Compare commits

..

7 Commits

Author SHA1 Message Date
6b8b64f607 use new s3 bucket for artifacts 2021-06-08 02:05:07 +08:00
6fa80222a6 update to latest v of alpine 2021-06-08 02:02:59 +08:00
031b58c90e update docs for 1.14.2
Signed-off-by: techknowlogick <techknowlogick@gitea.io>
2021-06-08 01:55:05 +08:00
178bc0ab79 Improve http service and update Readme (#167)
This PR adds some options for the http service:

- loadBalancerIP
- nodePort
- externalTrafficPolicy
- externalIPs

Also updated the README and values.yml with the values.

Added storageClass explanation in README and empty value in values.yml

Fixes: #162

Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/167
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-by: 6543 <6543@obermui.de>
Co-authored-by: luhahn <luhahn@noreply.gitea.io>
Co-committed-by: luhahn <luhahn@noreply.gitea.io>
2021-06-08 01:53:01 +08:00
441f0748e9 Fixing prometheus monitoring (#157)
At least the latest versions of prometheus watch for a label called "release" and not "prometheus" so with that change prometheus started collecting logs.

If that old label is still needed, we / I could change it to add entries from "additionalLabels", so that we are quite flexible and don't have breaking changes.

Co-authored-by: Justin Lamp <jlamp@vater-gruppe.de>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/157
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: modzilla <modzilla@noreply.gitea.io>
Co-committed-by: modzilla <modzilla@noreply.gitea.io>
2021-06-07 22:28:28 +08:00
5ab596937a Fix rootless image usage with enhanced security-context (#160)
I've noticed that the commented `securityContext` is not really useable with the rootless image due to different directory structure compared to the default image.

Important for the `readOnlyRootFilesystem` is to declare the `TMPDIR` environment variable, so that the tmp directory (which is readonly in this case) won't be used. Instead, another writeable directory can be used.

Another thing is the explicit hint that all these security options cannot be used with the default (root-based) image, because of its design.

~~Although this PR would fix the referenced issue, I am not totally happy with the current implementation. It would be more straight forward to use the same mount points for both image variants. Unfortunately, this is not possible right now due to hard coded paths in the default (root) image startup scripts.~~

~~Anyone have suggestions on how this could be more simple?~~

-------

**Sum-up:**
As mentioned in Discord, this PR tried to make too many changes. The necessary changes made in 1f331a7e6577fc798196a84a957330aca0d663cd will fix an error that occurs due to restricted access to the `/tmp` directory in a rootless image with all the `securityContext` options enabled.

I also updated the default image to 1.14.2.

Fixes: #158

Co-authored-by: JustusBunsi <sk.bunsenbrenner@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/160
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: 6543 <6543@obermui.de>
Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io>
Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>
2021-06-07 21:27:25 +08:00
5b5ea7173a Add value option to define schedulerName (#150)
For those who have a need to configure the schedulerName like us, make this an option just as it is for example in the postgres chart

Co-authored-by: Dimitri Ars <dimitri.ars@kpn.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/150
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: mrdima <mrdima@noreply.gitea.io>
Co-committed-by: mrdima <mrdima@noreply.gitea.io>
2021-06-07 16:41:16 +08:00
6 changed files with 65 additions and 12 deletions

View File

@ -9,7 +9,7 @@ platform:
steps:
- name: lint
pull: always
image: alpine:3.12
image: alpine:3.13
commands:
- apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
- helm lint
@ -42,21 +42,22 @@ trigger:
steps:
- name: generate-chart
pull: always
image: alpine:3.12
image: alpine:3.13
commands:
- apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
- apk add --no-cache curl
- helm dependency update
- helm package --version "${DRONE_TAG##v}" ./
- mkdir gitea
- mv gitea*.tgz gitea/
- wget -O gitea/index.yaml https://dl.gitea.io/charts/index.yaml
- curl -L -o gitea/index.yaml https://dl.gitea.io/charts/index.yaml
- helm repo index gitea/ --url https://dl.gitea.io/charts --merge gitea/index.yaml
- name: upload-chart
pull: always
image: plugins/s3:latest
settings:
bucket: releases
bucket: gitea-artifacts
endpoint: https://storage.gitea.io
path_style: true
access_key:

View File

@ -205,6 +205,17 @@ If the built in cache should not be used simply configure the cache in gitea.con
Gitea will be deployed as a statefulset. By simply enabling the persistence and setting the storage class according to your cluster
everything else will be taken care of. The following example will create a PVC as a part of the statefulset. This PVC will not be deleted even if you uninstall the chart.
Please note, that an empty storageClass in the persistence will result in kubernetes using your default storage class.
If you want to use your own storageClass define it as followed:
```yaml
persistence:
enabled: true
storageClass: myOwnStorageClass
```
When using Postgresql as dependency, this will also be deployed as a statefulset by default.
If you want to manage your own PVC you can simply pass the PVC name to the chart.
@ -376,13 +387,14 @@ Annotations can be added to the Gitea pod.
| extraVolumeMounts | Additional volumes mounts for the Gitea containers | {} |
| initPreScript | Bash script copied verbatim to start of init container | |
| securityContext | Run as a specific securityContext | {} |
| schedulerName | Use an alternate scheduler, e.g. "stork" | |
### Image
| Parameter | Description | Default |
|---------------------|-----------------------------------|------------------------------|
|image.repository| Image to start for this pod | gitea/gitea |
|image.tag| [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated) | 1.14.1 |
|image.tag| [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated) | 1.14.2 |
|image.pullPolicy| Image pull policy | Always |
|image.rootless | Wether or not to pull the rootless version of gitea, only works on gitea 1.14.x or higher | false |
@ -413,11 +425,22 @@ Annotations can be added to the Gitea pod.
|---------------------|-----------------------------------|------------------------------|
|service.http.type| Kubernetes service type for web traffic | ClusterIP |
|service.http.port| Port for web traffic | 3000 |
|service.http.clusterIP| ClusterIP setting for http autosetup for statefulset is None | None |
|service.http.loadBalancerIP| LoadBalancer Ip setting | |
|service.http.nodePort| NodePort for http service | |
|service.http.externalTrafficPolicy| If `service.http.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation | |
|service.http.externalIPs| http service external IP addresses | 3000 |
|service.http.loadBalancerSourceRanges| Source range filter for http loadbalancer | [] |
|service.http.annotations| http service annotations | |
|service.ssh.type| Kubernetes service type for ssh traffic | ClusterIP |
|service.ssh.port| Port for ssh traffic | 22 |
|service.ssh.loadBalancerIP| LoadBalancer Ip setting | |
|service.ssh.nodePort| NodePort for ssh service | |
|service.ssh.externalTrafficPolicy| If `service.ssh.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable source IP preservation | |
|service.ssh.externalIPs| SSH service external IP addresses |[]|
|service.ssh.annotations| Additional ssh annotations for the ssh service ||
|service.ssh.externalIPs| ssh service external IP addresses | 3000 |
|service.ssh.loadBalancerSourceRanges| Source range filter for ssh loadbalancer | [] |
|service.ssh.annotations| ssh service annotations | |
### Gitea Configuration

View File

@ -11,6 +11,19 @@ spec:
{{- if and .Values.service.http.loadBalancerIP (eq .Values.service.http.type "LoadBalancer") }}
loadBalancerIP: {{ .Values.service.http.loadBalancerIP }}
{{- end }}
{{- if .Values.service.http.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{- range .Values.service.http.loadBalancerSourceRanges }}
- {{ . }}
{{- end }}
{{- end }}
{{- if .Values.service.http.externalIPs }}
externalIPs:
{{- toYaml .Values.service.http.externalIPs | nindent 4 }}
{{- end }}
{{- if .Values.service.http.externalTrafficPolicy }}
externalTrafficPolicy: {{ .Values.service.http.externalTrafficPolicy }}
{{- end }}
{{- if and .Values.service.http.clusterIP (eq .Values.service.http.type "ClusterIP") }}
clusterIP: {{ .Values.service.http.clusterIP }}
{{- end }}

View File

@ -5,8 +5,8 @@ metadata:
name: {{ include "gitea.fullname" . }}
labels:
{{- include "gitea.labels" . | nindent 4 }}
{{- if .Values.gitea.metrics.serviceMonitor.prometheusSelector }}
prometheus: {{ .Values.gitea.metrics.serviceMonitor.prometheusSelector }}
{{- if .Values.gitea.metrics.serviceMonitor.additionalLabels }}
{{- toYaml .Values.gitea.metrics.serviceMonitor.additionalLabels | nindent 4 }}
{{- end }}
spec:
selector:

View File

@ -28,6 +28,9 @@ spec:
{{- toYaml .Values.statefulset.labels | nindent 8 }}
{{- end }}
spec:
{{- if .Values.schedulerName }}
schedulerName: "{{ .Values.schedulerName }}"
{{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
@ -77,6 +80,8 @@ spec:
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: TMPDIR
value: /tmp/gitea
{{- if .Values.statefulset.env }}
{{- toYaml .Values.statefulset.env | nindent 12 }}
{{- end }}
@ -134,7 +139,7 @@ spec:
{{- toYaml .Values.securityContext | nindent 12 }}
volumeMounts:
- name: temp
mountPath: /tmp/gitea
mountPath: /tmp
- name: data
mountPath: /data
{{- if .Values.extraVolumeMounts }}

View File

@ -8,12 +8,13 @@ clusterDomain: cluster.local
image:
repository: gitea/gitea
tag: 1.14.1
tag: 1.14.2
pullPolicy: Always
rootless: false # only possible when running 1.14 or later
imagePullSecrets: []
# only usable with rootless image due to image design
securityContext: {}
# allowPrivilegeEscalation: false
# capabilities:
@ -32,6 +33,9 @@ service:
clusterIP: None
#loadBalancerIP:
#nodePort:
#externalTrafficPolicy:
#externalIPs:
loadBalancerSourceRanges: []
annotations:
ssh:
type: ClusterIP
@ -68,6 +72,11 @@ resources: {}
# cpu: 100m
# memory: 128Mi
## Use an alternate scheduler, e.g. "stork".
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
##
# schedulerName:
nodeSelector: {}
tolerations: []
@ -89,6 +98,7 @@ persistence:
- ReadWriteOnce
labels: {}
annotations: {}
# storageClass:
# additional volumes to add to the Gitea statefulset.
extraVolumes:
@ -125,7 +135,8 @@ gitea:
enabled: false
serviceMonitor:
enabled: false
# prometheusSelector: default
# additionalLabels:
# prometheus-release: prom1
ldap:
enabled: false