Bump Gitea to 1.18.3 (#397 )

Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/397 Reviewed-by: John Olheiser <john+gitea@jolheiser.com> Reviewed-by: techknowlogick <techknowlogick@gitea.io>
bump to 1.18.2
2023-01-24 00:53:20 +08:00 · 2023-01-20 14:26:45 +08:00 · 2023-01-18 19:40:04 +08:00 · 2023-01-18 00:58:10 +08:00 · 2023-01-10 14:54:55 +08:00 · 2022-12-28 18:30:15 +08:00
22 changed files with 504 additions and 70 deletions
--- a/.drone.yml
+++ b/.drone.yml
@ -10,22 +10,31 @@ platform:
 steps:
 - name: helm lint
  pull: always
-  image: alpine:3.16
+  image: alpine:3.17
  commands:
  - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
  - helm lint

 - name: helm template
  pull: always
-  image: alpine:3.16
+  image: alpine:3.17
  commands:
  - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
  - helm dependency update
  - helm template --debug gitea-helm .

+- name: helm unittests
+  pull: always
+  image: alpine:3.17
+  commands:
+  - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make helm git bash
+  - helm plugin install https://github.com/heyhabito/helm-unittest
+  - helm dependency update
+  - make unittests
+
 - name: verify readme
  pull: always
-  image: alpine:3.16
+  image: alpine:3.17
  commands:
  - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing make npm git
  - make readme
@ -61,7 +70,7 @@ trigger:
 steps:
 - name: generate-chart
  pull: always
-  image: alpine:3.16
+  image: alpine:3.17
  commands:
    - apk add --no-cache -X http://dl-cdn.alpinelinux.org/alpine/edge/testing helm
    - apk add --no-cache curl
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,4 @@
 charts/
 node_modules/
 .DS_Store
+unittests/*/__snapshot__/
--- a/.helmignore
+++ b/.helmignore
@ -25,3 +25,9 @@ node_modules/
 package.json
 package-lock.json
 .gitea/
+Makefile
+.markdownlintignore
+.markdownlint.yaml
+.drone.yml
+CONTRIBUTING.md
+unittests/
--- a/.markdownlint.yaml
+++ b/.markdownlint.yaml
@ -45,7 +45,7 @@ MD012:
 # MD013/line-length - Line length
 MD013:
  # Number of characters
-  line_length: 80
+  line_length: 200
  # Number of characters for headings
  heading_line_length: 80
  # Number of characters for code blocks
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -50,3 +50,13 @@ be used:
   forwarded first from `minikube` to localhost first via `kubectl --namespace
   default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at
   [http://localhost:3000](http://localhost:3000).
+
+### Unit tests
+
+```bash
+# install the unittest plugin
+$ helm plugin install https://github.com/heyhabito/helm-unittest
+
+# run the unittests
+make unittests
+```
--- a/Chart.yaml
+++ b/Chart.yaml
@ -3,7 +3,7 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-appVersion: 1.17.2
+appVersion: 1.18.3
 icon: https://docs.gitea.io/images/gitea.png

 keywords:
--- a/4
+++ b/4
@ -6,3 +6,7 @@ prepare-environment:
 readme: prepare-environment
 	npm run readme:parameters
 	npm run readme:lint
+
+.PHONY: unittests
+unittests:
+	helm unittest --helm3 --strict -f 'unittests/**/*.yaml' ./
--- a/README.md
+++ b/README.md
@ -41,24 +41,6 @@ of this document for major and breaking changes.
 - Helm 3.0+
 - PV provisioner for persistent data support

-## Configure Commit Signing
-
-When using the rootless image the gpg key folder was is not persistent by
-default. If you consider using signed commits for internal Gitea activities
-(e.g. initial commit), you'd need to provide a signing key. Prior to
-[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be
-re-imported once the container got replaced by another.
-
-The mentioned PR introduced a new configuration object `signing` allowing you to
-configure prerequisites for commit signing. By default this section is disabled
-to maintain backwards compatibility.
-
-```yaml
-signing:
-  enabled: false
-  gpgHome: /data/git/.gnupg
-```
-
 ## Examples

 ### Gitea Configuration
@ -525,6 +507,49 @@ gitea:
        ...
 ```

+## Configure commit signing
+
+When using the rootless image the gpg key folder is not persistent by
+default. If you consider using signed commits for internal Gitea activities
+(e.g. initial commit), you'd need to provide a signing key. Prior to
+[PR186](https://gitea.com/gitea/helm-chart/pulls/186), imported keys had to be
+re-imported once the container got replaced by another.
+
+The mentioned PR introduced a new configuration object `signing` allowing you to
+configure prerequisites for commit signing. By default this section is disabled
+to maintain backwards compatibility.
+
+```yaml
+signing:
+  enabled: false
+  gpgHome: /data/git/.gnupg
+```
+
+Regardless of the used container image the `signing` object allows to specify a
+private gpg key. Either using the `signing.privateKey` to define the key inline,
+or refer to an existing secret containing the key data by using `signing.existingKey`.
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: custom-gitea-gpg-key
+type: Opaque
+stringData:
+  privateKey: |-
+    -----BEGIN PGP PRIVATE KEY BLOCK-----
+    ...
+    -----END PGP PRIVATE KEY BLOCK-----
+```
+
+```yaml
+signing:
+  existingSecret: custom-gitea-gpg-key
+```
+
+To use the gpg key, Gitea needs to be configured accordingly. A detailed description
+can be found in the [official Gitea documentation](https://docs.gitea.io/en-us/signing/#general-configuration).
+
 ### Metrics and profiling

 A Prometheus `/metrics` endpoint on the `HTTP_PORT` and `pprof` profiling
@ -669,10 +694,12 @@ gitea:

 ### Signing

-| Name              | Description                  | Value              |
-| ----------------- | ---------------------------- | ------------------ |
-| `signing.enabled` | Enable commit/action signing | `false`            |
-| `signing.gpgHome` | GPG home directory           | `/data/git/.gnupg` |
+| Name                     | Description                                                       | Value              |
+| ------------------------ | ----------------------------------------------------------------- | ------------------ |
+| `signing.enabled`        | Enable commit/action signing                                      | `false`            |
+| `signing.gpgHome`        | GPG home directory                                                | `/data/git/.gnupg` |
+| `signing.privateKey`     | Inline private gpg key for signed Gitea actions                   | `""`               |
+| `signing.existingSecret` | Use an existing secret to store the value of `signing.privateKey` | `""`               |

 ### Gitea

@ -786,6 +813,17 @@ See [CONTRIBUTORS GUIDE](CONTRIBUTING.md) for details.
 This section lists major and breaking changes of each Helm Chart version.
 Please read them carefully to upgrade successfully.

+### To 7.0.0
+
+#### Gitea 1.18.1
+
+This Chart version updates Gitea to 1.18.1. Don't miss any application related [breaking changes of 1.18.0](https://blog.gitea.io/2022/12/gitea-1.18.0-is-released/#breaking-changes).
+
+#### Private GPG key configuration for Gitea signing actions
+
+Having `signing.enabled=true` now requires to use either `signing.privateKey` or `signing.existingSecret` so that the Chart can automatically prepare the GPG key for Gitea internal signing actions.
+See [Configure commit signing](#configure-commit-signing) for details.
+
 ### To 6.0.0

 #### Different volume mounts for init-containers and runtime container
--- a/package-lock.json
+++ b/package-lock.json
@ -7,14 +7,30 @@
      "name": "gitea-helm-chart",
      "license": "MIT",
      "devDependencies": {
-        "markdownlint-cli": "^0.31.1",
-        "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main"
+        "@bitnami/readme-generator-for-helm": "^2.4.2",
+        "markdownlint-cli": "^0.31.1"
      },
      "engines": {
        "node": ">=16.0.0",
        "npm": ">=8.0.0"
      }
    },
+    "node_modules/@bitnami/readme-generator-for-helm": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/@bitnami/readme-generator-for-helm/-/readme-generator-for-helm-2.4.2.tgz",
+      "integrity": "sha512-2kIXOjRiKJ3PBoBD6EaImp4SNyGM/w67ZPPwbuJi5NeXesupQjFyhIhcKliIledlpuiSrMeH9l80yl6hvmYHUA==",
+      "dev": true,
+      "dependencies": {
+        "commander": "^7.1.0",
+        "dot-object": "^2.1.4",
+        "lodash": "^4.17.21",
+        "markdown-table": "^2.0.0",
+        "yaml": "^2.0.0-3"
+      },
+      "bin": {
+        "readme-generator": "bin/index.js"
+      }
+    },
    "node_modules/argparse": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@ -331,23 +347,6 @@
        "node": ">=0.10.0"
      }
    },
-    "node_modules/readme-generator-for-helm": {
-      "version": "2.4.0",
-      "resolved": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main",
-      "integrity": "sha512-W5ziOuId0M00YQRDlA5le3oEguWe8hoINhivOAgEF+AZkk2bDoNxuFUaJIxqAUEvZRA8qlTfUlu+w90EOFbTLw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "commander": "^7.1.0",
-        "dot-object": "^2.1.4",
-        "lodash": "^4.17.21",
-        "markdown-table": "^2.0.0",
-        "yaml": "^2.0.0-3"
-      },
-      "bin": {
-        "readme-generator": "bin/index.js"
-      }
-    },
    "node_modules/repeat-string": {
      "version": "1.6.1",
      "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
@ -397,9 +396,9 @@
      "dev": true
    },
    "node_modules/yaml": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.1.tgz",
-      "integrity": "sha512-o96x3OPo8GjWeSLF+wOAbrPfhFOGY0W00GNaxCDv+9hkcDJEnev1yh8S7pgHF0ik6zc8sQLuL8hjHjJULZp8bw==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.3.tgz",
+      "integrity": "sha512-AacA8nRULjKMX2DvWvOAdBZMOfQlypSFkjcOcu9FalllIDJ1kvlREzcdIZmidQUqqeMv7jorHjq2HlLv/+c2lg==",
      "dev": true,
      "engines": {
        "node": ">= 14"
@ -407,6 +406,19 @@
    }
  },
  "dependencies": {
+    "@bitnami/readme-generator-for-helm": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/@bitnami/readme-generator-for-helm/-/readme-generator-for-helm-2.4.2.tgz",
+      "integrity": "sha512-2kIXOjRiKJ3PBoBD6EaImp4SNyGM/w67ZPPwbuJi5NeXesupQjFyhIhcKliIledlpuiSrMeH9l80yl6hvmYHUA==",
+      "dev": true,
+      "requires": {
+        "commander": "^7.1.0",
+        "dot-object": "^2.1.4",
+        "lodash": "^4.17.21",
+        "markdown-table": "^2.0.0",
+        "yaml": "^2.0.0-3"
+      }
+    },
    "argparse": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@ -663,18 +675,6 @@
      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
      "dev": true
    },
-    "readme-generator-for-helm": {
-      "version": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main",
-      "integrity": "sha512-W5ziOuId0M00YQRDlA5le3oEguWe8hoINhivOAgEF+AZkk2bDoNxuFUaJIxqAUEvZRA8qlTfUlu+w90EOFbTLw==",
-      "dev": true,
-      "requires": {
-        "commander": "^7.1.0",
-        "dot-object": "^2.1.4",
-        "lodash": "^4.17.21",
-        "markdown-table": "^2.0.0",
-        "yaml": "^2.0.0-3"
-      }
-    },
    "repeat-string": {
      "version": "1.6.1",
      "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
@ -712,9 +712,9 @@
      "dev": true
    },
    "yaml": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.1.tgz",
-      "integrity": "sha512-o96x3OPo8GjWeSLF+wOAbrPfhFOGY0W00GNaxCDv+9hkcDJEnev1yh8S7pgHF0ik6zc8sQLuL8hjHjJULZp8bw==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.1.3.tgz",
+      "integrity": "sha512-AacA8nRULjKMX2DvWvOAdBZMOfQlypSFkjcOcu9FalllIDJ1kvlREzcdIZmidQUqqeMv7jorHjq2HlLv/+c2lg==",
      "dev": true
    }
  }
--- a/package.json
+++ b/package.json
@ -13,7 +13,7 @@
    "readme:parameters": "readme-generator -v values.yaml -r README.md"
  },
  "devDependencies": {
-    "markdownlint-cli": "^0.31.1",
-    "readme-generator-for-helm": "https://github.com/bitnami-labs/readme-generator-for-helm/tarball/main"
+    "@bitnami/readme-generator-for-helm": "^2.4.2",
+    "markdownlint-cli": "^0.31.1"
  }
 }
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@ -331,3 +331,7 @@ https
    {{- toYaml .Values.extraVolumeMounts -}}
  {{- end -}}
 {{- end -}}
+
+{{- define "gitea.gpg-key-secret-name" -}}
+{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
+{{- end -}}
--- a/templates/gitea/gpg-secret.yaml
+++ b/templates/gitea/gpg-secret.yaml
@ -0,0 +1,16 @@
+{{- if .Values.signing.enabled -}}
+{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
+  {{- fail "Either specify `signing.privateKey` or `signing.existingKey`" -}}
+{{- end }}
+{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.gpg-key-secret-name" . }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+data:
+  privateKey: {{ .Values.signing.privateKey | b64enc }}
+{{- end }}
+{{- end }}
--- a/templates/gitea/init.yaml
+++ b/templates/gitea/init.yaml
@ -6,6 +6,11 @@ metadata:
    {{- include "gitea.labels" . | nindent 4 }}
 type: Opaque
 stringData:
+  configure_gpg_environment.sh: |-
+    #!/usr/bin/env bash
+    set -eu
+
+    gpg --batch --import /raw/private.asc
  init_directory_structure.sh: |-
    #!/usr/bin/env bash

@ -26,7 +31,7 @@ stringData:
    {{- end }}
    mkdir -p /data/git/.ssh
    chmod -R 700 /data/git/.ssh
-    [ ! -d /data/gitea ] && mkdir -p /data/gitea/conf
+    [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf

    # prepare temp directory structure
    mkdir -p "${GITEA_TEMP}"
@ -35,6 +40,14 @@ stringData:
    {{- end }}
    chmod ug+rwx "${GITEA_TEMP}"

+    {{ if .Values.signing.enabled -}}
+    if [ ! -d "${GNUPGHOME}" ]; then
+      mkdir -p "${GNUPGHOME}"
+      chmod 700 "${GNUPGHOME}"
+      chown 1000:1000 "${GNUPGHOME}"
+    fi
+    {{- end }}
+
  configure_gitea.sh: |-
    #!/usr/bin/env bash

--- a/templates/gitea/statefulset.yaml
+++ b/templates/gitea/statefulset.yaml
@ -59,6 +59,10 @@ spec:
            {{- if .Values.statefulset.env }}
            {{- toYaml .Values.statefulset.env | nindent 12 }}
            {{- end }}
+            {{- if .Values.signing.enabled }}
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+            {{- end }}
          volumeMounts:
            - name: init
              mountPath: /usr/sbin
@ -110,6 +114,36 @@ spec:
            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
          securityContext:
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+        {{- if .Values.signing.enabled }}
+        - name: configure-gpg
+          image: "{{ include "gitea.image" . }}"
+          command: ["/usr/sbin/configure_gpg_environment.sh"]
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
+          env:
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+          volumeMounts:
+            - name: init
+              mountPath: /usr/sbin
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            - name: gpg-private-key
+              mountPath: /raw
+              readOnly: true
+            {{- if .Values.extraVolumeMounts }}
+            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+        {{- end }}
        - name: configure-gitea
          image: "{{ include "gitea.image" . }}"
          command: ["/usr/sbin/configure_gitea.sh"]
@ -305,6 +339,15 @@ spec:
        {{- end }}
        - name: temp
          emptyDir: {}
+        {{- if .Values.signing.enabled }}
+        - name: gpg-private-key
+          secret:
+            secretName: {{ include "gitea.gpg-key-secret-name" . }}
+            items:
+              - key: privateKey
+                path: private.asc
+            defaultMode: 0100
+        {{- end }}
  {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
        - name: data
          persistentVolumeClaim:
--- a/unittests/gpg-secret/signing-disabled.yaml
+++ b/unittests/gpg-secret/signing-disabled.yaml
@ -0,0 +1,13 @@
+suite: GPG secret template (signing disabled)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/gpg-secret.yaml
+tests:
+  - it: renders nothing
+    set:
+      signing.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
--- a/unittests/gpg-secret/signing-enabled.yaml
+++ b/unittests/gpg-secret/signing-enabled.yaml
@ -0,0 +1,40 @@
+suite: GPG secret template (signing enabled)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/gpg-secret.yaml
+tests:
+  - it: fails rendering when nothing is configured
+    set:
+      signing:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: Either specify `signing.privateKey` or `signing.existingKey`
+  - it: skips rendering using external secret reference
+    set:
+      signing:
+        enabled: true
+        existingSecret: "external-secret-reference"
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: renders secret specification using inline gpg key
+    set:
+      signing:
+        enabled: true
+        privateKey: "gpg-key-placeholder"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - documentIndex: 0
+        containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-gpg-key
+      - isNotEmpty:
+          path: metadata.labels
+      - equal:
+          path: data.privateKey
+          value: "Z3BnLWtleS1wbGFjZWhvbGRlcg=="
--- a/unittests/init/basic.yaml
+++ b/unittests/init/basic.yaml
@ -0,0 +1,15 @@
+suite: Init template (basic)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/init.yaml
+tests:
+  - it: renders a secret
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: Secret  
+          apiVersion: v1
+          name: gitea-unittests-init
--- a/unittests/init/init_directory_structure.sh.yaml
+++ b/unittests/init/init_directory_structure.sh.yaml
@ -0,0 +1,64 @@
+suite: Init template
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/init.yaml
+tests:
+  - it: runs gpg in batch mode
+    set:
+      signing.enabled: true
+    asserts:
+      - equal:
+          path: stringData.[configure_gpg_environment.sh]
+          value: |-
+            #!/usr/bin/env bash
+            set -eu
+
+            gpg --batch --import /raw/private.asc
+  - it: skips gpg script block for disabled signing
+    asserts:
+      - equal:
+          path: stringData.[init_directory_structure.sh]
+          value: |-
+            #!/usr/bin/env bash
+
+            set -euo pipefail
+
+            set -x
+            chown 1000:1000 /data
+            mkdir -p /data/git/.ssh
+            chmod -R 700 /data/git/.ssh
+            [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
+
+            # prepare temp directory structure
+            mkdir -p "${GITEA_TEMP}"
+            chown 1000:1000 "${GITEA_TEMP}"
+            chmod ug+rwx "${GITEA_TEMP}"
+  - it: adds gpg script block for enabled signing
+    set:
+      signing.enabled: true
+    asserts:
+      - equal:
+          path: stringData.[init_directory_structure.sh]
+          value: |-
+            #!/usr/bin/env bash
+
+            set -euo pipefail
+
+            set -x
+            chown 1000:1000 /data
+            mkdir -p /data/git/.ssh
+            chmod -R 700 /data/git/.ssh
+            [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
+
+            # prepare temp directory structure
+            mkdir -p "${GITEA_TEMP}"
+            chown 1000:1000 "${GITEA_TEMP}"
+            chmod ug+rwx "${GITEA_TEMP}"
+
+            if [ ! -d "${GNUPGHOME}" ]; then
+              mkdir -p "${GNUPGHOME}"
+              chmod 700 "${GNUPGHOME}"
+              chown 1000:1000 "${GNUPGHOME}"
+            fi
--- a/unittests/statefulset/basic.yaml
+++ b/unittests/statefulset/basic.yaml
@ -0,0 +1,17 @@
+suite: Statefulset template (basic)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/statefulset.yaml
+  - templates/gitea/config.yaml
+tests:
+  - it: renders a statefulset
+    template: templates/gitea/statefulset.yaml
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: StatefulSet  
+          apiVersion: apps/v1
+          name: gitea-unittests
--- a/unittests/statefulset/signing-disabled.yaml
+++ b/unittests/statefulset/signing-disabled.yaml
@ -0,0 +1,40 @@
+suite: Statefulset template (signing disabled)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/statefulset.yaml
+  - templates/gitea/config.yaml
+tests:
+  - it: skips gpg init container
+    template: templates/gitea/statefulset.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers
+          any: true
+          content:
+            name: configure-gpg
+  - it: skips gpg env in `init-directories` init container
+    template: templates/gitea/statefulset.yaml
+    set:
+      signing.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].env
+          content:
+            name: GNUPGHOME
+            value: /data/git/.gnupg
+  - it: skips gpg env in runtime container
+    template: templates/gitea/statefulset.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: GNUPGHOME
+  - it: skips gpg volume spec
+    template: templates/gitea/statefulset.yaml
+    asserts:
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: gpg-private-key
--- a/unittests/statefulset/signing-enabled.yaml
+++ b/unittests/statefulset/signing-enabled.yaml
@ -0,0 +1,93 @@
+suite: Statefulset template (signing enabled)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/statefulset.yaml
+  - templates/gitea/config.yaml
+tests:
+  - it: adds gpg init container
+    template: templates/gitea/statefulset.yaml
+    set:
+      signing:
+        enabled: true
+        existingSecret: "custom-gpg-secret"
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[2].name
+          value: configure-gpg
+      - equal:
+          path: spec.template.spec.initContainers[2].command
+          value: ["/usr/sbin/configure_gpg_environment.sh"]
+      - equal:
+          path: spec.template.spec.initContainers[2].securityContext
+          value:
+            runAsUser: 1000
+      - equal:
+          path: spec.template.spec.initContainers[2].env
+          value:
+            - name: GNUPGHOME
+              value: /data/git/.gnupg
+      - equal:
+          path: spec.template.spec.initContainers[2].volumeMounts
+          value:
+            - name: init
+              mountPath: /usr/sbin
+            - name: data
+              mountPath: /data
+            - name: gpg-private-key
+              mountPath: /raw
+              readOnly: true
+  - it: adds gpg env in `init-directories` init container
+    template: templates/gitea/statefulset.yaml
+    set:
+      signing.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].env
+          content:
+            name: GNUPGHOME
+            value: /data/git/.gnupg
+  - it: adds gpg env in runtime container
+    template: templates/gitea/statefulset.yaml
+    set:
+      signing.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: GNUPGHOME
+            value: /data/git/.gnupg
+  - it: adds gpg volume spec
+    template: templates/gitea/statefulset.yaml
+    set:
+      signing:
+        enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: gpg-private-key
+            secret:
+              secretName: gitea-unittests-gpg-key
+              items:
+                - key: privateKey
+                  path: private.asc
+              defaultMode: 0100
+  - it: supports gpg volume spec with external reference
+    template: templates/gitea/statefulset.yaml
+    set:
+      signing:
+        enabled: true
+        existingSecret: custom-gpg-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: gpg-private-key
+            secret:
+              secretName: custom-gpg-secret
+              items:
+                - key: privateKey
+                  path: private.asc
+              defaultMode: 0100
--- a/values.yaml
+++ b/values.yaml
@ -63,7 +63,7 @@ containerSecurityContext: {}
 #   runAsNonRoot: true
 #   runAsUser: 1000

-## @depracated The securityContext variable has been split two:
+## @deprecated The securityContext variable has been split two:
 ## - containerSecurityContext
 ## - podSecurityContext.
 ## @param securityContext Run init and Gitea containers as a specific securityContext
@ -228,7 +228,7 @@ extraContainerVolumeMounts: []
 ## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration.
 extraInitVolumeMounts: []

-## @depracated The extraVolumeMounts variable has been split two:
+## @deprecated The extraVolumeMounts variable has been split two:
 ## - extraContainerVolumeMounts
 ## - extraInitVolumeMounts
 ## As an example, can be used to mount a client cert when connecting to an external Postgres server.
@ -253,9 +253,17 @@ initPreScript: ""
 #
 ## @param signing.enabled Enable commit/action signing
 ## @param signing.gpgHome GPG home directory
+## @param signing.privateKey Inline private gpg key for signed Gitea actions
+## @param signing.existingSecret Use an existing secret to store the value of `signing.privateKey`
 signing:
  enabled: false
  gpgHome: /data/git/.gnupg
+  privateKey: ""
+  # privateKey: |-
+  #   -----BEGIN PGP PRIVATE KEY BLOCK-----
+  #   ...
+  #   -----END PGP PRIVATE KEY BLOCK-----
+  existingSecret: ""

 ## @section Gitea
 #
Author	SHA1	Message	Date
justusbunsi	da4120809f	Bump Gitea to 1.18.3 (#397 ) Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/397 Reviewed-by: John Olheiser <john+gitea@jolheiser.com> Reviewed-by: techknowlogick <techknowlogick@gitea.io>	2023-01-24 00:53:20 +08:00
techknowlogick	83c184826b	bump to 1.18.2	2023-01-20 14:26:45 +08:00
justusbunsi	ccec32c144	Bump Gitea image to 1.18.1 (#395 ) As title: Bump Gitea image to 1.18.1. Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/395 Reviewed-by: John Olheiser <john+gitea@jolheiser.com> Reviewed-by: pat-s <pat-s@noreply.gitea.io> Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>	2023-01-18 19:40:04 +08:00
justusbunsi	19e9b07e6e	Re-add GPG configuration feature (#374 ) This reverts d5ce1a47eaad935ea709b7a03bfdf6c69bac8f32 and therefore adds the GPG feature back into main. As it is a breaking change, this PR now also contains the required upgrade notes. Closes #107 again. Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/374 Reviewed-by: pat-s <pat-s@noreply.gitea.io> Reviewed-by: John Olheiser <john+gitea@jolheiser.com>	2023-01-18 00:58:10 +08:00
robv89r	8b6a00603a	Update 'values.yaml' (#394 ) ### Description of the change Corrects the spelling of the word deprecated. ### Benefits Documentation free of misspelled words is more likely to be viewed as "professional". ### Possible drawbacks None that I can think of ### Applicable issues - fixes #393 ### Additional information There may be other misspelled words or incorrectly phrased passages that aren't addressed in this PR. For reference, see the online dictionary for the correct spelling of deprecated. https://www.merriam-webster.com/dictionary/deprecated ### Checklist - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [X] Breaking changes are documented in the `README.md` Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/394 Reviewed-by: pat-s <pat-s@noreply.gitea.io> Reviewed-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-authored-by: robv89r <robv8r@noreply.gitea.io> Co-committed-by: robv89r <robv8r@noreply.gitea.io>	2023-01-10 14:54:55 +08:00
JSchlarb	6574b1b232	Ignore unrelated helm files from bundling (#385 ) <!-- Before you open the request please review the following guidelines and tips to help it be more easily integrated: - Describe the scope of your change - i.e. what the change does. - Describe any known limitations with your change. - Please run any tests or examples that can exercise your modified code. Thank you for contributing! We will try to review, test and integrate the change as soon as we can. --> ### Description of the change Exluding non helm chart related files from release artifact ### Benefits Smaller release artifacts ### Possible drawbacks Exluded files not visible any within the artifact ### Applicable issues None ### Additional information None ### ⚠ BREAKING None ### Checklist <!-- [Place an '[X]' (no spaces) in all applicable fields. Please remove unrelated fields.] --> - [x] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [x] Breaking changes are documented in the `README.md` Co-authored-by: Julian Schlarb <js@project-deadline.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/385 Reviewed-by: justusbunsi <justusbunsi@noreply.gitea.io> Reviewed-by: pat-s <pat-s@noreply.gitea.io> Co-authored-by: JSchlarb <jschlarb@noreply.gitea.io> Co-committed-by: JSchlarb <jschlarb@noreply.gitea.io>	2022-12-28 18:30:15 +08:00
pat-s	4f7bc17d34	Bump alpine version in CI (#384 ) To fix package installation issues. Apparently installing `helm` in 3.16 fails constantly. Co-authored-by: pat-s <patrick.schratz@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/384 Reviewed-by: justusbunsi <justusbunsi@noreply.gitea.io> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: pat-s <pat-s@noreply.gitea.io> Co-committed-by: pat-s <pat-s@noreply.gitea.io>	2022-12-27 17:18:36 +08:00
techknowlogick	279bacb941	v1.17.4	2022-12-22 08:18:31 +08:00
justusbunsi	9ed671d685	Switch to official npm release of readme generator (#375 ) This is a follow up for #369. They published the package on NPM. https://github.com/bitnami-labs/readme-generator-for-helm/issues/36 Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/375 Reviewed-by: pat-s <pat-s@noreply.gitea.io> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>	2022-12-05 20:56:08 +08:00
justusbunsi	d5ce1a47ea	Temporary revert GPG feature for semver based retagging (#373 ) Feature #343 happens to be a breaking change when enabling `.Values.signing` but not specifying any of the new private key properties. Tag `v6.0.2` is therefore not following semantic versioning. This temporarily reverts commit b8f0310c43bd71dd48ac92b70d8ebdb94d43c29b and a fix-up commit 57a1cd27d9a6cc014f425fabeadb0db34f242b0e to retag 6.0.2 as 6.0.3. Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/373 Reviewed-by: techknowlogick <techknowlogick@gitea.io> Reviewed-by: luhahn <luhahn@noreply.gitea.io>	2022-10-21 00:35:19 +08:00
dajoen74	57a1cd27d9	Gpg init fails to import key (#371 ) ### Description of the change The init container for gpg key import doesn´t work. There is a not a tty error. ### Benefits This will run gpg in batch mode. Eliminating the tty error. ### Possible drawbacks None that I can think off. ### Applicable issues - fixes #370 ### Checklist - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [X] Breaking changes are documented in the `README.md` Co-authored-by: Jeroen Verhoeven <jeroen@joentje.org> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/371 Reviewed-by: techknowlogick <techknowlogick@gitea.io> Reviewed-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-authored-by: dajoen74 <dajoen74@noreply.gitea.io> Co-committed-by: dajoen74 <dajoen74@noreply.gitea.io>	2022-10-18 13:47:21 +08:00
techknowlogick	6c59fe361d	v1.17.3	2022-10-17 04:19:45 +08:00
justusbunsi	d1f5dca573	Lock readme-generator-for-helm dependency (#369 ) With every push on main/master branch of that repository, the referenced tarball is replaced, causing npm integrity checks to fail. Locking the used reference to a specific commit hash is more reliable. There is an open issue regarding publishing on NPM. As long as this is not resolved, we would need to use this workaround to get updates. (https://github.com/bitnami-labs/readme-generator-for-helm/issues/36) Signed-off-by: justusbunsi <sk.bunsenbrenner@gmail.com> Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/369 Reviewed-by: pat-s <pat-s@noreply.gitea.io> Reviewed-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>	2022-10-14 00:16:41 +08:00
justusbunsi	b8f0310c43	Add gpg configuration settings (#343 ) ### Description of the change This PR adds support for gpg key setup. It allows to pass the gpg private key content inline inside `values.yaml` or refer to an existing secret containing the key content data. ### Benefits Administrators don't need to manually setup the gpg environment from inside a running container. It also eliminates the breaking change of Gitea 1.17 regarding `[git].HOME` as the `GNUPGHOME` environment variable is used consistently to relocate the `.gnupg` directory to its former location. ### Applicable issues - fixes #107 ### Additional information This PR add the first unit tests to this Helm Chart, ensuring templating integrity for signing related configuration. ### Checklist - [x] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) Co-authored-by: justusbunsi <sk.bunsenbrenner@gmail.com> Co-authored-by: pat-s <pat-s@noreply.gitea.io> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/343 Reviewed-by: luhahn <luhahn@noreply.gitea.io> Reviewed-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>	2022-09-28 16:18:59 +08:00
cboin1996	0d1f748898	check existence of `/data/gitea/conf/` instead of `/data/gitea/` (#310 ) ### Description of the change Checking the existence of the config directory should be done with the directory path itself. Not its parent directory. This simple fix addresses that by using the config directory for its existence check. ### Benefits Prior to #337 there was no other way to install this helm chart using the `extraVolumeMounts` setting with these values: ```yaml replicaCount: %d extraVolumes: - name: config-volume configMap: name: %s extraVolumeMounts: - name: config-volume mountPath: /data/gitea/templates/custom ``` Without this fix, the Gitea pod would never initialize, and would crashloop with the same error in #296. ### Additional information Mounting a configMap to `/data/gitea/templates/custom` causes the `/data/gitea` folder to exist even though the `/data/gitea/conf` had not been initialized yet. The initialization script saw that the `/data/gitea` dir existed and exited early without initializing `/data/gitea/conf`. Co-authored-by: cboin1996 <christianboin@hotmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/310 Reviewed-by: justusbunsi <justusbunsi@noreply.gitea.io> Reviewed-by: pat-s <pat-s@noreply.gitea.io> Co-authored-by: cboin1996 <cboin1996@noreply.gitea.io> Co-committed-by: cboin1996 <cboin1996@noreply.gitea.io>	2022-09-26 04:08:56 +08:00
pat-s	6e5ae5c912	Increase line length linter to 200 (#355 ) As discussed in #348 fix #348 Co-authored-by: pat-s <patrick.schratz@gmail.com> Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/355 Reviewed-by: justusbunsi <justusbunsi@noreply.gitea.io> Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: pat-s <pat-s@noreply.gitea.io> Co-committed-by: pat-s <pat-s@noreply.gitea.io>	2022-09-25 23:21:52 +08:00