refactor(serviceAccount)!: group the values into existingServiceAccount and new

The previous notation mixed two concerns in a single flat dict: `create`/`name` decided whether the chart manages the
ServiceAccount or only references an externally provided one, while the remaining keys only ever applied to a
chart-managed ServiceAccount. That made `name` ambiguous, because it either renamed the generated object or pointed to a
foreign one, and it forced the deployment to guard the reference with `or .Values.serviceAccount.create
.Values.serviceAccount.name`.

The values are now grouped the same way as `persistence`, which was restructured in dfe087c. `serviceAccount.enabled`
controls whether the pod uses a ServiceAccount at all, `serviceAccount.existingServiceAccount` references an externally
managed object and `serviceAccount.new` holds the properties of the object created by the chart. The templates follow
the established helper layout in `templates/gitea/_serviceAccounts.tpl`.

Two latent bugs are fixed along the way. The annotation helper was defined as `gitea.secret.admin.annotations`, so the
`gitea.serviceAccount.annotations` include in the template never resolved. And the duplicated name helper
`gitea.serviceAccountName` in `templates/_helpers.tpl` is removed in favour of `gitea.serviceAccount.name`.

BREAKING CHANGE:
- `serviceAccount.create` does no longer exist. Use `serviceAccount.enabled` instead. The default changed from `false`
  to `true`, so a ServiceAccount is now created unless it is explicitly disabled.
- `serviceAccount.name` does no longer exist. Use `serviceAccount.existingServiceAccount.enabled` together with
  `serviceAccount.existingServiceAccount.existingServiceAccountName` to reference an externally managed ServiceAccount.
- `serviceAccount.annotations`, `serviceAccount.labels`, `serviceAccount.automountServiceAccountToken` and
  `serviceAccount.imagePullSecrets` moved below `serviceAccount.new`.

Co-authored-by: Copilot <copilot@github.com>

templates/_helpers.tpl

@@ -493,10 +493,6 @@ https
   {{- end -}}
 {{- end -}}
 
-{{- define "gitea.serviceAccountName" -}}
-{{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
-{{- end -}}
-
 {{- define "ingress.annotations" -}}
   {{- if .Values.ingress.annotations }}
   annotations:

templates/gitea/_serviceAccounts.tpl

@@ -0,0 +1,38 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.serviceAccount.annotations" -}}
+{{- with .Values.serviceAccount.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.serviceAccount.enabled" -}}
+{{- if and .Values.serviceAccount.enabled (not .Values.serviceAccount.existingServiceAccount.enabled) -}}
+true
+{{- else -}}
+false
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.serviceAccount.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.serviceAccount.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* name */}}
+
+{{- define "gitea.serviceAccount.name" -}}
+{{- if .Values.serviceAccount.existingServiceAccount.enabled -}}
+{{ required "serviceAccount.existingServiceAccount.existingServiceAccountName is required when serviceAccount.existingServiceAccount.enabled is true" .Values.serviceAccount.existingServiceAccount.existingServiceAccountName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}
+{{- end }}
+{{- end }}

templates/gitea/deployment.yaml

@@ -42,8 +42,8 @@ spec:
       {{- if .Values.deployment.schedulerName }}
       schedulerName: "{{ .Values.deployment.schedulerName }}"
       {{- end }}
-      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
-      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
+      {{- if .Values.serviceAccount.enabled }}
+      serviceAccountName: {{ include "gitea.serviceAccount.name" . }}
       {{- end }}
       {{- if .Values.deployment.priorityClassName }}
       priorityClassName: "{{ .Values.deployment.priorityClassName }}"

templates/gitea/serviceAccount.yaml

@@ -1,20 +1,20 @@
-{{- if .Values.serviceAccount.create }}
+{{- if eq (include "gitea.serviceAccount.enabled" .) "true" }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "gitea.serviceAccountName" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-    {{- with .Values.serviceAccount.labels }}
-    {{- . | toYaml | nindent 4 }}
-  {{- end }}
-  {{- with .Values.serviceAccount.annotations }}
+  {{- with (include "gitea.serviceAccount.annotations" .) }}
   annotations:
-    {{- . | toYaml | nindent 4 }}
+    {{- . | nindent 4 }}
   {{- end }}
-automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
-{{- with .Values.serviceAccount.imagePullSecrets }}
+  {{- with (include "gitea.serviceAccount.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.serviceAccount.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+automountServiceAccountToken: {{ .Values.serviceAccount.new.automountServiceAccountToken }}
+{{- with .Values.serviceAccount.new.imagePullSecrets }}
 imagePullSecrets:
   {{- . | toYaml | nindent 2 }}
 {{- end }}