add helm charts
This commit is contained in:
Ybehrooz
36
backing-services/gitea/templates/NOTES.txt
Normal file
36
backing-services/gitea/templates/NOTES.txt
Normal file
@@ -0,0 +1,36 @@
|
||||
1. Get the application URL by running these commands:
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
{{- range .paths }}
|
||||
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if contains "NodePort" .Values.service.http.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "gitea.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.http.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "gitea.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo http://$SERVICE_IP:{{ .Values.service.port }}
|
||||
{{- else if contains "ClusterIP" .Values.service.http.type }}
|
||||
echo "Visit http://127.0.0.1:{{ .Values.service.http.port }} to use your application"
|
||||
kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ .Release.Name }}-http {{ .Values.service.http.port }}:{{ .Values.service.http.port }}
|
||||
{{- end }}
|
||||
{{- $warnings := list -}}
|
||||
{{- if eq (get .Values.gitea.config.cache "ADAPTER") "memory" -}}
|
||||
{{- $warnings = append $warnings "Gitea uses 'memory' for caching which is not recommended for production use. See https://docs.gitea.com/next/administration/config-cheat-sheet#cache-cache for available options." -}}
|
||||
{{- end }}
|
||||
{{- if eq (get .Values.gitea.config.queue "TYPE") "level" -}}
|
||||
{{- $warnings = append $warnings "Gitea uses 'leveldb' for queue actions which is not recommended for production use. See https://docs.gitea.com/next/administration/config-cheat-sheet#queue-queue-and-queue for available options." -}}
|
||||
{{- end }}
|
||||
{{- if eq (get .Values.gitea.config.session "PROVIDER") "memory" -}}
|
||||
{{- $warnings = append $warnings "Gitea uses 'memory' for sessions which is not recommended for production use. See https://docs.gitea.com/next/administration/config-cheat-sheet#session-session for available options." -}}
|
||||
{{- end }}
|
||||
{{- if gt (len $warnings) 0 }}
|
||||
2. Review these warnings:
|
||||
{{- range $warnings }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
473
backing-services/gitea/templates/_helpers.tpl
Normal file
473
backing-services/gitea/templates/_helpers.tpl
Normal file
@@ -0,0 +1,473 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
|
||||
{{- define "gitea.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "gitea.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default worker name.
|
||||
*/}}
|
||||
{{- define "gitea.workername" -}}
|
||||
{{- printf "%s-%s" .global.Release.Name .worker | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "gitea.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create image name and tag used by the deployment.
|
||||
*/}}
|
||||
{{- define "gitea.image" -}}
|
||||
{{- $fullOverride := .Values.image.fullOverride | default "" -}}
|
||||
{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
|
||||
{{- $repository := .Values.image.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
|
||||
{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
|
||||
{{- $digest := "" -}}
|
||||
{{- if .Values.image.digest }}
|
||||
{{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
|
||||
{{- end -}}
|
||||
{{- if $fullOverride }}
|
||||
{{- printf "%s" $fullOverride -}}
|
||||
{{- else if $registry }}
|
||||
{{- printf "%s/%s%s%s%s%s" $registry $repository $separator $tag $rootless $digest -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s%s%s%s%s" $repository $separator $tag $rootless $digest -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Docker Image Registry Secret Names evaluating values as templates
|
||||
*/}}
|
||||
{{- define "gitea.images.pullSecrets" -}}
|
||||
{{- $pullSecrets := .Values.imagePullSecrets -}}
|
||||
{{- range .Values.global.imagePullSecrets -}}
|
||||
{{- $pullSecrets = append $pullSecrets (dict "name" .) -}}
|
||||
{{- end -}}
|
||||
{{- if (not (empty $pullSecrets)) }}
|
||||
imagePullSecrets:
|
||||
{{ toYaml $pullSecrets }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Storage Class
|
||||
*/}}
|
||||
{{- define "gitea.persistence.storageClass" -}}
|
||||
{{- $storageClass := (tpl ( default "" .Values.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
|
||||
{{- if $storageClass }}
|
||||
storageClassName: {{ $storageClass | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "gitea.labels" -}}
|
||||
helm.sh/chart: {{ include "gitea.chart" . }}
|
||||
app: {{ include "gitea.name" . }}
|
||||
{{ include "gitea.selectorLabels" . }}
|
||||
app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
|
||||
version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.labels.actRunner" -}}
|
||||
helm.sh/chart: {{ include "gitea.chart" . }}
|
||||
app: {{ include "gitea.name" . }}-act-runner
|
||||
{{ include "gitea.selectorLabels.actRunner" . }}
|
||||
app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
|
||||
version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "gitea.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "gitea.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.selectorLabels.actRunner" -}}
|
||||
app.kubernetes.io/name: {{ include "gitea.name" . }}-act-runner
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "postgresql-ha.dns" -}}
|
||||
{{- if (index .Values "postgresql-ha").enabled -}}
|
||||
{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "postgresql.dns" -}}
|
||||
{{- if (index .Values "postgresql").enabled -}}
|
||||
{{- printf "%s-postgresql.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain .Values.postgresql.global.postgresql.service.ports.postgresql -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "valkey.dns" -}}
|
||||
{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
|
||||
{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
|
||||
{{- else if (index .Values "valkey-cluster").enabled -}}
|
||||
{{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
|
||||
{{- else if (index .Values "valkey").enabled -}}
|
||||
{{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "valkey.port" -}}
|
||||
{{- if (index .Values "valkey-cluster").enabled -}}
|
||||
{{ (index .Values "valkey-cluster").service.ports.valkey }}
|
||||
{{- else if (index .Values "valkey").enabled -}}
|
||||
{{ (index .Values "valkey").master.service.ports.valkey }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "valkey.servicename" -}}
|
||||
{{- if (index .Values "valkey-cluster").enabled -}}
|
||||
{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- else if (index .Values "valkey").enabled -}}
|
||||
{{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.default_domain" -}}
|
||||
{{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.ldap_settings" -}}
|
||||
{{- $idx := index . 0 }}
|
||||
{{- $values := index . 1 }}
|
||||
|
||||
{{- if not (hasKey $values "bindDn") -}}
|
||||
{{- $_ := set $values "bindDn" "" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not (hasKey $values "bindPassword") -}}
|
||||
{{- $_ := set $values "bindPassword" "" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $flags := list "notActive" "skipTlsVerify" "allowDeactivateAll" "synchronizeUsers" "attributesInBind" -}}
|
||||
{{- range $key, $val := $values -}}
|
||||
{{- if and (ne $key "enabled") (ne $key "existingSecret") -}}
|
||||
{{- if eq $key "bindDn" -}}
|
||||
{{- printf "--%s \"${GITEA_LDAP_BIND_DN_%d}\" " ($key | kebabcase) ($idx) -}}
|
||||
{{- else if eq $key "bindPassword" -}}
|
||||
{{- printf "--%s \"${GITEA_LDAP_PASSWORD_%d}\" " ($key | kebabcase) ($idx) -}}
|
||||
{{- else if eq $key "port" -}}
|
||||
{{- printf "--%s %d " $key ($val | int) -}}
|
||||
{{- else if has $key $flags -}}
|
||||
{{- printf "--%s " ($key | kebabcase) -}}
|
||||
{{- else -}}
|
||||
{{- printf "--%s %s " ($key | kebabcase) ($val | squote) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.oauth_settings" -}}
|
||||
{{- $idx := index . 0 }}
|
||||
{{- $values := index . 1 }}
|
||||
|
||||
{{- if not (hasKey $values "key") -}}
|
||||
{{- $_ := set $values "key" (printf "${GITEA_OAUTH_KEY_%d}" $idx) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not (hasKey $values "secret") -}}
|
||||
{{- $_ := set $values "secret" (printf "${GITEA_OAUTH_SECRET_%d}" $idx) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- range $key, $val := $values -}}
|
||||
{{- if ne $key "existingSecret" -}}
|
||||
{{- printf "--%s %s " ($key | kebabcase) ($val | quote) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.public_protocol" -}}
|
||||
{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
|
||||
https
|
||||
{{- else -}}
|
||||
{{ .Values.gitea.config.server.PROTOCOL }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration" -}}
|
||||
{{- include "gitea.inline_configuration.init" . -}}
|
||||
{{- include "gitea.inline_configuration.defaults" . -}}
|
||||
|
||||
{{- $generals := list -}}
|
||||
{{- $inlines := dict -}}
|
||||
|
||||
{{- range $key, $value := .Values.gitea.config }}
|
||||
{{- if kindIs "map" $value }}
|
||||
{{- if gt (len $value) 0 }}
|
||||
{{- $section := default list (get $inlines $key) -}}
|
||||
{{- range $n_key, $n_value := $value }}
|
||||
{{- $section = append $section (printf "%s=%v" $n_key $n_value) -}}
|
||||
{{- end }}
|
||||
{{- $_ := set $inlines $key (join "\n" $section) -}}
|
||||
{{- end -}}
|
||||
{{- else }}
|
||||
{{- if or (eq $key "APP_NAME") (eq $key "RUN_USER") (eq $key "RUN_MODE") -}}
|
||||
{{- $generals = append $generals (printf "%s=%s" $key $value) -}}
|
||||
{{- else -}}
|
||||
{{- (printf "Key %s cannot be on top level of configuration" $key) | fail -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- $_ := set $inlines "_generals_" (join "\n" $generals) -}}
|
||||
{{- toYaml $inlines -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.init" -}}
|
||||
{{- if not (hasKey .Values.gitea.config "cache") -}}
|
||||
{{- $_ := set .Values.gitea.config "cache" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "server") -}}
|
||||
{{- $_ := set .Values.gitea.config "server" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "metrics") -}}
|
||||
{{- $_ := set .Values.gitea.config "metrics" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "database") -}}
|
||||
{{- $_ := set .Values.gitea.config "database" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "security") -}}
|
||||
{{- $_ := set .Values.gitea.config "security" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.repository -}}
|
||||
{{- $_ := set .Values.gitea.config "repository" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "oauth2") -}}
|
||||
{{- $_ := set .Values.gitea.config "oauth2" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "session") -}}
|
||||
{{- $_ := set .Values.gitea.config "session" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "queue") -}}
|
||||
{{- $_ := set .Values.gitea.config "queue" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "queue.issue_indexer") -}}
|
||||
{{- $_ := set .Values.gitea.config "queue.issue_indexer" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "indexer") -}}
|
||||
{{- $_ := set .Values.gitea.config "indexer" dict -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config "actions") -}}
|
||||
{{- $_ := set .Values.gitea.config "actions" dict -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.defaults" -}}
|
||||
{{- include "gitea.inline_configuration.defaults.server" . -}}
|
||||
{{- include "gitea.inline_configuration.defaults.database" . -}}
|
||||
|
||||
{{- if not .Values.gitea.config.repository.ROOT -}}
|
||||
{{- $_ := set .Values.gitea.config.repository "ROOT" "/data/git/gitea-repositories" -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.security.INSTALL_LOCK -}}
|
||||
{{- $_ := set .Values.gitea.config.security "INSTALL_LOCK" "true" -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config.metrics "ENABLED") -}}
|
||||
{{- $_ := set .Values.gitea.config.metrics "ENABLED" .Values.gitea.metrics.enabled -}}
|
||||
{{- end -}}
|
||||
{{- if and (not (hasKey .Values.gitea.config.metrics "TOKEN")) (.Values.gitea.metrics.token) (.Values.gitea.metrics.enabled) -}}
|
||||
{{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
|
||||
{{- end -}}
|
||||
{{- /* valkey queue */ -}}
|
||||
{{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER_CONFIG" (include "valkey.dns" .) -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "ADAPTER" "redis" -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "HOST" (include "valkey.dns" .) -}}
|
||||
{{- else -}}
|
||||
{{- if not (get .Values.gitea.config.session "PROVIDER") -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER" "memory" -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.session "PROVIDER_CONFIG") -}}
|
||||
{{- $_ := set .Values.gitea.config.session "PROVIDER_CONFIG" "" -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.queue "TYPE") -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "TYPE" "level" -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.queue "CONN_STR") -}}
|
||||
{{- $_ := set .Values.gitea.config.queue "CONN_STR" "" -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.cache "ADAPTER") -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "ADAPTER" "memory" -}}
|
||||
{{- end -}}
|
||||
{{- if not (get .Values.gitea.config.cache "HOST") -}}
|
||||
{{- $_ := set .Values.gitea.config.cache "HOST" "" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE -}}
|
||||
{{- $_ := set .Values.gitea.config.indexer "ISSUE_INDEXER_TYPE" "db" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.defaults.server" -}}
|
||||
{{- if not (hasKey .Values.gitea.config.server "HTTP_PORT") -}}
|
||||
{{- $_ := set .Values.gitea.config.server "HTTP_PORT" .Values.service.http.port -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.server.PROTOCOL -}}
|
||||
{{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
|
||||
{{- end -}}
|
||||
{{- if not (.Values.gitea.config.server.DOMAIN) -}}
|
||||
{{- if gt (len .Values.ingress.hosts) 0 -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.server.ROOT_URL -}}
|
||||
{{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.server.SSH_DOMAIN -}}
|
||||
{{- $_ := set .Values.gitea.config.server "SSH_DOMAIN" .Values.gitea.config.server.DOMAIN -}}
|
||||
{{- end -}}
|
||||
{{- if not .Values.gitea.config.server.SSH_PORT -}}
|
||||
{{- $_ := set .Values.gitea.config.server "SSH_PORT" .Values.service.ssh.port -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config.server "START_SSH_SERVER") -}}
|
||||
{{- if .Values.image.rootless -}}
|
||||
{{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "true" -}}
|
||||
{{- if not (hasKey .Values.gitea.config.server "SSH_LISTEN_PORT") -}}
|
||||
{{- if not .Values.gitea.config.server.SSH_LISTEN_PORT -}}
|
||||
{{- $_ := set .Values.gitea.config.server "SSH_LISTEN_PORT" .Values.gitea.config.server.SSH_PORT -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.gitea.config.server "SSH_LISTEN_PORT" .Values.gitea.config.server.SSH_LISTEN_PORT -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "false" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config.server "APP_DATA_PATH") -}}
|
||||
{{- $_ := set .Values.gitea.config.server "APP_DATA_PATH" "/data" -}}
|
||||
{{- end -}}
|
||||
{{- if not (hasKey .Values.gitea.config.server "ENABLE_PPROF") -}}
|
||||
{{- $_ := set .Values.gitea.config.server "ENABLE_PPROF" false -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.inline_configuration.defaults.database" -}}
|
||||
{{- if (index .Values "postgresql-ha" "enabled") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "DB_TYPE" "postgres" -}}
|
||||
{{- if not (.Values.gitea.config.database.HOST) -}}
|
||||
{{- $_ := set .Values.gitea.config.database "HOST" (include "postgresql-ha.dns" .) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.gitea.config.database "NAME" (index .Values "postgresql-ha" "global" "postgresql" "database") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "USER" (index .Values "postgresql-ha" "global" "postgresql" "username") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "PASSWD" (index .Values "postgresql-ha" "global" "postgresql" "password") -}}
|
||||
{{- end -}}
|
||||
{{- if (index .Values "postgresql" "enabled") -}}
|
||||
{{- $_ := set .Values.gitea.config.database "DB_TYPE" "postgres" -}}
|
||||
{{- if not (.Values.gitea.config.database.HOST) -}}
|
||||
{{- $_ := set .Values.gitea.config.database "HOST" (include "postgresql.dns" .) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set .Values.gitea.config.database "NAME" .Values.postgresql.global.postgresql.auth.database -}}
|
||||
{{- $_ := set .Values.gitea.config.database "USER" .Values.postgresql.global.postgresql.auth.username -}}
|
||||
{{- $_ := set .Values.gitea.config.database "PASSWD" .Values.postgresql.global.postgresql.auth.password -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.init-additional-mounts" -}}
|
||||
{{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
|
||||
{{- if gt (len .Values.extraInitVolumeMounts) 0 -}}
|
||||
{{- toYaml .Values.extraInitVolumeMounts -}}
|
||||
{{- else if gt (len .Values.extraVolumeMounts) 0 -}}
|
||||
{{- toYaml .Values.extraVolumeMounts -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.container-additional-mounts" -}}
|
||||
{{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
|
||||
{{- if gt (len .Values.extraContainerVolumeMounts) 0 -}}
|
||||
{{- toYaml .Values.extraContainerVolumeMounts -}}
|
||||
{{- else if gt (len .Values.extraVolumeMounts) 0 -}}
|
||||
{{- toYaml .Values.extraVolumeMounts -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.gpg-key-secret-name" -}}
|
||||
{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.serviceAccountName" -}}
|
||||
{{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "ingress.annotations" -}}
|
||||
{{- if .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- $tp := typeOf .Values.ingress.annotations }}
|
||||
{{- if eq $tp "string" }}
|
||||
{{- tpl .Values.ingress.annotations . | nindent 4 }}
|
||||
{{- else }}
|
||||
{{- toYaml .Values.ingress.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.admin.passwordMode" -}}
|
||||
{{- if has .Values.gitea.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
|
||||
{{ .Values.gitea.admin.passwordMode }}
|
||||
{{- else -}}
|
||||
{{ printf "gitea.admin.passwordMode must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.gitea.admin.passwordMode | fail }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Create a functioning probe object for rendering. Given argument must be either a livenessProbe, readinessProbe, or startupProbe */}}
|
||||
{{- define "gitea.deployment.probe" -}}
|
||||
{{- $probe := unset . "enabled" -}}
|
||||
{{- $probeKeys := keys $probe -}}
|
||||
{{- $containsCustomMethod := false -}}
|
||||
{{- $chartDefaultMethod := "tcpSocket" -}}
|
||||
{{- $nonChartDefaultMethods := list "exec" "httpGet" "grpc" -}}
|
||||
{{- range $probeKeys -}}
|
||||
{{- if has . $nonChartDefaultMethods -}}
|
||||
{{- $containsCustomMethod = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $containsCustomMethod -}}
|
||||
{{- $probe = unset . $chartDefaultMethod -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $probe -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "gitea.metrics-secret-name" -}}
|
||||
{{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,3 @@
|
||||
{{- if .Values.actions -}}
|
||||
{{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
|
||||
{{- end -}}
|
||||
57
backing-services/gitea/templates/gitea/config.yaml
Normal file
57
backing-services/gitea/templates/gitea/config.yaml
Normal file
@@ -0,0 +1,57 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}-inline-config
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{- include "gitea.inline_configuration" . | nindent 2 }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
|
||||
assertions: |
|
||||
|
||||
{{- /*assert that only one PG dep is enabled */ -}}
|
||||
{{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
|
||||
{{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
|
||||
{{- end }}
|
||||
|
||||
{{- /* multiple replicas assertions */ -}}
|
||||
{{- if gt (.Values.replicaCount | int) 1 -}}
|
||||
{{- if .Values.gitea.config.cron -}}
|
||||
{{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
|
||||
{{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
|
||||
{{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}}
|
||||
{{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.config.indexer -}}
|
||||
{{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
|
||||
{{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
|
||||
{{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
|
||||
{{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
|
||||
{{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
|
||||
{{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
432
backing-services/gitea/templates/gitea/deployment.yaml
Normal file
432
backing-services/gitea/templates/gitea/deployment.yaml
Normal file
@@ -0,0 +1,432 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
annotations:
|
||||
{{- if .Values.deployment.annotations }}
|
||||
{{- toYaml .Values.deployment.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
{{- toYaml .Values.deployment.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
strategy:
|
||||
type: {{ .Values.strategy.type }}
|
||||
{{- if eq .Values.strategy.type "RollingUpdate" }}
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
|
||||
maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
{{- toYaml .Values.deployment.labels | nindent 6 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/gitea/config.yaml") . | sha256sum }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
|
||||
{{- end }}
|
||||
{{- with .Values.gitea.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 8 }}
|
||||
{{- if .Values.deployment.labels }}
|
||||
{{- toYaml .Values.deployment.labels | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: "{{ .Values.schedulerName }}"
|
||||
{{- end }}
|
||||
{{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
|
||||
serviceAccountName: {{ include "gitea.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
{{- include "gitea.images.pullSecrets" . | nindent 6 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
{{- if .Values.preExtraInitContainers }}
|
||||
{{- toYaml .Values.preExtraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: init-directories
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: GNUPGHOME
|
||||
value: {{ .Values.signing.gpgHome }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
- name: init-app-ini
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMP_EXISTING_ENVS_FILE
|
||||
value: /tmp/existing-envs
|
||||
- name: ENV_TO_INI_MOUNT_POINT
|
||||
value: /env-to-ini-mounts
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.additionalConfigFromEnvs }}
|
||||
{{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
{{- range $idx, $value := .Values.gitea.additionalConfigSources }}
|
||||
- name: additional-config-sources-{{ $idx }}
|
||||
mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: configure-gpg
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
|
||||
{{- $csc := deepCopy .Values.containerSecurityContext -}}
|
||||
{{- if not (hasKey $csc "runAsUser") -}}
|
||||
{{- $_ := set $csc "runAsUser" 1000 -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $csc | nindent 12 }}
|
||||
env:
|
||||
- name: GNUPGHOME
|
||||
value: {{ .Values.signing.gpgHome }}
|
||||
- name: TMP_RAW_GPG_KEY
|
||||
value: /raw/private.asc
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
- name: gpg-private-key
|
||||
mountPath: /raw
|
||||
readOnly: true
|
||||
{{- if .Values.extraVolumeMounts }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
- name: configure-gitea
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
command:
|
||||
- "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
|
||||
{{- $csc := deepCopy .Values.containerSecurityContext -}}
|
||||
{{- if not (hasKey $csc "runAsUser") -}}
|
||||
{{- $_ := set $csc "runAsUser" 1000 -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $csc | nindent 12 }}
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindDn
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: bindPassword
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- else }}
|
||||
- name: GITEA_LDAP_BIND_DN_{{ $idx }}
|
||||
value: {{ $value.bindDn | quote }}
|
||||
- name: GITEA_LDAP_PASSWORD_{{ $idx }}
|
||||
value: {{ $value.bindPassword | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
{{- if $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_KEY_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: key
|
||||
name: {{ $value.existingSecret }}
|
||||
- name: GITEA_OAUTH_SECRET_{{ $idx }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret
|
||||
name: {{ $value.existingSecret }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.admin.existingSecret }}
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: username
|
||||
name: {{ .Values.gitea.admin.existingSecret }}
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: {{ .Values.gitea.admin.existingSecret }}
|
||||
{{- else }}
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
value: {{ .Values.gitea.admin.username | quote }}
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
value: {{ .Values.gitea.admin.password | quote }}
|
||||
{{- end }}
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: {{ include "gitea.admin.passwordMode" $ }}
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.init-additional-mounts" . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.initContainers.resources | nindent 12 }}
|
||||
{{- if .Values.postExtraInitContainers }}
|
||||
{{- toYaml .Values.postExtraInitContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ include "gitea.image" . }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
env:
|
||||
# SSH Port values have to be set here as well for openssh configuration
|
||||
- name: SSH_LISTEN_PORT
|
||||
value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
|
||||
- name: SSH_PORT
|
||||
value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
|
||||
{{- if not .Values.image.rootless }}
|
||||
- name: SSH_LOG_LEVEL
|
||||
value: {{ .Values.gitea.ssh.logLevel | quote }}
|
||||
{{- end }}
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
{{- if and (hasKey .Values.resources "limits") (hasKey .Values.resources.limits "cpu") }}
|
||||
- name: GOMAXPROCS
|
||||
valueFrom:
|
||||
resourceFieldRef:
|
||||
divisor: "1"
|
||||
resource: limits.cpu
|
||||
{{- end }}
|
||||
- name: TMPDIR
|
||||
value: /tmp/gitea
|
||||
{{- if .Values.image.rootless }}
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
{{- end }}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: GNUPGHOME
|
||||
value: {{ .Values.signing.gpgHome }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.env }}
|
||||
{{- toYaml .Values.deployment.env | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ssh
|
||||
containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
{{- if .Values.service.ssh.hostPort }}
|
||||
hostPort: {{ .Values.service.ssh.hostPort }}
|
||||
{{- end }}
|
||||
- name: http
|
||||
containerPort: {{ .Values.gitea.config.server.HTTP_PORT }}
|
||||
{{- if .Values.gitea.config.server.ENABLE_PPROF }}
|
||||
- name: profiler
|
||||
containerPort: 6060
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
{{- include "gitea.deployment.probe" .Values.gitea.livenessProbe | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
{{- include "gitea.deployment.probe" .Values.gitea.readinessProbe | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
{{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{- /* Honor the deprecated securityContext variable when defined */ -}}
|
||||
{{- if .Values.containerSecurityContext -}}
|
||||
{{ toYaml .Values.containerSecurityContext | nindent 12 -}}
|
||||
{{- else -}}
|
||||
{{ toYaml .Values.securityContext | nindent 12 -}}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
{{- if .Values.persistence.subPath }}
|
||||
subPath: {{ .Values.persistence.subPath }}
|
||||
{{- end }}
|
||||
{{- include "gitea.container-additional-mounts" . | nindent 12 }}
|
||||
{{- if .Values.extraContainers }}
|
||||
{{- toYaml .Values.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- toYaml .Values.dnsConfig | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: init
|
||||
secret:
|
||||
secretName: {{ include "gitea.fullname" . }}-init
|
||||
defaultMode: 110
|
||||
- name: config
|
||||
secret:
|
||||
secretName: {{ include "gitea.fullname" . }}
|
||||
defaultMode: 110
|
||||
{{- if gt (len .Values.extraVolumes) 0 }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: inline-config-sources
|
||||
secret:
|
||||
secretName: {{ include "gitea.fullname" . }}-inline-config
|
||||
{{- range $idx, $value := .Values.gitea.additionalConfigSources }}
|
||||
- name: additional-config-sources-{{ $idx }}
|
||||
{{- toYaml $value | nindent 10 }}
|
||||
{{- end }}
|
||||
- name: temp
|
||||
emptyDir: {}
|
||||
{{- if .Values.signing.enabled }}
|
||||
- name: gpg-private-key
|
||||
secret:
|
||||
secretName: {{ include "gitea.gpg-key-secret-name" . }}
|
||||
items:
|
||||
- key: privateKey
|
||||
path: private.asc
|
||||
defaultMode: 0100
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.enabled }}
|
||||
{{- if .Values.persistence.mount }}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.persistence.claimName }}
|
||||
{{- end }}
|
||||
{{- else if not .Values.persistence.enabled }}
|
||||
- name: data
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
34
backing-services/gitea/templates/gitea/deprecation.yaml
Normal file
34
backing-services/gitea/templates/gitea/deprecation.yaml
Normal file
@@ -0,0 +1,34 @@
|
||||
{{- if .Values.checkDeprecation -}}
|
||||
{{/* CUSTOM PROBES */}}
|
||||
{{- if .Values.gitea.customLivenessProbe -}}
|
||||
{{- fail "`gitea.customLivenessProbe` does no longer exist. Please refer to the changelog and configure `gitea.livenessProbe` instead." -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.gitea.customReadinessProbe -}}
|
||||
{{- fail "`gitea.customReadinessProbe` does no longer exist. Please refer to the changelog and configure `gitea.readinessProbe` instead." -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.gitea.customStartupProbe -}}
|
||||
{{- fail "`gitea.customStartupProbe` does no longer exist. Please refer to the changelog and configure `gitea.startupProbe` instead." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* LDAP SOURCES */}}
|
||||
{{- if kindIs "map" .Values.gitea.ldap -}}
|
||||
{{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* OAUTH SOURCES */}}
|
||||
{{- if kindIs "map" .Values.gitea.oauth -}}
|
||||
{{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* BUILTIN */}}
|
||||
{{- if .Values.gitea.cache -}}
|
||||
{{- if .Values.gitea.cache.builtIn -}}
|
||||
{{- fail "`gitea.cache.builtIn` does no longer exist. Please use `memcached` at root level instead." -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.gitea.database -}}
|
||||
{{- if .Values.gitea.database.builtIn -}}
|
||||
{{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
8
backing-services/gitea/templates/gitea/extra-list.yaml
Normal file
8
backing-services/gitea/templates/gitea/extra-list.yaml
Normal file
@@ -0,0 +1,8 @@
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{- if typeIs "string" . }}
|
||||
{{- tpl . $ }}
|
||||
{{- else }}
|
||||
{{- tpl (. | toYaml) $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
17
backing-services/gitea/templates/gitea/gpg-secret.yaml
Normal file
17
backing-services/gitea/templates/gitea/gpg-secret.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
{{- if .Values.signing.enabled -}}
|
||||
{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
|
||||
{{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}}
|
||||
{{- end }}
|
||||
{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.gpg-key-secret-name" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
privateKey: {{ .Values.signing.privateKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
54
backing-services/gitea/templates/gitea/http-svc.yaml
Normal file
54
backing-services/gitea/templates/gitea/http-svc.yaml
Normal file
@@ -0,0 +1,54 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}-http
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- if .Values.service.http.labels }}
|
||||
{{- toYaml .Values.service.http.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- toYaml .Values.service.http.annotations | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.http.type }}
|
||||
{{- if eq .Values.service.http.type "LoadBalancer" }}
|
||||
{{- if .Values.service.http.loadBalancerClass }}
|
||||
loadBalancerClass: {{ .Values.service.http.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if and .Values.service.http.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.service.http.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.http.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- range .Values.service.http.loadBalancerSourceRanges }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.http.externalIPs }}
|
||||
externalIPs:
|
||||
{{- toYaml .Values.service.http.externalIPs | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.http.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.service.http.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.http.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.service.http.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.service.http.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
{{- if and .Values.service.http.clusterIP (eq .Values.service.http.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.http.clusterIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.service.http.port }}
|
||||
{{- if .Values.service.http.nodePort }}
|
||||
nodePort: {{ .Values.service.http.nodePort }}
|
||||
{{- end }}
|
||||
targetPort: {{ .Values.gitea.config.server.HTTP_PORT }}
|
||||
selector:
|
||||
{{- include "gitea.selectorLabels" . | nindent 4 }}
|
||||
62
backing-services/gitea/templates/gitea/ingress.yaml
Normal file
62
backing-services/gitea/templates/gitea/ingress.yaml
Normal file
@@ -0,0 +1,62 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "gitea.fullname" . -}}
|
||||
{{- $httpPort := .Values.service.http.port -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ingressClassName: {{ tpl .Values.ingress.className . }}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ tpl . $ | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ tpl .host $ | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- if .paths }}
|
||||
{{- range .paths }}
|
||||
{{- if kindIs "string" . }}
|
||||
- path: {{ . }}
|
||||
pathType: {{ default "Prefix" $.Values.ingress.pathType }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ $fullName }}-http
|
||||
port:
|
||||
number: {{ $httpPort }}
|
||||
{{- else }}
|
||||
- path: {{ .path | default "/" }}
|
||||
pathType: {{ .pathType | default "Prefix" }}
|
||||
backend:
|
||||
service:
|
||||
name: {{ $fullName }}-http
|
||||
port:
|
||||
number: {{ $httpPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- path: "/"
|
||||
pathType: "Prefix"
|
||||
backend:
|
||||
service:
|
||||
name: {{ $fullName }}-http
|
||||
port:
|
||||
number: {{ $httpPort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
228
backing-services/gitea/templates/gitea/init.yaml
Normal file
228
backing-services/gitea/templates/gitea/init.yaml
Normal file
@@ -0,0 +1,228 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}-init
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
|
||||
init_directory_structure.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
{{- if .Values.initPreScript }}
|
||||
# BEGIN: initPreScript
|
||||
{{- with .Values.initPreScript -}}
|
||||
{{ . | nindent 4}}
|
||||
{{- end -}}
|
||||
# END: initPreScript
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.image.rootless }}
|
||||
chown -v 1000:1000 /data
|
||||
{{- end }}
|
||||
mkdir -pv /data/git/.ssh
|
||||
chmod -Rv 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -pv "${GITEA_TEMP}"
|
||||
{{- if not .Values.image.rootless }}
|
||||
chown -v 1000:1000 "${GITEA_TEMP}"
|
||||
{{- end }}
|
||||
chmod -v ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
{{ if .Values.signing.enabled -}}
|
||||
if [ ! -d "${GNUPGHOME}" ]; then
|
||||
mkdir -pv "${GNUPGHOME}"
|
||||
chmod -v 700 "${GNUPGHOME}"
|
||||
chown -v 1000:1000 "${GNUPGHOME}"
|
||||
fi
|
||||
{{- end }}
|
||||
|
||||
configure_gitea.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||
|
||||
{ # try
|
||||
gitea migrate
|
||||
} || { # catch
|
||||
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
exit 1
|
||||
}
|
||||
|
||||
{{- if include "valkey.servicename" . }}
|
||||
function test_valkey_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for valkey to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Valkey not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_valkey_connection
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
|
||||
function configure_admin_user() {
|
||||
local full_admin_list=$(gitea admin user list --admin)
|
||||
local actual_user_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
|
||||
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||
echo "--"
|
||||
echo "${full_admin_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||
local -a create_args
|
||||
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||
create_args+=(--must-change-password=true)
|
||||
else
|
||||
create_args+=(--must-change-password=false)
|
||||
fi
|
||||
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||
gitea admin user create "${create_args[@]}"
|
||||
echo '...created.'
|
||||
else
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||
# See https://gitea.com/gitea/helm-gitea/issues/673
|
||||
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||
# should add it to prevent requiring frequent admin password resets.
|
||||
local -a change_args
|
||||
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||
change_args+=(--must-change-password=false)
|
||||
fi
|
||||
gitea admin user change-password "${change_args[@]}"
|
||||
echo '...password sync done.'
|
||||
else
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configure_admin_user
|
||||
{{- end }}
|
||||
|
||||
function configure_ldap() {
|
||||
{{- if .Values.gitea.ldap }}
|
||||
{{- range $idx, $value := .Values.gitea.ldap }}
|
||||
local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
|
||||
local full_auth_list=$(gitea admin auth list --vertical-bars)
|
||||
local actual_auth_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
|
||||
if [[ "${full_auth_list}" =~ $regex ]]; then
|
||||
actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
|
||||
echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
|
||||
echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
|
||||
echo "--"
|
||||
echo "${full_auth_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}")
|
||||
|
||||
if [[ -z "${GITEA_AUTH_ID}" ]]; then
|
||||
echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
|
||||
gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...installed.'
|
||||
else
|
||||
echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
|
||||
gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...sync settings done.'
|
||||
fi
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
echo 'no ldap configuration... skipping.'
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
configure_ldap
|
||||
|
||||
function configure_oauth() {
|
||||
{{- if .Values.gitea.oauth }}
|
||||
{{- range $idx, $value := .Values.gitea.oauth }}
|
||||
local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
|
||||
local full_auth_list=$(gitea admin auth list --vertical-bars)
|
||||
local actual_auth_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
|
||||
if [[ "${full_auth_list}" =~ $regex ]]; then
|
||||
actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
|
||||
echo " Please review the output of 'gitea admin auth list --vertical-bars' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
|
||||
echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
|
||||
echo "--"
|
||||
echo "${full_auth_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}")
|
||||
|
||||
if [[ -z "${AUTH_ID}" ]]; then
|
||||
echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
|
||||
gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...installed.'
|
||||
else
|
||||
echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
|
||||
gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
|
||||
echo '...sync settings done.'
|
||||
fi
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
echo 'no oauth configuration... skipping.'
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
configure_oauth
|
||||
|
||||
echo '==== END GITEA CONFIGURATION ===='
|
||||
12
backing-services/gitea/templates/gitea/metrics-secret.yaml
Normal file
12
backing-services/gitea/templates/gitea/metrics-secret.yaml
Normal file
@@ -0,0 +1,12 @@
|
||||
{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "gitea.metrics-secret-name" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
token: {{ .Values.gitea.metrics.token | b64enc }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.podDisruptionBudget -}}
|
||||
{{- if .Capabilities.APIVersions.Has "policy/v1" }}
|
||||
apiVersion: policy/v1
|
||||
{{- else }}
|
||||
apiVersion: policy/v1beta1
|
||||
{{- end }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
{{- toYaml .Values.podDisruptionBudget | nindent 2 }}
|
||||
{{- end -}}
|
||||
26
backing-services/gitea/templates/gitea/pvc.yaml
Normal file
26
backing-services/gitea/templates/gitea/pvc.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
{{- if and .Values.persistence.enabled .Values.persistence.create }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: {{ .Values.persistence.claimName }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
annotations:
|
||||
{{ .Values.persistence.annotations | toYaml | indent 4}}
|
||||
labels:
|
||||
{{ .Values.persistence.labels | toYaml | indent 4}}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- if gt (.Values.replicaCount | int) 1 }}
|
||||
- ReadWriteMany
|
||||
{{- else }}
|
||||
{{- .Values.persistence.accessModes | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMode: Filesystem
|
||||
{{- include "gitea.persistence.storageClass" . | nindent 2 }}
|
||||
{{- with .Values.persistence.volumeName }}
|
||||
volumeName: {{ . }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- end }}
|
||||
21
backing-services/gitea/templates/gitea/serviceaccount.yaml
Normal file
21
backing-services/gitea/templates/gitea/serviceaccount.yaml
Normal file
@@ -0,0 +1,21 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "gitea.serviceAccountName" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.labels }}
|
||||
{{- . | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- . | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- with .Values.serviceAccount.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- . | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
43
backing-services/gitea/templates/gitea/servicemonitor.yaml
Normal file
43
backing-services/gitea/templates/gitea/servicemonitor.yaml
Normal file
@@ -0,0 +1,43 @@
|
||||
{{- if and .Values.gitea.metrics.enabled .Values.gitea.metrics.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- if .Values.gitea.metrics.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml .Values.gitea.metrics.serviceMonitor.additionalLabels | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: http
|
||||
{{- if .Values.gitea.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.gitea.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- with .Values.gitea.metrics.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- . | toYaml | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.metrics.serviceMonitor.scheme }}
|
||||
scheme: {{ .Values.gitea.metrics.serviceMonitor.scheme }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.gitea.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- with .Values.gitea.metrics.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{- . | toYaml | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.gitea.metrics.token }}
|
||||
authorization:
|
||||
type: Bearer
|
||||
credentials:
|
||||
name: {{ include "gitea.metrics-secret-name" . }}
|
||||
key: token
|
||||
optional: false
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
57
backing-services/gitea/templates/gitea/ssh-svc.yaml
Normal file
57
backing-services/gitea/templates/gitea/ssh-svc.yaml
Normal file
@@ -0,0 +1,57 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "gitea.fullname" . }}-ssh
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
{{- if .Values.service.ssh.labels }}
|
||||
{{- toYaml .Values.service.ssh.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- toYaml .Values.service.ssh.annotations | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.ssh.type }}
|
||||
{{- if eq .Values.service.ssh.type "LoadBalancer" }}
|
||||
{{- if .Values.service.ssh.loadBalancerClass }}
|
||||
loadBalancerClass: {{ .Values.service.ssh.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ssh.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.service.ssh.loadBalancerIP }}
|
||||
{{- end -}}
|
||||
{{- if .Values.service.ssh.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- range .Values.service.ssh.loadBalancerSourceRanges }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.service.ssh.clusterIP (eq .Values.service.ssh.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.service.ssh.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ssh.externalIPs }}
|
||||
externalIPs:
|
||||
{{- toYaml .Values.service.ssh.externalIPs | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ssh.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.service.ssh.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.ssh.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- if .Values.service.ssh.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.service.ssh.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: ssh
|
||||
port: {{ .Values.service.ssh.port }}
|
||||
{{- if .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
targetPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
||||
{{- end }}
|
||||
protocol: TCP
|
||||
{{- if .Values.service.ssh.nodePort }}
|
||||
nodePort: {{ .Values.service.ssh.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "gitea.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.test.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "gitea.fullname" . }}-test-connection"
|
||||
namespace: {{ .Values.namespace | default .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "gitea.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test-success
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
|
||||
command: ['wget']
|
||||
args: ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
|
||||
restartPolicy: Never
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user