90 lines
3.5 KiB
Diff
90 lines
3.5 KiB
Diff
diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
|
|
--- a/templates/_helpers.tpl
|
|
+++ b/templates/_helpers.tpl
|
|
@@ -201,7 +201,15 @@
|
|
{{- $_ := set $values "key" (printf "${GITEA_OAUTH_KEY_%d}" $idx) -}}
|
|
{{- end -}}
|
|
|
|
-{{- if not (hasKey $values "secret") -}}
|
|
+{{- if hasKey $values "secretFile" -}}
|
|
+{{- if or (hasKey $values "secret") (hasKey $values "existingSecret") -}}
|
|
+{{- fail "OAuth secretFile conflicts with secret or existingSecret" -}}
|
|
+{{- end -}}
|
|
+{{- if ne $values.secretFile "/run/forgejo-oidc/CLIENT_SECRET" -}}
|
|
+{{- fail "OAuth secretFile requires the admitted mount path" -}}
|
|
+{{- end -}}
|
|
+{{- end -}}
|
|
+{{- if and (not (hasKey $values "secret")) (not (hasKey $values "secretFile")) -}}
|
|
{{- $_ := set $values "secret" (printf "${GITEA_OAUTH_SECRET_%d}" $idx) -}}
|
|
{{- end -}}
|
|
|
|
@@ -471,3 +479,28 @@
|
|
{{- define "gitea.metrics-secret-name" -}}
|
|
{{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
|
|
{{- end -}}
|
|
+
|
|
+{{/* Bounded first-case source continuation; no Secret value or alias key. */}}
|
|
+{{- define "gitea.oauth_private_validate" -}}
|
|
+{{- $private := 0 -}}
|
|
+{{- range $idx, $value := .Values.gitea.oauth -}}
|
|
+{{- if hasKey $value "secretFile" -}}
|
|
+{{- $private = add1 $private -}}
|
|
+{{- range $.Values.deployment.env -}}
|
|
+{{- if eq .name (printf "GITEA_OAUTH_SECRET_%d" $idx) -}}
|
|
+{{- fail "OAuth secretFile conflicts with indexed secret environment" -}}
|
|
+{{- end -}}
|
|
+{{- end -}}
|
|
+{{- end -}}
|
|
+{{- end -}}
|
|
+{{- if gt $private 1 -}}{{- fail "Only one private OAuth mount is supported" -}}{{- end -}}
|
|
+{{- if gt $private 0 -}}
|
|
+{{- if ne (int .Values.podSecurityContext.fsGroup) 1000 -}}{{- fail "Private OAuth mount requires fsGroup 1000" -}}{{- end -}}
|
|
+{{- range .Values.extraVolumes -}}
|
|
+{{- if eq .name "oauth-private-client" -}}{{- fail "Private OAuth volume conflict" -}}{{- end -}}
|
|
+{{- end -}}
|
|
+{{- range concat .Values.extraVolumeMounts .Values.extraInitVolumeMounts .Values.extraContainerVolumeMounts -}}
|
|
+{{- if or (eq .name "oauth-private-client") (hasPrefix "/run/forgejo-oidc" .mountPath) -}}{{- fail "Private OAuth mount conflict" -}}{{- end -}}
|
|
+{{- end -}}
|
|
+{{- end -}}
|
|
+{{- end -}}
|
|
diff --git a/templates/gitea/deployment.yaml b/templates/gitea/deployment.yaml
|
|
--- a/templates/gitea/deployment.yaml
|
|
+++ b/templates/gitea/deployment.yaml
|
|
@@ -1,3 +1,4 @@
|
|
+{{- include "gitea.oauth_private_validate" . -}}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
@@ -260,6 +261,14 @@
|
|
{{- toYaml .Values.deployment.env | nindent 12 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
+ {{- range .Values.gitea.oauth }}
|
|
+ {{- if hasKey . "secretFile" }}
|
|
+ - name: oauth-private-client
|
|
+ mountPath: /run/forgejo-oidc/CLIENT_SECRET
|
|
+ subPath: CLIENT_SECRET
|
|
+ readOnly: true
|
|
+ {{- end }}
|
|
+ {{- end }}
|
|
- name: init
|
|
mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
|
|
- name: temp
|
|
@@ -388,6 +397,17 @@
|
|
{{- toYaml .Values.dnsConfig | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
+ {{- range .Values.gitea.oauth }}
|
|
+ {{- if hasKey . "secretFile" }}
|
|
+ - name: oauth-private-client
|
|
+ secret:
|
|
+ secretName: forgejo-netkingdom-oidc-client
|
|
+ defaultMode: 288
|
|
+ items:
|
|
+ - key: CLIENT_SECRET
|
|
+ path: CLIENT_SECRET
|
|
+ {{- end }}
|
|
+ {{- end }}
|
|
- name: init
|
|
secret:
|
|
secretName: {{ include "gitea.fullname" . }}-init
|