Fix NodePort settings for ssh service (#32)

Fix NodePort settings for ssh service

Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/32
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Reviewed-by: Andrew Thornton <art27@cantab.net>

Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
-version: 1.4.4
+version: 1.5.1
 appVersion: 1.12.4
 icon: https://docs.gitea.io/images/gitea.png
 

README.md

@@ -65,7 +65,7 @@ An external Database can be used instead of builtIn postgresql or mysql.
         NAME: gitea
         USER: root
         PASSWD: gitea
-      SCHEMA: gitea
+        SCHEMA: gitea
 ```
 
 ### Ports and external url
@@ -175,6 +175,15 @@ Like the admin user the ldap settings can be updated but also disabled or delete
       usernameAttribute: CN
 ```
 
+### Pod Annotations
+
+Annotations can be added to the Gitea pod.
+
+```yaml
+  gitea:
+    podAnnotations: {}
+```
+
 ## Configuration
 
 ### Others
@@ -182,6 +191,7 @@ Like the admin user the ldap settings can be updated but also disabled or delete
 | Parameter           | Description                       | Default                      |
 |---------------------|-----------------------------------|------------------------------|
 |statefulset.terminationGracePeriodSeconds| Image to start for this pod | gitea/gitea |
+|statefulset.env           | Additional environment variables to pass to containers | [] |
 
 
 ### Image
@@ -189,7 +199,7 @@ Like the admin user the ldap settings can be updated but also disabled or delete
 | Parameter           | Description                       | Default                      |
 |---------------------|-----------------------------------|------------------------------|
 |image.repository| Image to start for this pod | gitea/gitea |
-|image.version| Image Version | 1.12.2 |
+|image.version| Image Version | 1.12.4 |
 |image.pullPolicy| Image pull policy | Always |
 
 ### Persistence

templates/NOTES.txt

@@ -13,7 +13,6 @@
   export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.http.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "gitea.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
   echo "Visit http://127.0.0.1:{{ .Values.service.http.port }} to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME {{ .Values.service.http.port }}:{{ .Values.service.http.port }}
+  kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ .Release.Name }}-http {{ .Values.service.http.port }}:{{ .Values.service.http.port }}
 {{- end }}

templates/gitea/config.yaml

@@ -1,10 +1,11 @@
 apiVersion: v1
-kind: ConfigMap
+kind: Secret
 metadata:
   name: {{ include "gitea.fullname" . }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
-data:
+type: Opaque
+stringData:
   app.ini: |-
     {{- if not (hasKey .Values.gitea.config "cache") -}}
     {{- $_ := set .Values.gitea.config "cache" dict -}}
@@ -65,13 +66,17 @@ data:
     {{- /* database default settings */ -}}
     {{- if .Values.gitea.database.builtIn.postgresql.enabled -}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}} 
+    {{- if not (.Values.gitea.config.database.HOST) -}}
     {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql.dns" .) -}}
+    {{- end -}}
     {{- $_ := set .Values.gitea.config.database "NAME"      .Values.postgresql.global.postgresql.postgresqlDatabase -}}
     {{- $_ := set .Values.gitea.config.database "USER"      .Values.postgresql.global.postgresql.postgresqlUsername -}}
     {{- $_ := set .Values.gitea.config.database "PASSWD"    .Values.postgresql.global.postgresql.postgresqlPassword -}}
     {{ else if .Values.gitea.database.builtIn.mysql.enabled -}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "mysql" -}} 
+    {{- if not (.Values.gitea.config.database.HOST) -}}
     {{- $_ := set .Values.gitea.config.database "HOST"      (include "mysql.dns" .) -}}
+    {{- end -}}
     {{- $_ := set .Values.gitea.config.database "NAME"      .Values.mysql.db.name -}}
     {{- $_ := set .Values.gitea.config.database "USER"      .Values.mysql.db.user -}}
     {{- $_ := set .Values.gitea.config.database "PASSWD"    .Values.mysql.db.password -}}
@@ -81,8 +86,10 @@ data:
     {{- if .Values.gitea.cache.builtIn.enabled -}}
     {{- $_ := set .Values.gitea.config.cache "ENABLED" "true" -}}
     {{- $_ := set .Values.gitea.config.cache "ADAPTER" "memcache" -}}
+    {{- if not (.Values.gitea.config.cache.HOST) -}}
     {{- $_ := set .Values.gitea.config.cache "HOST" (include "memcached.dns" .) -}}
     {{- end -}}
+    {{- end -}}
     
     {{- /* autogenerate app.ini */ -}}
     {{- range $key, $value := .Values.gitea.config  }}

templates/gitea/init.yaml

@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}-init
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  init_gitea.sh: |-
+    #!/bin/bash
+    mkdir -p /data/git/.ssh
+    chmod -R 700 /data/git/.ssh
+    mkdir -p /data/gitea/conf
+    cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
+    chmod a+rwx /data/gitea/conf/app.ini
+    nc -v -w2 -z {{ include "db.servicename" . }} {{ include "db.port" . }} && \
+    su git -c ' \
+    set -x; \
+    gitea migrate; \
+    {{- if and .Values.gitea.admin.username .Values.gitea.admin.password }}
+    gitea admin create-user --username  {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}' --email {{ .Values.gitea.admin.email }} --admin \
+    || \
+    gitea admin change-password --username {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}'; \
+    {{- end }}
+    {{- if .Values.gitea.ldap.enabled }}
+    gitea admin auth add-ldap \
+    --name {{ .Values.gitea.ldap.name | quote }} \
+    --security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
+    --host {{ .Values.gitea.ldap.host | quote }} \
+    --port {{ .Values.gitea.ldap.port | int}} \
+    --user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
+    --user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
+    --admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
+    --email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
+    --bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
+    --bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
+    --synchronize-users \
+    --username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
+    || \
+    ( \
+      export GITEA_AUTH_ID=$(gitea admin auth list | grep {{ .Values.gitea.ldap.name | quote }} | awk -F " "  "{print \$1}"); \
+      gitea admin auth update-ldap --id ${GITEA_AUTH_ID} \
+      --name {{ .Values.gitea.ldap.name | quote }} \
+      --security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
+      --host {{ .Values.gitea.ldap.host | quote }} \
+      --port {{ .Values.gitea.ldap.port | int}} \
+      --user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
+      --user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
+      --admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
+      --email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
+      --bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
+      --bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
+      --synchronize-users \
+      --username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
+    ) \
+    {{- end }}
+    '

templates/gitea/ssh-svc.yaml

@@ -11,7 +11,7 @@ spec:
   {{- if and .Values.service.ssh.loadBalancerIP (eq .Values.service.ssh.type "LoadBalancer") }}
   loadBalancerIP: {{ .Values.service.ssh.loadBalancerIP }}
   {{- end }}
-  {{- if ne .Values.service.ssh.type "LoadBalancer" }}
+  {{- if eq .Values.service.ssh.type "ClusterIP" }}
   clusterIP: None
   {{- end }}
   {{- if .Values.service.ssh.externalIPs }}

templates/gitea/statefulset.yaml

@@ -14,6 +14,9 @@ spec:
     metadata:
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/gitea/config.yaml") . | sha256sum }}
+        {{- with .Values.gitea.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "gitea.selectorLabels" . | nindent 8 }}
     spec:
@@ -22,56 +25,10 @@ spec:
       initContainers:
         - name: init
           image: "{{ .Values.image.repository }}:{{ .Values.image.version }}"
-          env:
-            - name: SCRIPT
-              value: &script |-
-                mkdir -p /data/gitea/conf
-                cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
-                chmod a+rwx /data/gitea/conf/app.ini
-                nc -v -w2 -z {{ include "db.servicename" . }} {{ include "db.port" . }} && \
-                su git -c ' \
-                set -x; \
-                gitea migrate; \
-                {{- if and .Values.gitea.admin.username .Values.gitea.admin.password }}
-                gitea admin create-user --username  {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}' --email {{ .Values.gitea.admin.email }} --admin \
-                || \
-                gitea admin change-password --username {{ .Values.gitea.admin.username }} --password '{{ .Values.gitea.admin.password }}'; \
-                {{- end }}
-                {{- if .Values.gitea.ldap.enabled }}
-                gitea admin auth add-ldap \
-                --name {{ .Values.gitea.ldap.name | quote }} \
-                --security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
-                --host {{ .Values.gitea.ldap.host | quote }} \
-                --port {{ .Values.gitea.ldap.port | int}} \
-                --user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
-                --user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
-                --admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
-                --email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
-                --bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
-                --bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
-                --synchronize-users \
-                --username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
-                || \
-                ( \
-                  export GITEA_AUTH_ID=$(gitea admin auth list | grep {{ .Values.gitea.ldap.name | quote }} | awk -F " "  "{print \$1}"); \
-                  gitea admin auth update-ldap --id ${GITEA_AUTH_ID} \
-                  --name {{ .Values.gitea.ldap.name | quote }} \
-                  --security-protocol {{ .Values.gitea.ldap.securityProtocol | quote }} \
-                  --host {{ .Values.gitea.ldap.host | quote }} \
-                  --port {{ .Values.gitea.ldap.port | int}} \
-                  --user-search-base {{ .Values.gitea.ldap.userSearchBase | quote }} \
-                  --user-filter {{ .Values.gitea.ldap.userFilter | quote }} \
-                  --admin-filter {{ .Values.gitea.ldap.adminFilter | quote }} \
-                  --email-attribute {{ .Values.gitea.ldap.emailAttribute | quote }} \
-                  --bind-dn {{ .Values.gitea.ldap.bindDn | quote }} \
-                  --bind-password {{ .Values.gitea.ldap.bindPassword | quote }} \
-                  --synchronize-users \
-                  --username-attribute {{ .Values.gitea.ldap.usernameAttribute | quote }} \
-                ) \
-                {{- end }}
-                '
-          command: ["/bin/sh",'-c', *script]
+          command: ["/usr/sbin/init_gitea.sh"]
           volumeMounts:
+            - name: init
+              mountPath: /usr/sbin
             - name: config
               mountPath: /etc/gitea/conf
             - name: data
@@ -87,6 +44,10 @@ spec:
               value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
             - name: SSH_PORT
               value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
+            {{- range .Values.statefulset.env }}
+            - name: {{ .name | quote | nospace }}
+              value: {{ .value | quote }}
+            {{- end }}
           ports:
             - name: ssh
               containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
@@ -125,9 +86,13 @@ spec:
         {{- toYaml . | nindent 8 }}
     {{- end }}
       volumes:
+        - name: init
+          secret:
+            secretName: {{ include "gitea.fullname" . }}-init
+            defaultMode: 0777
         - name: config
-          configMap:
-            name: {{ include "gitea.fullname" . }}
+          secret:
+            secretName: {{ include "gitea.fullname" . }}
   {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
         - name: data
           persistentVolumeClaim:

values.yaml

@@ -55,6 +55,9 @@ tolerations: []
 affinity: {}
 
 statefulset:
+  env: []
+    # - name: VARIABLE
+    #   value: my-value
   terminationGracePeriodSeconds: 60
 
 persistence:
@@ -95,6 +98,8 @@ gitea:
   #  security:
   #    PASSWORD_COMPLEXITY: spec
 
+  podAnnotations: {}
+
   database:
     builtIn:
       postgresql: