57479bdf37
This PR adds a few new chart features which adds to the flexibility of the chart.
- allow extra volumes to be mounted (such as secrets): 2f862c5a48
- pass environment variables also to the init-container: 7044049478
- allow a preparation script to be "injected" into the init-container: 6125a69345
As a concrete example of how this can be used, I use is to configure Gitea to use client certificate authentication against an external Postgres database. That could be accomplished by having a `gitea-postgres-ssl` secret:
```
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: gitea-postgres-ssl
data:
postgresql.crt: <base64...>
postgresql.key: <base64...>
root.crt: <base64...>
```
and then mounting this as a volume in Gitea using:
```
extraVolumes:
- name: postgres-ssl-vol
secret:
secretName: gitea-postgres-ssl
extraVolumeMounts:
- name: postgres-ssl-vol
readOnly: true
mountPath: "/pg-ssl"
```
To get the right permissions on the credentials, we'd use the `initPreScript`:
```
initPreScript: |
# copy postgres client and CA cert from mount and
# give proper permissions
mkdir -p /data/git/.postgresql
cp /pg-ssl/* /data/git/.postgresql/
chown -R git:git /data/git/.postgresql/
chmod 400 /data/git/.postgresql/postgresql.key
```
and to make sure that Gitea uses the certificate we need to pass the proper postgres environment variables (both to the init container and the "main" container):
```
statefulset:
env:
- name: "PGSSLCERT"
value: "/data/git/.postgresql/postgresql.crt"
- name: "PGSSLKEY"
value: "/data/git/.postgresql/postgresql.key"
- name: "PGSSLROOTCERT"
value: "/data/git/.postgresql/root.crt"
```
Co-authored-by: Peter Gardfjäll <peter.gardfjall.work@gmail.com>
Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/47
Reviewed-by: luhahn <luhahn@noreply.gitea.io>
Reviewed-by: 6543 <6543@obermui.de>
Co-authored-by: petergardfjall <petergardfjall@noreply.gitea.io>
Co-committed-by: petergardfjall <petergardfjall@noreply.gitea.io>
138 lines
4.8 KiB
YAML
138 lines
4.8 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ include "gitea.fullname" . }}
|
|
labels:
|
|
{{- include "gitea.labels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "gitea.selectorLabels" . | nindent 6 }}
|
|
serviceName: {{ include "gitea.fullname" . }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/gitea/config.yaml") . | sha256sum }}
|
|
checksum/ldap: {{ include "gitea.ldap_settings" . | sha256sum }}
|
|
{{- with .Values.gitea.podAnnotations }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "gitea.selectorLabels" . | nindent 8 }}
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
securityContext:
|
|
fsGroup: 1000
|
|
initContainers:
|
|
- name: init
|
|
image: "{{ .Values.image.repository }}:{{ ternary .Values.image.version .Values.image.tag (hasKey .Values.image "version") }}"
|
|
command: ["/usr/sbin/init_gitea.sh"]
|
|
env:
|
|
{{- range .Values.statefulset.env }}
|
|
- name: {{ .name | quote | nospace }}
|
|
value: {{ .value | quote }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: init
|
|
mountPath: /usr/sbin
|
|
- name: config
|
|
mountPath: /etc/gitea/conf
|
|
- name: data
|
|
mountPath: /data
|
|
{{- if .Values.extraVolumeMounts }}
|
|
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
|
{{- end }}
|
|
terminationGracePeriodSeconds: {{ .Values.statefulset.terminationGracePeriodSeconds }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
image: "{{ .Values.image.repository }}:{{ ternary .Values.image.version .Values.image.tag (hasKey .Values.image "version") }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
env:
|
|
# SSH Port values have to be set here as well for openssh configuration
|
|
- name: SSH_LISTEN_PORT
|
|
value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
|
|
- name: SSH_PORT
|
|
value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
|
|
{{- range .Values.statefulset.env }}
|
|
- name: {{ .name | quote | nospace }}
|
|
value: {{ .value | quote }}
|
|
{{- end }}
|
|
ports:
|
|
- name: ssh
|
|
containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
|
|
- name: http
|
|
containerPort: {{ .Values.gitea.config.server.HTTP_PORT }}
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 200
|
|
timeoutSeconds: 1
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
failureThreshold: 10
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
failureThreshold: 3
|
|
resources:
|
|
{{- toYaml .Values.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
{{- if .Values.extraVolumeMounts }}
|
|
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
|
{{- end }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: init
|
|
secret:
|
|
secretName: {{ include "gitea.fullname" . }}-init
|
|
defaultMode: 0777
|
|
- name: config
|
|
secret:
|
|
secretName: {{ include "gitea.fullname" . }}
|
|
{{- if .Values.extraVolumes }}
|
|
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
|
{{- end }}
|
|
{{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Values.persistence.existingClaim }}
|
|
{{- else if not .Values.persistence.enabled }}
|
|
- name: data
|
|
emptyDir: {}
|
|
{{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: data
|
|
spec:
|
|
accessModes:
|
|
{{- range .Values.persistence.accessModes }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
{{- if .Values.persistence.storageClass }}
|
|
storageClassName: {{ .Values.persistence.storageClass | quote }}
|
|
{{- end }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.persistence.size | quote }}
|
|
{{- end }}
|