gitea/helm-actions
Fork 12
Code Issues 12 Pull Requests 6 Actions Releases 2 Activity

feat(chart): Make the securityContext for the StatefulSet configurable (#62)
All checks were successful
changelog / changelog (push) Successful in 7s
Details
generate-chart / generate-chart-publish (push) Successful in 1m46s
Details

Browse Source 
<!-- Before you open the request please review the following guidelines and tips to help it be more easily integrated: - Describe the scope of your change - i.e. what the change does. - Describe any known limitations with your change. - Please run any tests or examples that can exercise your modified code. Thank you for contributing! We will try to review, test and integrate the change as soon as we can. --> ### Description of the change <!-- Describe the scope of your change - i.e. what the change does. --> This patch adds the ability to **customize the `SecurityContext`** for the `statefulset` of the Gitea Actions `act_runner`. This allows users to configure pod-level security settings, such as `fsGroup` and `fsGroupChangePolicy`. The patch introduces `statefulset.podSecurityContext` as a new configurable parameter. ### Benefits <!-- What benefits will be realized by the code change? --> This change makes the chart more configurable for different kinds of deployment scenarios. ### Possible drawbacks <!-- Describe any known limitations with your change --> ### Applicable issues <!-- Enter any applicable Issues here (You can reference an issue using #). Please remove this section if there is no referenced issue. --> - Fixes # ### Additional information <!-- If there's anything else that's important and relevant to your pull request, mention that information here. Please remove this section if it remains empty. --> * The patch only adds the ability to customize the `podSecurityContext` for the `statefulset`. It does not modify any other security settings or introduce new features beyond this customization. * The default value for `statefulset.podSecurityContext` is an empty object `{}`, meaning no security context is applied unless the user explicitly defines it. ### ⚠ BREAKING <!-- If there's a breaking change, please shortly describe in which way users are affected and how they can mitigate it. If there are no breakings, please remove this section. --> ### Checklist <!-- [Place an '[X]' (no spaces) in all applicable fields. Please remove unrelated fields.] --> - [X] Parameters are documented in the `values.yaml` and added to the `README.md` using [readme-generator-for-helm](https://github.com/bitnami-labs/readme-generator-for-helm) - [X] Helm templating unittests are added (required when changing anything in `templates` folder) - [X] All added template resources MUST render a namespace in metadata Reviewed-on: #62 Reviewed-by: DaanSelen <daanselen@noreply.gitea.com> Co-authored-by: Stephen Sullivan <sjsullivan7@gmail.com> Co-committed-by: Stephen Sullivan <sjsullivan7@gmail.com>
This commit was merged in pull request #62.
This commit is contained in:
Stephen Sullivan
2025-11-03 17:43:27 +00:00
committed by DaanSelen
parent 0536d625cf
commit b91d297e32
4 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@@ -75,6 +75,7 @@ You should be good to go!
| `statefulset.dind.extraVolumeMounts` | Allows mounting extra volumes in the Docker-in-Docker container | `[]` |
| `statefulset.dind.extraEnvs` | Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY` | `[]` |
| `statefulset.persistence.size` | Size for persistence to store act runner data | `1Gi` |
| `statefulset.securityContext` | Customize the SecurityContext | `{}` |
| `existingSecret` | Secret that contains the token | `""` |
| `existingSecretKey` | Secret key | `""` |
| `giteaRootURL` | URL the act_runner registers and connect with | `""` |

2
templates/statefulset.yaml
View File

@@ -30,6 +30,8 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
securityContext:
{{- toYaml .Values.statefulset.securityContext | nindent 8 }}
initContainers:
- name: init-gitea
image: "{{ include "gitea.actions.init.image" . }}"

54
unittests/helm/statefulset.yaml
View File

@@ -162,6 +162,60 @@ tests:
- matchRegex:
path: spec.template.spec.containers[0].env[8].name
pattern: "GITEA_RUNNER_NAME"
- it: Has fsGroup in securityContext
template: templates/statefulset.yaml
set:
enabled: true
existingSecret: "my-secret"
existingSecretKey: "my-secret-key"
statefulset.securityContext:
fsGroup: 1000
asserts:
- hasDocuments:
count: 1
- containsDocument:
kind: StatefulSet
apiVersion: apps/v1
name: gitea-unittests-actions-act-runner
- equal:
path: spec.template.spec.securityContext["fsGroup"]
value: 1000
- it: Has fsGroupChangePolicy in securityContext
template: templates/statefulset.yaml
set:
enabled: true
existingSecret: "my-secret"
existingSecretKey: "my-secret-key"
statefulset.securityContext:
fsGroupChangePolicy: OnRootMismatch
asserts:
- hasDocuments:
count: 1
- containsDocument:
kind: StatefulSet
apiVersion: apps/v1
name: gitea-unittests-actions-act-runner
- equal:
path: spec.template.spec.securityContext["fsGroupChangePolicy"]
value: "OnRootMismatch"
- it: Has Always in securityContext
template: templates/statefulset.yaml
set:
enabled: true
existingSecret: "my-secret"
existingSecretKey: "my-secret-key"
statefulset.securityContext:
fsGroupChangePolicy: Always
asserts:
- hasDocuments:
count: 1
- containsDocument:
kind: StatefulSet
apiVersion: apps/v1
name: gitea-unittests-actions-act-runner
- equal:
path: spec.template.spec.securityContext["fsGroupChangePolicy"]
value: "Always"
- it: doesn't renders a StatefulSet by default
template: templates/statefulset.yaml
asserts:

2
values.yaml
View File

@@ -31,6 +31,7 @@
## @param statefulset.dind.extraVolumeMounts Allows mounting extra volumes in the Docker-in-Docker container
## @param statefulset.dind.extraEnvs Allows adding custom environment variables, such as `DOCKER_IPTABLES_LEGACY`
## @param statefulset.persistence.size Size for persistence to store act runner data
## @param statefulset.securityContext Customize the SecurityContext
## @param existingSecret Secret that contains the token
## @param existingSecretKey Secret key
## @param giteaRootURL URL the act_runner registers and connect with
@@ -45,6 +46,7 @@ statefulset:
tolerations: []
affinity: {}
extraVolumes: []
securityContext: {}
actRunner:
registry: "docker.gitea.com"