feat!: merge upstream changes
BREAKING CHANGES: See Gitea chart breaking changes at https://gitea.com/gitea/helm-chart#upgrading.
This commit is contained in:
Michael Kriese
commit
4b35bcb402
38 changed files with 1976 additions and 1607 deletions
|
|
@ -47,7 +47,7 @@ MD013:
|
|||
# Number of characters
|
||||
line_length: 200
|
||||
# Number of characters for headings
|
||||
heading_line_length: 80
|
||||
heading_line_length: 100
|
||||
# Number of characters for code blocks
|
||||
code_block_line_length: 80
|
||||
# Include code blocks
|
||||
|
|
@ -106,7 +106,7 @@ MD030:
|
|||
# MD033/no-inline-html - Inline HTML
|
||||
MD033:
|
||||
# Allowed elements
|
||||
allowed_elements: []
|
||||
allowed_elements: [details, summary]
|
||||
|
||||
# MD035/hr-style - Horizontal rule style
|
||||
MD035:
|
||||
|
|
@ -135,6 +135,7 @@ MD044:
|
|||
- Prometheus
|
||||
- Git
|
||||
- GitOps
|
||||
- Forgejo
|
||||
# Include code blocks
|
||||
code_blocks: false
|
||||
|
||||
|
|
|
|||
8
.vscode/extensions.json
vendored
Normal file
8
.vscode/extensions.json
vendored
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"recommendations": [
|
||||
"yzhang.markdown-all-in-one",
|
||||
"DavidAnson.vscode-markdownlint",
|
||||
"Tim-Koehler.helm-intellisense",
|
||||
"esbenp.prettier-vscode"
|
||||
]
|
||||
}
|
||||
8
.vscode/settings.json
vendored
Normal file
8
.vscode/settings.json
vendored
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"yaml.schemas": {
|
||||
"https://raw.githubusercontent.com/helm-unittest/helm-unittest/v0.3.6/schema/helm-testsuite.json": [
|
||||
"/unittests/**/*.yaml"
|
||||
]
|
||||
},
|
||||
"yaml.schemaStore.enable": true
|
||||
}
|
||||
|
|
@ -9,21 +9,16 @@ refactorings for easier maintainability or documentation improvements.
|
|||
- [`helm`](https://helm.sh/docs/intro/install/)
|
||||
- `make` is optional; you may call the commands directly
|
||||
|
||||
When using Visual Studio Code as IDE, following plugins might be useful:
|
||||
|
||||
- [Markdown All in One](https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one)
|
||||
- [markdownlint](https://marketplace.visualstudio.com/items?itemName=DavidAnson.vscode-markdownlint)
|
||||
- [Helm Intellisense](https://marketplace.visualstudio.com/items?itemName=Tim-Koehler.helm-intellisense)
|
||||
- [Prettier - Code formatter](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode)
|
||||
When using Visual Studio Code as IDE, a [ready-to-use profile](.vscode/) is available.
|
||||
|
||||
## Documentation Requirements
|
||||
|
||||
The `README.md` must include all configuration options. The parameters section
|
||||
is generated by extracting the parameter annotations from the `values.yaml` file,
|
||||
by using [this tool](https://github.com/bitnami-labs/readme-generator-for-helm).
|
||||
The `README.md` must include all configuration options.
|
||||
The parameters section is generated by extracting the parameter annotations from the `values.yaml` file, by using [this tool](https://github.com/bitnami-labs/readme-generator-for-helm).
|
||||
|
||||
If changes were made on configuration options, run `make readme` to update the
|
||||
README file.
|
||||
If changes were made on configuration options, run `make readme` to update the README file.
|
||||
|
||||
The ToC is created via the VSCode [Markdown All in One](https://marketplace.visualstudio.com/items?itemName=yzhang.markdown-all-in-one) extension which can/must also be used used to update it.
|
||||
|
||||
## Pull Request Requirements
|
||||
|
||||
|
|
@ -41,16 +36,15 @@ For local development and testing of pull requests, the following workflow can
|
|||
be used:
|
||||
|
||||
1. Install `minikube` and `helm`.
|
||||
2. Start a `minikube` cluster via `minikube start`.
|
||||
3. From the `gitea/helm-chart` directory execute the following command. This
|
||||
will install the dependencies listed in `Chart.yml` and deploy the current
|
||||
state of the helm chart found locally. If you want to test a branch, make
|
||||
sure to switch to the respective branch first.
|
||||
`helm install --dependency-update gitea . -f values.yaml`.
|
||||
4. Gitea is now deployed in `minikube`. To access it, it's port needs to be
|
||||
forwarded first from `minikube` to localhost first via `kubectl --namespace
|
||||
default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at
|
||||
[http://localhost:3000](http://localhost:3000).
|
||||
1. Start a `minikube` cluster via `minikube start`.
|
||||
1. From the `forgejo-contrib/forgejo-helm` directory execute the following command.
|
||||
This will install the dependencies listed in `Chart.yml` and deploy the current state of the helm chart found locally.
|
||||
If you want to test a branch, make sure to switch to the respective branch first.
|
||||
`helm install --dependency-update forgejo . -f values.yaml`.
|
||||
1. Forgejo is now deployed in `minikube`.
|
||||
To access it, it's port needs to be forwarded first from `minikube` to localhost first via `kubectl --namespace
|
||||
default port-forward svc/gitea-http 3000:3000`.
|
||||
Now Forgejo is accessible at [http://localhost:3000](http://localhost:3000).
|
||||
|
||||
### Unit tests
|
||||
|
||||
|
|
@ -61,3 +55,11 @@ $ helm plugin install https://github.com/helm-unittest/helm-unittest
|
|||
# run the unittests
|
||||
make unittests
|
||||
```
|
||||
|
||||
See [plugin documentation](https://github.com/helm-unittest/helm-unittest/blob/main/DOCUMENT.md) for usage instructions.
|
||||
|
||||
## Release process
|
||||
|
||||
1. Create a tag following the tagging schema
|
||||
1. Push the tag
|
||||
1. Let CI do it's work
|
||||
|
|
|
|||
13
Chart.lock
13
Chart.lock
|
|
@ -1,9 +1,12 @@
|
|||
dependencies:
|
||||
- name: memcached
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 6.7.1
|
||||
- name: postgresql
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 13.2.24
|
||||
digest: sha256:00c678cbc02c9f9e12ad5b1a9b3b2f3f6e6b6fcaadfbda5979baf8cf41475e66
|
||||
generated: "2023-12-06T00:08:05.974489063Z"
|
||||
- name: postgresql-ha
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 12.3.1
|
||||
- name: redis-cluster
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 9.1.3
|
||||
digest: sha256:f8a15775e3245385109ae0d7a7374163e8e718fd6b38ef3f17dbe142dd600aea
|
||||
generated: "2023-12-06T11:40:02.8712781+01:00"
|
||||
|
|
|
|||
16
Chart.yaml
16
Chart.yaml
|
|
@ -26,12 +26,18 @@ maintainers:
|
|||
# https://hub.docker.com/u/bitnamicharts
|
||||
# https://blog.bitnami.com/2023/01/bitnami-helm-charts-available-as-oci.html
|
||||
dependencies:
|
||||
- name: memcached
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 6.7.1
|
||||
condition: memcached.enabled
|
||||
# Chart release date: 2023-04
|
||||
# https://github.com/bitnami/charts/blob/main/bitnami/postgresql/Chart.yaml
|
||||
- name: postgresql
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 13.2.24
|
||||
condition: postgresql.enabled
|
||||
# https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml
|
||||
- name: postgresql-ha
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 12.3.1
|
||||
condition: postgresql-ha.enabled
|
||||
# https://github.com/bitnami/charts/blob/main/bitnami/redis-cluster/Chart.yaml
|
||||
- name: redis-cluster
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 9.1.3
|
||||
condition: redis-cluster.enabled
|
||||
7
Makefile
7
Makefile
|
|
@ -9,4 +9,9 @@ readme: prepare-environment
|
|||
|
||||
.PHONY: unittests
|
||||
unittests:
|
||||
helm unittest --strict -f 'unittests/**/*.yaml' ./
|
||||
helm unittest --strict -f 'unittests/**/*.yaml' -f 'unittests/dependency-major-image-check.yaml' ./
|
||||
|
||||
.PHONY: helm
|
||||
update-helm-dependencies:
|
||||
helm dependency update
|
||||
|
||||
530
README.md
530
README.md
|
|
@ -1,14 +1,68 @@
|
|||
# Forgejo Helm Chart
|
||||
|
||||
# Forgejo Helm Chart <!-- omit from toc -->
|
||||
|
||||
[](https://ci.dachary.org/forgejo-contrib/forgejo-helm)
|
||||
|
||||
[Forgejo](https://forgejo.org/) is a community managed lightweight code hosting
|
||||
solution written in Go. It is published under the MIT license.
|
||||
- [Introduction](#introduction)
|
||||
- [Update and versioning policy](#update-and-versioning-policy)
|
||||
- [Dependencies](#dependencies)
|
||||
- [Installing](#installing)
|
||||
- [High Availability](#high-availability)
|
||||
- [Configuration](#configuration)
|
||||
- [Default Configuration](#default-configuration)
|
||||
- [Database defaults](#database-defaults)
|
||||
- [Server defaults](#server-defaults)
|
||||
- [Metrics defaults](#metrics-defaults)
|
||||
- [Rootless Defaults](#rootless-defaults)
|
||||
- [Single-Pod Configurations](#single-pod-configurations)
|
||||
- [Additional _app.ini_ settings](#additional-appini-settings)
|
||||
- [User defined environment variables in app.ini](#user-defined-environment-variables-in-appini)
|
||||
- [External Database](#external-database)
|
||||
- [Ports and external url](#ports-and-external-url)
|
||||
- [ClusterIP](#clusterip)
|
||||
- [SSH and Ingress](#ssh-and-ingress)
|
||||
- [SSH on crio based kubernetes cluster](#ssh-on-crio-based-kubernetes-cluster)
|
||||
- [Cache](#cache)
|
||||
- [Persistence](#persistence)
|
||||
- [Admin User](#admin-user)
|
||||
- [LDAP Settings](#ldap-settings)
|
||||
- [OAuth2 Settings](#oauth2-settings)
|
||||
- [Configure commit signing](#configure-commit-signing)
|
||||
- [Metrics and profiling](#metrics-and-profiling)
|
||||
- [Pod annotations](#pod-annotations)
|
||||
- [Themes](#themes)
|
||||
- [Renovate](#renovate)
|
||||
- [Parameters](#parameters)
|
||||
- [Global](#global)
|
||||
- [strategy](#strategy)
|
||||
- [Image](#image)
|
||||
- [Security](#security)
|
||||
- [Service](#service)
|
||||
- [Ingress](#ingress)
|
||||
- [deployment](#deployment)
|
||||
- [ServiceAccount](#serviceaccount)
|
||||
- [Persistence](#persistence-1)
|
||||
- [Init](#init)
|
||||
- [Signing](#signing)
|
||||
- [Gitea](#gitea)
|
||||
- [LivenessProbe](#livenessprobe)
|
||||
- [ReadinessProbe](#readinessprobe)
|
||||
- [StartupProbe](#startupprobe)
|
||||
- [redis-cluster](#redis-cluster)
|
||||
- [PostgreSQL-ha](#postgresql-ha)
|
||||
- [PostgreSQL](#postgresql)
|
||||
- [Advanced](#advanced)
|
||||
- [Contributing](#contributing)
|
||||
- [Upgrading](#upgrading)
|
||||
|
||||
[Forgejo](https://forgejo.org/) is a community managed lightweight code hosting solution written in Go.
|
||||
It is published under the MIT license.
|
||||
|
||||
## Introduction
|
||||
|
||||
This helm chart is based on official [Gitea helm chart](https://gitea.com/gitea/helm-chart).
|
||||
Additionally, this chart provides LDAP and admin user configuration with values, as well as being deployed as a statefulset to retain stored repositories.
|
||||
Yet it takes a completely different approach in providing a database and cache with dependencies.
|
||||
Additionally, this chart allows to provide LDAP and admin user configuration with values.
|
||||
|
||||
## Update and versioning policy
|
||||
|
||||
|
|
@ -30,8 +84,8 @@ This chart provides those dependencies, which can be enabled, or disabled via co
|
|||
|
||||
Dependencies:
|
||||
|
||||
- PostgreSQL ([configuration](#postgresql))
|
||||
- Memcached ([configuration](#memcached))
|
||||
- PostgreSQL HA ([configuration](#postgresql))
|
||||
- Redis Cluster ([configuration](#cache))
|
||||
|
||||
## Installing
|
||||
|
||||
|
|
@ -47,18 +101,18 @@ helm install forgejo -f values.yaml oci://codeberg.org/forgejo-contrib/forgejo
|
|||
|
||||
When upgrading, please refer to the [Upgrading](#upgrading) section at the bottom of this document for major and breaking changes.
|
||||
|
||||
## Prerequisites
|
||||
## High Availability
|
||||
|
||||
- Kubernetes 1.12+
|
||||
- Helm 3.0+
|
||||
- PV provisioner for persistent data support
|
||||
This chart supports running Forgejo and it's dependencies in HA mode.
|
||||
Care must be taken for production use as not all implementation details of Forgejo core are officially HA-ready yet.
|
||||
|
||||
## Examples
|
||||
Deploying a HA-ready Forgejo instance requires some effort including using HA-ready dependencies.
|
||||
See the [HA Setup](docs/ha-setup.md) document for more details.
|
||||
|
||||
### Forgejo Configuration
|
||||
## Configuration
|
||||
|
||||
Forgejo offers lots of configuration options.
|
||||
This is fully described in the [Gitea Cheat Sheet](https://docs.gitea.io/en-us/config-cheat-sheet/).
|
||||
This is fully described in the [Gitea Cheat Sheet](https://docs.gitea.com/administration/config-cheat-sheet).
|
||||
|
||||
```yaml
|
||||
gitea:
|
||||
|
|
@ -77,12 +131,12 @@ All defaults can be overwritten in `gitea.config`.
|
|||
|
||||
INSTALL_LOCK is always set to true, since we want to configure Forgejo with this helm chart and everything is taken care of.
|
||||
|
||||
_All default settings are made directly in the generated app.ini, not in the Values._
|
||||
_All default settings are made directly in the generated `app.ini`, not in the Values._
|
||||
|
||||
#### Database defaults
|
||||
|
||||
If a builtIn database is enabled the database configuration is set automatically.
|
||||
For example, PostgreSQL builtIn will appear in the app.ini as:
|
||||
For example, PostgreSQL builtIn will appear in the `app.ini` as:
|
||||
|
||||
```ini
|
||||
[database]
|
||||
|
|
@ -93,18 +147,6 @@ PASSWD = gitea
|
|||
USER = gitea
|
||||
```
|
||||
|
||||
#### Memcached defaults
|
||||
|
||||
Memcached is handled the exact same way as database builtIn.
|
||||
Once Memcached builtIn is enabled, this chart will generate the following part in the `app.ini`:
|
||||
|
||||
```ini
|
||||
[cache]
|
||||
ADAPTER = memcache
|
||||
ENABLED = true
|
||||
HOST = RELEASE-NAME-memcached.default.svc.cluster.local:11211
|
||||
```
|
||||
|
||||
#### Server defaults
|
||||
|
||||
The server defaults are a bit more complex.
|
||||
|
|
@ -133,9 +175,101 @@ The Prometheus `/metrics` endpoint is disabled by default.
|
|||
ENABLED = false
|
||||
```
|
||||
|
||||
#### Rootless Defaults
|
||||
|
||||
If `.Values.image.rootless: true`, then the following will occur. In case you use `.Values.image.fullOverride`, check that this works in your image:
|
||||
|
||||
- `$HOME` becomes `/data/gitea/git`
|
||||
|
||||
[see deployment.yaml](./templates/gitea/deployment.yaml) template inside (init-)container "env" declarations
|
||||
|
||||
- `START_SSH_SERVER: true` (Unless explicity overwritten by `gitea.config.server.START_SSH_SERVER`)
|
||||
|
||||
[see \_helpers.tpl](./templates/_helpers.tpl) in `gitea.inline_configuration.defaults.server` definition
|
||||
|
||||
- `SSH_LISTEN_PORT: 2222` (Unless explicity overwritten by `gitea.config.server.SSH_LISTEN_PORT`)
|
||||
|
||||
[see \_helpers.tpl](./templates/_helpers.tpl) in `gitea.inline_configuration.defaults.server` definition
|
||||
|
||||
- `SSH_LOG_LEVEL` environment variable is not injected into the container
|
||||
|
||||
[see deployment.yaml](./templates/gitea/deployment.yaml) template inside container "env" declarations
|
||||
|
||||
### Single-Pod Configurations
|
||||
|
||||
If HA is not needed/desired, the following configurations can be used to deploy a single-pod Forgejo instance.
|
||||
|
||||
1. For a production-ready single-pod Forgejo instance without external dependencies (using the chart dependency `postgresql`):
|
||||
|
||||
<details>
|
||||
|
||||
<summary>values.yml</summary>
|
||||
|
||||
```yaml
|
||||
redis-cluster:
|
||||
enabled: false
|
||||
postgresql:
|
||||
enabled: true
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
gitea:
|
||||
config:
|
||||
database:
|
||||
DB_TYPE: postgres
|
||||
session:
|
||||
PROVIDER: db
|
||||
cache:
|
||||
ADAPTER: memory
|
||||
queue:
|
||||
TYPE: level
|
||||
indexer:
|
||||
ISSUE_INDEXER_TYPE: bleve
|
||||
REPO_INDEXER_ENABLED: true
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
2. For a minimal DEV installation (using the built-in sqlite DB instead of Postgres):
|
||||
|
||||
This will result in a single-pod Forgejo instance _without any dependencies and persistence_.
|
||||
**Do not use this configuration for production use**.
|
||||
|
||||
<details>
|
||||
|
||||
<summary>values.yml</summary>
|
||||
|
||||
```yaml
|
||||
redis-cluster:
|
||||
enabled: false
|
||||
postgresql:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
|
||||
gitea:
|
||||
config:
|
||||
database:
|
||||
DB_TYPE: sqlite3
|
||||
session:
|
||||
PROVIDER: memory
|
||||
cache:
|
||||
ADAPTER: memory
|
||||
queue:
|
||||
TYPE: level
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
### Additional _app.ini_ settings
|
||||
|
||||
> **The [generic](https://docs.gitea.io/en-us/config-cheat-sheet/#overall-default)
|
||||
> **The [generic](https://docs.gitea.com/administration/config-cheat-sheet#overall-default)
|
||||
> section cannot be defined that way.**
|
||||
|
||||
Some settings inside _app.ini_ (like passwords or whole authentication configurations) must be considered sensitive and therefore should not be passed via plain text inside the _values.yaml_ file.
|
||||
|
|
@ -153,8 +287,7 @@ gitea:
|
|||
name: gitea-app-ini-plaintext
|
||||
```
|
||||
|
||||
This would mount the two additional volumes (`oauth` and `some-additionals`)
|
||||
from different sources to the init containerwhere the _app.ini_ gets updated.
|
||||
This would mount the two additional volumes (`oauth` and `some-additionals`) from different sources to the init container where the _app.ini_ gets updated.
|
||||
All files mounted that way will be read and converted to environment variables and then added to the _app.ini_ using [environment-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini).
|
||||
|
||||
The key of such additional source represents the section inside the _app.ini_.
|
||||
|
|
@ -195,8 +328,10 @@ stringData:
|
|||
Users are able to define their own environment variables, which are loaded into the containers.
|
||||
We also support to directly interact with the generated _app.ini_.
|
||||
|
||||
To inject self defined variables into the _app.ini_, environment variables need
|
||||
to be prefixed with `FORGEJO`.
|
||||
To inject self defined variables into the _app.ini_ a certain format needs to be honored.
|
||||
This is described in detail on the [env-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini) page.
|
||||
|
||||
Environment variables need to be prefixed with `FORGEJO`.
|
||||
|
||||
For example a database setting needs to have the following format:
|
||||
|
||||
|
|
@ -215,12 +350,13 @@ gitea:
|
|||
Priority (highest to lowest) for defining app.ini variables:
|
||||
|
||||
1. Environment variables prefixed with `FORGEJO`
|
||||
|
||||
1. Additional config sources
|
||||
1. Values defined in `gitea.config`
|
||||
|
||||
### External Database
|
||||
|
||||
Any external Database listed in [https://docs.gitea.io/en-us/database-prep/](https://docs.gitea.io/en-us/database-prep/) can be used instead of the built-in PostgreSQL.
|
||||
Any external database listed in [https://docs.gitea.com/installation/database-prep](https://docs.gitea.com/installation/database-prep) can be used instead of the built-in PostgreSQL.
|
||||
In fact, it is **highly recommended** to use an external database to ensure a stable Forgejo installation longterm.
|
||||
|
||||
If an external database is used, no matter which type, make sure to set `postgresql.enabled` to `false` to disable the use of the built-in PostgreSQL.
|
||||
|
|
@ -306,34 +442,23 @@ More about this issue [here](https://gitea.com/gitea/helm-chart/issues/161).
|
|||
|
||||
### Cache
|
||||
|
||||
This helm chart can use a built in cache.
|
||||
The default is Memcached from bitnami.
|
||||
The cache handling is done via `redis-cluster` (via the `bitnami` chart) by default.
|
||||
This deployment is HA-ready but can also be used for single-pod deployments.
|
||||
By default, 6 replicas are deployed for a working `redis-cluster` deployment.
|
||||
Many cloud providers offer a managed redis service, which can be used instead of the built-in `redis-cluster`.
|
||||
|
||||
```yaml
|
||||
memcached:
|
||||
redis-cluster:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
If the built in cache should not be used simply configure the cache in `gitea.config`.
|
||||
|
||||
```yaml
|
||||
gitea:
|
||||
config:
|
||||
cache:
|
||||
ENABLED: true
|
||||
ADAPTER: memory
|
||||
INTERVAL: 60
|
||||
HOST: 127.0.0.1:9090
|
||||
```
|
||||
|
||||
### Persistence
|
||||
|
||||
Forgejo will be deployed as a statefulset.
|
||||
Forgejo will be deployed as a deployment.
|
||||
By simply enabling the persistence and setting the storage class according to your cluster everything else will be taken care of.
|
||||
The following example will create a PVC as a part of the statefulset.
|
||||
This PVC will not be deleted even if you uninstall the chart.
|
||||
The following example will create a PVC as a part of the deployment.
|
||||
|
||||
Please note, that an empty storageClass in the persistence will result in kubernetes using your default storage class.
|
||||
Please note, that an empty `storageClass` in the persistence will result in kubernetes using your default storage class.
|
||||
|
||||
If you want to use your own storage class define it as follows:
|
||||
|
||||
|
|
@ -343,14 +468,12 @@ persistence:
|
|||
storageClass: myOwnStorageClass
|
||||
```
|
||||
|
||||
When using PostgreSQL as dependency, this will also be deployed as a statefulset by default.
|
||||
|
||||
If you want to manage your own PVC you can simply pass the PVC name to the chart.
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: MyAwesomeGiteaClaim
|
||||
claimName: MyAwesomeGiteaClaim
|
||||
```
|
||||
|
||||
In case that persistence has been disabled it will simply use an empty dir volume.
|
||||
|
|
@ -362,13 +485,13 @@ You can interact with the postgres settings as displayed in the following exampl
|
|||
postgresql:
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim: MyAwesomeGiteaPostgresClaim
|
||||
claimName: MyAwesomeGiteaPostgresClaim
|
||||
```
|
||||
|
||||
### Admin User
|
||||
|
||||
This chart enables you to create a default admin user.
|
||||
It is also possible to update the password for this user by upgrading or redeloying the chart.
|
||||
It is also possible to update the password for this user by upgrading or redeploying the chart.
|
||||
It is not possible to delete an admin user after it has been created.
|
||||
This has to be done in the ui.
|
||||
You cannot use `admin` as username.
|
||||
|
|
@ -403,7 +526,7 @@ gitea:
|
|||
### LDAP Settings
|
||||
|
||||
Like the admin user the LDAP settings can be updated.
|
||||
All LDAP values from <https://docs.gitea.io/en-us/command-line/#admin> are available.
|
||||
All LDAP values from <https://docs.gitea.com/administration/command-line#admin> are available.
|
||||
|
||||
Multiple LDAP sources can be configured with additional LDAP list items.
|
||||
|
||||
|
|
@ -457,7 +580,7 @@ Affected options:
|
|||
|
||||
Like the admin user, OAuth2 settings can be updated and disabled but not deleted.
|
||||
Deleting OAuth2 settings has to be done in the ui.
|
||||
All OAuth2 values, which are documented [here](https://docs.gitea.io/en-us/command-line/#admin), are
|
||||
All OAuth2 values, which are documented [here](https://docs.gitea.com/administration/command-line#admin), are
|
||||
available.
|
||||
|
||||
Multiple OAuth2 sources can be configured with additional OAuth list items.
|
||||
|
|
@ -534,9 +657,9 @@ signing:
|
|||
```
|
||||
|
||||
To use the gpg key, Forgejo needs to be configured accordingly.
|
||||
A detailed description can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration).
|
||||
A detailed description can be found in the [official Gitea documentation](https://docs.gitea.com/administration/signing#general-configuration).
|
||||
|
||||
### Metrics and profiling
|
||||
## Metrics and profiling
|
||||
|
||||
A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling endpoints on port 6060 can be enabled under `gitea`.
|
||||
Beware that the metrics endpoint is exposed via the ingress, manage access using ingress annotations for example.
|
||||
|
|
@ -555,7 +678,7 @@ gitea:
|
|||
ENABLE_PPROF: true
|
||||
```
|
||||
|
||||
### Pod Annotations
|
||||
## Pod annotations
|
||||
|
||||
Annotations can be added to the Forgejo pod.
|
||||
|
||||
|
|
@ -564,29 +687,137 @@ gitea:
|
|||
podAnnotations: {}
|
||||
```
|
||||
|
||||
## Themes
|
||||
|
||||
Custom themes can be added via k8s secrets and referencing them in `values.yaml`.
|
||||
|
||||
The [http provider](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) is useful here.
|
||||
|
||||
```yaml
|
||||
extraVolumes:
|
||||
- name: gitea-themes
|
||||
secret:
|
||||
secretName: gitea-themes
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: gitea-themes
|
||||
readOnly: true
|
||||
mountPath: "/data/gitea/public/assets/css"
|
||||
```
|
||||
|
||||
The secret can be created via `terraform`:
|
||||
|
||||
```hcl
|
||||
resource "kubernetes_secret" "gitea-themes" {
|
||||
metadata {
|
||||
name = "gitea-themes"
|
||||
namespace = "gitea"
|
||||
}
|
||||
|
||||
data = {
|
||||
"my-theme.css" = data.http.gitea-theme-light.body
|
||||
"my-theme-dark.css" = data.http.gitea-theme-dark.body
|
||||
"my-theme-auto.css" = data.http.gitea-theme-auto.body
|
||||
}
|
||||
|
||||
type = "Opaque"
|
||||
}
|
||||
|
||||
|
||||
data "http" "gitea-theme-light" {
|
||||
url = "<raw theme url>"
|
||||
|
||||
request_headers = {
|
||||
Accept = "application/json"
|
||||
}
|
||||
}
|
||||
|
||||
data "http" "gitea-theme-dark" {
|
||||
url = "<raw theme url>"
|
||||
|
||||
request_headers = {
|
||||
Accept = "application/json"
|
||||
}
|
||||
}
|
||||
|
||||
data "http" "gitea-theme-auto" {
|
||||
url = "<raw theme url>"
|
||||
|
||||
request_headers = {
|
||||
Accept = "application/json"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
or natively via `kubectl`:
|
||||
|
||||
```bash
|
||||
kubectl create secret generic gitea-themes --from-file={{FULL-PATH-TO-CSS}} --namespace gitea
|
||||
```
|
||||
|
||||
## Renovate
|
||||
|
||||
To be able to use a digest value which is automatically updated by `Renovate` a [customManager](https://docs.renovatebot.com/modules/manager/regex/) is required.
|
||||
Here's an examplary `values.yml` definition which makes use of a digest:
|
||||
|
||||
```yaml
|
||||
image:
|
||||
registry: codeberg.org
|
||||
repository: forgejo/forgejo
|
||||
tag: 1.20.2-0
|
||||
digest: sha256:f597c14a403c2fdee9a62dae8bae29d6442f7b2cc85872cc9bb535a24cb1630e
|
||||
```
|
||||
|
||||
By default Renovate adds digest after the `tag`.
|
||||
To comply with the Forgejo helm chart definition of the digest parameter, a "customManagers" definition is required:
|
||||
|
||||
```json
|
||||
"customManagers": [
|
||||
{
|
||||
"customType": "regex",
|
||||
"description": "Apply an explicit gitea digest field match",
|
||||
"fileMatch": ["values\\.ya?ml"],
|
||||
"matchStrings": ["(?<depName>forgejo\\/forgejo)\\n(?<indentation>\\s+)tag: (?<currentValue>[^@].*?)\\n\\s+digest: (?<currentDigest>sha256:[a-f0-9]+)"],
|
||||
"datasourceTemplate": "docker",
|
||||
"packageNameTemplate": "codeberg.org/{{depName}}",
|
||||
"autoReplaceStringTemplate": "{{depName}}\n{{indentation}}tag: {{newValue}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
|
||||
}
|
||||
]
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------- | ------------------------------------------------------------------------- | --------------- |
|
||||
| `global.imageRegistry` | global image registry override | `""` |
|
||||
| `global.imagePullSecrets` | global image pull secrets override; can be extended by `imagePullSecrets` | `[]` |
|
||||
| `global.storageClass` | global storage class override | `""` |
|
||||
| `global.hostAliases` | global hostAliases which will be added to the pod's hosts files | `[]` |
|
||||
| `replicaCount` | number of replicas for the statefulset | `1` |
|
||||
| `clusterDomain` | cluster domain | `cluster.local` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------- | ------------------------------------------------------------------------- | ----- |
|
||||
| `global.imageRegistry` | global image registry override | `""` |
|
||||
| `global.imagePullSecrets` | global image pull secrets override; can be extended by `imagePullSecrets` | `[]` |
|
||||
| `global.storageClass` | global storage class override | `""` |
|
||||
| `global.hostAliases` | global hostAliases which will be added to the pod's hosts files | `[]` |
|
||||
| `replicaCount` | number of replicas for the deployment | `1` |
|
||||
|
||||
### strategy
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------- | -------------- | --------------- |
|
||||
| `strategy.type` | strategy type | `RollingUpdate` |
|
||||
| `strategy.rollingUpdate.maxSurge` | maxSurge | `100%` |
|
||||
| `strategy.rollingUpdate.maxUnavailable` | maxUnavailable | `0` |
|
||||
| `clusterDomain` | cluster domain | `cluster.local` |
|
||||
|
||||
### Image
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||
| `image.registry` | image registry, e.g. gcr.io,docker.io | `codeberg.org` |
|
||||
| `image.repository` | Image to start for this pod | `forgejo/forgejo` |
|
||||
| `image.tag` | Visit: [Image tag](https://codeberg.org/forgejo/-/packages/container/forgejo/versions). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `image.pullPolicy` | Image pull policy | `Always` |
|
||||
| `image.rootless` | Wether or not to pull the rootless version of Forgejo, only works on Forgejo 1.14.x or higher | `false` |
|
||||
| `imagePullSecrets` | Secret to use for pulling the image | `[]` |
|
||||
| Name | Description | Value |
|
||||
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
|
||||
| `image.registry` | image registry, e.g. gcr.io,docker.io | `codeberg.org` |
|
||||
| `image.repository` | Image to start for this pod | `forgejo/forgejo` |
|
||||
| `image.tag` | Visit: [Image tag](https://codeberg.org/forgejo/-/packages/container/forgejo/versions). Defaults to `appVersion` within Chart.yaml. | `""` |
|
||||
| `image.digest` | Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest` | `""` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `image.rootless` | Wether or not to pull the rootless version of Forgejo | `true` |
|
||||
| `image.fullOverride` | Completely overrides the image registry, path/image, tag and digest. **Adjust `image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""` |
|
||||
| `imagePullSecrets` | Secret to use for pulling the image | `[]` |
|
||||
|
||||
### Security
|
||||
|
||||
|
|
@ -594,7 +825,8 @@ gitea:
|
|||
| ---------------------------- | --------------------------------------------------------------- | ------ |
|
||||
| `podSecurityContext.fsGroup` | Set the shared file system group for all containers in the pod. | `1000` |
|
||||
| `containerSecurityContext` | Security context | `{}` |
|
||||
| `securityContext` | Run init and Forgejo containers as a specific securityContext | `{}` |
|
||||
| `securityContext` | Run init and Forgejo containers as a specific securityContext | `{}` |
|
||||
| `podDisruptionBudget` | Pod disruption budget | `{}` |
|
||||
|
||||
### Service
|
||||
|
||||
|
|
@ -602,7 +834,7 @@ gitea:
|
|||
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
|
||||
| `service.http.type` | Kubernetes service type for web traffic | `ClusterIP` |
|
||||
| `service.http.port` | Port number for web traffic | `3000` |
|
||||
| `service.http.clusterIP` | ClusterIP setting for http autosetup for statefulset is None | `None` |
|
||||
| `service.http.clusterIP` | ClusterIP setting for http autosetup for deployment is None | `None` |
|
||||
| `service.http.loadBalancerIP` | LoadBalancer IP setting | `nil` |
|
||||
| `service.http.nodePort` | NodePort for http service | `nil` |
|
||||
| `service.http.externalTrafficPolicy` | If `service.http.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation | `nil` |
|
||||
|
|
@ -613,7 +845,7 @@ gitea:
|
|||
| `service.http.annotations` | HTTP service annotations | `{}` |
|
||||
| `service.ssh.type` | Kubernetes service type for ssh traffic | `ClusterIP` |
|
||||
| `service.ssh.port` | Port number for ssh traffic | `22` |
|
||||
| `service.ssh.clusterIP` | ClusterIP setting for ssh autosetup for statefulset is None | `None` |
|
||||
| `service.ssh.clusterIP` | ClusterIP setting for ssh autosetup for deployment is None | `None` |
|
||||
| `service.ssh.loadBalancerIP` | LoadBalancer IP setting | `nil` |
|
||||
| `service.ssh.nodePort` | NodePort for ssh service | `nil` |
|
||||
| `service.ssh.externalTrafficPolicy` | If `service.ssh.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation | `nil` |
|
||||
|
|
@ -637,38 +869,53 @@ gitea:
|
|||
| `ingress.tls` | Ingress tls settings | `[]` |
|
||||
| `ingress.apiVersion` | Specify APIVersion of ingress object. Mostly would only be used for argocd. | |
|
||||
|
||||
### StatefulSet
|
||||
### deployment
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------- | ------------------------------------------------------ | ----- |
|
||||
| `resources` | Kubernetes resources | `{}` |
|
||||
| `schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` |
|
||||
| `nodeSelector` | NodeSelector for the statefulset | `{}` |
|
||||
| `tolerations` | Tolerations for the statefulset | `[]` |
|
||||
| `affinity` | Affinity for the statefulset | `{}` |
|
||||
| `dnsConfig` | dnsConfig for the statefulset | `{}` |
|
||||
| `priorityClassName` | priorityClassName for the statefulset | `""` |
|
||||
| `statefulset.env` | Additional environment variables to pass to containers | `[]` |
|
||||
| `statefulset.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` |
|
||||
| `statefulset.labels` | Labels for the statefulset | `{}` |
|
||||
| `statefulset.annotations` | Annotations for the Forgejo StatefulSet to be created | `{}` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | ------------------------------------------------------ | ----- |
|
||||
| `resources` | Kubernetes resources | `{}` |
|
||||
| `schedulerName` | Use an alternate scheduler, e.g. "stork" | `""` |
|
||||
| `nodeSelector` | NodeSelector for the deployment | `{}` |
|
||||
| `tolerations` | Tolerations for the deployment | `[]` |
|
||||
| `affinity` | Affinity for the deployment | `{}` |
|
||||
| `topologySpreadConstraints` | TopologySpreadConstraints for the deployment | `[]` |
|
||||
| `dnsConfig` | dnsConfig for the deployment | `{}` |
|
||||
| `priorityClassName` | priorityClassName for the deployment | `""` |
|
||||
| `deployment.env` | Additional environment variables to pass to containers | `[]` |
|
||||
| `deployment.terminationGracePeriodSeconds` | How long to wait until forcefully kill the pod | `60` |
|
||||
| `deployment.labels` | Labels for the deployment | `{}` |
|
||||
| `deployment.annotations` | Annotations for the Gitea deployment to be created | `{}` |
|
||||
|
||||
### ServiceAccount
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `serviceAccount.create` | Enable the creation of a ServiceAccount | `false` |
|
||||
| `serviceAccount.name` | Name of the created ServiceAccount, defaults to release name. Can also link to an externally provided ServiceAccount that should be used. | `""` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Enable/disable auto mounting of the service account token | `false` |
|
||||
| `serviceAccount.imagePullSecrets` | Image pull secrets, available to the ServiceAccount | `[]` |
|
||||
| `serviceAccount.annotations` | Custom annotations for the ServiceAccount | `{}` |
|
||||
| `serviceAccount.labels` | Custom labels for the ServiceAccount | `{}` |
|
||||
|
||||
### Persistence
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------- |
|
||||
| `persistence.enabled` | Enable persistent storage | `true` |
|
||||
| `persistence.existingClaim` | Use an existing claim to store repository information | `nil` |
|
||||
| `persistence.size` | Size for persistence to store repo information | `10Gi` |
|
||||
| `persistence.accessModes` | AccessMode for persistence | `["ReadWriteOnce"]` |
|
||||
| `persistence.labels` | Labels for the persistence volume claim to be created | `{}` |
|
||||
| `persistence.annotations` | Annotations for the persistence volume claim to be created | `{}` |
|
||||
| `persistence.storageClass` | Name of the storage class to use | `nil` |
|
||||
| `persistence.subPath` | Subdirectory of the volume to mount at | `nil` |
|
||||
| `extraVolumes` | Additional volumes to mount to the Forgejo statefulset | `[]` |
|
||||
| `extraContainerVolumeMounts` | Mounts that are only mapped into the Forgejo runtime/main container, to e.g. override custom templates. | `[]` |
|
||||
| `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` |
|
||||
| `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Forgejo main container | `[]` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------- |
|
||||
| `persistence.enabled` | Enable persistent storage | `true` |
|
||||
| `persistence.create` | Whether to create the persistentVolumeClaim for shared storage | `true` |
|
||||
| `persistence.mount` | Whether the persistentVolumeClaim should be mounted (even if not created) | `true` |
|
||||
| `persistence.claimName` | Use an existing claim to store repository information | `gitea-shared-storage` |
|
||||
| `persistence.size` | Size for persistence to store repo information | `10Gi` |
|
||||
| `persistence.accessModes` | AccessMode for persistence | `["ReadWriteOnce"]` |
|
||||
| `persistence.labels` | Labels for the persistence volume claim to be created | `{}` |
|
||||
| `persistence.annotations.helm.sh/resource-policy` | Resource policy for the persistence volume claim | `keep` |
|
||||
| `persistence.storageClass` | Name of the storage class to use | `nil` |
|
||||
| `persistence.subPath` | Subdirectory of the volume to mount at | `nil` |
|
||||
| `persistence.volumeName` | Name of persistent volume in PVC | `""` |
|
||||
| `extraVolumes` | Additional volumes to mount to the Forgejo deployment | `[]` |
|
||||
| `extraContainerVolumeMounts` | Mounts that are only mapped into the Forgejo runtime/main container, to e.g. override custom templates. | `[]` |
|
||||
| `extraInitVolumeMounts` | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]` |
|
||||
| `extraVolumeMounts` | **DEPRECATED** Additional volume mounts for init containers and the Forgejo main container | `[]` |
|
||||
|
||||
### Init
|
||||
|
||||
|
|
@ -690,21 +937,22 @@ gitea:
|
|||
|
||||
### Gitea
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------- | --------------------------------------------------------------------------------------------------------------- | -------------------- |
|
||||
| `gitea.admin.username` | Username for the Forgejo admin user | `gitea_admin` |
|
||||
| `gitea.admin.existingSecret` | Use an existing secret to store admin user credentials | `nil` |
|
||||
| `gitea.admin.password` | Password for the Forgejo admin user | `r8sA8CPHD9!bt6d` |
|
||||
| `gitea.admin.email` | Email for the Forgejo admin user | `gitea@local.domain` |
|
||||
| `gitea.metrics.enabled` | Enable Forgejo metrics | `false` |
|
||||
| `gitea.metrics.serviceMonitor.enabled` | Enable Forgejo metrics service monitor | `false` |
|
||||
| `gitea.ldap` | LDAP configuration | `[]` |
|
||||
| `gitea.oauth` | OAuth configuration | `[]` |
|
||||
| `gitea.config` | Configuration for the Forgejo server,ref: [config-cheat-sheet](https://docs.gitea.io/en-us/config-cheat-sheet/) | `{}` |
|
||||
| `gitea.additionalConfigSources` | Additional configuration from secret or configmap | `[]` |
|
||||
| `gitea.additionalConfigFromEnvs` | Additional configuration sources from environment variables | `[]` |
|
||||
| `gitea.podAnnotations` | Annotations for the Forgejo pod | `{}` |
|
||||
| `gitea.ssh.logLevel` | Configure OpenSSH's log level. Only available for root-based Forgejo image. | `INFO` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------- | ------------------------------------------------------------------------- | -------------------- |
|
||||
| `gitea.admin.username` | Username for the Forgejo admin user | `gitea_admin` |
|
||||
| `gitea.admin.existingSecret` | Use an existing secret to store admin user credentials | `nil` |
|
||||
| `gitea.admin.password` | Password for the Forgejo admin user | `r8sA8CPHD9!bt6d` |
|
||||
| `gitea.admin.email` | Email for the Forgejo admin user | `gitea@local.domain` |
|
||||
| `gitea.metrics.enabled` | Enable Forgejo metrics | `false` |
|
||||
| `gitea.metrics.serviceMonitor.enabled` | Enable Forgejo metrics service monitor | `false` |
|
||||
| `gitea.ldap` | LDAP configuration | `[]` |
|
||||
| `gitea.oauth` | OAuth configuration | `[]` |
|
||||
| `gitea.config.server.SSH_PORT` | SSH port for rootlful Forgejo image | `22` |
|
||||
| `gitea.config.server.SSH_LISTEN_PORT` | SSH port for rootless Forgejo image | `2222` |
|
||||
| `gitea.additionalConfigSources` | Additional configuration from secret or configmap | `[]` |
|
||||
| `gitea.additionalConfigFromEnvs` | Additional configuration sources from environment variables | `[]` |
|
||||
| `gitea.podAnnotations` | Annotations for the Forgejo pod | `{}` |
|
||||
| `gitea.ssh.logLevel` | Configure OpenSSH's log level. Only available for root-based Forgejo image. | `INFO` |
|
||||
|
||||
### LivenessProbe
|
||||
|
||||
|
|
@ -742,14 +990,29 @@ gitea:
|
|||
| `gitea.startupProbe.successThreshold` | Success threshold for startup probe | `1` |
|
||||
| `gitea.startupProbe.failureThreshold` | Failure threshold for startup probe | `10` |
|
||||
|
||||
### Memcached
|
||||
### redis-cluster
|
||||
|
||||
Memcached is loaded as a dependency from [Bitnami](https://github.com/bitnami/charts/tree/master/bitnami/memcached) if enabled in the values. Complete Configuration can be taken from their website.
|
||||
| Name | Description | Value |
|
||||
| -------------------------------- | -------------------------------------------- | ------- |
|
||||
| `redis-cluster.enabled` | Enable redis | `true` |
|
||||
| `redis-cluster.usePassword` | Whether to use password authentication | `false` |
|
||||
| `redis-cluster.cluster.nodes` | Number of redis cluster master nodes | `3` |
|
||||
| `redis-cluster.cluster.replicas` | Number of redis cluster master node replicas | `0` |
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `memcached.enabled` | Memcached is loaded as a dependency from [Bitnami](https://github.com/bitnami/charts/tree/master/bitnami/memcached) if enabled in the values. Complete Configuration can be taken from their website. | `true` |
|
||||
| `memcached.service.ports.memcached` | Port for Memcached | `11211` |
|
||||
### PostgreSQL-ha
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------- | ---------------------------------------------------------------- | ----------- |
|
||||
| `postgresql-ha.enabled` | Enable PostgreSQL-ha | `true` |
|
||||
| `postgresql-ha.postgresql.password` | Password for the `gitea` user (overrides `auth.password`) | `changeme4` |
|
||||
| `postgresql-ha.global.postgresql.database` | Name for a custom database to create (overrides `auth.database`) | `gitea` |
|
||||
| `postgresql-ha.global.postgresql.username` | Name for a custom user to create (overrides `auth.username`) | `gitea` |
|
||||
| `postgresql-ha.global.postgresql.password` | Name for a custom password to create (overrides `auth.password`) | `gitea` |
|
||||
| `postgresql-ha.postgresql.repmgrPassword` | Repmgr Password | `changeme2` |
|
||||
| `postgresql-ha.postgresql.postgresPassword` | postgres Password | `changeme1` |
|
||||
| `postgresql-ha.pgpool.adminPassword` | pgpool adminPassword | `changeme3` |
|
||||
| `postgresql-ha.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`) | `5432` |
|
||||
| `postgresql-ha.primary.persistence.size` | PVC Storage Request for PostgreSQL-ha volume | `10Gi` |
|
||||
|
||||
### PostgreSQL
|
||||
|
||||
|
|
@ -757,7 +1020,7 @@ PostgreSQL is loaded as a dependency from [Bitnami](https://github.com/bitnami/c
|
|||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------- | ---------------------------------------------------------------- | ------- |
|
||||
| `postgresql.enabled` | Enable PostgreSQL | `true` |
|
||||
| `postgresql.enabled` | Enable PostgreSQL | `false` |
|
||||
| `postgresql.global.postgresql.auth.password` | Password for the `gitea` user (overrides `auth.password`) | `gitea` |
|
||||
| `postgresql.global.postgresql.auth.database` | Name for a custom database to create (overrides `auth.database`) | `gitea` |
|
||||
| `postgresql.global.postgresql.auth.username` | Name for a custom user to create (overrides `auth.username`) | `gitea` |
|
||||
|
|
@ -782,5 +1045,6 @@ See [CONTRIBUTORS GUIDE](CONTRIBUTING.md) for details.
|
|||
|
||||
## Upgrading
|
||||
|
||||
This section lists major and breaking changes of each Helm Chart version
|
||||
Please read them carefully to upgrade successfully.
|
||||
This section lists major and breaking changes of each Helm Chart version.
|
||||
Please read them carefully to upgrade successfully, especially the change of the **default database backend**!
|
||||
If you miss this, blindly upgrading may delete your Postgres instance and you may lose your data!
|
||||
|
|
|
|||
178
docs/ha-setup.md
Normal file
178
docs/ha-setup.md
Normal file
|
|
@ -0,0 +1,178 @@
|
|||
# High Availability
|
||||
|
||||
All components (in-memory DB, volume/asset storage, code indexer) used by Forgejo must be deployed in a HA-ready fashion to achieve a full HA-ready Forgejo deployment.
|
||||
The following document explains how to achieve this for all individual components.
|
||||
|
||||
The resulting Forgejo deployment will consist of ~ 10 pods (depending on the chosen components and their replicas).
|
||||
One should evaluate upfront whether a HA-deployment is required as switching between HA/non-HA comes with some effort.
|
||||
For production instances, HA is always recommended to increase uptime and have a frictionless update process.
|
||||
|
||||
A general comment about chart dependencies and external services:
|
||||
Instead of relying on chart dependencies, it is often better to rely on an external, (managed) instances (in-memory database, asset storage provider, database, etc.).
|
||||
Many cloud providers offer such services, at least for databases or in-memory databases.
|
||||
They might cost a bit more than using a self-hosted k8s variant but are usually easier to maintain and scale, if needed.
|
||||
Also they can be centrally managed and are not linked to the Forgejo helm chart or namespace.
|
||||
Please consider using external services before you start with your Forgejo HA setup, it will make your life (and the life of the Forgejo maintainers) easier.
|
||||
|
||||
This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Forgejo instance by implementing smart conditionals if `replicaCount` is set to a value > 1.
|
||||
Nevertheless, we cannot guarantee for every possible combination of Forgejo settings to work together perfectly in a HA setup.
|
||||
As a general advice, we recommend to have a test environment aside on which to test possible changes/upgrades before applying these to a production installation.
|
||||
|
||||
## Requirements for HA
|
||||
|
||||
Storage-wise, the HA-Forgejo setup requires a RWX file-system which can be shared among the deployment-based replica pods.
|
||||
In addition, the following components are required for full HA-readiness:
|
||||
|
||||
- A HA-ready issue (and optionally code) indexer: `elasticsearch` or `meilisearch`
|
||||
- A HA-ready external object/asset storage (`minio`) (optional, assets can also be stored on the RWX file-system)
|
||||
- A HA-ready cache (`redis-cluster`)
|
||||
- A HA-ready DB
|
||||
|
||||
`postgres.enabled`, which default to `true`, must be set to `false` for a HA setup.
|
||||
The default `postgres` chart dependency is not HA-ready (there's a dedicated `postgres-ha` chart).
|
||||
|
||||
The following sections discuss each of the components in more detail.
|
||||
Note that for each component discussed, the shown configurations only provides a (working) starting point, not necessarily the most optimal setup.
|
||||
We try to optimize this document over time as we have gained more experience with HA setups from users.
|
||||
|
||||
## Indexers (Issues and code/repo)
|
||||
|
||||
The default code indexer `bleve` is not able to allow multiple connections and hence cannot be used in a HA setup.
|
||||
Alternatives are `elasticsearch` and `meilisearch` (as of >= 1.19.2).
|
||||
Unless you have an existing `elasticsearch` cluster, we recommend using `meilisearch` as it is faster and requires way less resources.
|
||||
|
||||
Unfortunately, `meilisearch` does only support the `ISSUE_INDEXER` and not the `REPO_INDEXER` yet ([tracking issue](https://github.com/go-gitea/gitea/pull/24149)).
|
||||
This means that the `REPO_INDEXER` must still be disabled for a HA setup right now.
|
||||
An alternative to the two options above for the `ISSUE_INDEXER` is `"db"`, however we recommend to just go with `meilisearch` in this case and to not bother the DB with indexing.
|
||||
|
||||
To configure `meilisearch` within Forgejo, do the following:
|
||||
|
||||
```yml
|
||||
gitea:
|
||||
config:
|
||||
indexer:
|
||||
ISSUE_INDEXER_CONN_STR: <http://meilisearch.<namespace>.svc.cluster.local:7700>
|
||||
ISSUE_INDEXER_ENABLED: true
|
||||
ISSUE_INDEXER_TYPE: meilisearch
|
||||
REPO_INDEXER_ENABLED: false
|
||||
# REPO_INDEXER_TYPE: meilisearch # not yet working
|
||||
```
|
||||
|
||||
Unfortunately `meilisearch` cannot be deployed in HA as of now.
|
||||
Nevertheless it allows for multiple Forgejo requests at the same time and is therefore required in a HA setup.
|
||||
|
||||
Exemplary configuration for the [meilisearch-kubernetes](https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch) chart:
|
||||
|
||||
```yaml
|
||||
persistence:
|
||||
enabled: true
|
||||
accessMode: ReadWriteOnce
|
||||
size: 5Gi
|
||||
```
|
||||
|
||||
## Cache, session and queue
|
||||
|
||||
A `redis` instance is required for the in-memory cache.
|
||||
Two options exist:
|
||||
|
||||
- `redis`
|
||||
- `redis-cluster`
|
||||
|
||||
The chart provides `redis-cluster` as a dependency as this one can be used for both HA and non-HA setups.
|
||||
You're also welcome to go with `redis` if you prefer or already have a running instance.
|
||||
|
||||
It should be noted that `redis-cluster` support is only available starting with Forgejo 1.19.2.
|
||||
You can also configure an external (managed) `redis` instance to be used.
|
||||
To do so, you need to set the following configuration values yourself:
|
||||
|
||||
- `gitea.config.queue.TYPE`: redis`
|
||||
- `gitea.config.queue.CONN_STR`: `<your redis connection string>`
|
||||
|
||||
- `gitea.config.session.PROVIDER`: `redis`
|
||||
- `gitea.config.session.PROVIDER_CONFIG`: `<your redis connection string>`
|
||||
|
||||
- `gitea.config.cache.ENABLED`: `true`
|
||||
- `gitea.config.cache.ADAPTER`: `redis`
|
||||
- `gitea.config.cache.HOST`: `<your redis connection string>`
|
||||
|
||||
By default, the `redis-cluster` chart provisions three standalone master nodes of which each has a single replica.
|
||||
To reduce the number of pods for a default Forgejo deployment, we opted to omit the replicas (`replicas: 0`) by default.
|
||||
Only the minimum required number of master pods for a functional `redis-cluster` deployment are provisioned.
|
||||
For a "proper" `redis-cluster` setup however, we recommend to set `replicas: 1` and `nodes: 6`.
|
||||
|
||||
## Object and asset storage
|
||||
|
||||
Object/asset storage refers to the storage of attachments, avatars, LFS files, etc.
|
||||
While most of these can be stored on the RWX file-system, it is recommended to use an external S3-compatible object storage for such, mainly for performance reasons.
|
||||
|
||||
By default the chart provisions a single RWO volume to store everything (repos, avatars, packages, etc.).
|
||||
This volume cannot be mounted by multiple pods.
|
||||
Hence, a RWX volume is required and (optionally) an external HA-ready object storage.
|
||||
|
||||
> **Note:** Double-check that the file permissions are set correctly on the RWX volume! That is everything should be owned by the `git` user which usually has `uid=1000` and `gid=1000`.
|
||||
|
||||
To use `minio` you need to deploy and configure an external `minio` instance yourself and explicitly define the `STORAGE_TYPE` values as shown below.
|
||||
|
||||
Note that `MINIO_BUCKET` here is just a name and does not refer to a S3 bucket.
|
||||
It's the root access point for all objects belonging to the respective application, i.e., to Forgejo in this case.
|
||||
|
||||
```yaml
|
||||
gitea:
|
||||
config:
|
||||
attachment:
|
||||
STORAGE_TYPE: minio
|
||||
lfs:
|
||||
STORAGE_TYPE: minio
|
||||
picture:
|
||||
AVATAR_STORAGE_TYPE: minio
|
||||
"storage.packages":
|
||||
STORAGE_TYPE: minio
|
||||
|
||||
storage:
|
||||
MINIO_ENDPOINT: <minio-headless.<namespace>.svc.cluster.local:9000>
|
||||
MINIO_LOCATION: <location>
|
||||
MINIO_ACCESS_KEY_ID: <access key>
|
||||
MINIO_SECRET_ACCESS_KEY: <secret key>
|
||||
MINIO_BUCKET: <bucket name>
|
||||
MINIO_USE_SSL: false
|
||||
```
|
||||
|
||||
Exemplary configuration for the [bitnami minio](https://github.com/bitnami/charts/blob/main/bitnami/minio) chart:
|
||||
|
||||
```yaml
|
||||
auth:
|
||||
rootUser: minio
|
||||
mode: distributed
|
||||
replicaCount: 4
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 20Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
```
|
||||
|
||||
## Database
|
||||
|
||||
If you do not have an HA-ready DB, using a managed database service in the cloud might be the easiest and most robust solution.
|
||||
Remember: disable the built-in `postgres` dependency and configure the database connection manually via `gitea.config.database`:
|
||||
|
||||
```yml
|
||||
gitea:
|
||||
database:
|
||||
builtIn:
|
||||
postgresql:
|
||||
enabled: false
|
||||
config:
|
||||
database:
|
||||
DB_TYPE: postgres
|
||||
HOST: <host>
|
||||
NAME: <name>
|
||||
USER: <user>
|
||||
```
|
||||
|
||||
## Known issues
|
||||
|
||||
- Currently Cron jobs are run on all replicas as no leader election is implemented.
|
||||
See [https://github.com/go-gitea/gitea/issues/13791](https://github.com/go-gitea/gitea/issues/13791) for a discussion and possible solution.
|
||||
|
||||
- Running with multiple replicas slows down Forgejo a bit, i.e. page loading time increases.
|
||||
1580
package-lock.json
generated
1580
package-lock.json
generated
File diff suppressed because it is too large
Load diff
|
|
@ -36,13 +36,14 @@
|
|||
{
|
||||
"description": "Automerge dev deps updates",
|
||||
"matchManagers": ["npm"],
|
||||
"matchDepTypes":["devDependencies"],
|
||||
"matchDepTypes": ["devDependencies"],
|
||||
"automerge": true
|
||||
}
|
||||
],
|
||||
"regexManagers": [
|
||||
"customManagers": [
|
||||
{
|
||||
"description": "Update forgeo version in chart",
|
||||
"customType": "regex",
|
||||
"fileMatch": ["^Chart\\.yaml$"],
|
||||
"matchStrings": ["appVersion: (?<currentValue>.+?)\\s"],
|
||||
"depNameTemplate": "forgejo",
|
||||
|
|
@ -51,11 +52,23 @@
|
|||
},
|
||||
{
|
||||
"description": "Update helm unittest plugin",
|
||||
"customType": "regex",
|
||||
"fileMatch": ["^\\.woodpecker/[a-z-]+\\.yml$"],
|
||||
"matchStrings": ["helm plugin install --version (?<currentValue>.+?) https://github.com/helm-unittest/helm-unittest\\s"],
|
||||
"matchStrings": [
|
||||
"helm plugin install --version (?<currentValue>.+?) https://github.com/helm-unittest/helm-unittest\\s"
|
||||
],
|
||||
"depNameTemplate": "helm-unittest",
|
||||
"packageNameTemplate": "helm-unittest/helm-unittest",
|
||||
"datasourceTemplate": "github-releases"
|
||||
},
|
||||
{
|
||||
"description": "Detect helm-unittest yaml schema file",
|
||||
"customType": "regex",
|
||||
"fileMatch": [".vscode/settings\\.json$"],
|
||||
"matchStrings": [
|
||||
"https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json"
|
||||
],
|
||||
"datasourceTemplate": "github-releases"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,6 +2,27 @@
|
|||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
|
||||
{{- /* multiple replicas assertions */ -}}
|
||||
{{- if gt .Values.replicaCount 1.0 -}}
|
||||
{{- fail "When using multiple replicas, a RWX file system is required" -}}
|
||||
{{- if eq (get (.Values.persistence.accessModes 0) "ReadWriteOnce") -}}
|
||||
{{- fail "When using multiple replicas, a RWX file system is required" -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq (get .Values.gitea.config.indexer "ISSUE_INDEXER_TYPE") "bleve" -}}
|
||||
{{- fail "When using multiple replicas, the repo indexer must be set to 'meilisearch' or 'elasticsearch'" -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if and (eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve") (eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED "true") -}}
|
||||
{{- fail "When using multiple replicas, the repo indexer must be set to 'meilisearch' or 'elasticsearch'" -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
|
||||
{{- (printf "DEBUG: When using multiple replicas, the repo indexer must be set to 'meilisearch' or 'elasticsearch'") | fail -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "gitea.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
|
@ -35,14 +56,22 @@ Create chart name and version as used by the chart label.
|
|||
Create image name and tag used by the deployment.
|
||||
*/}}
|
||||
{{- define "gitea.image" -}}
|
||||
{{- $fullOverride := .Values.image.fullOverride | default "" -}}
|
||||
{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
|
||||
{{- $name := .Values.image.repository -}}
|
||||
{{- $repository := .Values.image.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $tag := .Values.image.tag | default .Chart.AppVersion -}}
|
||||
{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
|
||||
{{- if $registry -}}
|
||||
{{- printf "%s/%s:%s%s" $registry $name $tag $rootless -}}
|
||||
{{- $digest := "" -}}
|
||||
{{- if .Values.image.digest }}
|
||||
{{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
|
||||
{{- end -}}
|
||||
{{- if $fullOverride }}
|
||||
{{- printf "%s" $fullOverride -}}
|
||||
{{- else if $registry }}
|
||||
{{- printf "%s/%s%s%s%s%s" $registry $repository $separator $tag $rootless $digest -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s:%s%s" $name $tag $rootless -}}
|
||||
{{- printf "%s%s%s%s%s" $repository $separator $tag $rootless $digest -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -91,16 +120,38 @@ app.kubernetes.io/name: {{ include "gitea.name" . }}
|
|||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "postgresql.dns" -}}
|
||||
{{- printf "%s-postgresql.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain .Values.postgresql.global.postgresql.service.ports.postgresql -}}
|
||||
{{- define "postgresql-ha.dns" -}}
|
||||
{{- if (index .Values "postgresql-ha").enabled -}}
|
||||
{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "memcached.dns" -}}
|
||||
{{- printf "%s-memcached.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain .Values.memcached.service.ports.memcached | trunc 63 | trimSuffix "-" -}}
|
||||
{{- define "postgresql.dns" -}}
|
||||
{{- if (index .Values "postgresql").enabled -}}
|
||||
{{- printf "%s-postgresql.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain .Values.postgresql.global.postgresql.service.ports.postgresql -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "redis.dns" -}}
|
||||
{{- if (index .Values "redis-cluster").enabled -}}
|
||||
{{- printf "redis+cluster://:%s@%s-redis-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "redis-cluster").global.redis.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "redis-cluster").service.ports.redis -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "redis.port" -}}
|
||||
{{- if (index .Values "redis-cluster").enabled -}}
|
||||
{{ (index .Values "redis-cluster").service.ports.redis }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "redis.servicename" -}}
|
||||
{{- if (index .Values "redis-cluster").enabled -}}
|
||||
{{- printf "%s-redis-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.default_domain" -}}
|
||||
{{- printf "%s-gitea.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain | trunc 63 | trimSuffix "-" -}}
|
||||
{{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.ldap_settings" -}}
|
||||
|
|
@ -182,6 +233,7 @@ https
|
|||
{{- else -}}
|
||||
{{- (printf "Key %s cannot be on top level of configuration" $key) | fail -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
|
@ -211,6 +263,18 @@ https
|
|||
{{- if not (hasKey .Values.gitea.config "oauth2") -}}
|
||||
{{- $_ := set .Values.gitea.config "oauth2" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "session") -}}
|
||||
{{- $_ := set .Values.gitea.config "session" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "queue") -}}
|
||||
{{- $_ := set .Values.gitea.config "queue" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "queue.issue_indexer") -}}
|
||||
{{- $_ := set .Values.gitea.config "queue.issue_indexer" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "indexer") -}}
|
||||
{{- $_ := set .Values.gitea.config "indexer" dict -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.defaults" -}}
|
||||
|
|
@ -226,13 +290,27 @@ https
|
|||
{{- if not (hasKey .Values.gitea.config.metrics "ENABLED") -}}
|
||||
{{- $_ := set .Values.gitea.config.metrics "ENABLED" .Values.gitea.metrics.enabled -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.memcached.enabled -}}
|
||||
{{- if (index .Values "redis-cluster").enabled -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "ENABLED" "true" -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "ADAPTER" "memcache" -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "ADAPTER" "redis" -}}
|
||||
{{- if not (.Values.gitea.config.cache.HOST) -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "HOST" (include "memcached.dns" .) -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "HOST" (include "redis.dns" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- /* redis queue */ -}}
|
||||
{{- if (index .Values "redis-cluster").enabled -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "redis.dns" .) -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.session "PROVIDER") -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.session "PROVIDER_CONFIG") -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER_CONFIG" (include "redis.dns" .) -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE -}}
|
||||
{{- $_ := set .Values.gitea.config.indexer "ISSUE_INDEXER_TYPE" "db" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.defaults.server" -}}
|
||||
|
|
@ -244,7 +322,7 @@ https
|
|||
{{- end -}}
|
||||
{{- if not (.Values.gitea.config.server.DOMAIN) -}}
|
||||
{{- if gt (len .Values.ingress.hosts) 0 -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" (index .Values.ingress.hosts 0).host -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
|
||||
{{- end -}}
|
||||
|
|
@ -279,7 +357,16 @@ https
|
|||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.defaults.database" -}}
|
||||
{{- if .Values.postgresql.enabled -}}
|
||||
{{- if (index .Values "postgresql-ha" "enabled") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "DB_TYPE" "postgres" -}}
|
||||
{{- if not (.Values.gitea.config.database.HOST) -}}
|
||||
{{- $_ := set .Values.gitea.config.database "HOST" (include "postgresql-ha.dns" .) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.gitea.config.database "NAME" (index .Values "postgresql-ha" "global" "postgresql" "database") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "USER" (index .Values "postgresql-ha" "global" "postgresql" "username") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "PASSWD" (index .Values "postgresql-ha" "global" "postgresql" "password") -}}
|
||||
{{- end -}}
|
||||
{{- if (index .Values "postgresql" "enabled") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "DB_TYPE" "postgres" -}}
|
||||
{{- if not (.Values.gitea.config.database.HOST) -}}
|
||||
{{- $_ := set .Values.gitea.config.database "HOST" (include "postgresql.dns" .) -}}
|
||||
|
|
@ -311,3 +398,7 @@ https
|
|||
{{- define "gitea.gpg-key-secret-name" -}}
|
||||
{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.serviceAccountName" -}}
|
||||
{{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
|
|
|||
|
|
@ -16,6 +16,37 @@ metadata:
|
|||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
assertions: |
|
||||
|
||||
{{- /*assert that only one PG dep is enabled */ -}}
|
||||
{{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
|
||||
{{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
|
||||
{{- end }}
|
||||
|
||||
{{- /* multiple replicas assertions */ -}}
|
||||
{{- if gt .Values.replicaCount 1.0 -}}
|
||||
{{- if (get (get .Values.gitea.config "cron.GIT_GC_REPOS") "ENABLED") -}}
|
||||
{{- fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'cron.GIT_GC_REPOS.enabled = false'." -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}}
|
||||
{{- fail "When using multiple replicas, a RWX file system is required and gitea.persistence.accessModes[0] must be set to ReadWriteMany." -}}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq (get .Values.gitea.config.indexer "ISSUE_INDEXER_TYPE") "bleve" -}}
|
||||
{{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
|
||||
{{- if eq (get .Values.gitea.config.indexer "REPO_INDEXER_TYPE") "bleve" -}}
|
||||
{{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
|
||||
{{- if eq (get .Values.gitea.config.indexer "REPO_INDEXER_ENABLED") "true" -}}
|
||||
{{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
config_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
|
@ -57,10 +88,10 @@ stringData:
|
|||
return
|
||||
fi
|
||||
|
||||
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||
masked_section="${masked_section//-/_0X2D_}"
|
||||
|
||||
export "FORGEJO__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
export "FORGEJO__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
}
|
||||
|
||||
function env2ini::reload_preset_envs() {
|
||||
|
|
@ -131,7 +162,7 @@ stringData:
|
|||
function env2ini::generate_initial_secrets() {
|
||||
# These environment variables will either be
|
||||
# - overwritten with user defined values,
|
||||
# - initially used to set up Gitea
|
||||
# - initially used to set up Forgejo
|
||||
# Anyway, they won't harm existing app.ini files
|
||||
|
||||
export FORGEJO__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||
|
|
|
|||
|
|
@ -1,22 +1,28 @@
|
|||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
annotations:
|
||||
{{- if .Values.statefulset.annotations }}
|
||||
{{- toYaml .Values.statefulset.annotations | nindent 4 }}
|
||||
{{- if .Values.deployment.annotations }}
|
||||
{{- toYaml .Values.deployment.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
{{- if eq .Values.strategy.type "RollingUpdate" }}
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
|
||||
maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
{{- if .Values.statefulset.labels }}
|
||||
{{- toYaml .Values.statefulset.labels | nindent 6 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
{{- toYaml .Values.deployment.labels | nindent 6 }}
|
||||
{{- end }}
|
||||
serviceName: {{ include "gitea.fullname" . }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
|
|
@ -32,13 +38,16 @@ spec:
|
|||
{{- end }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 8 }}
|
||||
{{- if .Values.statefulset.labels }}
|
||||
{{- toYaml .Values.statefulset.labels | nindent 8 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
{{- toYaml .Values.deployment.labels | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: "{{ .Values.schedulerName }}"
|
||||
{{- end }}
|
||||
{{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
|
||||
serviceAccountName: {{ include "gitea.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
|
|
@ -59,8 +68,8 @@ spec:
|
|||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.statefulset.env }}
|
||||
{{- toYaml .Values.statefulset.env | nindent 12 }}
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: GNUPGHOME
|
||||
|
|
@ -94,8 +103,8 @@ spec:
|
|||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.statefulset.env }}
|
||||
{{- toYaml .Values.statefulset.env | nindent 12 }}
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.additionalConfigFromEnvs }}
|
||||
{{- toYaml .Values.gitea.additionalConfigFromEnvs | nindent 12 }}
|
||||
|
|
@ -173,6 +182,10 @@ spec:
|
|||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
{{- if $value.existingSecret }}
|
||||
|
|
@ -227,8 +240,8 @@ spec:
|
|||
- name: GITEA_ADMIN_PASSWORD
|
||||
value: {{ .Values.gitea.admin.password | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.statefulset.env }}
|
||||
{{- toYaml .Values.statefulset.env | nindent 12 }}
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
|
|
@ -243,7 +256,7 @@ spec:
|
|||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
terminationGracePeriodSeconds: {{ .Values.statefulset.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
|
|
@ -268,12 +281,16 @@ spec:
|
|||
value: /tmp/gitea
|
||||
- name: TMPDIR
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: GNUPGHOME
|
||||
value: {{ .Values.signing.gpgHome }}
|
||||
{{- end }}
|
||||
{{- if .Values.statefulset.env }}
|
||||
{{- toYaml .Values.statefulset.env | nindent 12 }}
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ssh
|
||||
|
|
@ -329,6 +346,10 @@ spec:
|
|||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
|
|
@ -367,38 +388,13 @@ spec:
|
|||
path: private.asc
|
||||
defaultMode: 0100
|
||||
{{- end }}
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- if .Values.persistence.mount }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
{{- with .Values.persistence.existingClaim }}
|
||||
claimName: {{ tpl . $ }}
|
||||
{{- end }}
|
||||
claimName: {{ .Values.persistence.claimName }}
|
||||
{{- end }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.labels }}
|
||||
labels:
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- include "gitea.persistence.storageClass" . | indent 8 }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- end }}
|
||||
|
|
@ -15,10 +15,10 @@ metadata:
|
|||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.className }}
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
|
|
@ -28,14 +28,14 @@ spec:
|
|||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
- {{ tpl . $ | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ .host | quote }}
|
||||
- host: {{ tpl .host $ | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- range .paths }}
|
||||
|
|
|
|||
|
|
@ -58,9 +58,30 @@ stringData:
|
|||
{ # try
|
||||
gitea migrate
|
||||
} || { # catch
|
||||
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
echo "Forgejo migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
exit 1
|
||||
}
|
||||
|
||||
{{- if include "redis.servicename" . }}
|
||||
function test_redis_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for redis to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
nc -vz -w2 {{ include "redis.servicename" . }} {{ include "redis.port" . }} && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Redis not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_redis_connection
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
|
||||
|
|
|
|||
17
templates/gitea/poddisruptionbudget.yaml
Normal file
17
templates/gitea/poddisruptionbudget.yaml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{{- if .Values.podDisruptionBudget -}}
|
||||
{{- if .Capabilities.APIVersions.Has "policy/v1" }}
|
||||
apiVersion: policy/v1
|
||||
{{- else }}
|
||||
apiVersion: policy/v1beta1
|
||||
{{- end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
{{- toYaml .Values.podDisruptionBudget | nindent 2 }}
|
||||
{{- end -}}
|
||||
26
templates/gitea/pvc.yaml
Normal file
26
templates/gitea/pvc.yaml
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
{{- if and .Values.persistence.enabled .Values.persistence.create }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ .Values.persistence.claimName }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
annotations:
|
||||
{{ .Values.persistence.annotations | toYaml | indent 4}}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- if gt .Values.replicaCount 1.0 }}
|
||||
- ReadWriteMany
|
||||
{{- else }}
|
||||
{{- .Values.persistence.accessModes | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMode: Filesystem
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.volumeName }}
|
||||
volumeName: {{ . }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- end }}
|
||||
21
templates/gitea/serviceaccount.yaml
Normal file
21
templates/gitea/serviceaccount.yaml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "gitea.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.labels }}
|
||||
{{- . | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- . | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- with .Values.serviceAccount.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -39,7 +39,9 @@ spec:
|
|||
ports:
|
||||
- name: ssh
|
||||
port: {{ .Values.service.ssh.port }}
|
||||
{{- if .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
targetPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
{{- end }}
|
||||
protocol: TCP
|
||||
{{- if .Values.service.ssh.nodePort }}
|
||||
nodePort: {{ .Values.service.ssh.nodePort }}
|
||||
|
|
|
|||
30
unittests/config/database-section_postgresql-ha.yaml
Normal file
30
unittests/config/database-section_postgresql-ha.yaml
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
suite: config template | database section (postgresql-ha)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: connects to pgpool service
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
postgresql:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: true
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.database
|
||||
pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:5432
|
||||
- it: renders the referenced service
|
||||
template: charts/postgresql-ha/templates/pgpool/service.yaml
|
||||
set:
|
||||
postgresql:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: true
|
||||
asserts:
|
||||
- containsDocument:
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-postgresql-ha-pgpool
|
||||
namespace: testing
|
||||
30
unittests/config/database-section_postgresql.yaml
Normal file
30
unittests/config/database-section_postgresql.yaml
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
suite: config template | database section (postgresql)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: "connects to postgresql service"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
postgresql:
|
||||
enabled: true
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.database
|
||||
pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:5432
|
||||
- it: "renders the referenced service"
|
||||
template: charts/postgresql/templates/primary/svc.yaml
|
||||
set:
|
||||
postgresql:
|
||||
enabled: true
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
asserts:
|
||||
- containsDocument:
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
name: gitea-unittests-postgresql
|
||||
namespace: testing
|
||||
67
unittests/config/server-section_domain.yaml
Normal file
67
unittests/config/server-section_domain.yaml
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
suite: config template | server section (domain related)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
||||
template: templates/gitea/config.yaml
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nDOMAIN=git.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nSSH_DOMAIN=git.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=http://git.example.com
|
||||
|
||||
################################################
|
||||
|
||||
- it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
ingress:
|
||||
hosts: []
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
|
||||
|
||||
################################################
|
||||
|
||||
- it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
|
||||
template: templates/gitea/config.yaml
|
||||
set:
|
||||
gitea.config.server.DOMAIN: provided.example.com
|
||||
ingress:
|
||||
hosts:
|
||||
- host: non-used.example.com
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nDOMAIN=provided.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nSSH_DOMAIN=provided.example.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: \nROOT_URL=http://provided.example.com
|
||||
42
unittests/dependency-major-image-check.yaml
Normal file
42
unittests/dependency-major-image-check.yaml
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
suite: Dependency update consistency
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
tests:
|
||||
- it: "[postgresql-ha] ensures we detect major image version upgrades"
|
||||
template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||
set:
|
||||
postgresql:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: true
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: spec.template.spec.containers[0].image
|
||||
# IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
|
||||
pattern: ^docker.io/bitnami/postgresql-repmgr:16.+$
|
||||
- it: "[postgresql] ensures we detect major image version upgrades"
|
||||
template: charts/postgresql/templates/primary/statefulset.yaml
|
||||
set:
|
||||
postgresql:
|
||||
enabled: true
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: spec.template.spec.containers[0].image
|
||||
# IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
|
||||
pattern: ^docker.io/bitnami/postgresql:15.+$
|
||||
- it: "[redis-cluster] ensures we detect major image version upgrades"
|
||||
template: charts/redis-cluster/templates/redis-statefulset.yaml
|
||||
set:
|
||||
redis-cluster:
|
||||
enabled: true
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: spec.template.spec.containers[0].image
|
||||
# IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
|
||||
pattern: ^docker.io/bitnami/redis-cluster:7.+$
|
||||
|
|
@ -1,17 +1,17 @@
|
|||
suite: Statefulset template (basic)
|
||||
suite: deployment template (basic)
|
||||
release:
|
||||
name: forgejo-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: renders a statefulset
|
||||
template: templates/gitea/statefulset.yaml
|
||||
- it: renders a deployment
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: StatefulSet
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
name: forgejo-unittests
|
||||
93
unittests/deployment/image-configuration.yaml
Normal file
93
unittests/deployment/image-configuration.yaml
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
suite: deployment template (image configuration)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
chart:
|
||||
# Override appVersion to be consistent with used digest :)
|
||||
appVersion: 1.19.3
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: default values
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "gitea/gitea:1.19.3-rootless"
|
||||
- it: tag override
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.tag: "1.19.4"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "gitea/gitea:1.19.4-rootless"
|
||||
- it: root-based image
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.rootless: false
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "gitea/gitea:1.19.3"
|
||||
- it: scoped registry
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.registry: "example.com"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "example.com/gitea/gitea:1.19.3-rootless"
|
||||
- it: global registry
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
global.imageRegistry: "global.example.com"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "global.example.com/gitea/gitea:1.19.3-rootless"
|
||||
- it: digest for rootless image
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image:
|
||||
rootless: true
|
||||
digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "gitea/gitea:1.19.3-rootless@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
|
||||
- it: image fullOverride (does not append rootless)
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image:
|
||||
fullOverride: gitea/gitea:1.19.3
|
||||
# setting rootless, registry, repository, tag, and digest to prove that override works
|
||||
rootless: true
|
||||
registry: example.com
|
||||
repository: example/image
|
||||
tag: "1.0.0"
|
||||
digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "gitea/gitea:1.19.3"
|
||||
- it: digest for root-based image
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image:
|
||||
rootless: false
|
||||
digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "gitea/gitea:1.19.3@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
|
||||
- it: digest and global registry
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
global.imageRegistry: "global.example.com"
|
||||
image.digest: "sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.containers[0].image
|
||||
value: "global.example.com/gitea/gitea:1.19.3-rootless@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
|
||||
23
unittests/deployment/ingress-configuration.yaml
Normal file
23
unittests/deployment/ingress-configuration.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
suite: ingress template
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/ingress.yaml
|
||||
tests:
|
||||
- it: hostname using TPL
|
||||
set:
|
||||
global.giteaHostName: "gitea.example.com"
|
||||
ingress.enabled: true
|
||||
ingress.hosts[0].host: "{{ .Values.global.giteaHostName }}"
|
||||
ingress.tls:
|
||||
- secretName: gitea-tls
|
||||
hosts:
|
||||
- "{{ .Values.global.giteaHostName }}"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.tls[0].hosts[0]
|
||||
value: "gitea.example.com"
|
||||
- equal:
|
||||
path: spec.rules[0].host
|
||||
value: "gitea.example.com"
|
||||
33
unittests/deployment/inline-config.yaml
Normal file
33
unittests/deployment/inline-config.yaml
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
suite: config template
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: inline config stringData.server using TPL
|
||||
set:
|
||||
global.giteaHostName: "gitea.example.com"
|
||||
ingress.enabled: true
|
||||
ingress.hosts[0].host: "{{ .Values.global.giteaHostName }}"
|
||||
ingress.tls:
|
||||
- secretName: gitea-tls
|
||||
hosts:
|
||||
- "{{ .Values.global.giteaHostName }}"
|
||||
asserts:
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: metadata.name
|
||||
pattern: .*-inline-config$
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: DOMAIN=gitea\.example\.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: ROOT_URL=https://gitea\.example\.com
|
||||
- documentIndex: 0
|
||||
matchRegex:
|
||||
path: stringData.server
|
||||
pattern: SSH_DOMAIN=gitea\.example\.com
|
||||
|
|
@ -1,13 +1,13 @@
|
|||
suite: Statefulset template (signing disabled)
|
||||
suite: deployment template (signing disabled)
|
||||
release:
|
||||
name: forgejo-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: skips gpg init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.initContainers
|
||||
|
|
@ -15,7 +15,7 @@ tests:
|
|||
content:
|
||||
name: configure-gpg
|
||||
- it: skips gpg env in `init-directories` init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing.enabled: false
|
||||
asserts:
|
||||
|
|
@ -25,14 +25,14 @@ tests:
|
|||
name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- it: skips gpg env in runtime container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: GNUPGHOME
|
||||
- it: skips gpg volume spec
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.volumes
|
||||
|
|
@ -1,13 +1,13 @@
|
|||
suite: Statefulset template (signing enabled)
|
||||
suite: deployment template (signing enabled)
|
||||
release:
|
||||
name: forgejo-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: adds gpg init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
|
|
@ -39,7 +39,7 @@ tests:
|
|||
mountPath: /raw
|
||||
readOnly: true
|
||||
- it: adds gpg env in `init-directories` init container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing.enabled: true
|
||||
signing.existingSecret: "custom-gpg-secret"
|
||||
|
|
@ -50,7 +50,7 @@ tests:
|
|||
name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- it: adds gpg env in runtime container
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing.enabled: true
|
||||
signing.existingSecret: "custom-gpg-secret"
|
||||
|
|
@ -61,7 +61,7 @@ tests:
|
|||
name: GNUPGHOME
|
||||
value: /data/git/.gnupg
|
||||
- it: adds gpg volume spec
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
|
|
@ -78,7 +78,7 @@ tests:
|
|||
path: private.asc
|
||||
defaultMode: 0100
|
||||
- it: supports gpg volume spec with external reference
|
||||
template: templates/gitea/statefulset.yaml
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
signing:
|
||||
enabled: true
|
||||
64
unittests/deployment/ssh-configuration.yaml
Normal file
64
unittests/deployment/ssh-configuration.yaml
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
suite: deployment template (SSH configuration)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: supports defining SSH log level for root based image
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.rootless: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
value: "INFO"
|
||||
- it: supports overriding SSH log level
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.rootless: false
|
||||
gitea.ssh.logLevel: "DEBUG"
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
value: "DEBUG"
|
||||
- it: supports overriding SSH log level (even when image.fullOverride set)
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.fullOverride: gitea/gitea:1.19.3
|
||||
image.rootless: false
|
||||
gitea.ssh.logLevel: "DEBUG"
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
value: "DEBUG"
|
||||
- it: skips SSH_LOG_LEVEL for rootless image
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.rootless: true
|
||||
gitea.ssh.logLevel: "DEBUG" # explicitly defining a non-standard level here
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
any: true
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
- it: skips SSH_LOG_LEVEL for rootless image (even when image.fullOverride set)
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
image.fullOverride: gitea/gitea:1.19.3
|
||||
image.rootless: true
|
||||
gitea.ssh.logLevel: "DEBUG" # explicitly defining a non-standard level here
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
any: true
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
|
|
@ -33,7 +33,7 @@ tests:
|
|||
kind: Secret
|
||||
apiVersion: v1
|
||||
name: forgejo-unittests-gpg-key
|
||||
- isNotEmpty:
|
||||
- isNotNullOrEmpty:
|
||||
path: metadata.labels
|
||||
- equal:
|
||||
path: data.privateKey
|
||||
|
|
|
|||
88
unittests/init/init_directory_structure.sh-rootless.yaml
Normal file
88
unittests/init/init_directory_structure.sh-rootless.yaml
Normal file
|
|
@ -0,0 +1,88 @@
|
|||
suite: Init template
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/init.yaml
|
||||
tests:
|
||||
- it: runs gpg in batch mode
|
||||
set:
|
||||
signing.enabled: true
|
||||
signing.privateKey: |-
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
{placeholder}
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData["configure_gpg_environment.sh"]
|
||||
value: |-
|
||||
#!/usr/bin/env bash
|
||||
set -eu
|
||||
|
||||
gpg --batch --import /raw/private.asc
|
||||
- it: skips gpg script block for disabled signing
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData["init_directory_structure.sh"]
|
||||
value: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
- it: adds gpg script block for enabled signing
|
||||
set:
|
||||
signing.enabled: true
|
||||
signing.privateKey: |-
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
{placeholder}
|
||||
-----END PGP PRIVATE KEY BLOCK-----
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData["init_directory_structure.sh"]
|
||||
value: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
if [ ! -d "${GNUPGHOME}" ]; then
|
||||
mkdir -p "${GNUPGHOME}"
|
||||
chmod 700 "${GNUPGHOME}"
|
||||
chown 1000:1000 "${GNUPGHOME}"
|
||||
fi
|
||||
- it: it does not chown /data even when image.fullOverride is set
|
||||
template: templates/gitea/init.yaml
|
||||
set:
|
||||
image.fullOverride: gitea/gitea:1.20.5
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData["init_directory_structure.sh"]
|
||||
value: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
|
|
@ -7,6 +7,7 @@ templates:
|
|||
tests:
|
||||
- it: runs gpg in batch mode
|
||||
set:
|
||||
image.rootless: false
|
||||
signing.enabled: true
|
||||
signing.privateKey: |-
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
|
|
@ -21,6 +22,8 @@ tests:
|
|||
|
||||
gpg --batch --import /raw/private.asc
|
||||
- it: skips gpg script block for disabled signing
|
||||
set:
|
||||
image.rootless: false
|
||||
asserts:
|
||||
- equal:
|
||||
path: stringData["init_directory_structure.sh"]
|
||||
|
|
@ -41,6 +44,7 @@ tests:
|
|||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
- it: adds gpg script block for enabled signing
|
||||
set:
|
||||
image.rootless: false
|
||||
signing.enabled: true
|
||||
signing.privateKey: |-
|
||||
-----BEGIN PGP PRIVATE KEY BLOCK-----
|
||||
|
|
|
|||
82
unittests/serviceaccount/basic.yaml
Normal file
82
unittests/serviceaccount/basic.yaml
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
suite: ServiceAccount template (basic)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/serviceaccount.yaml
|
||||
tests:
|
||||
- it: skips rendering by default
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 0
|
||||
- it: renders default ServiceAccount object with serviceAccount.create=true
|
||||
set:
|
||||
serviceAccount.create: true
|
||||
asserts:
|
||||
- hasDocuments:
|
||||
count: 1
|
||||
- containsDocument:
|
||||
kind: ServiceAccount
|
||||
apiVersion: v1
|
||||
name: gitea-unittests
|
||||
- equal:
|
||||
path: automountServiceAccountToken
|
||||
value: false
|
||||
- notExists:
|
||||
path: imagePullSecrets
|
||||
- notExists:
|
||||
path: metadata.annotations
|
||||
- it: allows for adding custom labels
|
||||
set:
|
||||
serviceAccount:
|
||||
create: true
|
||||
labels:
|
||||
custom: label
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.labels.custom
|
||||
value: label
|
||||
- it: allows for adding custom annotations
|
||||
set:
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations:
|
||||
myCustom: annotation
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.annotations.myCustom
|
||||
value: annotation
|
||||
- it: allows to override the generated name
|
||||
set:
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: provided-serviceaccount-name
|
||||
asserts:
|
||||
- equal:
|
||||
path: metadata.name
|
||||
value: provided-serviceaccount-name
|
||||
- it: allows to mount the token
|
||||
set:
|
||||
serviceAccount:
|
||||
create: true
|
||||
automountServiceAccountToken: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: automountServiceAccountToken
|
||||
value: true
|
||||
- it: allows to reference image pull secrets
|
||||
set:
|
||||
serviceAccount:
|
||||
create: true
|
||||
imagePullSecrets:
|
||||
- name: testing-image-pull-secret
|
||||
- name: another-pull-secret
|
||||
asserts:
|
||||
- contains:
|
||||
path: imagePullSecrets
|
||||
content:
|
||||
name: testing-image-pull-secret
|
||||
- contains:
|
||||
path: imagePullSecrets
|
||||
content:
|
||||
name: another-pull-secret
|
||||
32
unittests/serviceaccount/reference.yaml
Normal file
32
unittests/serviceaccount/reference.yaml
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
suite: ServiceAccount template (reference)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/serviceaccount.yaml
|
||||
- templates/gitea/deployment.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: does not modify the deployment by default
|
||||
template: templates/gitea/deployment.yaml
|
||||
asserts:
|
||||
- notExists:
|
||||
path: spec.serviceAccountName
|
||||
- it: adds the reference to the deployment with serviceAccount.create=true
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
serviceAccount.create: true
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: gitea-unittests
|
||||
- it: allows referencing an externally created ServiceAccount to the deployment
|
||||
template: templates/gitea/deployment.yaml
|
||||
set:
|
||||
serviceAccount:
|
||||
create: false # explicitly set to define rendering behavior
|
||||
name: "externally-existing-serviceaccount"
|
||||
asserts:
|
||||
- equal:
|
||||
path: spec.template.spec.serviceAccountName
|
||||
value: externally-existing-serviceaccount
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
suite: Statefulset template (SSH configuration)
|
||||
release:
|
||||
name: gitea-unittests
|
||||
namespace: testing
|
||||
templates:
|
||||
- templates/gitea/statefulset.yaml
|
||||
- templates/gitea/config.yaml
|
||||
tests:
|
||||
- it: supports defining SSH log level for root based image
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
image.rootless: false
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
value: "INFO"
|
||||
- it: supports overriding SSH log level
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
image.rootless: false
|
||||
gitea.ssh.logLevel: "DEBUG"
|
||||
asserts:
|
||||
- contains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
value: "DEBUG"
|
||||
- it: skips SSH_LOG_LEVEL for rootless image
|
||||
template: templates/gitea/statefulset.yaml
|
||||
set:
|
||||
image.rootless: true
|
||||
gitea.ssh.logLevel: "DEBUG" # explicitly defining a non-standard level here
|
||||
asserts:
|
||||
- notContains:
|
||||
path: spec.template.spec.containers[0].env
|
||||
any: true
|
||||
content:
|
||||
name: SSH_LOG_LEVEL
|
||||
166
values.yaml
166
values.yaml
|
|
@ -20,9 +20,19 @@ global:
|
|||
# hostnames:
|
||||
# - example.com
|
||||
|
||||
## @param replicaCount number of replicas for the statefulset
|
||||
## @param replicaCount number of replicas for the deployment
|
||||
replicaCount: 1
|
||||
|
||||
## @section strategy
|
||||
## @param strategy.type strategy type
|
||||
## @param strategy.rollingUpdate.maxSurge maxSurge
|
||||
## @param strategy.rollingUpdate.maxUnavailable maxUnavailable
|
||||
strategy:
|
||||
type: "RollingUpdate"
|
||||
rollingUpdate:
|
||||
maxSurge: "100%"
|
||||
maxUnavailable: 0
|
||||
|
||||
## @param clusterDomain cluster domain
|
||||
clusterDomain: cluster.local
|
||||
|
||||
|
|
@ -30,15 +40,19 @@ clusterDomain: cluster.local
|
|||
## @param image.registry image registry, e.g. gcr.io,docker.io
|
||||
## @param image.repository Image to start for this pod
|
||||
## @param image.tag Visit: [Image tag](https://codeberg.org/forgejo/-/packages/container/forgejo/versions). Defaults to `appVersion` within Chart.yaml.
|
||||
## @param image.digest Image digest. Allows to pin the given image tag. Useful for having control over mutable tags like `latest`
|
||||
## @param image.pullPolicy Image pull policy
|
||||
## @param image.rootless Wether or not to pull the rootless version of Forgejo, only works on Forgejo 1.14.x or higher
|
||||
## @param image.rootless Wether or not to pull the rootless version of Forgejo
|
||||
## @param image.fullOverride Completely overrides the image registry, path/image, tag and digest. **Adjust `image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).**
|
||||
image:
|
||||
registry: "codeberg.org"
|
||||
registry: codeberg.org
|
||||
repository: forgejo/forgejo
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: ""
|
||||
pullPolicy: Always
|
||||
rootless: false # only possible when running 1.14 or later
|
||||
digest: ""
|
||||
pullPolicy: IfNotPresent
|
||||
rootless: true
|
||||
fullOverride: ""
|
||||
|
||||
## @param imagePullSecrets Secret to use for pulling the image
|
||||
imagePullSecrets: []
|
||||
|
|
@ -74,11 +88,16 @@ containerSecurityContext: {}
|
|||
## @param securityContext Run init and Forgejo containers as a specific securityContext
|
||||
securityContext: {}
|
||||
|
||||
## @param podDisruptionBudget Pod disruption budget
|
||||
podDisruptionBudget: {}
|
||||
# maxUnavailable: 1
|
||||
# minAvailable: 1
|
||||
|
||||
## @section Service
|
||||
service:
|
||||
## @param service.http.type Kubernetes service type for web traffic
|
||||
## @param service.http.port Port number for web traffic
|
||||
## @param service.http.clusterIP ClusterIP setting for http autosetup for statefulset is None
|
||||
## @param service.http.clusterIP ClusterIP setting for http autosetup for deployment is None
|
||||
## @param service.http.loadBalancerIP LoadBalancer IP setting
|
||||
## @param service.http.nodePort NodePort for http service
|
||||
## @param service.http.externalTrafficPolicy If `service.http.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation
|
||||
|
|
@ -101,7 +120,7 @@ service:
|
|||
annotations: {}
|
||||
## @param service.ssh.type Kubernetes service type for ssh traffic
|
||||
## @param service.ssh.port Port number for ssh traffic
|
||||
## @param service.ssh.clusterIP ClusterIP setting for ssh autosetup for statefulset is None
|
||||
## @param service.ssh.clusterIP ClusterIP setting for ssh autosetup for deployment is None
|
||||
## @param service.ssh.loadBalancerIP LoadBalancer IP setting
|
||||
## @param service.ssh.nodePort NodePort for ssh service
|
||||
## @param service.ssh.externalTrafficPolicy If `service.ssh.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation
|
||||
|
|
@ -155,7 +174,7 @@ ingress:
|
|||
# If helm doesn't correctly detect your ingress API version you can set it here.
|
||||
# apiVersion: networking.k8s.io/v1
|
||||
|
||||
## @section StatefulSet
|
||||
## @section deployment
|
||||
#
|
||||
## @param resources Kubernetes resources
|
||||
resources:
|
||||
|
|
@ -177,26 +196,29 @@ resources:
|
|||
## @param schedulerName Use an alternate scheduler, e.g. "stork"
|
||||
schedulerName: ""
|
||||
|
||||
## @param nodeSelector NodeSelector for the statefulset
|
||||
## @param nodeSelector NodeSelector for the deployment
|
||||
nodeSelector: {}
|
||||
|
||||
## @param tolerations Tolerations for the statefulset
|
||||
## @param tolerations Tolerations for the deployment
|
||||
tolerations: []
|
||||
|
||||
## @param affinity Affinity for the statefulset
|
||||
## @param affinity Affinity for the deployment
|
||||
affinity: {}
|
||||
|
||||
## @param dnsConfig dnsConfig for the statefulset
|
||||
## @param topologySpreadConstraints TopologySpreadConstraints for the deployment
|
||||
topologySpreadConstraints: []
|
||||
|
||||
## @param dnsConfig dnsConfig for the deployment
|
||||
dnsConfig: {}
|
||||
|
||||
## @param priorityClassName priorityClassName for the statefulset
|
||||
## @param priorityClassName priorityClassName for the deployment
|
||||
priorityClassName: ""
|
||||
|
||||
## @param statefulset.env Additional environment variables to pass to containers
|
||||
## @param statefulset.terminationGracePeriodSeconds How long to wait until forcefully kill the pod
|
||||
## @param statefulset.labels Labels for the statefulset
|
||||
## @param statefulset.annotations Annotations for the Forgejo StatefulSet to be created
|
||||
statefulset:
|
||||
## @param deployment.env Additional environment variables to pass to containers
|
||||
## @param deployment.terminationGracePeriodSeconds How long to wait until forcefully kill the pod
|
||||
## @param deployment.labels Labels for the deployment
|
||||
## @param deployment.annotations Annotations for the Forgejo deployment to be created
|
||||
deployment:
|
||||
env:
|
||||
[]
|
||||
# - name: VARIABLE
|
||||
|
|
@ -205,28 +227,52 @@ statefulset:
|
|||
labels: {}
|
||||
annotations: {}
|
||||
|
||||
## @section ServiceAccount
|
||||
|
||||
## @param serviceAccount.create Enable the creation of a ServiceAccount
|
||||
## @param serviceAccount.name Name of the created ServiceAccount, defaults to release name. Can also link to an externally provided ServiceAccount that should be used.
|
||||
## @param serviceAccount.automountServiceAccountToken Enable/disable auto mounting of the service account token
|
||||
## @param serviceAccount.imagePullSecrets Image pull secrets, available to the ServiceAccount
|
||||
## @param serviceAccount.annotations Custom annotations for the ServiceAccount
|
||||
## @param serviceAccount.labels Custom labels for the ServiceAccount
|
||||
serviceAccount:
|
||||
create: false
|
||||
name: ""
|
||||
automountServiceAccountToken: false
|
||||
imagePullSecrets: []
|
||||
# - name: private-registry-access
|
||||
annotations: {}
|
||||
labels: {}
|
||||
|
||||
## @section Persistence
|
||||
#
|
||||
## @param persistence.enabled Enable persistent storage
|
||||
## @param persistence.existingClaim Use an existing claim to store repository information
|
||||
## @param persistence.create Whether to create the persistentVolumeClaim for shared storage
|
||||
## @param persistence.mount Whether the persistentVolumeClaim should be mounted (even if not created)
|
||||
## @param persistence.claimName Use an existing claim to store repository information
|
||||
## @param persistence.size Size for persistence to store repo information
|
||||
## @param persistence.accessModes AccessMode for persistence
|
||||
## @param persistence.labels Labels for the persistence volume claim to be created
|
||||
## @param persistence.annotations Annotations for the persistence volume claim to be created
|
||||
## @param persistence.annotations.helm.sh/resource-policy Resource policy for the persistence volume claim
|
||||
## @param persistence.storageClass Name of the storage class to use
|
||||
## @param persistence.subPath Subdirectory of the volume to mount at
|
||||
## @param persistence.volumeName Name of persistent volume in PVC
|
||||
persistence:
|
||||
enabled: true
|
||||
existingClaim:
|
||||
create: true
|
||||
mount: true
|
||||
claimName: gitea-shared-storage
|
||||
size: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
labels: {}
|
||||
annotations: {}
|
||||
storageClass:
|
||||
subPath:
|
||||
volumeName: ""
|
||||
annotations:
|
||||
helm.sh/resource-policy: keep
|
||||
|
||||
## @param extraVolumes Additional volumes to mount to the Forgejo statefulset
|
||||
## @param extraVolumes Additional volumes to mount to the Forgejo deployment
|
||||
extraVolumes: []
|
||||
# - name: postgres-ssl-vol
|
||||
# secret:
|
||||
|
|
@ -341,13 +387,14 @@ gitea:
|
|||
# customProfileUrl:
|
||||
# customEmailUrl:
|
||||
|
||||
## @param gitea.config Configuration for the Forgejo server,ref: [config-cheat-sheet](https://docs.gitea.io/en-us/config-cheat-sheet/)
|
||||
config: {}
|
||||
# APP_NAME: "Forgejo: Git with a cup of tea"
|
||||
# RUN_MODE: dev
|
||||
#
|
||||
# server:
|
||||
# SSH_PORT: 22
|
||||
## @param gitea.config.server.SSH_PORT SSH port for rootlful Forgejo image
|
||||
## @param gitea.config.server.SSH_LISTEN_PORT SSH port for rootless Forgejo image
|
||||
config:
|
||||
# APP_NAME: "Forgejo: Git with a cup of tea"
|
||||
# RUN_MODE: dev
|
||||
server:
|
||||
SSH_PORT: 22 # rootful image
|
||||
SSH_LISTEN_PORT: 2222 # rootless image
|
||||
#
|
||||
# security:
|
||||
# PASSWORD_COMPLEXITY: spec
|
||||
|
|
@ -429,26 +476,49 @@ gitea:
|
|||
successThreshold: 1
|
||||
failureThreshold: 10
|
||||
|
||||
## @section Memcached
|
||||
## @descriptionStart
|
||||
## Memcached is loaded as a dependency from [Bitnami](https://github.com/bitnami/charts/tree/master/bitnami/memcached) if enabled in the values. Complete Configuration can be taken from their website.
|
||||
## @descriptionEnd
|
||||
#
|
||||
## @param memcached.enabled Memcached is loaded as a dependency from [Bitnami](https://github.com/bitnami/charts/tree/master/bitnami/memcached) if enabled in the values. Complete Configuration can be taken from their website.
|
||||
## ref: https://hub.docker.com/r/bitnami/memcached/tags/
|
||||
## @param memcached.service.ports.memcached Port for Memcached
|
||||
memcached:
|
||||
## @section redis-cluster
|
||||
## @param redis-cluster.enabled Enable redis
|
||||
## @param redis-cluster.usePassword Whether to use password authentication
|
||||
## @param redis-cluster.cluster.nodes Number of redis cluster master nodes
|
||||
## @param redis-cluster.cluster.replicas Number of redis cluster master node replicas
|
||||
redis-cluster:
|
||||
enabled: true
|
||||
# image:
|
||||
# registry: docker.io
|
||||
# repository: bitnami/memcached
|
||||
# tag: ""
|
||||
# digest: ""
|
||||
# pullPolicy: IfNotPresent
|
||||
# pullSecrets: []
|
||||
usePassword: false
|
||||
cluster:
|
||||
nodes: 3 # default: 6
|
||||
replicas: 0 # default: 1
|
||||
|
||||
## @section postgresql-ha
|
||||
#
|
||||
## @param postgresql-ha.enabled Enable postgresql-ha
|
||||
## @param postgresql-ha.postgresql.password Password for the `gitea` user (overrides `auth.password`)
|
||||
## @param postgresql-ha.global.postgresql.database Name for a custom database to create (overrides `auth.database`)
|
||||
## @param postgresql-ha.global.postgresql.username Name for a custom user to create (overrides `auth.username`)
|
||||
## @param postgresql-ha.global.postgresql.password Name for a custom password to create (overrides `auth.password`)
|
||||
## @param postgresql-ha.postgresql.repmgrPassword Repmgr Password
|
||||
## @param postgresql-ha.postgresql.postgresPassword postgres Password
|
||||
## @param postgresql-ha.pgpool.adminPassword pgpool adminPassword
|
||||
## @param postgresql-ha.service.ports.postgresql postgresql service port (overrides `service.ports.postgresql`)
|
||||
## @param postgresql-ha.primary.persistence.size PVC Storage Request for postgresql-ha volume
|
||||
postgresql-ha:
|
||||
global:
|
||||
postgresql:
|
||||
database: gitea
|
||||
password: gitea
|
||||
username: gitea
|
||||
enabled: true
|
||||
postgresql:
|
||||
repmgrPassword: changeme2
|
||||
postgresPassword: changeme1
|
||||
password: changeme4
|
||||
pgpool:
|
||||
adminPassword: changeme3
|
||||
service:
|
||||
ports:
|
||||
memcached: 11211
|
||||
postgresql: 5432
|
||||
primary:
|
||||
persistence:
|
||||
size: 10Gi
|
||||
|
||||
## @section PostgreSQL
|
||||
## @descriptionStart
|
||||
|
|
@ -462,7 +532,7 @@ memcached:
|
|||
## @param postgresql.global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`)
|
||||
## @param postgresql.primary.persistence.size PVC Storage Request for PostgreSQL volume
|
||||
postgresql:
|
||||
enabled: true
|
||||
enabled: false
|
||||
global:
|
||||
postgresql:
|
||||
auth:
|
||||
|
|
|
|||
Loading…
Reference in a new issue