This change adds a new value *statefulset.labels* to allow the user to add custom labels to the StatefulSet.
An example of where this could be useful is if gitea's pvc is stored on OpenEBS. With this new option, the user can add the extra *openebs.io/sts-target-affinity* label to specify that the volume target pod should run on the same node as gitea's StatefulSet.
Co-authored-by: Baptiste Covolato <b.covolato@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/130
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Co-authored-by: Nakrez <nakrez@noreply.gitea.io>
Co-committed-by: Nakrez <nakrez@noreply.gitea.io>
There are currently 2 issues that prevent using this chart to deploy gitea with a SQLite3 database.
1) The value from *gitea.config.database.HOST* is used to set *db.servicename* when all the databases under *gitea.database.buildIn* are not enabled. This causes a type error during the template processing:
`Error: UPGRADE FAILED: template: gitea/templates/gitea/init.yaml:24:20: executing "gitea/templates/gitea/init.yaml" at <include "db.servicename" .>: error calling include: template: gitea/templates/_helpers.tpl:64:31: executing "db.servicename" at <.Values.gitea.config.database.HOST>: wrong type for value; expected string; got interface {}`
2) In *init_gitea.sh*, we use the value *db.servicename* and *db.port* to ping the database. If this database responds to ping, we proceed with the init. The problem here is that *db.port* is not set when all the databases under *gitea.database.buildIn* are disabled. In turn, this raises an error from busybox's *nc*, because no parameter is passed for *PORT*. This causes the init container to go in *CrashLoopBackOff* forever.
The simple fix that is proposed in this PR is to check wether or not *.Values.gitea.config.database.DB_TYPE* is set to determine the value *db.servicename*. If *DB_TYPE* is *'sqlite3'*, leave *db.servicename* empty and use that to bypass the database ping.
Co-authored-by: Baptiste Covolato <b.covolato@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/124
Reviewed-by: Andrew Thornton <art27@cantab.net>
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Co-authored-by: Nakrez <nakrez@noreply.gitea.io>
Co-committed-by: Nakrez <nakrez@noreply.gitea.io>
I opened up the OAuth2 authentication option. I needed this feature, and it is available in the gitea cli. So I opened it up for configuration through this pull request.
Hope it can help others.
Co-authored-by: Marc Went <marc.went+git@redkubes.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/123
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Co-authored-by: Dunky13 <dunky13@noreply.gitea.io>
Co-committed-by: Dunky13 <dunky13@noreply.gitea.io>
This pull request adds the `app` and `version` labels that are used by Istio.
> Pods with app and version labels: We recommend adding an explicit app label and version label to the specification of the pods deployed using a Kubernetes Deployment. The app and version labels add contextual information to the metrics and telemetry that Istio collects.
>
> * The app label: Each deployment should have a distinct app label with a meaningful value. The app label is used to add contextual information in distributed tracing.
>
> * The version label: This label indicates the version of the application corresponding to the particular deployment.
From https://istio.io/latest/docs/ops/deployment/requirements/#pod-requirements
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/121
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Co-authored-by: Starefossen <starefossen@noreply.gitea.io>
Co-committed-by: Starefossen <starefossen@noreply.gitea.io>
Nothing critical, but had a typo in the naming of the config entry to enable `pprof`.
Co-authored-by: josef <josef.nilsen@outlook.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/114
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: JosefWN <josefwn@noreply.gitea.io>
Co-committed-by: JosefWN <josefwn@noreply.gitea.io>
SSH service might want to limit the a range of source IPs. LoadBalancerSourceRanges
enables to limit them just passing a list of CIDR addresses to whitelist
Co-authored-by: javier <perezrubio.javier@gmail.com>
Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/105
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: JPRbrs <jprbrs@noreply.gitea.io>
Co-committed-by: JPRbrs <jprbrs@noreply.gitea.io>
1. sshPublicKeyAttribute is useful to sync ssh public keys from ldap.
2. It would be easier to set pvc annotations/labels for those who are using storage services from cloud providers.
Co-authored-by: 钱卫春 <qianwch@chinasofti.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/76
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Co-authored-by: sanigo <sanigo@noreply.gitea.io>
Co-committed-by: sanigo <sanigo@noreply.gitea.io>
This PR adds a few new chart features which adds to the flexibility of the chart.
- allow extra volumes to be mounted (such as secrets): 2f862c5a48
- pass environment variables also to the init-container: 7044049478
- allow a preparation script to be "injected" into the init-container: 6125a69345
As a concrete example of how this can be used, I use is to configure Gitea to use client certificate authentication against an external Postgres database. That could be accomplished by having a `gitea-postgres-ssl` secret:
```
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: gitea-postgres-ssl
data:
postgresql.crt: <base64...>
postgresql.key: <base64...>
root.crt: <base64...>
```
and then mounting this as a volume in Gitea using:
```
extraVolumes:
- name: postgres-ssl-vol
secret:
secretName: gitea-postgres-ssl
extraVolumeMounts:
- name: postgres-ssl-vol
readOnly: true
mountPath: "/pg-ssl"
```
To get the right permissions on the credentials, we'd use the `initPreScript`:
```
initPreScript: |
# copy postgres client and CA cert from mount and
# give proper permissions
mkdir -p /data/git/.postgresql
cp /pg-ssl/* /data/git/.postgresql/
chown -R git:git /data/git/.postgresql/
chmod 400 /data/git/.postgresql/postgresql.key
```
and to make sure that Gitea uses the certificate we need to pass the proper postgres environment variables (both to the init container and the "main" container):
```
statefulset:
env:
- name: "PGSSLCERT"
value: "/data/git/.postgresql/postgresql.crt"
- name: "PGSSLKEY"
value: "/data/git/.postgresql/postgresql.key"
- name: "PGSSLROOTCERT"
value: "/data/git/.postgresql/root.crt"
```
Co-authored-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/47
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: 6543 <6543@obermui.de>
Co-authored-by: petergardfjall <petergardfjall@noreply.gitea.io>
Co-committed-by: petergardfjall <petergardfjall@noreply.gitea.io>
Kebab case will fail because of the current ldap default values in values.yml as stated in #88
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/89
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: luhahn <luhahn@noreply.gitea.io>
Co-committed-by: luhahn <luhahn@noreply.gitea.io>
Use image tag instead of image version in values
Change to tenary function instead of if
Update description and add link to tag list
Fixup readme
Co-authored-by: Lauris BH <lauris@nix.lv>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/91
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Co-Authored-By: lafriks <lafriks@noreply.gitea.io>
Co-Committed-By: lafriks <lafriks@noreply.gitea.io>
Improve ldap settings with helper function
Allow clusterIP for http service to be set, default to None
Use imagePullSecrets in statefulset now
Update default values
Update README
Bump Chart version
Co-authored-by: luhahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/87
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-Authored-By: luhahn <luhahn@noreply.gitea.io>
Co-Committed-By: luhahn <luhahn@noreply.gitea.io>
Fix admin user creation for gitea 1.13.0
Add load balancer hint for ssh in README
Merge branch 'master' into fix-admin-user-creation
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/80
Reviewed-by: Andrew Thornton <art27@cantab.net>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-Authored-By: luhahn <luhahn@noreply.gitea.io>
Co-Committed-By: luhahn <luhahn@noreply.gitea.io>
Bump chart version to 2.0.7
Fix Ingress
- Ingress uses now .Capabilities.APIVersions.Has to compare the api version available
- Added pathType since it is required in v1 and optional in v1beta1
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/70
Reviewed-by: Andrew Thornton <art27@cantab.net>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-Authored-By: luhahn <luhahn@noreply.gitea.io>
Co-Committed-By: luhahn <luhahn@noreply.gitea.io>
Use apiVersion v1 for Ingress in 1.19+
Currently, a warning is shown in newer versions of kubernetes:
```
W1120 10:04:16.194312 8003 warnings.go:67] networking.k8s.io/v1beta1 Ingress is deprecated in v1.19+, unavailable in v1.22+; use networking.k8s.io/v1 Ingress
```
Co-authored-by: Joel Gallant <joel@joelgallant.me>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/63
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-by: Andrew Thornton <art27@cantab.net>
Co-Authored-By: joelgallant <joelgallant@noreply.gitea.io>
Co-Committed-By: joelgallant <joelgallant@noreply.gitea.io>
Get http annotations from the right place
Allow templated annotations for http-service
When deploying this to cloud Kubernetes, annotations are useful to add features to the
http-service
Co-authored-by: javier <perezrubio.javier@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/62
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-Authored-By: JPRbrs <jprbrs@noreply.gitea.io>
Co-Committed-By: JPRbrs <jprbrs@noreply.gitea.io>
fix-test-pod
service name and port was wrong and was preventing the helm chart deployment
Co-authored-by: javier <perezrubio.javier@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/56
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Co-Authored-By: JPRbrs <jprbrs@noreply.gitea.io>
Co-Committed-By: JPRbrs <jprbrs@noreply.gitea.io>
Merge branch 'master' into master
Bump chart version and add gitea/helm-chart as link for artifacthub
Remove default value for storageClass
Remove storageClass 'Standard' and let it be set automatically
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/45
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-by: Andrew Thornton <art27@cantab.net>
Co-Authored-By: luhahn <luhahn@noreply.gitea.io>
Co-Committed-By: luhahn <luhahn@noreply.gitea.io>
Upgrade mariadb Helm chart to 8.0.0
The names of the values changed in the new Helm chart, see [1]. Thus the
Helm chart ships breaking changes and therefore bump the major version
of this Chart.yaml (not sure if you use semver?)
Furthermore, there is a bug [2] where not setting the root password
results in the mariadb entering a CrashLoopBackOff when re-installing
it. Thus set it (as done in the mysql values already).
[1] 1206942b69
[2] https://github.com/bitnami/charts/issues/3884
Co-authored-by: Andre Schröder <andre.schroedr@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/48
Reviewed-by: Andrew Thornton <art27@cantab.net>
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Co-Authored-By: schra <schra@noreply.gitea.io>
Co-Committed-By: schra <schra@noreply.gitea.io>
use alpine package version of helm
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/35
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Reviewed-by: 6543 <6543@noreply.gitea.io>
Update dependencies
- Update Postgres version from 8.6.4 to 9.7.3
- Update Mysql version from 6.14.8 to 6.14.10
- Add MariaDB as built in dependency
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/33
Reviewed-by: Jonas Franz <jonasfranz@noreply.gitea.io>
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Fix NodePort settings for ssh service
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/32
Reviewed-by: lafriks <lafriks@noreply.gitea.io>
Reviewed-by: Andrew Thornton <art27@cantab.net>
Bump Chart version
Move all password related data to secrets
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/28
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Use recursive chmod for .ssh directory in init container
Co-authored-by: Lucas Hahn <lucas.hahn@novum-rgi.de>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/26
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
Merge branch 'master' into techknowlogick-patch-1
Merge branch 'master' into techknowlogick-patch-1
utilize service for port forwarding in instructions
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/22
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Adding same changes to cache
Deleted useDefaultHost value
no longer needed
Eliminated need for useDefaultHost value
Using whether gitea.config.database.HOST exists instead in the values file. If true, don't overwrite. If false, use "mysql/postgresql.dns"
Updated db host logic
Config map uses "postgresql/mysql.dns" when useDefaultHost is true, and the value from gitea.config.database.HOST when useDefaultHost is false.
Added useDefaultHost to built in database values.
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/23
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Reviewed-by: techknowlogick <techknowlogick@gitea.io>
2020-09-18 03:21:29 +00:00
15 changed files with 679 additions and 137 deletions
# additional volumes to add to the Gitea statefulset.
extraVolumes:
# - name: postgres-ssl-vol
# secret:
# secretName: gitea-postgres-ssl
# additional volumes to mount, both to the init container and to the main
# container. As an example, can be used to mount a client cert when connecting
# to an external Postgres server.
extraVolumeMounts:
# - name: postgres-ssl-vol
# readOnly: true
# mountPath: "/pg-ssl"
# bash shell script copied verbatim to the start of the init-container.
initPreScript:""
#
# initPreScript: |
# mkdir -p /data/git/.postgresql
# cp /pg-ssl/* /data/git/.postgresql/
# chown -R git:git /data/git/.postgresql/
# chmod 400 /data/git/.postgresql/postgresql.key
gitea:
admin:
@ -74,41 +111,111 @@ gitea:
password:r8sA8CPHD9!bt6d
email:"gitea@local.domain"
metrics:
enabled:false
serviceMonitor:
enabled:false
# prometheusSelector: default
ldap:
enabled:false
name:""
securityProtocol:""
host:""
port:""
userSearchBase:""
userFilter:""
adminFilter:""
emailAttribute:""
bindDn:""
bindPassword:""
usernameAttribute:""
#name:
#securityProtocol:
#host:
#port:
#userSearchBase:
#userFilter:
#adminFilter:
#emailAttribute:
#bindDn:
#bindPassword:
#usernameAttribute:
#sshPublicKeyAttribute:
oauth:
enabled:false
#name:
#provider:
#key:
#secret:
#autoDiscoverUrl:
#useCustomUrls:
#customAuthUrl:
#customTokenUrl:
#customProfileUrl:
#customEmailUrl:
config:{}
# APP_NAME: "Gitea: Git with a cup of tea"
# RUN_MODE: dev
#
# RUN_MODE: dev
#
# server:
# SSH_PORT: 22
#
# security:
# PASSWORD_COMPLEXITY: spec
podAnnotations:{}
database:
builtIn:
postgresql:
enabled:true
mysql:
enabled:false
mariadb:
enabled:false
cache:
builtIn:
enabled:true
livenessProbe:
enabled:true
initialDelaySeconds:200
timeoutSeconds:1
periodSeconds:10
successThreshold:1
failureThreshold:10
readinessProbe:
enabled:true
initialDelaySeconds:5
timeoutSeconds:1
periodSeconds:10
successThreshold:1
failureThreshold:3
startupProbe:
enabled:false
initialDelaySeconds:60
periodSeconds:10
successThreshold:1
failureThreshold:10
# customLivenessProbe:
# httpGet:
# path: /user/login
# port: http
# initialDelaySeconds: 60
# periodSeconds: 10
# successThreshold: 1
# failureThreshold: 10
# customReadinessProbe:
# httpGet:
# path: /user/login
# port: http
# initialDelaySeconds: 5
# periodSeconds: 10
# successThreshold: 1
# failureThreshold: 3
# customStartupProbe:
# httpGet:
# path: /user/login
# port: http
# initialDelaySeconds: 60
# periodSeconds: 10
# successThreshold: 1
# failureThreshold: 10
memcached:
service:
port:11211
@ -134,3 +241,15 @@ mysql:
port:3306
persistence:
size:10Gi
mariadb:
auth:
database:gitea
username:gitea
password:gitea
rootPassword:gitea
primary:
service:
port:3306
persistence:
size:10Gi
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
