overrides `auth.username`) | `gitea` | | `postgresql.global.postgresql.auth.username` | Name for a custom user to create (overrides `auth.username`) | `gitea` |
| `postgresql.global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`) | `5432` | | `postgresql.global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`) | `5432` |
@ -793,6 +770,7 @@ gitea:
| `test.enabled` | Set it to false to disable test-connection Pod. | `true` | | `test.enabled` | Set it to false to disable test-connection Pod. | `true` |
| `test.image.name` | Image name for the wget container used in the test-connection Pod. | `busybox` | | `test.image.name` | Image name for the wget container used in the test-connection Pod. | `busybox` |
| `test.image.tag` | Image tag for the wget container used in the test-connection Pod. | `latest` | | `test.image.tag` | Image tag for the wget container used in the test-connection Pod. | `latest` |
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
## Contributing ## Contributing
@ -831,26 +809,21 @@ See [Configure commit signing](#configure-commit-signing) for details.
#### Different volume mounts for init-containers and runtime container #### Different volume mounts for init-containers and runtime container
**The `extraVolumeMounts` is deprecated** in favor of `extraInitVolumeMounts` and **The `extraVolumeMounts` is deprecated** in favor of `extraInitVolumeMounts` and `extraContainerVolumeMounts`.
`extraContainerVolumeMounts`. You can now have different mounts for the initialization You can now have different mounts for the initialization phase and Gitea runtime.
phase and Gitea runtime. The deprecated `extraVolumeMounts` will still be available The deprecated `extraVolumeMounts` will still be available for the time being and is mounted into every container.
for the time being and is mounted into every container. If you want to switch to If you want to switch to the new settings and want to mount specific volumes into all containers, you have to configure their mount points within both new settings.
the new settings and want to mount specific volumes into all containers, you have
to configure their mount points within both new settings.
**Combining values from the deprecated setting with values from the new settings **Combining values from the deprecated setting with values from the new settings is not possible.**
is not possible.**
#### New `enabled` flag for `startupProbe` #### New `enabled` flag for `startupProbe`
Prior to this version the `startupProbe` was just a commented sample within the Prior to this version the `startupProbe` was just a commented sample within the `values.yaml`.
`values.yaml`. With the migration to an auto-generated [Parameters](#parameters) With the migration to an auto-generated [Parameters](#parameters) section, a new parameter `gitea.startupProbe.enabled` has been introduced set to
section, a new parameter `gitea.startupProbe.enabled` has been introduced set to
`false` by default. `false` by default.
If you are using the `startupProbe` you need to add that new If you are using the `startupProbe` you need to add that new parameter and set it to `true`.
parameter and set it to `true`. Otherwise, your defined probe won't be considered Otherwise, your defined probe won't be considered after the upgrade.
after the upgrade.
### To 5.0.0 ### To 5.0.0
@ -858,9 +831,7 @@ after the upgrade.
#### Enable Dependencies #### Enable Dependencies
The values to enable the dependencies, The values to enable the dependencies, such as PostgreSQL, Memcached, MySQL and MariaDB have been moved from `gitea.database.builtIn.` to the dependency values.
such as PostgreSQL, Memcached, MySQL and MariaDB.
have been moved from `gitea.database.builtIn.` to the dependency values.
You can now enable the dependencies as followed: You can now enable the dependencies as followed:
@ -880,39 +851,32 @@ mariadb:
#### App.ini generation #### App.ini generation
The app.ini generation has changed and now utilizes the environment-to-ini The app.ini generation has changed and now utilizes the environment-to-ini script provided by newer Gitea versions.
script provided by newer Gitea versions. This change ensures, that the app.ini This change ensures, that the app.ini is now persistent.
is now persistent.
##### Secret Key generation ##### Secret Key generation
Gitea secret keys (SECRET_KEY, INTERNAL_TOKEN, JWT_SECRET) are now generated Gitea secret keys (SECRET_KEY, INTERNAL_TOKEN, JWT_SECRET) are now generated automatically in certain situations:
automatically in certain situations:
- New install: By default the secrets are created automatically. If you provide - New install: By default the secrets are created automatically.
secrets via `gitea.config` they will be used instead of automatic generation. If you provide secrets via `gitea.config` they will be used instead of automatic generation.
- Existing installs: The secrets won't be deployed, neither via - Existing installs: The secrets won't be deployed, neither via configuration nor via auto generation.
configuration nor via auto generation. We explicitly prevent to set new secrets. We explicitly prevent to set new secrets.
> 💡 It would be possible to set new secret keys manually by entering > 💡 It would be possible to set new secret keys manually by entering the running container and rewriting the app.ini by hand.
> the running container and rewriting the app.ini by hand. However, this it is > However, this it is not advisable to do so for existing installations.
> not advisable to do so for existing installations. Certain settings like > Certain settings like _LDAP_ would not be readable anymore.
> _LDAP_ would not be readable anymore.
#### Probes #### Probes
`gitea.customLivenessProbe`, `gitea.customReadinessProbe` and `gitea.customStartupProbe` `gitea.customLivenessProbe`, `gitea.customReadinessProbe` and `gitea.customStartupProbe` have been removed.
have been removed.
They are replaced by the settings `gitea.livenessProbe`, `gitea.readinessProbe` They are replaced by the settings `gitea.livenessProbe`, `gitea.readinessProbe` and `gitea.startupProbe` which are now fully configurable and used _as-is_ for
and `gitea.startupProbe` which are now fully configurable and used _as-is_ for
a Chart deployment. a Chart deployment.
If you have customized their values instead of using the `custom` prefixed settings, If you have customized their values instead of using the `custom` prefixed settings, please ensure that you remove the `enabled` property from each of them.
please ensure that you remove the `enabled` property from each of them.
In case you want to disable one of these probes, let's say the `livenessProbe`, add In case you want to disable one of these probes, let's say the `livenessProbe`, add the following to your values.
the following to your values. The `podAnnotation` is just there to have a bit more The `podAnnotation` is just there to have a bit more context.
context.
```diff ```diff
gitea: gitea:
@ -922,20 +886,17 @@ gitea:
#### Multiple OAuth and LDAP authentication sources #### Multiple OAuth and LDAP authentication sources
With `5.0.0` of this Chart it is now possible to configure Gitea with multiple With `5.0.0` of this Chart it is now possible to configure Gitea with multiple OAuth and LDAP sources.
OAuth and LDAP sources. As a result, you need to update an existing OAuth/LDAP configuration As a result, you need to update an existing OAuth/LDAP configuration in your customized `values.yaml` by replacing the object with settings to a list
in your customized `values.yaml` by replacing the object with settings to a list of settings objects.
of settings objects. See [OAuth2 Settings](#oauth2-settings) and See [OAuth2 Settings](#oauth2-settings) and [LDAP Settings](#ldap-settings) section for details.
[LDAP Settings](#ldap-settings) section for details.
### To 4.0.0 ### To 4.0.0
#### Ingress changes #### Ingress changes
To provide a more flexible Ingress configuration we now support not only host To provide a more flexible Ingress configuration we now support not only host settings but also provide configuration for the path and pathType.
settings but also provide configuration for the path and pathType. So this So this change changes the hosts from a simple string list, to a list containing a more complex object for more configuration.
change changes the hosts from a simple string list, to a list containing a more
complex object for more configuration.
```diff ```diff
ingress: ingress:
@ -956,8 +917,7 @@ ingress:
# - git.example.com # - git.example.com
``` ```
If you want everything as it was before, you can simply add the following code If you want everything as it was before, you can simply add the following code to all your host entries.
to all your host entries.
```yaml ```yaml
paths: paths:
@ -967,41 +927,34 @@ paths:
#### Dropped kebab-case support #### Dropped kebab-case support
In 3.x.x it was possible to provide an ldap configuration via kebab-case, this In 3.x.x it was possible to provide an ldap configuration via kebab-case, this support has now been dropped and only camel case is supported.
support has now been dropped and only camel case is supported. See [LDAP See [LDAP section](#ldap-settings) for more information.
section](#ldap-settings) for more information.
#### Dependency update #### Dependency update
The chart comes with multiple databases and Memcached as dependency, the latest The chart comes with multiple databases and Memcached as dependency, the latest release updated the dependencies.
release updated the dependencies.
- Memcached: `4.2.20` -> `5.9.0` - Memcached: `4.2.20` -> `5.9.0`
- PostgreSQL: `9.7.2` -> `10.3.17` - PostgreSQL: `9.7.2` -> `10.3.17`
- MariaDB: `8.0.0` -> `9.3.6` - MariaDB: `8.0.0` -> `9.3.6`
If you're using the builtin databases you will most likely redeploy the chart in If you're using the builtin databases you will most likely redeploy the chart in order to update the database correctly.
order to update the database correctly.
#### Execution of initPreScript #### Execution of initPreScript
Generally spoken, this might not be a breaking change, but it is worth to be Generally spoken, this might not be a breaking change, but it is worth to be mentioned.
mentioned.
Prior to `4.0.0` only one init container was used to both setup directories and Prior to `4.0.0` only one init container was used to both setup directories and configure Gitea.
configure Gitea. As of now the actual Gitea configuration is separated from the As of now the actual Gitea configuration is separated from the other pre-execution.
other pre-execution. This also includes the execution of _initPreScript_. If you This also includes the execution of _initPreScript_.
have such script, please be aware of this. Dynamically prepare the Gitea setup If you have such script, please be aware of this.
during execution by e.g. adding environment variables to the execution context Dynamically prepare the Gitea setup during execution by e.g. adding environment variables to the execution context won't work anymore.
won't work anymore.
### Misc ### Misc
#### Gitea Version 1.14.X repository ROOT #### Gitea Version 1.14.X repository ROOT
Previously the ROOT folder for the Gitea repositories was located at Previously the ROOT folder for the Gitea repositories was located at `/data/git/gitea-repositories`.
`/data/git/gitea-repositories`. In version `1.14` has the path been changed to In version `1.14` has the path been changed to `/data/gitea-repositories`.
`/data/gitea-repositories`.
This chart will set the `gitea.config.repository.ROOT` value default to This chart will set the `gitea.config.repository.ROOT` value default to `/data/git/gitea-repositories`.
`/data/git/gitea-repositories`.

8
templates/gitea/extra-list.yaml Normal file
View file

@ -0,0 +1,8 @@
{{- range .Values.extraDeploy }}
---
{{- if typeIs "string" . }}
{{- tpl . $ }}
{{- else }}
{{- tpl (. | toYaml) $ }}
{{- end }}
{{- end }}

8
unittests/init/init_directory_structure.sh.yaml
View file

@ -8,6 +8,10 @@ tests:
- it: runs gpg in batch mode - it: runs gpg in batch mode
set: set:
signing.enabled: true signing.enabled: true
signing.privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK-----
{placeholder}
-----END PGP PRIVATE KEY BLOCK-----
asserts: asserts:
- equal: - equal:
path: stringData["configure_gpg_environment.sh"] path: stringData["configure_gpg_environment.sh"]
@ -38,6 +42,10 @@ tests:
- it: adds gpg script block for enabled signing - it: adds gpg script block for enabled signing
set: set:
signing.enabled: true signing.enabled: true
signing.privateKey: |-
-----BEGIN PGP PRIVATE KEY BLOCK-----
{placeholder}
-----END PGP PRIVATE KEY BLOCK-----
asserts: asserts:
- equal: - equal:
path: stringData["init_directory_structure.sh"] path: stringData["init_directory_structure.sh"]

4
unittests/statefulset/signing-disabled.yaml
View file

@ -17,9 +17,9 @@ tests:
- it: skips gpg env in `init-directories` init container - it: skips gpg env in `init-directories` init container
template: templates/gitea/statefulset.yaml template: templates/gitea/statefulset.yaml
set: set:
signing.enabled: true signing.enabled: false
asserts: asserts:
- contains: - notContains:
path: spec.template.spec.initContainers[0].env path: spec.template.spec.initContainers[0].env
content: content:
name: GNUPGHOME name: GNUPGHOME

3
unittests/statefulset/signing-enabled.yaml
View file

@ -42,6 +42,7 @@ tests:
template: templates/gitea/statefulset.yaml template: templates/gitea/statefulset.yaml
set: set:
signing.enabled: true signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
asserts: asserts:
- contains: - contains:
path: spec.template.spec.initContainers[0].env path: spec.template.spec.initContainers[0].env
@ -52,6 +53,7 @@ tests:
template: templates/gitea/statefulset.yaml template: templates/gitea/statefulset.yaml
set: set:
signing.enabled: true signing.enabled: true
signing.existingSecret: "custom-gpg-secret"
asserts: asserts:
- contains: - contains:
path: spec.template.spec.containers[0].env path: spec.template.spec.containers[0].env
@ -63,6 +65,7 @@ tests:
set: set:
signing: signing:
enabled: true enabled: true
existingSecret: "gitea-unittests-gpg-key"
asserts: asserts:
- contains: - contains:
path: spec.template.spec.volumes path: spec.template.spec.volumes

6
values.yaml
View file

@ -450,7 +450,7 @@ memcached:
## @section PostgreSQL ## @section PostgreSQL
# #
## @param postgresql.enabled Enable PostgreSQL ## @param postgresql.enabled Enable PostgreSQL
## @param postgresql.global.postgresql.auth.password Password for the "gitea" user (overrides `auth.password`) ## @param postgresql.global.postgresql.auth.password Password for the `gitea` user (overrides `auth.password`)
## @param postgresql.global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`) ## @param postgresql.global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`)
## @param postgresql.global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`) ## @param postgresql.global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`)
## @param postgresql.global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`) ## @param postgresql.global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
@ -483,3 +483,7 @@ test:
image: image:
name: busybox name: busybox
tag: latest tag: latest
## @param extraDeploy Array of extra objects to deploy with the release
##
extraDeploy: []