feat(k8s/gitea): add renovate support
This commit is contained in:
@@ -21,6 +21,175 @@ spec:
|
||||
upgrade:
|
||||
remediation:
|
||||
retries: 3
|
||||
# Patch the init script: Gitea 1.26 removed environment-to-ini; use built-in subcommand instead.
|
||||
# Remove once helm-gitea chart ships a release with the fix (commit 1baf2d0).
|
||||
postRenderers:
|
||||
- kustomize:
|
||||
patches:
|
||||
- target:
|
||||
kind: Secret
|
||||
name: gitea-gitea
|
||||
patch: |
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitea-gitea
|
||||
stringData:
|
||||
config_environment.sh: |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
function env2ini::log() {
|
||||
printf "$${1}\n"
|
||||
}
|
||||
|
||||
function env2ini::read_config_to_env() {
|
||||
local section="$${1}"
|
||||
local line="$${2}"
|
||||
|
||||
if [[ -z "$${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "$${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "$${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^$${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="$${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '$${setting}'"
|
||||
|
||||
if [[ -z "$${section}" ]]; then
|
||||
export "GITEA____$${setting^^}=$${value}" # '^^' makes the variable content uppercase
|
||||
return
|
||||
fi
|
||||
|
||||
local masked_section="$${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||
masked_section="$${masked_section//-/_0X2D_}"
|
||||
|
||||
export "GITEA__$${masked_section^^}__$${setting^^}=$${value}" # '^^' makes the variable content uppercase
|
||||
}
|
||||
|
||||
function env2ini::reload_preset_envs() {
|
||||
env2ini::log "Reloading preset envs..."
|
||||
|
||||
while read -r line; do
|
||||
if [[ -z "$${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "$${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "$${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^$${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="$${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '$${setting}'"
|
||||
|
||||
export "$${setting^^}=$${value}" # '^^' makes the variable content uppercase
|
||||
done < "$TMP_EXISTING_ENVS_FILE"
|
||||
|
||||
rm $TMP_EXISTING_ENVS_FILE
|
||||
}
|
||||
|
||||
|
||||
function env2ini::process_config_file() {
|
||||
local config_file="$${1}"
|
||||
local section="$(basename "$${config_file}")"
|
||||
|
||||
if [[ $section == '_generals_' ]]; then
|
||||
env2ini::log " [ini root]"
|
||||
section=''
|
||||
else
|
||||
env2ini::log " $${section}"
|
||||
fi
|
||||
|
||||
while read -r line; do
|
||||
env2ini::read_config_to_env "$${section}" "$${line}"
|
||||
done < <(awk 1 "$${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||
}
|
||||
|
||||
function env2ini::load_config_sources() {
|
||||
local path="$${1}"
|
||||
|
||||
if [[ -d "$${path}" ]]; then
|
||||
env2ini::log "Processing $(basename "$${path}")..."
|
||||
|
||||
while read -d '' configFile; do
|
||||
env2ini::process_config_file "$${configFile}"
|
||||
done < <(find "$${path}" -type l -not -name '..data' -print0)
|
||||
|
||||
env2ini::log "\n"
|
||||
fi
|
||||
}
|
||||
|
||||
function env2ini::generate_initial_secrets() {
|
||||
# These environment variables will either be
|
||||
# - overwritten with user defined values,
|
||||
# - initially used to set up Gitea
|
||||
# Anyway, they won't harm existing app.ini files
|
||||
|
||||
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||
|
||||
env2ini::log "...Initial secrets generated\n"
|
||||
}
|
||||
|
||||
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > $TMP_EXISTING_ENVS_FILE
|
||||
|
||||
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||
env2ini::generate_initial_secrets
|
||||
|
||||
env2ini::load_config_sources "$ENV_TO_INI_MOUNT_POINT/inlines/"
|
||||
env2ini::load_config_sources "$ENV_TO_INI_MOUNT_POINT/additionals/"
|
||||
|
||||
# load existing envs to override auto generated envs
|
||||
env2ini::reload_preset_envs
|
||||
|
||||
env2ini::log "=== All configuration sources loaded ===\n"
|
||||
|
||||
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||
if [ -f $${GITEA_APP_INI} ]; then
|
||||
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||
env2ini::log ' - security.SECRET_KEY'
|
||||
env2ini::log ' - oauth2.JWT_SECRET'
|
||||
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||
|
||||
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||
unset GITEA__SECURITY__SECRET_KEY
|
||||
unset GITEA__OAUTH2__JWT_SECRET
|
||||
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||
fi
|
||||
|
||||
gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
|
||||
values:
|
||||
strategy:
|
||||
type: Recreate
|
||||
@@ -30,6 +199,9 @@ spec:
|
||||
type: RuntimeDefault
|
||||
|
||||
image:
|
||||
# renovate: currentValue=1.26.1-rootless currentDigest=sha256:4c4256497e2e237ddebdd30986c7ce52cb6f936b3e90c34bb9f4665714599f62
|
||||
tag: 1.26.1
|
||||
digest: sha256:4c4256497e2e237ddebdd30986c7ce52cb6f936b3e90c34bb9f4665714599f62
|
||||
rootless: true
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"customManagers": [
|
||||
{
|
||||
"customType": "regex",
|
||||
"description": "Track gitea rootless image; chart appends -rootless to tag automatically",
|
||||
"fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
|
||||
"matchStrings": [
|
||||
"(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
|
||||
],
|
||||
"depNameTemplate": "gitea/gitea",
|
||||
"datasourceTemplate": "docker",
|
||||
"autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
|
||||
}
|
||||
],
|
||||
"packageRules": [
|
||||
{
|
||||
"matchFileNames": ["kubernetes/app/gitea/**"],
|
||||
"semanticCommitScope": "k8s/gitea"
|
||||
},
|
||||
{
|
||||
"matchFileNames": ["kubernetes/app/gitea/**"],
|
||||
"matchPackageNames": ["gitea/gitea"],
|
||||
"matchUpdateTypes": ["patch", "minor"],
|
||||
"automerge": true
|
||||
},
|
||||
{
|
||||
"description": "Ignore infrastructure images",
|
||||
"matchFileNames": ["kubernetes/app/gitea/**"],
|
||||
"matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
|
||||
"enabled": false
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user