Allow existing secrets for passwords (#170 )

Allow admin user and password to be configured via existing secrets Allow LDAP bindDn and bindPassword to be configured via existing secrets Update Readme Fixes: #169 Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/170 Reviewed-by: techknowlogick <techknowlogick@gitea.io> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: luhahn <luhahn@noreply.gitea.io> Co-committed-by: luhahn <luhahn@noreply.gitea.io>
Fix regression for creating repositories in root-based containers (#172 )
2021-06-10 19:13:33 +08:00 · 2021-06-09 22:35:50 +08:00 · 2021-06-09 19:42:49 +08:00
6 changed files with 105 additions and 7 deletions
--- a/Chart.yaml
+++ b/Chart.yaml
@ -3,7 +3,7 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-appVersion: 1.14.1
+appVersion: 1.14.2
 icon: https://docs.gitea.io/images/gitea.png

 keywords:
--- a/README.md
+++ b/README.md
@ -262,6 +262,25 @@ You cannot use `admin` as username.
      email: "gi@tea.com"
 ```

+You can also use an existing Secret to configure the admin user:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-admin-secret
+type: Opaque
+stringData:
+  username: MyAwesomeGiteaAdmin
+  password: AReallyAwesomeGiteaPassword
+```
+
+```yaml
+gitea:
+    admin:
+      existingSecret: gitea-admin-secret
+```
+
 ### LDAP Settings

 Like the admin user the LDAP settings can be updated, but also disabled or deleted.
@ -306,6 +325,26 @@ kebab-case:
      bind-password: JustAnotherBindPw
      username-attribute: CN
 ```
+
+You can also use an existing secret to set the bindDn and bindPassword:
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-ldap-secret
+type: Opaque
+stringData:
+  bindDn: CN=ldap read,OU=Spezial,DC=example,DC=com
+  bindPassword: JustAnotherBindPw
+```
+
+```yaml
+gitea:
+    ldap:
+      existingSecret: gitea-ldap-secret
+```
+
 ### OAuth2 Settings

 Like the admin user the OAuth2 settings can be updated but also disabled or deleted.
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@ -108,9 +108,21 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}

 {{- define "gitea.ldap_settings" -}}
+{{- if or (not (hasKey .Values.gitea.ldap "bindDn")) (not (hasKey .Values.gitea.ldap "bind-dn")) -}}
+{{- $_ := set .Values.gitea.ldap "bindDn" "" -}}
+{{- end -}}
+
+{{- if or (not (hasKey .Values.gitea.ldap "bindPassword")) (not (hasKey .Values.gitea.ldap "bind-password")) -}}
+{{- $_ := set .Values.gitea.ldap "bindPassword" "" -}}
+{{- end -}}
+
 {{- range $key, $val := .Values.gitea.ldap -}}
-{{- if ne $key "enabled" -}}
-{{- if eq $key "port" -}}
+{{- if and (ne $key "enabled") (ne $key "existingSecret") -}}
+{{- if eq  ($key | kebabcase) "bind-dn" -}}
+{{- printf "--%s %s " ($key | kebabcase) ("${GITEA_LDAP_BIND_DN}" | quote ) -}}
+{{- else if eq ($key | kebabcase) "bind-password" -}}
+{{- printf "--%s %s " ($key | kebabcase) ("${GITEA_LDAP_PASSWORD}" | quote ) -}}
+{{- else if eq $key "port" -}}
 {{- printf "--%s %d " ($key | kebabcase) ($val | int) -}}
 {{- else -}}
 {{- printf "--%s %s " ($key | kebabcase) ($val | quote) -}}
--- a/templates/gitea/init.yaml
+++ b/templates/gitea/init.yaml
@ -16,11 +16,18 @@ stringData:
    # END: initPreScript
    {{- end }}

+    {{- if not .Values.image.rootless }}
    chown 1000:1000 /data
+    {{- end }}
    mkdir -p /data/git/.ssh
    chmod -R 700 /data/git/.ssh
    mkdir -p /data/gitea/conf

+    # prepare temp directory structure
+    mkdir -p "${GITEA_TEMP}"
+    chown 1000:1000 "${GITEA_TEMP}"
+    chmod ug+rwx "${GITEA_TEMP}"
+
    # Copy config file to writable volume
    cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
    chmod a+rwx /data/gitea/conf/app.ini
@ -34,13 +41,13 @@ stringData:
    set -x; \
    gitea migrate; \
    {{- if and .Values.gitea.admin.username .Values.gitea.admin.password }}
-    gitea admin create-user --username  {{ .Values.gitea.admin.username }} --password {{ .Values.gitea.admin.password | quote }} --email {{ .Values.gitea.admin.email }} --admin --must-change-password=false \
+    gitea admin create-user --username  "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email }} --admin --must-change-password=false \
    || \
-    gitea admin change-password --username {{ .Values.gitea.admin.username }} --password {{ .Values.gitea.admin.password | quote }} \
+    gitea admin change-password --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" \
    || \
-    gitea admin user create --username  {{ .Values.gitea.admin.username }} --password {{ .Values.gitea.admin.password | quote }} --email {{ .Values.gitea.admin.email }} --admin --must-change-password=false \
+    gitea admin user create --username  "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email }} --admin --must-change-password=false \
    || \
-    gitea admin user change-password --username {{ .Values.gitea.admin.username }} --password {{ .Values.gitea.admin.password | quote }}; \
+    gitea admin user change-password --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}"; \
    {{- end }}
    {{- if .Values.gitea.ldap.enabled }}
    gitea admin auth add-ldap \
--- a/templates/gitea/statefulset.yaml
+++ b/templates/gitea/statefulset.yaml
@ -48,12 +48,50 @@ spec:
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- if .Values.gitea.ldap.existingSecret }}
+            - name: GITEA_LDAP_BIND_DN
+              valueFrom:
+                secretKeyRef:
+                  key:  bindDn
+                  name: {{ .Values.gitea.ldap.existingSecret }}
+            - name: GITEA_LDAP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key:  bindPassword
+                  name: {{ .Values.gitea.ldap.existingSecret }}
+            {{- else }}
+            - name: GITEA_LDAP_BIND_DN
+              value: {{ .Values.gitea.ldap.bindDn | quote }}
+            - name: GITEA_ADMIN_PASSWORD
+              value: {{ .Values.gitea.ldap.bindPassword | quote }}
+            {{- end }}
+            {{- if .Values.gitea.admin.existingSecret }}
+            - name: GITEA_ADMIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  key:  username
+                  name: {{ .Values.gitea.admin.existingSecret }}
+            - name: GITEA_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key:  password
+                  name: {{ .Values.gitea.admin.existingSecret }}
+            {{- else }}
+            - name: GITEA_ADMIN_USERNAME
+              value: {{ .Values.gitea.admin.username | quote }}
+            - name: GITEA_ADMIN_PASSWORD
+              value: {{ .Values.gitea.admin.password | quote }}
+            {{- end }}
            {{- if .Values.statefulset.env }}
            {{- toYaml .Values.statefulset.env | nindent 12 }}
            {{- end }}
          volumeMounts:
            - name: init
              mountPath: /usr/sbin
+            - name: temp
+              mountPath: /tmp
            - name: config
              mountPath: /etc/gitea/conf
            - name: data
--- a/values.yaml
+++ b/values.yaml
@ -127,6 +127,7 @@ initPreScript: ""

 gitea:
  admin:
+    #existingSecret: gitea-admin-secret
    username: gitea_admin
    password: r8sA8CPHD9!bt6d
    email: "gitea@local.domain"
@ -140,6 +141,7 @@ gitea:

  ldap:
    enabled: false
+    #existingSecret: gitea-ldap-secret
    #name:
    #securityProtocol:
    #host: