From 6e5ae5c9129e41716c3a889ef5e9c7b9261688fa Mon Sep 17 00:00:00 2001 From: pat-s Date: Sun, 25 Sep 2022 23:21:52 +0800 Subject: [PATCH 01/21] Increase line length linter to 200 (#355) As discussed in #348 fix #348 Co-authored-by: pat-s Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/355 Reviewed-by: justusbunsi Reviewed-by: Lunny Xiao Co-authored-by: pat-s Co-committed-by: pat-s --- .markdownlint.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.markdownlint.yaml b/.markdownlint.yaml index a67574a..6320f35 100644 --- a/.markdownlint.yaml +++ b/.markdownlint.yaml @@ -45,7 +45,7 @@ MD012: # MD013/line-length - Line length MD013: # Number of characters - line_length: 80 + line_length: 200 # Number of characters for headings heading_line_length: 80 # Number of characters for code blocks From 0d1f74889864f6082810dc59f033cd0d76f294df Mon Sep 17 00:00:00 2001 From: cboin1996 Date: Mon, 26 Sep 2022 04:08:56 +0800 Subject: [PATCH 02/21] check existence of `/data/gitea/conf/` instead of `/data/gitea/` (#310) ### Description of the change Checking the existence of the config directory should be done with the directory path itself. Not its parent directory. This simple fix addresses that by using the config directory for its existence check. ### Benefits Prior to #337 there was no other way to install this helm chart using the `extraVolumeMounts` setting with these values: ```yaml replicaCount: %d extraVolumes: - name: config-volume configMap: name: %s extraVolumeMounts: - name: config-volume mountPath: /data/gitea/templates/custom ``` Without this fix, the Gitea pod would never initialize, and would crashloop with the same error in #296. ### Additional information Mounting a configMap to `/data/gitea/templates/custom` causes the `/data/gitea` folder to exist even though the `/data/gitea/conf` had not been initialized yet. The initialization script saw that the `/data/gitea` dir existed and exited early without initializing `/data/gitea/conf`. Co-authored-by: cboin1996 Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/310 Reviewed-by: justusbunsi Reviewed-by: pat-s Co-authored-by: cboin1996 Co-committed-by: cboin1996 --- templates/gitea/init.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/gitea/init.yaml b/templates/gitea/init.yaml index 00af29b..8ea3aa9 100644 --- a/templates/gitea/init.yaml +++ b/templates/gitea/init.yaml @@ -26,7 +26,7 @@ stringData: {{- end }} mkdir -p /data/git/.ssh chmod -R 700 /data/git/.ssh - [ ! -d /data/gitea ] && mkdir -p /data/gitea/conf + [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf # prepare temp directory structure mkdir -p "${GITEA_TEMP}" From b8f0310c43bd71dd48ac92b70d8ebdb94d43c29b Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Wed, 28 Sep 2022 16:18:59 +0800 Subject: [PATCH 03/21] Add gpg configuration settings (#343) ### Description of the change This PR adds support for gpg key setup. It allows to pass the gpg private key content inline inside `values.yaml` or refer to an existing secret containing the key content data. ### Benefits Administrators don't need to manually setup the gpg environment from inside a running container. It also eliminates the breaking change of Gitea 1.17 regarding `[git].HOME` as the `GNUPGHOME` environment variable is used consistently to relocate the `.gnupg` directory to its former location. ### Applicable issues - fixes #107 ### Additional information This PR add the first unit tests to this Helm Chart, ensuring templating integrity for signing related configuration. ### Checklist - [x] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) Co-authored-by: justusbunsi Co-authored-by: pat-s Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/343 Reviewed-by: luhahn Reviewed-by: techknowlogick Co-authored-by: justusbunsi Co-committed-by: justusbunsi --- .drone.yml | 9 ++ .gitignore | 1 + .helmignore | 1 + CONTRIBUTING.md | 10 ++ Makefile | 4 + README.md | 71 +++++++++----- templates/_helpers.tpl | 4 + templates/gitea/gpg-secret.yaml | 16 ++++ templates/gitea/init.yaml | 13 +++ templates/gitea/statefulset.yaml | 43 +++++++++ unittests/gpg-secret/signing-disabled.yaml | 13 +++ unittests/gpg-secret/signing-enabled.yaml | 40 ++++++++ unittests/init/basic.yaml | 15 +++ .../init/init_directory_structure.sh.yaml | 53 +++++++++++ unittests/statefulset/basic.yaml | 17 ++++ unittests/statefulset/signing-disabled.yaml | 40 ++++++++ unittests/statefulset/signing-enabled.yaml | 93 +++++++++++++++++++ values.yaml | 8 ++ 18 files changed, 429 insertions(+), 22 deletions(-) create mode 100644 templates/gitea/gpg-secret.yaml create mode 100644 unittests/gpg-secret/signing-disabled.yaml create mode 100644 unittests/gpg-secret/signing-enabled.yaml create mode 100644 unittests/init/basic.yaml create mode 100644 unittests/init/init_directory_structure.sh.yaml create mode 100644 unittests/statefulset/basic.yaml create mode 100644 unittests/statefulset/signing-disabled.yaml create mode 100644 unittests/statefulset/signing-enabled.yaml diff --git a/.drone.yml b/.drone.yml index d0244e3..b9365c4 100644 --- a/.drone.yml +++ b/.drone.yml @@ -23,6 +23,15 @@ steps: - helm dependency update - helm template --debug gitea-helm . +- name: helm unittests + pull: always + image: alpine:3.16 + commands: + - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make helm git bash + - helm plugin install https://github.com/heyhabito/helm-unittest + - helm dependency update + - make unittests + - name: verify readme pull: always image: alpine:3.16 diff --git a/.gitignore b/.gitignore index 22b7fa6..10261af 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ charts/ node_modules/ .DS_Store +unittests/*/__snapshot__/ diff --git a/.helmignore b/.helmignore index a8cc816..048126d 100644 --- a/.helmignore +++ b/.helmignore @@ -25,3 +25,4 @@ node_modules/ package.json package-lock.json .gitea/ +unittests/ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d06973c..78f77d9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -50,3 +50,13 @@ be used: forwarded first from `minikube` to localhost first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000). + +### Unit tests + +```bash +# install the unittest plugin +$ helm plugin install https://github.com/heyhabito/helm-unittest + +# run the unittests +make unittests +``` diff --git a/Makefile b/Makefile index 720a657..2b61849 100644 --- a/Makefile +++ b/Makefile @@ -6,3 +6,7 @@ prepare-environment: readme: prepare-environment npm run readme:parameters npm run readme:lint + +.PHONY: unittests +unittests: + helm unittest --helm3 --strict -f 'unittests/**/*.yaml' ./ diff --git a/README.md b/README.md index 2fc73f7..d7eaa66 100644 --- a/README.md +++ b/README.md @@ -41,24 +41,6 @@ of this document for major and breaking changes. - Helm 3.0+ - PV provisioner for persistent data support -## Configure Commit Signing - -When using the rootless image the gpg key folder was is not persistent by -default. If you consider using signed commits for internal Gitea activities -(e.g. initial commit), you'd need to provide a signing key. Prior to -[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be -re-imported once the container got replaced by another. - -The mentioned PR introduced a new configuration object `signing` allowing you to -configure prerequisites for commit signing. By default this section is disabled -to maintain backwards compatibility. - -```yaml -signing: - enabled: false - gpgHome: /data/git/.gnupg -``` - ## Examples ### Gitea Configuration @@ -525,6 +507,49 @@ gitea: ... ``` +## Configure commit signing + +When using the rootless image the gpg key folder is not persistent by +default. If you consider using signed commits for internal Gitea activities +(e.g. initial commit), you'd need to provide a signing key. Prior to +[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be +re-imported once the container got replaced by another. + +The mentioned PR introduced a new configuration object `signing` allowing you to +configure prerequisites for commit signing. By default this section is disabled +to maintain backwards compatibility. + +```yaml +signing: + enabled: false + gpgHome: /data/git/.gnupg +``` + +Regardless of the used container image the `signing` object allows to specify a +private gpg key. Either using the `signing.privateKey` to define the key inline, +or refer to an existing secret containing the key data by using `signing.existingKey`. + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: custom-gitea-gpg-key +type: Opaque +stringData: + privateKey: |- + -----BEGIN PGP PRIVATE KEY BLOCK----- + ... + -----END PGP PRIVATE KEY BLOCK----- +``` + +```yaml +signing: + existingSecret: custom-gitea-gpg-key +``` + +To use the gpg key, Gitea needs to be configured accordingly. A detailed description +can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration). + ### Metrics and profiling A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling @@ -669,10 +694,12 @@ gitea: ### Signing -| Name | Description | Value | -| ----------------- | ---------------------------- | ------------------ | -| `signing.enabled` | Enable commit/action signing | `false` | -| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | +| Name | Description | Value | +| ------------------------ | ----------------------------------------------------------------- | ------------------ | +| `signing.enabled` | Enable commit/action signing | `false` | +| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | +| `signing.privateKey` | Inline private gpg key for signed Gitea actions | `""` | +| `signing.existingSecret` | Use an existing secret to store the value of `signing.privateKey` | `""` | ### Gitea diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 0e481e0..5bdcca9 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -331,3 +331,7 @@ https {{- toYaml .Values.extraVolumeMounts -}} {{- end -}} {{- end -}} + +{{- define "gitea.gpg-key-secret-name" -}} +{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} +{{- end -}} diff --git a/templates/gitea/gpg-secret.yaml b/templates/gitea/gpg-secret.yaml new file mode 100644 index 0000000..29b6d4f --- /dev/null +++ b/templates/gitea/gpg-secret.yaml @@ -0,0 +1,16 @@ +{{- if .Values.signing.enabled -}} +{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} + {{- fail "Either specify `signing.privateKey` or `signing.existingKey`" -}} +{{- end }} +{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "gitea.gpg-key-secret-name" . }} + labels: + {{- include "gitea.labels" . | nindent 4 }} +type: Opaque +data: + privateKey: {{ .Values.signing.privateKey | b64enc }} +{{- end }} +{{- end }} diff --git a/templates/gitea/init.yaml b/templates/gitea/init.yaml index 8ea3aa9..0337388 100644 --- a/templates/gitea/init.yaml +++ b/templates/gitea/init.yaml @@ -6,6 +6,11 @@ metadata: {{- include "gitea.labels" . | nindent 4 }} type: Opaque stringData: + configure_gpg_environment.sh: |- + #!/usr/bin/env bash + set -eu + + gpg --import /raw/private.asc init_directory_structure.sh: |- #!/usr/bin/env bash @@ -35,6 +40,14 @@ stringData: {{- end }} chmod ug+rwx "${GITEA_TEMP}" + {{ if .Values.signing.enabled -}} + if [ ! -d "${GNUPGHOME}" ]; then + mkdir -p "${GNUPGHOME}" + chmod 700 "${GNUPGHOME}" + chown 1000:1000 "${GNUPGHOME}" + fi + {{- end }} + configure_gitea.sh: |- #!/usr/bin/env bash diff --git a/templates/gitea/statefulset.yaml b/templates/gitea/statefulset.yaml index ed9a887..ce6f550 100644 --- a/templates/gitea/statefulset.yaml +++ b/templates/gitea/statefulset.yaml @@ -59,6 +59,10 @@ spec: {{- if .Values.statefulset.env }} {{- toYaml .Values.statefulset.env | nindent 12 }} {{- end }} + {{- if .Values.signing.enabled }} + - name: GNUPGHOME + value: {{ .Values.signing.gpgHome }} + {{- end }} volumeMounts: - name: init mountPath: /usr/sbin @@ -110,6 +114,36 @@ spec: {{- include "gitea.init-additional-mounts" . | nindent 12 }} securityContext: {{- toYaml .Values.containerSecurityContext | nindent 12 }} + {{- if .Values.signing.enabled }} + - name: configure-gpg + image: "{{ include "gitea.image" . }}" + command: ["/usr/sbin/configure_gpg_environment.sh"] + imagePullPolicy: {{ .Values.image.pullPolicy }} + securityContext: + {{- /* By default this container runs as user 1000 unless otherwise stated */ -}} + {{- $csc := deepCopy .Values.containerSecurityContext -}} + {{- if not (hasKey $csc "runAsUser") -}} + {{- $_ := set $csc "runAsUser" 1000 -}} + {{- end -}} + {{- toYaml $csc | nindent 12 }} + env: + - name: GNUPGHOME + value: {{ .Values.signing.gpgHome }} + volumeMounts: + - name: init + mountPath: /usr/sbin + - name: data + mountPath: /data + {{- if .Values.persistence.subPath }} + subPath: {{ .Values.persistence.subPath }} + {{- end }} + - name: gpg-private-key + mountPath: /raw + readOnly: true + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + {{- end }} - name: configure-gitea image: "{{ include "gitea.image" . }}" command: ["/usr/sbin/configure_gitea.sh"] @@ -305,6 +339,15 @@ spec: {{- end }} - name: temp emptyDir: {} + {{- if .Values.signing.enabled }} + - name: gpg-private-key + secret: + secretName: {{ include "gitea.gpg-key-secret-name" . }} + items: + - key: privateKey + path: private.asc + defaultMode: 0100 + {{- end }} {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} - name: data persistentVolumeClaim: diff --git a/unittests/gpg-secret/signing-disabled.yaml b/unittests/gpg-secret/signing-disabled.yaml new file mode 100644 index 0000000..3b1aba4 --- /dev/null +++ b/unittests/gpg-secret/signing-disabled.yaml @@ -0,0 +1,13 @@ +suite: GPG secret template (signing disabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/gpg-secret.yaml +tests: + - it: renders nothing + set: + signing.enabled: false + asserts: + - hasDocuments: + count: 0 diff --git a/unittests/gpg-secret/signing-enabled.yaml b/unittests/gpg-secret/signing-enabled.yaml new file mode 100644 index 0000000..3c742e9 --- /dev/null +++ b/unittests/gpg-secret/signing-enabled.yaml @@ -0,0 +1,40 @@ +suite: GPG secret template (signing enabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/gpg-secret.yaml +tests: + - it: fails rendering when nothing is configured + set: + signing: + enabled: true + asserts: + - failedTemplate: + errorMessage: Either specify `signing.privateKey` or `signing.existingKey` + - it: skips rendering using external secret reference + set: + signing: + enabled: true + existingSecret: "external-secret-reference" + asserts: + - hasDocuments: + count: 0 + - it: renders secret specification using inline gpg key + set: + signing: + enabled: true + privateKey: "gpg-key-placeholder" + asserts: + - hasDocuments: + count: 1 + - documentIndex: 0 + containsDocument: + kind: Secret + apiVersion: v1 + name: gitea-unittests-gpg-key + - isNotEmpty: + path: metadata.labels + - equal: + path: data.privateKey + value: "Z3BnLWtleS1wbGFjZWhvbGRlcg==" diff --git a/unittests/init/basic.yaml b/unittests/init/basic.yaml new file mode 100644 index 0000000..f2b746e --- /dev/null +++ b/unittests/init/basic.yaml @@ -0,0 +1,15 @@ +suite: Init template (basic) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/init.yaml +tests: + - it: renders a secret + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: Secret + apiVersion: v1 + name: gitea-unittests-init diff --git a/unittests/init/init_directory_structure.sh.yaml b/unittests/init/init_directory_structure.sh.yaml new file mode 100644 index 0000000..75b43ea --- /dev/null +++ b/unittests/init/init_directory_structure.sh.yaml @@ -0,0 +1,53 @@ +suite: Init template +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/init.yaml +tests: + - it: skips gpg script block for disabled signing + asserts: + - equal: + path: stringData.[init_directory_structure.sh] + value: |- + #!/usr/bin/env bash + + set -euo pipefail + + set -x + chown 1000:1000 /data + mkdir -p /data/git/.ssh + chmod -R 700 /data/git/.ssh + [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf + + # prepare temp directory structure + mkdir -p "${GITEA_TEMP}" + chown 1000:1000 "${GITEA_TEMP}" + chmod ug+rwx "${GITEA_TEMP}" + - it: adds gpg script block for enabled signing + set: + signing.enabled: true + asserts: + - equal: + path: stringData.[init_directory_structure.sh] + value: |- + #!/usr/bin/env bash + + set -euo pipefail + + set -x + chown 1000:1000 /data + mkdir -p /data/git/.ssh + chmod -R 700 /data/git/.ssh + [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf + + # prepare temp directory structure + mkdir -p "${GITEA_TEMP}" + chown 1000:1000 "${GITEA_TEMP}" + chmod ug+rwx "${GITEA_TEMP}" + + if [ ! -d "${GNUPGHOME}" ]; then + mkdir -p "${GNUPGHOME}" + chmod 700 "${GNUPGHOME}" + chown 1000:1000 "${GNUPGHOME}" + fi diff --git a/unittests/statefulset/basic.yaml b/unittests/statefulset/basic.yaml new file mode 100644 index 0000000..00fb684 --- /dev/null +++ b/unittests/statefulset/basic.yaml @@ -0,0 +1,17 @@ +suite: Statefulset template (basic) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/statefulset.yaml + - templates/gitea/config.yaml +tests: + - it: renders a statefulset + template: templates/gitea/statefulset.yaml + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: StatefulSet + apiVersion: apps/v1 + name: gitea-unittests diff --git a/unittests/statefulset/signing-disabled.yaml b/unittests/statefulset/signing-disabled.yaml new file mode 100644 index 0000000..4f9f2ce --- /dev/null +++ b/unittests/statefulset/signing-disabled.yaml @@ -0,0 +1,40 @@ +suite: Statefulset template (signing disabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/statefulset.yaml + - templates/gitea/config.yaml +tests: + - it: skips gpg init container + template: templates/gitea/statefulset.yaml + asserts: + - notContains: + path: spec.template.spec.initContainers + any: true + content: + name: configure-gpg + - it: skips gpg env in `init-directories` init container + template: templates/gitea/statefulset.yaml + set: + signing.enabled: true + asserts: + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: GNUPGHOME + value: /data/git/.gnupg + - it: skips gpg env in runtime container + template: templates/gitea/statefulset.yaml + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: GNUPGHOME + - it: skips gpg volume spec + template: templates/gitea/statefulset.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: gpg-private-key diff --git a/unittests/statefulset/signing-enabled.yaml b/unittests/statefulset/signing-enabled.yaml new file mode 100644 index 0000000..ecb237f --- /dev/null +++ b/unittests/statefulset/signing-enabled.yaml @@ -0,0 +1,93 @@ +suite: Statefulset template (signing enabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/statefulset.yaml + - templates/gitea/config.yaml +tests: + - it: adds gpg init container + template: templates/gitea/statefulset.yaml + set: + signing: + enabled: true + existingSecret: "custom-gpg-secret" + asserts: + - equal: + path: spec.template.spec.initContainers[2].name + value: configure-gpg + - equal: + path: spec.template.spec.initContainers[2].command + value: ["/usr/sbin/configure_gpg_environment.sh"] + - equal: + path: spec.template.spec.initContainers[2].securityContext + value: + runAsUser: 1000 + - equal: + path: spec.template.spec.initContainers[2].env + value: + - name: GNUPGHOME + value: /data/git/.gnupg + - equal: + path: spec.template.spec.initContainers[2].volumeMounts + value: + - name: init + mountPath: /usr/sbin + - name: data + mountPath: /data + - name: gpg-private-key + mountPath: /raw + readOnly: true + - it: adds gpg env in `init-directories` init container + template: templates/gitea/statefulset.yaml + set: + signing.enabled: true + asserts: + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: GNUPGHOME + value: /data/git/.gnupg + - it: adds gpg env in runtime container + template: templates/gitea/statefulset.yaml + set: + signing.enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: GNUPGHOME + value: /data/git/.gnupg + - it: adds gpg volume spec + template: templates/gitea/statefulset.yaml + set: + signing: + enabled: true + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: gpg-private-key + secret: + secretName: gitea-unittests-gpg-key + items: + - key: privateKey + path: private.asc + defaultMode: 0100 + - it: supports gpg volume spec with external reference + template: templates/gitea/statefulset.yaml + set: + signing: + enabled: true + existingSecret: custom-gpg-secret + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: gpg-private-key + secret: + secretName: custom-gpg-secret + items: + - key: privateKey + path: private.asc + defaultMode: 0100 diff --git a/values.yaml b/values.yaml index bd8c4d0..5958d24 100644 --- a/values.yaml +++ b/values.yaml @@ -253,9 +253,17 @@ initPreScript: "" # ## @param signing.enabled Enable commit/action signing ## @param signing.gpgHome GPG home directory +## @param signing.privateKey Inline private gpg key for signed Gitea actions +## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey` signing: enabled: false gpgHome: /data/git/.gnupg + privateKey: "" + # privateKey: |- + # -----BEGIN PGP PRIVATE KEY BLOCK----- + # ... + # -----END PGP PRIVATE KEY BLOCK----- + existingSecret: "" ## @section Gitea # From d1f5dca5735539c7bb6a8c04f41914a3024486b5 Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Fri, 14 Oct 2022 00:16:41 +0800 Subject: [PATCH 04/21] Lock readme-generator-for-helm dependency (#369) With every push on main/master branch of that repository, the referenced tarball is replaced, causing npm integrity checks to fail. Locking the used reference to a specific commit hash is more reliable. There is an open issue regarding publishing on NPM. As long as this is not resolved, we would need to use this workaround to get updates. (https://github.com/bitnami-labs/readme-generator-for-helm/issues/36) Signed-off-by: justusbunsi Co-authored-by: justusbunsi Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/369 Reviewed-by: pat-s Reviewed-by: techknowlogick Co-authored-by: justusbunsi Co-committed-by: justusbunsi --- package-lock.json | 24 ++++++++++++------------ package.json | 2 +- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/package-lock.json b/package-lock.json index 5f0c69c..78a9d97 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8,7 +8,7 @@ "license": "MIT", "devDependencies": { "markdownlint-cli": "^0.31.1", - "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main" + "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289" }, "engines": { "node": ">=16.0.0", @@ -332,9 +332,9 @@ } }, "node_modules/readme-generator-for-helm": { - "version": "2.4.0", - "resolved": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main", - "integrity": "sha512-W5ziOuId0M00YQRDlA5le3oEguWe8hoINhivOAgEF+AZkk2bDoNxuFUaJIxqAUEvZRA8qlTfUlu+w90EOFbTLw==", + "version": "2.4.1", + "resolved": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289", + "integrity": "sha512-vCIT2YuskoOU38vNd/if6EhWCVBixdle0e4w2070jv82MlctrQ/5HAYpHZ0cRZCkfoUJ2QOxkGa38nAgUvBb+A==", "dev": true, "license": "ISC", "dependencies": { @@ -397,9 +397,9 @@ "dev": true }, "node_modules/yaml": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.1.tgz", - "integrity": "sha512-o96x3OPo8GjWeSLF+wOAbrPfhFOGY0W00GNaxCDv+9hkcDJEnev1yh8S7pgHF0ik6zc8sQLuL8hjHjJULZp8bw==", + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.3.tgz", + "integrity": "sha512-AacA8nRULjKMX2DvWvOAdBZMOfQlypSFkjcOcu9FalllIDJ1kvlREzcdIZmidQUqqeMv7jorHjq2HlLv/+c2lg==", "dev": true, "engines": { "node": ">= 14" @@ -664,8 +664,8 @@ "dev": true }, "readme-generator-for-helm": { - "version": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main", - "integrity": "sha512-W5ziOuId0M00YQRDlA5le3oEguWe8hoINhivOAgEF+AZkk2bDoNxuFUaJIxqAUEvZRA8qlTfUlu+w90EOFbTLw==", + "version": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289", + "integrity": "sha512-vCIT2YuskoOU38vNd/if6EhWCVBixdle0e4w2070jv82MlctrQ/5HAYpHZ0cRZCkfoUJ2QOxkGa38nAgUvBb+A==", "dev": true, "requires": { "commander": "^7.1.0", @@ -712,9 +712,9 @@ "dev": true }, "yaml": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.1.tgz", - "integrity": "sha512-o96x3OPo8GjWeSLF+wOAbrPfhFOGY0W00GNaxCDv+9hkcDJEnev1yh8S7pgHF0ik6zc8sQLuL8hjHjJULZp8bw==", + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.3.tgz", + "integrity": "sha512-AacA8nRULjKMX2DvWvOAdBZMOfQlypSFkjcOcu9FalllIDJ1kvlREzcdIZmidQUqqeMv7jorHjq2HlLv/+c2lg==", "dev": true } } diff --git a/package.json b/package.json index 007e11f..c39e58a 100644 --- a/package.json +++ b/package.json @@ -14,6 +14,6 @@ }, "devDependencies": { "markdownlint-cli": "^0.31.1", - "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main" + "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289" } } From 6c59fe361d35a3e341880bbf9215f0ddaf1c4084 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Mon, 17 Oct 2022 04:19:45 +0800 Subject: [PATCH 05/21] v1.17.3 --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 446305a..2b4ed96 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.17.2 +appVersion: 1.17.3 icon: https://docs.gitea.io/images/gitea.png keywords: From 57a1cd27d9a6cc014f425fabeadb0db34f242b0e Mon Sep 17 00:00:00 2001 From: dajoen74 Date: Tue, 18 Oct 2022 13:47:21 +0800 Subject: [PATCH 06/21] Gpg init fails to import key (#371) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ### Description of the change The init container for gpg key import doesn´t work. There is a not a tty error. ### Benefits This will run gpg in batch mode. Eliminating the tty error. ### Possible drawbacks None that I can think off. ### Applicable issues - fixes #370 ### Checklist - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [X] Breaking changes are documented in the `README.md` Co-authored-by: Jeroen Verhoeven Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/371 Reviewed-by: techknowlogick Reviewed-by: justusbunsi Co-authored-by: dajoen74 Co-committed-by: dajoen74 --- templates/gitea/init.yaml | 2 +- unittests/init/init_directory_structure.sh.yaml | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/templates/gitea/init.yaml b/templates/gitea/init.yaml index 0337388..838460b 100644 --- a/templates/gitea/init.yaml +++ b/templates/gitea/init.yaml @@ -10,7 +10,7 @@ stringData: #!/usr/bin/env bash set -eu - gpg --import /raw/private.asc + gpg --batch --import /raw/private.asc init_directory_structure.sh: |- #!/usr/bin/env bash diff --git a/unittests/init/init_directory_structure.sh.yaml b/unittests/init/init_directory_structure.sh.yaml index 75b43ea..7be2336 100644 --- a/unittests/init/init_directory_structure.sh.yaml +++ b/unittests/init/init_directory_structure.sh.yaml @@ -5,6 +5,17 @@ release: templates: - templates/gitea/init.yaml tests: + - it: runs gpg in batch mode + set: + signing.enabled: true + asserts: + - equal: + path: stringData.[configure_gpg_environment.sh] + value: |- + #!/usr/bin/env bash + set -eu + + gpg --batch --import /raw/private.asc - it: skips gpg script block for disabled signing asserts: - equal: From d5ce1a47eaad935ea709b7a03bfdf6c69bac8f32 Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Fri, 21 Oct 2022 00:35:19 +0800 Subject: [PATCH 07/21] Temporary revert GPG feature for semver based retagging (#373) Feature #343 happens to be a breaking change when enabling `.Values.signing` but not specifying any of the new private key properties. Tag `v6.0.2` is therefore not following semantic versioning. This temporarily reverts commit b8f0310c43bd71dd48ac92b70d8ebdb94d43c29b and a fix-up commit 57a1cd27d9a6cc014f425fabeadb0db34f242b0e to retag 6.0.2 as 6.0.3. Co-authored-by: justusbunsi Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/373 Reviewed-by: techknowlogick Reviewed-by: luhahn --- .drone.yml | 9 -- .gitignore | 1 - .helmignore | 1 - CONTRIBUTING.md | 10 -- Makefile | 4 - README.md | 71 +++++--------- templates/_helpers.tpl | 4 - templates/gitea/gpg-secret.yaml | 16 ---- templates/gitea/init.yaml | 13 --- templates/gitea/statefulset.yaml | 43 --------- unittests/gpg-secret/signing-disabled.yaml | 13 --- unittests/gpg-secret/signing-enabled.yaml | 40 -------- unittests/init/basic.yaml | 15 --- .../init/init_directory_structure.sh.yaml | 64 ------------- unittests/statefulset/basic.yaml | 17 ---- unittests/statefulset/signing-disabled.yaml | 40 -------- unittests/statefulset/signing-enabled.yaml | 93 ------------------- values.yaml | 8 -- 18 files changed, 22 insertions(+), 440 deletions(-) delete mode 100644 templates/gitea/gpg-secret.yaml delete mode 100644 unittests/gpg-secret/signing-disabled.yaml delete mode 100644 unittests/gpg-secret/signing-enabled.yaml delete mode 100644 unittests/init/basic.yaml delete mode 100644 unittests/init/init_directory_structure.sh.yaml delete mode 100644 unittests/statefulset/basic.yaml delete mode 100644 unittests/statefulset/signing-disabled.yaml delete mode 100644 unittests/statefulset/signing-enabled.yaml diff --git a/.drone.yml b/.drone.yml index b9365c4..d0244e3 100644 --- a/.drone.yml +++ b/.drone.yml @@ -23,15 +23,6 @@ steps: - helm dependency update - helm template --debug gitea-helm . -- name: helm unittests - pull: always - image: alpine:3.16 - commands: - - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make helm git bash - - helm plugin install https://github.com/heyhabito/helm-unittest - - helm dependency update - - make unittests - - name: verify readme pull: always image: alpine:3.16 diff --git a/.gitignore b/.gitignore index 10261af..22b7fa6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,3 @@ charts/ node_modules/ .DS_Store -unittests/*/__snapshot__/ diff --git a/.helmignore b/.helmignore index 048126d..a8cc816 100644 --- a/.helmignore +++ b/.helmignore @@ -25,4 +25,3 @@ node_modules/ package.json package-lock.json .gitea/ -unittests/ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 78f77d9..d06973c 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -50,13 +50,3 @@ be used: forwarded first from `minikube` to localhost first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000). - -### Unit tests - -```bash -# install the unittest plugin -$ helm plugin install https://github.com/heyhabito/helm-unittest - -# run the unittests -make unittests -``` diff --git a/Makefile b/Makefile index 2b61849..720a657 100644 --- a/Makefile +++ b/Makefile @@ -6,7 +6,3 @@ prepare-environment: readme: prepare-environment npm run readme:parameters npm run readme:lint - -.PHONY: unittests -unittests: - helm unittest --helm3 --strict -f 'unittests/**/*.yaml' ./ diff --git a/README.md b/README.md index d7eaa66..2fc73f7 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,24 @@ of this document for major and breaking changes. - Helm 3.0+ - PV provisioner for persistent data support +## Configure Commit Signing + +When using the rootless image the gpg key folder was is not persistent by +default. If you consider using signed commits for internal Gitea activities +(e.g. initial commit), you'd need to provide a signing key. Prior to +[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be +re-imported once the container got replaced by another. + +The mentioned PR introduced a new configuration object `signing` allowing you to +configure prerequisites for commit signing. By default this section is disabled +to maintain backwards compatibility. + +```yaml +signing: + enabled: false + gpgHome: /data/git/.gnupg +``` + ## Examples ### Gitea Configuration @@ -507,49 +525,6 @@ gitea: ... ``` -## Configure commit signing - -When using the rootless image the gpg key folder is not persistent by -default. If you consider using signed commits for internal Gitea activities -(e.g. initial commit), you'd need to provide a signing key. Prior to -[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be -re-imported once the container got replaced by another. - -The mentioned PR introduced a new configuration object `signing` allowing you to -configure prerequisites for commit signing. By default this section is disabled -to maintain backwards compatibility. - -```yaml -signing: - enabled: false - gpgHome: /data/git/.gnupg -``` - -Regardless of the used container image the `signing` object allows to specify a -private gpg key. Either using the `signing.privateKey` to define the key inline, -or refer to an existing secret containing the key data by using `signing.existingKey`. - -```yaml -apiVersion: v1 -kind: Secret -metadata: - name: custom-gitea-gpg-key -type: Opaque -stringData: - privateKey: |- - -----BEGIN PGP PRIVATE KEY BLOCK----- - ... - -----END PGP PRIVATE KEY BLOCK----- -``` - -```yaml -signing: - existingSecret: custom-gitea-gpg-key -``` - -To use the gpg key, Gitea needs to be configured accordingly. A detailed description -can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration). - ### Metrics and profiling A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling @@ -694,12 +669,10 @@ gitea: ### Signing -| Name | Description | Value | -| ------------------------ | ----------------------------------------------------------------- | ------------------ | -| `signing.enabled` | Enable commit/action signing | `false` | -| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | -| `signing.privateKey` | Inline private gpg key for signed Gitea actions | `""` | -| `signing.existingSecret` | Use an existing secret to store the value of `signing.privateKey` | `""` | +| Name | Description | Value | +| ----------------- | ---------------------------- | ------------------ | +| `signing.enabled` | Enable commit/action signing | `false` | +| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | ### Gitea diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 5bdcca9..0e481e0 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -331,7 +331,3 @@ https {{- toYaml .Values.extraVolumeMounts -}} {{- end -}} {{- end -}} - -{{- define "gitea.gpg-key-secret-name" -}} -{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} -{{- end -}} diff --git a/templates/gitea/gpg-secret.yaml b/templates/gitea/gpg-secret.yaml deleted file mode 100644 index 29b6d4f..0000000 --- a/templates/gitea/gpg-secret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.signing.enabled -}} -{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} - {{- fail "Either specify `signing.privateKey` or `signing.existingKey`" -}} -{{- end }} -{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "gitea.gpg-key-secret-name" . }} - labels: - {{- include "gitea.labels" . | nindent 4 }} -type: Opaque -data: - privateKey: {{ .Values.signing.privateKey | b64enc }} -{{- end }} -{{- end }} diff --git a/templates/gitea/init.yaml b/templates/gitea/init.yaml index 838460b..8ea3aa9 100644 --- a/templates/gitea/init.yaml +++ b/templates/gitea/init.yaml @@ -6,11 +6,6 @@ metadata: {{- include "gitea.labels" . | nindent 4 }} type: Opaque stringData: - configure_gpg_environment.sh: |- - #!/usr/bin/env bash - set -eu - - gpg --batch --import /raw/private.asc init_directory_structure.sh: |- #!/usr/bin/env bash @@ -40,14 +35,6 @@ stringData: {{- end }} chmod ug+rwx "${GITEA_TEMP}" - {{ if .Values.signing.enabled -}} - if [ ! -d "${GNUPGHOME}" ]; then - mkdir -p "${GNUPGHOME}" - chmod 700 "${GNUPGHOME}" - chown 1000:1000 "${GNUPGHOME}" - fi - {{- end }} - configure_gitea.sh: |- #!/usr/bin/env bash diff --git a/templates/gitea/statefulset.yaml b/templates/gitea/statefulset.yaml index ce6f550..ed9a887 100644 --- a/templates/gitea/statefulset.yaml +++ b/templates/gitea/statefulset.yaml @@ -59,10 +59,6 @@ spec: {{- if .Values.statefulset.env }} {{- toYaml .Values.statefulset.env | nindent 12 }} {{- end }} - {{- if .Values.signing.enabled }} - - name: GNUPGHOME - value: {{ .Values.signing.gpgHome }} - {{- end }} volumeMounts: - name: init mountPath: /usr/sbin @@ -114,36 +110,6 @@ spec: {{- include "gitea.init-additional-mounts" . | nindent 12 }} securityContext: {{- toYaml .Values.containerSecurityContext | nindent 12 }} - {{- if .Values.signing.enabled }} - - name: configure-gpg - image: "{{ include "gitea.image" . }}" - command: ["/usr/sbin/configure_gpg_environment.sh"] - imagePullPolicy: {{ .Values.image.pullPolicy }} - securityContext: - {{- /* By default this container runs as user 1000 unless otherwise stated */ -}} - {{- $csc := deepCopy .Values.containerSecurityContext -}} - {{- if not (hasKey $csc "runAsUser") -}} - {{- $_ := set $csc "runAsUser" 1000 -}} - {{- end -}} - {{- toYaml $csc | nindent 12 }} - env: - - name: GNUPGHOME - value: {{ .Values.signing.gpgHome }} - volumeMounts: - - name: init - mountPath: /usr/sbin - - name: data - mountPath: /data - {{- if .Values.persistence.subPath }} - subPath: {{ .Values.persistence.subPath }} - {{- end }} - - name: gpg-private-key - mountPath: /raw - readOnly: true - {{- if .Values.extraVolumeMounts }} - {{- toYaml .Values.extraVolumeMounts | nindent 12 }} - {{- end }} - {{- end }} - name: configure-gitea image: "{{ include "gitea.image" . }}" command: ["/usr/sbin/configure_gitea.sh"] @@ -339,15 +305,6 @@ spec: {{- end }} - name: temp emptyDir: {} - {{- if .Values.signing.enabled }} - - name: gpg-private-key - secret: - secretName: {{ include "gitea.gpg-key-secret-name" . }} - items: - - key: privateKey - path: private.asc - defaultMode: 0100 - {{- end }} {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} - name: data persistentVolumeClaim: diff --git a/unittests/gpg-secret/signing-disabled.yaml b/unittests/gpg-secret/signing-disabled.yaml deleted file mode 100644 index 3b1aba4..0000000 --- a/unittests/gpg-secret/signing-disabled.yaml +++ /dev/null @@ -1,13 +0,0 @@ -suite: GPG secret template (signing disabled) -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/gpg-secret.yaml -tests: - - it: renders nothing - set: - signing.enabled: false - asserts: - - hasDocuments: - count: 0 diff --git a/unittests/gpg-secret/signing-enabled.yaml b/unittests/gpg-secret/signing-enabled.yaml deleted file mode 100644 index 3c742e9..0000000 --- a/unittests/gpg-secret/signing-enabled.yaml +++ /dev/null @@ -1,40 +0,0 @@ -suite: GPG secret template (signing enabled) -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/gpg-secret.yaml -tests: - - it: fails rendering when nothing is configured - set: - signing: - enabled: true - asserts: - - failedTemplate: - errorMessage: Either specify `signing.privateKey` or `signing.existingKey` - - it: skips rendering using external secret reference - set: - signing: - enabled: true - existingSecret: "external-secret-reference" - asserts: - - hasDocuments: - count: 0 - - it: renders secret specification using inline gpg key - set: - signing: - enabled: true - privateKey: "gpg-key-placeholder" - asserts: - - hasDocuments: - count: 1 - - documentIndex: 0 - containsDocument: - kind: Secret - apiVersion: v1 - name: gitea-unittests-gpg-key - - isNotEmpty: - path: metadata.labels - - equal: - path: data.privateKey - value: "Z3BnLWtleS1wbGFjZWhvbGRlcg==" diff --git a/unittests/init/basic.yaml b/unittests/init/basic.yaml deleted file mode 100644 index f2b746e..0000000 --- a/unittests/init/basic.yaml +++ /dev/null @@ -1,15 +0,0 @@ -suite: Init template (basic) -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/init.yaml -tests: - - it: renders a secret - asserts: - - hasDocuments: - count: 1 - - containsDocument: - kind: Secret - apiVersion: v1 - name: gitea-unittests-init diff --git a/unittests/init/init_directory_structure.sh.yaml b/unittests/init/init_directory_structure.sh.yaml deleted file mode 100644 index 7be2336..0000000 --- a/unittests/init/init_directory_structure.sh.yaml +++ /dev/null @@ -1,64 +0,0 @@ -suite: Init template -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/init.yaml -tests: - - it: runs gpg in batch mode - set: - signing.enabled: true - asserts: - - equal: - path: stringData.[configure_gpg_environment.sh] - value: |- - #!/usr/bin/env bash - set -eu - - gpg --batch --import /raw/private.asc - - it: skips gpg script block for disabled signing - asserts: - - equal: - path: stringData.[init_directory_structure.sh] - value: |- - #!/usr/bin/env bash - - set -euo pipefail - - set -x - chown 1000:1000 /data - mkdir -p /data/git/.ssh - chmod -R 700 /data/git/.ssh - [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf - - # prepare temp directory structure - mkdir -p "${GITEA_TEMP}" - chown 1000:1000 "${GITEA_TEMP}" - chmod ug+rwx "${GITEA_TEMP}" - - it: adds gpg script block for enabled signing - set: - signing.enabled: true - asserts: - - equal: - path: stringData.[init_directory_structure.sh] - value: |- - #!/usr/bin/env bash - - set -euo pipefail - - set -x - chown 1000:1000 /data - mkdir -p /data/git/.ssh - chmod -R 700 /data/git/.ssh - [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf - - # prepare temp directory structure - mkdir -p "${GITEA_TEMP}" - chown 1000:1000 "${GITEA_TEMP}" - chmod ug+rwx "${GITEA_TEMP}" - - if [ ! -d "${GNUPGHOME}" ]; then - mkdir -p "${GNUPGHOME}" - chmod 700 "${GNUPGHOME}" - chown 1000:1000 "${GNUPGHOME}" - fi diff --git a/unittests/statefulset/basic.yaml b/unittests/statefulset/basic.yaml deleted file mode 100644 index 00fb684..0000000 --- a/unittests/statefulset/basic.yaml +++ /dev/null @@ -1,17 +0,0 @@ -suite: Statefulset template (basic) -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/statefulset.yaml - - templates/gitea/config.yaml -tests: - - it: renders a statefulset - template: templates/gitea/statefulset.yaml - asserts: - - hasDocuments: - count: 1 - - containsDocument: - kind: StatefulSet - apiVersion: apps/v1 - name: gitea-unittests diff --git a/unittests/statefulset/signing-disabled.yaml b/unittests/statefulset/signing-disabled.yaml deleted file mode 100644 index 4f9f2ce..0000000 --- a/unittests/statefulset/signing-disabled.yaml +++ /dev/null @@ -1,40 +0,0 @@ -suite: Statefulset template (signing disabled) -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/statefulset.yaml - - templates/gitea/config.yaml -tests: - - it: skips gpg init container - template: templates/gitea/statefulset.yaml - asserts: - - notContains: - path: spec.template.spec.initContainers - any: true - content: - name: configure-gpg - - it: skips gpg env in `init-directories` init container - template: templates/gitea/statefulset.yaml - set: - signing.enabled: true - asserts: - - contains: - path: spec.template.spec.initContainers[0].env - content: - name: GNUPGHOME - value: /data/git/.gnupg - - it: skips gpg env in runtime container - template: templates/gitea/statefulset.yaml - asserts: - - notContains: - path: spec.template.spec.containers[0].env - content: - name: GNUPGHOME - - it: skips gpg volume spec - template: templates/gitea/statefulset.yaml - asserts: - - notContains: - path: spec.template.spec.volumes - content: - name: gpg-private-key diff --git a/unittests/statefulset/signing-enabled.yaml b/unittests/statefulset/signing-enabled.yaml deleted file mode 100644 index ecb237f..0000000 --- a/unittests/statefulset/signing-enabled.yaml +++ /dev/null @@ -1,93 +0,0 @@ -suite: Statefulset template (signing enabled) -release: - name: gitea-unittests - namespace: testing -templates: - - templates/gitea/statefulset.yaml - - templates/gitea/config.yaml -tests: - - it: adds gpg init container - template: templates/gitea/statefulset.yaml - set: - signing: - enabled: true - existingSecret: "custom-gpg-secret" - asserts: - - equal: - path: spec.template.spec.initContainers[2].name - value: configure-gpg - - equal: - path: spec.template.spec.initContainers[2].command - value: ["/usr/sbin/configure_gpg_environment.sh"] - - equal: - path: spec.template.spec.initContainers[2].securityContext - value: - runAsUser: 1000 - - equal: - path: spec.template.spec.initContainers[2].env - value: - - name: GNUPGHOME - value: /data/git/.gnupg - - equal: - path: spec.template.spec.initContainers[2].volumeMounts - value: - - name: init - mountPath: /usr/sbin - - name: data - mountPath: /data - - name: gpg-private-key - mountPath: /raw - readOnly: true - - it: adds gpg env in `init-directories` init container - template: templates/gitea/statefulset.yaml - set: - signing.enabled: true - asserts: - - contains: - path: spec.template.spec.initContainers[0].env - content: - name: GNUPGHOME - value: /data/git/.gnupg - - it: adds gpg env in runtime container - template: templates/gitea/statefulset.yaml - set: - signing.enabled: true - asserts: - - contains: - path: spec.template.spec.containers[0].env - content: - name: GNUPGHOME - value: /data/git/.gnupg - - it: adds gpg volume spec - template: templates/gitea/statefulset.yaml - set: - signing: - enabled: true - asserts: - - contains: - path: spec.template.spec.volumes - content: - name: gpg-private-key - secret: - secretName: gitea-unittests-gpg-key - items: - - key: privateKey - path: private.asc - defaultMode: 0100 - - it: supports gpg volume spec with external reference - template: templates/gitea/statefulset.yaml - set: - signing: - enabled: true - existingSecret: custom-gpg-secret - asserts: - - contains: - path: spec.template.spec.volumes - content: - name: gpg-private-key - secret: - secretName: custom-gpg-secret - items: - - key: privateKey - path: private.asc - defaultMode: 0100 diff --git a/values.yaml b/values.yaml index 5958d24..bd8c4d0 100644 --- a/values.yaml +++ b/values.yaml @@ -253,17 +253,9 @@ initPreScript: "" # ## @param signing.enabled Enable commit/action signing ## @param signing.gpgHome GPG home directory -## @param signing.privateKey Inline private gpg key for signed Gitea actions -## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey` signing: enabled: false gpgHome: /data/git/.gnupg - privateKey: "" - # privateKey: |- - # -----BEGIN PGP PRIVATE KEY BLOCK----- - # ... - # -----END PGP PRIVATE KEY BLOCK----- - existingSecret: "" ## @section Gitea # From 9ed671d685589ee5cba66baa590f66d5d1e90c0a Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Mon, 5 Dec 2022 20:56:08 +0800 Subject: [PATCH 08/21] Switch to official npm release of readme generator (#375) This is a follow up for #369. They published the package on NPM. https://github.com/bitnami-labs/readme-generator-for-helm/issues/36 Co-authored-by: justusbunsi Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/375 Reviewed-by: pat-s Reviewed-by: Lunny Xiao Co-authored-by: justusbunsi Co-committed-by: justusbunsi --- package-lock.json | 62 +++++++++++++++++++++++------------------------ package.json | 4 +-- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/package-lock.json b/package-lock.json index 78a9d97..4a19561 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7,14 +7,30 @@ "name": "gitea-helm-chart", "license": "MIT", "devDependencies": { - "markdownlint-cli": "^0.31.1", - "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289" + "@bitnami/readme-generator-for-helm": "^2.4.2", + "markdownlint-cli": "^0.31.1" }, "engines": { "node": ">=16.0.0", "npm": ">=8.0.0" } }, + "node_modules/@bitnami/readme-generator-for-helm": { + "version": "2.4.2", + "resolved": "https://registry.npmjs.org/@bitnami/readme-generator-for-helm/-/readme-generator-for-helm-2.4.2.tgz", + "integrity": "sha512-2kIXOjRiKJ3PBoBD6EaImp4SNyGM/w67ZPPwbuJi5NeXesupQjFyhIhcKliIledlpuiSrMeH9l80yl6hvmYHUA==", + "dev": true, + "dependencies": { + "commander": "^7.1.0", + "dot-object": "^2.1.4", + "lodash": "^4.17.21", + "markdown-table": "^2.0.0", + "yaml": "^2.0.0-3" + }, + "bin": { + "readme-generator": "bin/index.js" + } + }, "node_modules/argparse": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", @@ -331,23 +347,6 @@ "node": ">=0.10.0" } }, - "node_modules/readme-generator-for-helm": { - "version": "2.4.1", - "resolved": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289", - "integrity": "sha512-vCIT2YuskoOU38vNd/if6EhWCVBixdle0e4w2070jv82MlctrQ/5HAYpHZ0cRZCkfoUJ2QOxkGa38nAgUvBb+A==", - "dev": true, - "license": "ISC", - "dependencies": { - "commander": "^7.1.0", - "dot-object": "^2.1.4", - "lodash": "^4.17.21", - "markdown-table": "^2.0.0", - "yaml": "^2.0.0-3" - }, - "bin": { - "readme-generator": "bin/index.js" - } - }, "node_modules/repeat-string": { "version": "1.6.1", "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz", @@ -407,6 +406,19 @@ } }, "dependencies": { + "@bitnami/readme-generator-for-helm": { + "version": "2.4.2", + "resolved": "https://registry.npmjs.org/@bitnami/readme-generator-for-helm/-/readme-generator-for-helm-2.4.2.tgz", + "integrity": "sha512-2kIXOjRiKJ3PBoBD6EaImp4SNyGM/w67ZPPwbuJi5NeXesupQjFyhIhcKliIledlpuiSrMeH9l80yl6hvmYHUA==", + "dev": true, + "requires": { + "commander": "^7.1.0", + "dot-object": "^2.1.4", + "lodash": "^4.17.21", + "markdown-table": "^2.0.0", + "yaml": "^2.0.0-3" + } + }, "argparse": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", @@ -663,18 +675,6 @@ "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==", "dev": true }, - "readme-generator-for-helm": { - "version": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289", - "integrity": "sha512-vCIT2YuskoOU38vNd/if6EhWCVBixdle0e4w2070jv82MlctrQ/5HAYpHZ0cRZCkfoUJ2QOxkGa38nAgUvBb+A==", - "dev": true, - "requires": { - "commander": "^7.1.0", - "dot-object": "^2.1.4", - "lodash": "^4.17.21", - "markdown-table": "^2.0.0", - "yaml": "^2.0.0-3" - } - }, "repeat-string": { "version": "1.6.1", "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz", diff --git a/package.json b/package.json index c39e58a..deaa802 100644 --- a/package.json +++ b/package.json @@ -13,7 +13,7 @@ "readme:parameters": "readme-generator -v values.yaml -r README.md" }, "devDependencies": { - "markdownlint-cli": "^0.31.1", - "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/498ea5d19478a36556f1636e1e041a7510d09289" + "@bitnami/readme-generator-for-helm": "^2.4.2", + "markdownlint-cli": "^0.31.1" } } From 279bacb9414cb5b01c649552f17c5aeb95f7c910 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Thu, 22 Dec 2022 08:18:31 +0800 Subject: [PATCH 09/21] v1.17.4 --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 2b4ed96..6ca2fec 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.17.3 +appVersion: 1.17.4 icon: https://docs.gitea.io/images/gitea.png keywords: From 4f7bc17d34854bbf98d6e4e169ebe09f29499566 Mon Sep 17 00:00:00 2001 From: pat-s Date: Tue, 27 Dec 2022 17:18:36 +0800 Subject: [PATCH 10/21] Bump alpine version in CI (#384) To fix package installation issues. Apparently installing `helm` in 3.16 fails constantly. Co-authored-by: pat-s Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/384 Reviewed-by: justusbunsi Reviewed-by: Lunny Xiao Co-authored-by: pat-s Co-committed-by: pat-s --- .drone.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.drone.yml b/.drone.yml index d0244e3..972cee4 100644 --- a/.drone.yml +++ b/.drone.yml @@ -10,14 +10,14 @@ platform: steps: - name: helm lint pull: always - image: alpine:3.16 + image: alpine:3.17 commands: - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm - helm lint - name: helm template pull: always - image: alpine:3.16 + image: alpine:3.17 commands: - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm - helm dependency update @@ -25,7 +25,7 @@ steps: - name: verify readme pull: always - image: alpine:3.16 + image: alpine:3.17 commands: - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make npm git - make readme @@ -61,7 +61,7 @@ trigger: steps: - name: generate-chart pull: always - image: alpine:3.16 + image: alpine:3.17 commands: - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm - apk add --no-cache curl From 6574b1b2320e06d042b80599a8e77575c690f0ac Mon Sep 17 00:00:00 2001 From: JSchlarb Date: Wed, 28 Dec 2022 18:30:15 +0800 Subject: [PATCH 11/21] Ignore unrelated helm files from bundling (#385) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ### Description of the change Exluding non helm chart related files from release artifact ### Benefits Smaller release artifacts ### Possible drawbacks Exluded files not visible any within the artifact ### Applicable issues None ### Additional information None ### ⚠ BREAKING None ### Checklist - [x] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [x] Breaking changes are documented in the `README.md` Co-authored-by: Julian Schlarb Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/385 Reviewed-by: justusbunsi Reviewed-by: pat-s Co-authored-by: JSchlarb Co-committed-by: JSchlarb --- .helmignore | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.helmignore b/.helmignore index a8cc816..fe6af29 100644 --- a/.helmignore +++ b/.helmignore @@ -25,3 +25,8 @@ node_modules/ package.json package-lock.json .gitea/ +Makefile +.markdownlintignore +.markdownlint.yaml +.drone.yml +CONTRIBUTING.md \ No newline at end of file From 8b6a00603adc1012e5345c2baa1e6f4c3d6066f6 Mon Sep 17 00:00:00 2001 From: robv89r Date: Tue, 10 Jan 2023 14:54:55 +0800 Subject: [PATCH 12/21] Update 'values.yaml' (#394) ### Description of the change Corrects the spelling of the word deprecated. ### Benefits Documentation free of misspelled words is more likely to be viewed as "professional". ### Possible drawbacks None that I can think of ### Applicable issues - fixes #393 ### Additional information There may be other misspelled words or incorrectly phrased passages that aren't addressed in this PR. For reference, see the online dictionary for the correct spelling of deprecated. https://www.merriam-webster.com/dictionary/deprecated ### Checklist - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [X] Breaking changes are documented in the `README.md` Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/394 Reviewed-by: pat-s Reviewed-by: justusbunsi Co-authored-by: robv89r Co-committed-by: robv89r --- values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/values.yaml b/values.yaml index bd8c4d0..ad0ca31 100644 --- a/values.yaml +++ b/values.yaml @@ -63,7 +63,7 @@ containerSecurityContext: {} # runAsNonRoot: true # runAsUser: 1000 -## @depracated The securityContext variable has been split two: +## @deprecated The securityContext variable has been split two: ## - containerSecurityContext ## - podSecurityContext. ## @param securityContext Run init and Gitea containers as a specific securityContext @@ -228,7 +228,7 @@ extraContainerVolumeMounts: [] ## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. extraInitVolumeMounts: [] -## @depracated The extraVolumeMounts variable has been split two: +## @deprecated The extraVolumeMounts variable has been split two: ## - extraContainerVolumeMounts ## - extraInitVolumeMounts ## As an example, can be used to mount a client cert when connecting to an external Postgres server. From 19e9b07e6e2adabffc570a00724660c34ee5a39f Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Wed, 18 Jan 2023 00:58:10 +0800 Subject: [PATCH 13/21] Re-add GPG configuration feature (#374) This reverts d5ce1a47eaad935ea709b7a03bfdf6c69bac8f32 and therefore adds the GPG feature back into main. As it is a breaking change, this PR now also contains the required upgrade notes. Closes #107 again. Co-authored-by: justusbunsi Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/374 Reviewed-by: pat-s Reviewed-by: John Olheiser --- .drone.yml | 9 ++ .gitignore | 1 + .helmignore | 3 +- CONTRIBUTING.md | 10 ++ Makefile | 4 + README.md | 78 +++++++++++----- templates/_helpers.tpl | 4 + templates/gitea/gpg-secret.yaml | 16 ++++ templates/gitea/init.yaml | 13 +++ templates/gitea/statefulset.yaml | 43 +++++++++ unittests/gpg-secret/signing-disabled.yaml | 13 +++ unittests/gpg-secret/signing-enabled.yaml | 40 ++++++++ unittests/init/basic.yaml | 15 +++ .../init/init_directory_structure.sh.yaml | 64 +++++++++++++ unittests/statefulset/basic.yaml | 17 ++++ unittests/statefulset/signing-disabled.yaml | 40 ++++++++ unittests/statefulset/signing-enabled.yaml | 93 +++++++++++++++++++ values.yaml | 8 ++ 18 files changed, 448 insertions(+), 23 deletions(-) create mode 100644 templates/gitea/gpg-secret.yaml create mode 100644 unittests/gpg-secret/signing-disabled.yaml create mode 100644 unittests/gpg-secret/signing-enabled.yaml create mode 100644 unittests/init/basic.yaml create mode 100644 unittests/init/init_directory_structure.sh.yaml create mode 100644 unittests/statefulset/basic.yaml create mode 100644 unittests/statefulset/signing-disabled.yaml create mode 100644 unittests/statefulset/signing-enabled.yaml diff --git a/.drone.yml b/.drone.yml index 972cee4..4f78db2 100644 --- a/.drone.yml +++ b/.drone.yml @@ -23,6 +23,15 @@ steps: - helm dependency update - helm template --debug gitea-helm . +- name: helm unittests + pull: always + image: alpine:3.17 + commands: + - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make helm git bash + - helm plugin install https://github.com/heyhabito/helm-unittest + - helm dependency update + - make unittests + - name: verify readme pull: always image: alpine:3.17 diff --git a/.gitignore b/.gitignore index 22b7fa6..10261af 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ charts/ node_modules/ .DS_Store +unittests/*/__snapshot__/ diff --git a/.helmignore b/.helmignore index fe6af29..e608c23 100644 --- a/.helmignore +++ b/.helmignore @@ -29,4 +29,5 @@ Makefile .markdownlintignore .markdownlint.yaml .drone.yml -CONTRIBUTING.md \ No newline at end of file +CONTRIBUTING.md +unittests/ diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d06973c..78f77d9 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -50,3 +50,13 @@ be used: forwarded first from `minikube` to localhost first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000). + +### Unit tests + +```bash +# install the unittest plugin +$ helm plugin install https://github.com/heyhabito/helm-unittest + +# run the unittests +make unittests +``` diff --git a/Makefile b/Makefile index 720a657..2b61849 100644 --- a/Makefile +++ b/Makefile @@ -6,3 +6,7 @@ prepare-environment: readme: prepare-environment npm run readme:parameters npm run readme:lint + +.PHONY: unittests +unittests: + helm unittest --helm3 --strict -f 'unittests/**/*.yaml' ./ diff --git a/README.md b/README.md index 2fc73f7..a5c1ce6 100644 --- a/README.md +++ b/README.md @@ -41,24 +41,6 @@ of this document for major and breaking changes. - Helm 3.0+ - PV provisioner for persistent data support -## Configure Commit Signing - -When using the rootless image the gpg key folder was is not persistent by -default. If you consider using signed commits for internal Gitea activities -(e.g. initial commit), you'd need to provide a signing key. Prior to -[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be -re-imported once the container got replaced by another. - -The mentioned PR introduced a new configuration object `signing` allowing you to -configure prerequisites for commit signing. By default this section is disabled -to maintain backwards compatibility. - -```yaml -signing: - enabled: false - gpgHome: /data/git/.gnupg -``` - ## Examples ### Gitea Configuration @@ -525,6 +507,49 @@ gitea: ... ``` +## Configure commit signing + +When using the rootless image the gpg key folder is not persistent by +default. If you consider using signed commits for internal Gitea activities +(e.g. initial commit), you'd need to provide a signing key. Prior to +[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be +re-imported once the container got replaced by another. + +The mentioned PR introduced a new configuration object `signing` allowing you to +configure prerequisites for commit signing. By default this section is disabled +to maintain backwards compatibility. + +```yaml +signing: + enabled: false + gpgHome: /data/git/.gnupg +``` + +Regardless of the used container image the `signing` object allows to specify a +private gpg key. Either using the `signing.privateKey` to define the key inline, +or refer to an existing secret containing the key data by using `signing.existingKey`. + +```yaml +apiVersion: v1 +kind: Secret +metadata: + name: custom-gitea-gpg-key +type: Opaque +stringData: + privateKey: |- + -----BEGIN PGP PRIVATE KEY BLOCK----- + ... + -----END PGP PRIVATE KEY BLOCK----- +``` + +```yaml +signing: + existingSecret: custom-gitea-gpg-key +``` + +To use the gpg key, Gitea needs to be configured accordingly. A detailed description +can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration). + ### Metrics and profiling A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling @@ -669,10 +694,12 @@ gitea: ### Signing -| Name | Description | Value | -| ----------------- | ---------------------------- | ------------------ | -| `signing.enabled` | Enable commit/action signing | `false` | -| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | +| Name | Description | Value | +| ------------------------ | ----------------------------------------------------------------- | ------------------ | +| `signing.enabled` | Enable commit/action signing | `false` | +| `signing.gpgHome` | GPG home directory | `/data/git/.gnupg` | +| `signing.privateKey` | Inline private gpg key for signed Gitea actions | `""` | +| `signing.existingSecret` | Use an existing secret to store the value of `signing.privateKey` | `""` | ### Gitea @@ -786,6 +813,13 @@ See [CONTRIBUTORS GUIDE](CONTRIBUTING.md) for details. This section lists major and breaking changes of each Helm Chart version. Please read them carefully to upgrade successfully. +### To 7.0.0 + +#### Private GPG key configuration for Gitea signing actions + +Having `signing.enabled=true` now requires to use either `signing.privateKey` or `signing.existingSecret` so that the Chart can automatically prepare the GPG key for Gitea internal signing actions. +See [Configure commit signing](#configure-commit-signing) for details. + ### To 6.0.0 #### Different volume mounts for init-containers and runtime container diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 0e481e0..5bdcca9 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -331,3 +331,7 @@ https {{- toYaml .Values.extraVolumeMounts -}} {{- end -}} {{- end -}} + +{{- define "gitea.gpg-key-secret-name" -}} +{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }} +{{- end -}} diff --git a/templates/gitea/gpg-secret.yaml b/templates/gitea/gpg-secret.yaml new file mode 100644 index 0000000..29b6d4f --- /dev/null +++ b/templates/gitea/gpg-secret.yaml @@ -0,0 +1,16 @@ +{{- if .Values.signing.enabled -}} +{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}} + {{- fail "Either specify `signing.privateKey` or `signing.existingKey`" -}} +{{- end }} +{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "gitea.gpg-key-secret-name" . }} + labels: + {{- include "gitea.labels" . | nindent 4 }} +type: Opaque +data: + privateKey: {{ .Values.signing.privateKey | b64enc }} +{{- end }} +{{- end }} diff --git a/templates/gitea/init.yaml b/templates/gitea/init.yaml index 8ea3aa9..838460b 100644 --- a/templates/gitea/init.yaml +++ b/templates/gitea/init.yaml @@ -6,6 +6,11 @@ metadata: {{- include "gitea.labels" . | nindent 4 }} type: Opaque stringData: + configure_gpg_environment.sh: |- + #!/usr/bin/env bash + set -eu + + gpg --batch --import /raw/private.asc init_directory_structure.sh: |- #!/usr/bin/env bash @@ -35,6 +40,14 @@ stringData: {{- end }} chmod ug+rwx "${GITEA_TEMP}" + {{ if .Values.signing.enabled -}} + if [ ! -d "${GNUPGHOME}" ]; then + mkdir -p "${GNUPGHOME}" + chmod 700 "${GNUPGHOME}" + chown 1000:1000 "${GNUPGHOME}" + fi + {{- end }} + configure_gitea.sh: |- #!/usr/bin/env bash diff --git a/templates/gitea/statefulset.yaml b/templates/gitea/statefulset.yaml index ed9a887..ce6f550 100644 --- a/templates/gitea/statefulset.yaml +++ b/templates/gitea/statefulset.yaml @@ -59,6 +59,10 @@ spec: {{- if .Values.statefulset.env }} {{- toYaml .Values.statefulset.env | nindent 12 }} {{- end }} + {{- if .Values.signing.enabled }} + - name: GNUPGHOME + value: {{ .Values.signing.gpgHome }} + {{- end }} volumeMounts: - name: init mountPath: /usr/sbin @@ -110,6 +114,36 @@ spec: {{- include "gitea.init-additional-mounts" . | nindent 12 }} securityContext: {{- toYaml .Values.containerSecurityContext | nindent 12 }} + {{- if .Values.signing.enabled }} + - name: configure-gpg + image: "{{ include "gitea.image" . }}" + command: ["/usr/sbin/configure_gpg_environment.sh"] + imagePullPolicy: {{ .Values.image.pullPolicy }} + securityContext: + {{- /* By default this container runs as user 1000 unless otherwise stated */ -}} + {{- $csc := deepCopy .Values.containerSecurityContext -}} + {{- if not (hasKey $csc "runAsUser") -}} + {{- $_ := set $csc "runAsUser" 1000 -}} + {{- end -}} + {{- toYaml $csc | nindent 12 }} + env: + - name: GNUPGHOME + value: {{ .Values.signing.gpgHome }} + volumeMounts: + - name: init + mountPath: /usr/sbin + - name: data + mountPath: /data + {{- if .Values.persistence.subPath }} + subPath: {{ .Values.persistence.subPath }} + {{- end }} + - name: gpg-private-key + mountPath: /raw + readOnly: true + {{- if .Values.extraVolumeMounts }} + {{- toYaml .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + {{- end }} - name: configure-gitea image: "{{ include "gitea.image" . }}" command: ["/usr/sbin/configure_gitea.sh"] @@ -305,6 +339,15 @@ spec: {{- end }} - name: temp emptyDir: {} + {{- if .Values.signing.enabled }} + - name: gpg-private-key + secret: + secretName: {{ include "gitea.gpg-key-secret-name" . }} + items: + - key: privateKey + path: private.asc + defaultMode: 0100 + {{- end }} {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }} - name: data persistentVolumeClaim: diff --git a/unittests/gpg-secret/signing-disabled.yaml b/unittests/gpg-secret/signing-disabled.yaml new file mode 100644 index 0000000..3b1aba4 --- /dev/null +++ b/unittests/gpg-secret/signing-disabled.yaml @@ -0,0 +1,13 @@ +suite: GPG secret template (signing disabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/gpg-secret.yaml +tests: + - it: renders nothing + set: + signing.enabled: false + asserts: + - hasDocuments: + count: 0 diff --git a/unittests/gpg-secret/signing-enabled.yaml b/unittests/gpg-secret/signing-enabled.yaml new file mode 100644 index 0000000..3c742e9 --- /dev/null +++ b/unittests/gpg-secret/signing-enabled.yaml @@ -0,0 +1,40 @@ +suite: GPG secret template (signing enabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/gpg-secret.yaml +tests: + - it: fails rendering when nothing is configured + set: + signing: + enabled: true + asserts: + - failedTemplate: + errorMessage: Either specify `signing.privateKey` or `signing.existingKey` + - it: skips rendering using external secret reference + set: + signing: + enabled: true + existingSecret: "external-secret-reference" + asserts: + - hasDocuments: + count: 0 + - it: renders secret specification using inline gpg key + set: + signing: + enabled: true + privateKey: "gpg-key-placeholder" + asserts: + - hasDocuments: + count: 1 + - documentIndex: 0 + containsDocument: + kind: Secret + apiVersion: v1 + name: gitea-unittests-gpg-key + - isNotEmpty: + path: metadata.labels + - equal: + path: data.privateKey + value: "Z3BnLWtleS1wbGFjZWhvbGRlcg==" diff --git a/unittests/init/basic.yaml b/unittests/init/basic.yaml new file mode 100644 index 0000000..f2b746e --- /dev/null +++ b/unittests/init/basic.yaml @@ -0,0 +1,15 @@ +suite: Init template (basic) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/init.yaml +tests: + - it: renders a secret + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: Secret + apiVersion: v1 + name: gitea-unittests-init diff --git a/unittests/init/init_directory_structure.sh.yaml b/unittests/init/init_directory_structure.sh.yaml new file mode 100644 index 0000000..7be2336 --- /dev/null +++ b/unittests/init/init_directory_structure.sh.yaml @@ -0,0 +1,64 @@ +suite: Init template +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/init.yaml +tests: + - it: runs gpg in batch mode + set: + signing.enabled: true + asserts: + - equal: + path: stringData.[configure_gpg_environment.sh] + value: |- + #!/usr/bin/env bash + set -eu + + gpg --batch --import /raw/private.asc + - it: skips gpg script block for disabled signing + asserts: + - equal: + path: stringData.[init_directory_structure.sh] + value: |- + #!/usr/bin/env bash + + set -euo pipefail + + set -x + chown 1000:1000 /data + mkdir -p /data/git/.ssh + chmod -R 700 /data/git/.ssh + [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf + + # prepare temp directory structure + mkdir -p "${GITEA_TEMP}" + chown 1000:1000 "${GITEA_TEMP}" + chmod ug+rwx "${GITEA_TEMP}" + - it: adds gpg script block for enabled signing + set: + signing.enabled: true + asserts: + - equal: + path: stringData.[init_directory_structure.sh] + value: |- + #!/usr/bin/env bash + + set -euo pipefail + + set -x + chown 1000:1000 /data + mkdir -p /data/git/.ssh + chmod -R 700 /data/git/.ssh + [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf + + # prepare temp directory structure + mkdir -p "${GITEA_TEMP}" + chown 1000:1000 "${GITEA_TEMP}" + chmod ug+rwx "${GITEA_TEMP}" + + if [ ! -d "${GNUPGHOME}" ]; then + mkdir -p "${GNUPGHOME}" + chmod 700 "${GNUPGHOME}" + chown 1000:1000 "${GNUPGHOME}" + fi diff --git a/unittests/statefulset/basic.yaml b/unittests/statefulset/basic.yaml new file mode 100644 index 0000000..00fb684 --- /dev/null +++ b/unittests/statefulset/basic.yaml @@ -0,0 +1,17 @@ +suite: Statefulset template (basic) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/statefulset.yaml + - templates/gitea/config.yaml +tests: + - it: renders a statefulset + template: templates/gitea/statefulset.yaml + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: StatefulSet + apiVersion: apps/v1 + name: gitea-unittests diff --git a/unittests/statefulset/signing-disabled.yaml b/unittests/statefulset/signing-disabled.yaml new file mode 100644 index 0000000..4f9f2ce --- /dev/null +++ b/unittests/statefulset/signing-disabled.yaml @@ -0,0 +1,40 @@ +suite: Statefulset template (signing disabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/statefulset.yaml + - templates/gitea/config.yaml +tests: + - it: skips gpg init container + template: templates/gitea/statefulset.yaml + asserts: + - notContains: + path: spec.template.spec.initContainers + any: true + content: + name: configure-gpg + - it: skips gpg env in `init-directories` init container + template: templates/gitea/statefulset.yaml + set: + signing.enabled: true + asserts: + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: GNUPGHOME + value: /data/git/.gnupg + - it: skips gpg env in runtime container + template: templates/gitea/statefulset.yaml + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: GNUPGHOME + - it: skips gpg volume spec + template: templates/gitea/statefulset.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: gpg-private-key diff --git a/unittests/statefulset/signing-enabled.yaml b/unittests/statefulset/signing-enabled.yaml new file mode 100644 index 0000000..ecb237f --- /dev/null +++ b/unittests/statefulset/signing-enabled.yaml @@ -0,0 +1,93 @@ +suite: Statefulset template (signing enabled) +release: + name: gitea-unittests + namespace: testing +templates: + - templates/gitea/statefulset.yaml + - templates/gitea/config.yaml +tests: + - it: adds gpg init container + template: templates/gitea/statefulset.yaml + set: + signing: + enabled: true + existingSecret: "custom-gpg-secret" + asserts: + - equal: + path: spec.template.spec.initContainers[2].name + value: configure-gpg + - equal: + path: spec.template.spec.initContainers[2].command + value: ["/usr/sbin/configure_gpg_environment.sh"] + - equal: + path: spec.template.spec.initContainers[2].securityContext + value: + runAsUser: 1000 + - equal: + path: spec.template.spec.initContainers[2].env + value: + - name: GNUPGHOME + value: /data/git/.gnupg + - equal: + path: spec.template.spec.initContainers[2].volumeMounts + value: + - name: init + mountPath: /usr/sbin + - name: data + mountPath: /data + - name: gpg-private-key + mountPath: /raw + readOnly: true + - it: adds gpg env in `init-directories` init container + template: templates/gitea/statefulset.yaml + set: + signing.enabled: true + asserts: + - contains: + path: spec.template.spec.initContainers[0].env + content: + name: GNUPGHOME + value: /data/git/.gnupg + - it: adds gpg env in runtime container + template: templates/gitea/statefulset.yaml + set: + signing.enabled: true + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: GNUPGHOME + value: /data/git/.gnupg + - it: adds gpg volume spec + template: templates/gitea/statefulset.yaml + set: + signing: + enabled: true + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: gpg-private-key + secret: + secretName: gitea-unittests-gpg-key + items: + - key: privateKey + path: private.asc + defaultMode: 0100 + - it: supports gpg volume spec with external reference + template: templates/gitea/statefulset.yaml + set: + signing: + enabled: true + existingSecret: custom-gpg-secret + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: gpg-private-key + secret: + secretName: custom-gpg-secret + items: + - key: privateKey + path: private.asc + defaultMode: 0100 diff --git a/values.yaml b/values.yaml index ad0ca31..ebd2e50 100644 --- a/values.yaml +++ b/values.yaml @@ -253,9 +253,17 @@ initPreScript: "" # ## @param signing.enabled Enable commit/action signing ## @param signing.gpgHome GPG home directory +## @param signing.privateKey Inline private gpg key for signed Gitea actions +## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey` signing: enabled: false gpgHome: /data/git/.gnupg + privateKey: "" + # privateKey: |- + # -----BEGIN PGP PRIVATE KEY BLOCK----- + # ... + # -----END PGP PRIVATE KEY BLOCK----- + existingSecret: "" ## @section Gitea # From ccec32c144c857abc6a75b1639e22104926697c7 Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Wed, 18 Jan 2023 19:40:04 +0800 Subject: [PATCH 14/21] Bump Gitea image to 1.18.1 (#395) As title: Bump Gitea image to 1.18.1. Co-authored-by: justusbunsi Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/395 Reviewed-by: John Olheiser Reviewed-by: pat-s Co-authored-by: justusbunsi Co-committed-by: justusbunsi --- Chart.yaml | 2 +- README.md | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 6ca2fec..f22b989 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.17.4 +appVersion: 1.18.1 icon: https://docs.gitea.io/images/gitea.png keywords: diff --git a/README.md b/README.md index a5c1ce6..34cf5b4 100644 --- a/README.md +++ b/README.md @@ -815,6 +815,10 @@ Please read them carefully to upgrade successfully. ### To 7.0.0 +#### Gitea 1.18.1 + +This Chart version updates Gitea to 1.18.1. Don't miss any application related [breaking changes of 1.18.0](https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/#breaking-changes). + #### Private GPG key configuration for Gitea signing actions Having `signing.enabled=true` now requires to use either `signing.privateKey` or `signing.existingSecret` so that the Chart can automatically prepare the GPG key for Gitea internal signing actions. From 83c184826b80cf4d7949e926c4a7d160010c1483 Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Fri, 20 Jan 2023 14:26:45 +0800 Subject: [PATCH 15/21] bump to 1.18.2 --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index f22b989..194a8b1 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.18.1 +appVersion: 1.18.2 icon: https://docs.gitea.io/images/gitea.png keywords: From da4120809fcadd8d240b3054ed3f916c1c2efac4 Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Tue, 24 Jan 2023 00:53:20 +0800 Subject: [PATCH 16/21] Bump Gitea to 1.18.3 (#397) Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/397 Reviewed-by: John Olheiser Reviewed-by: techknowlogick --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 194a8b1..0e7f1b5 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.18.2 +appVersion: 1.18.3 icon: https://docs.gitea.io/images/gitea.png keywords: From e47edbddf9d57a3ddb1fdc397b6454cdee32c06d Mon Sep 17 00:00:00 2001 From: techknowlogick Date: Wed, 8 Feb 2023 05:57:32 +0800 Subject: [PATCH 17/21] use drone secrets for s3 info (#399) Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/399 --- .drone.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.drone.yml b/.drone.yml index 4f78db2..40fc93e 100644 --- a/.drone.yml +++ b/.drone.yml @@ -85,8 +85,16 @@ steps: pull: always image: plugins/s3:latest settings: - bucket: gitea-artifacts - endpoint: https://ams3.digitaloceanspaces.com + acl: + from_secret: aws_s3_acl + region: + from_secret: aws_s3_region + bucket: + from_secret: aws_s3_bucket + endpoint: + from_secret: aws_s3_endpoint + path_style: + from_secret: aws_s3_path_style access_key: from_secret: aws_access_key_id secret_key: From 513ad812287eec3dfead25a9735eedfffef4122b Mon Sep 17 00:00:00 2001 From: siretart Date: Tue, 21 Feb 2023 05:09:04 +0800 Subject: [PATCH 18/21] Bump Gitea to 1.18.4 (#402) Signed-off-by: siretart Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/402 Reviewed-by: justusbunsi Reviewed-by: John Olheiser Co-authored-by: siretart Co-committed-by: siretart --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 0e7f1b5..35d449f 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.18.3 +appVersion: 1.18.4 icon: https://docs.gitea.io/images/gitea.png keywords: From 01bb9b4a7774c169eac084aa12612e818d6bfdfa Mon Sep 17 00:00:00 2001 From: podain77 Date: Wed, 22 Feb 2023 01:53:25 +0800 Subject: [PATCH 19/21] Add support for hostAliases (#401) ### Description of the change It is required to add custom mapping between hostnames and IP addresses for the gitea pods to be able to access external services like oauth providers or webhook servers. It is common to take global variables for the entires and set them using hostAliases in the pod template. ### Benefits Give us more flexibility when using gitea in various network environments. ### Applicable issues - fixes #400 ### Checklist - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) Co-authored-by: Taekyun Kim Co-authored-by: pat-s Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/401 Reviewed-by: pat-s Reviewed-by: justusbunsi Co-authored-by: podain77 Co-committed-by: podain77 --- README.md | 1 + templates/gitea/statefulset.yaml | 4 ++++ values.yaml | 5 +++++ 3 files changed, 10 insertions(+) diff --git a/README.md b/README.md index 34cf5b4..bb64eb6 100644 --- a/README.md +++ b/README.md @@ -591,6 +591,7 @@ gitea: | `global.imageRegistry` | global image registry override | `""` | | `global.imagePullSecrets` | global image pull secrets override; can be extended by `imagePullSecrets` | `[]` | | `global.storageClass` | global storage class override | `""` | +| `global.hostAliases` | global hostAliases which will be added to the pod's hosts files | `[]` | | `replicaCount` | number of replicas for the statefulset | `1` | | `clusterDomain` | cluster domain | `cluster.local` | diff --git a/templates/gitea/statefulset.yaml b/templates/gitea/statefulset.yaml index ce6f550..04cbdc5 100644 --- a/templates/gitea/statefulset.yaml +++ b/templates/gitea/statefulset.yaml @@ -302,6 +302,10 @@ spec: subPath: {{ .Values.persistence.subPath }} {{- end }} {{- include "gitea.container-additional-mounts" . | nindent 12 }} + {{- with .Values.global.hostAliases }} + hostAliases: + {{- toYaml . | nindent 8 }} + {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/values.yaml b/values.yaml index ebd2e50..1213221 100644 --- a/values.yaml +++ b/values.yaml @@ -6,6 +6,7 @@ ## @param global.imageRegistry global image registry override ## @param global.imagePullSecrets global image pull secrets override; can be extended by `imagePullSecrets` ## @param global.storageClass global storage class override +## @param global.hostAliases global hostAliases which will be added to the pod's hosts files global: imageRegistry: "" ## E.g. @@ -14,6 +15,10 @@ global: ## imagePullSecrets: [] storageClass: "" + hostAliases: [] + # - ip: 192.168.137.2 + # hostnames: + # - example.com ## @param replicaCount number of replicas for the statefulset replicaCount: 1 From 578a6cb867ad656f2b889256371fd73617a4b6a5 Mon Sep 17 00:00:00 2001 From: justusbunsi Date: Wed, 22 Feb 2023 04:38:08 +0800 Subject: [PATCH 20/21] Bump Gitea to 1.18.5 (#403) Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/403 Reviewed-by: John Olheiser Reviewed-by: techknowlogick --- Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Chart.yaml b/Chart.yaml index 35d449f..f0b09c0 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -3,7 +3,7 @@ name: gitea description: Gitea Helm chart for Kubernetes type: application version: 0.0.0 -appVersion: 1.18.4 +appVersion: 1.18.5 icon: https://docs.gitea.io/images/gitea.png keywords: From b6d275c4f526796dc945b6362357affa65acb50f Mon Sep 17 00:00:00 2001 From: pat-s Date: Sun, 26 Feb 2023 20:52:32 +0800 Subject: [PATCH 21/21] Update memcached and use new OCI registry (#405) OCI registry: https://blog.bitnami.com/2023/01/bitnami-helm-charts-available-as-oci.html fixes #404 I think we should switch all other binami charts to also use the new OCI registry as according to their blog post, this will be the future method they're heading to. Co-authored-by: pat-s Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/405 Reviewed-by: techknowlogick Reviewed-by: Lunny Xiao --- Chart.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index f0b09c0..4f0bc4c 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -31,9 +31,11 @@ maintainers: # Bitnami charts are served from GitHub CDN - See https://github.com/bitnami/charts/issues/10539 for details dependencies: +# OCI registry: https://blog.bitnami.com/2023/01/bitnami-helm-charts-available-as-oci.html (2023-01) +# Chart release date: 2023-02 - name: memcached - repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami - version: 5.9.0 + repository: oci://registry-1.docker.io/bitnamicharts + version: 6.3.7 condition: memcached.enabled - name: mysql repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami