This pull request adds the `app` and `version` labels that are used by Istio.
> Pods with app and version labels: We recommend adding an explicit app label and version label to the specification of the pods deployed using a Kubernetes Deployment. The app and version labels add contextual information to the metrics and telemetry that Istio collects.
>
> * The app label: Each deployment should have a distinct app label with a meaningful value. The app label is used to add contextual information in distributed tracing.
>
> * The version label: This label indicates the version of the application corresponding to the particular deployment.
From https://istio.io/latest/docs/ops/deployment/requirements/#pod-requirements
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/121
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Co-authored-by: Starefossen <starefossen@noreply.gitea.io>
Co-committed-by: Starefossen <starefossen@noreply.gitea.io>
This PR adds a few new chart features which adds to the flexibility of the chart.
- allow extra volumes to be mounted (such as secrets): 2f862c5a48
- pass environment variables also to the init-container: 7044049478
- allow a preparation script to be "injected" into the init-container: 6125a69345
As a concrete example of how this can be used, I use is to configure Gitea to use client certificate authentication against an external Postgres database. That could be accomplished by having a `gitea-postgres-ssl` secret:
```
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: gitea-postgres-ssl
data:
postgresql.crt: <base64...>
postgresql.key: <base64...>
root.crt: <base64...>
```
and then mounting this as a volume in Gitea using:
```
extraVolumes:
- name: postgres-ssl-vol
secret:
secretName: gitea-postgres-ssl
extraVolumeMounts:
- name: postgres-ssl-vol
readOnly: true
mountPath: "/pg-ssl"
```
To get the right permissions on the credentials, we'd use the `initPreScript`:
```
initPreScript: |
# copy postgres client and CA cert from mount and
# give proper permissions
mkdir -p /data/git/.postgresql
cp /pg-ssl/* /data/git/.postgresql/
chown -R git:git /data/git/.postgresql/
chmod 400 /data/git/.postgresql/postgresql.key
```
and to make sure that Gitea uses the certificate we need to pass the proper postgres environment variables (both to the init container and the "main" container):
```
statefulset:
env:
- name: "PGSSLCERT"
value: "/data/git/.postgresql/postgresql.crt"
- name: "PGSSLKEY"
value: "/data/git/.postgresql/postgresql.key"
- name: "PGSSLROOTCERT"
value: "/data/git/.postgresql/root.crt"
```
Co-authored-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/47
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: 6543 <6543@obermui.de>
Co-authored-by: petergardfjall <petergardfjall@noreply.gitea.io>
Co-committed-by: petergardfjall <petergardfjall@noreply.gitea.io>
# additional volumes to add to the Gitea statefulset.
extraVolumes:
# - name: postgres-ssl-vol
# secret:
# secretName: gitea-postgres-ssl
# additional volumes to mount, both to the init container and to the main
# container. As an example, can be used to mount a client cert when connecting
# to an external Postgres server.
extraVolumeMounts:
# - name: postgres-ssl-vol
# readOnly: true
# mountPath: "/pg-ssl"
# bash shell script copied verbatim to the start of the init-container.
initPreScript:""
#
# initPreScript: |
# mkdir -p /data/git/.postgresql
# cp /pg-ssl/* /data/git/.postgresql/
# chown -R git:git /data/git/.postgresql/
# chmod 400 /data/git/.postgresql/postgresql.key
gitea:
admin:
@ -74,24 +110,44 @@ gitea:
password:r8sA8CPHD9!bt6d
email:"gitea@local.domain"
metrics:
enabled:false
serviceMonitor:
enabled:false
# prometheusSelector: default
ldap:
enabled:false
name:""
securityProtocol:""
host:""
port:""
userSearchBase:""
userFilter:""
adminFilter:""
emailAttribute:""
bindDn:""
bindPassword:""
usernameAttribute:""
#name:
#securityProtocol:
#host:
#port:
#userSearchBase:
#userFilter:
#adminFilter:
#emailAttribute:
#bindDn:
#bindPassword:
#usernameAttribute:
#sshPublicKeyAttribute:
oauth:
enabled:false
#name:
#provider:
#key:
#secret:
#autoDiscoverUrl:
#useCustomUrls:
#customAuthUrl:
#customTokenUrl:
#customProfileUrl:
#customEmailUrl:
config:{}
# APP_NAME: "Gitea: Git with a cup of tea"
# RUN_MODE: dev
#
# RUN_MODE: dev
#
# server:
# SSH_PORT: 22
#
@ -113,6 +169,52 @@ gitea:
builtIn:
enabled:true
livenessProbe:
enabled:true
initialDelaySeconds:200
timeoutSeconds:1
periodSeconds:10
successThreshold:1
failureThreshold:10
readinessProbe:
enabled:true
initialDelaySeconds:5
timeoutSeconds:1
periodSeconds:10
successThreshold:1
failureThreshold:3
startupProbe:
enabled:false
initialDelaySeconds:60
periodSeconds:10
successThreshold:1
failureThreshold:10
# customLivenessProbe:
# httpGet:
# path: /user/login
# port: http
# initialDelaySeconds: 60
# periodSeconds: 10
# successThreshold: 1
# failureThreshold: 10
# customReadinessProbe:
# httpGet:
# path: /user/login
# port: http
# initialDelaySeconds: 5
# periodSeconds: 10
# successThreshold: 1
# failureThreshold: 3
# customStartupProbe:
# httpGet:
# path: /user/login
# port: http
# initialDelaySeconds: 60
# periodSeconds: 10
# successThreshold: 1
# failureThreshold: 10
memcached:
service:
port:11211
@ -140,12 +242,13 @@ mysql:
size:10Gi
mariadb:
db:
name:gitea
user:gitea
auth:
database:gitea
username:gitea
password:gitea
service:
port:3306
master:
rootPassword:gitea
primary:
service:
port:3306
persistence:
size:10Gi
size:10Gi
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
