refactor(serviceAccount)!: group the values into existingServiceAccount and new

The previous notation mixed two concerns in a single flat dict: `create`/`name` decided whether the chart manages the ServiceAccount or only references an externally provided one, while the remaining keys only ever applied to a chart-managed ServiceAccount. That made `name` ambiguous, because it either renamed the generated object or pointed to a foreign one, and it forced the deployment to guard the reference with `or .Values.serviceAccount.create .Values.serviceAccount.name`. The values are now grouped the same way as `persistence`, which was restructured in dfe087c. `serviceAccount.enabled` controls whether the pod uses a ServiceAccount at all, `serviceAccount.existingServiceAccount` references an externally managed object and `serviceAccount.new` holds the properties of the object created by the chart. The templates follow the established helper layout in `templates/gitea/_serviceAccounts.tpl`. Two latent bugs are fixed along the way. The annotation helper was defined as `gitea.secret.admin.annotations`, so the `gitea.serviceAccount.annotations` include in the template never resolved. And the duplicated name helper `gitea.serviceAccountName` in `templates/_helpers.tpl` is removed in favour of `gitea.serviceAccount.name`. BREAKING CHANGE: - `serviceAccount.create` does no longer exist. Use `serviceAccount.enabled` instead. The default changed from `false` to `true`, so a ServiceAccount is now created unless it is explicitly disabled. - `serviceAccount.name` does no longer exist. Use `serviceAccount.existingServiceAccount.enabled` together with `serviceAccount.existingServiceAccount.existingServiceAccountName` to reference an externally managed ServiceAccount. - `serviceAccount.annotations`, `serviceAccount.labels`, `serviceAccount.automountServiceAccountToken` and `serviceAccount.imagePullSecrets` moved below `serviceAccount.new`. Co-authored-by: Copilot <copilot@github.com>
2026-09-14 19:15:58 +02:00
parent dfe087c0c1
commit 0a237ba2c1
9 changed files with 182 additions and 159 deletions
@@ -0,0 +1,102 @@
+chart:
+  appVersion: 1.27.3 # renovate: datasource=docker registryUrl=https://docker.gitea.com depName=gitea
+release:
+  name: gitea-unittests
+  namespace: testing
+suite: ServiceAccount template
+templates:
+  - templates/gitea/serviceAccount.yaml
+tests:
+  - it: Render the ServiceAccount by default
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+          name: gitea-unittests
+          namespace: testing
+      - notExists:
+          path: metadata.annotations
+      - equal:
+          path: metadata.labels
+          value:
+            app: gitea
+            app.kubernetes.io/instance: gitea-unittests
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: gitea
+            app.kubernetes.io/version: 1.27.3 # renovate: datasource=docker registryUrl=https://docker.gitea.com depName=gitea
+            helm.sh/chart: gitea-0.0.0
+            version: 1.27.3 # renovate: datasource=docker registryUrl=https://docker.gitea.com depName=gitea
+      - equal:
+          path: automountServiceAccountToken
+          value: false
+      - notExists:
+          path: imagePullSecrets
+
+  - it: Skip rendering when serviceAccount.enabled is false
+    set:
+      serviceAccount:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: Skip rendering when an existing ServiceAccount is used
+    set:
+      serviceAccount:
+        existingServiceAccount:
+          enabled: true
+          existingServiceAccountName: externally-existing-serviceaccount
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: Add custom labels when serviceAccount.new.labels is defined
+    set:
+      serviceAccount:
+        new:
+          labels:
+            custom: label
+    asserts:
+      - equal:
+          path: metadata.labels.custom
+          value: label
+
+  - it: Add custom annotations when serviceAccount.new.annotations is defined
+    set:
+      serviceAccount:
+        new:
+          annotations:
+            myCustom: annotation
+    asserts:
+      - equal:
+          path: metadata.annotations.myCustom
+          value: annotation
+
+  - it: Mount the token when serviceAccount.new.automountServiceAccountToken is true
+    set:
+      serviceAccount:
+        new:
+          automountServiceAccountToken: true
+    asserts:
+      - equal:
+          path: automountServiceAccountToken
+          value: true
+
+  - it: Reference image pull secrets when serviceAccount.new.imagePullSecrets is defined
+    set:
+      serviceAccount:
+        new:
+          imagePullSecrets:
+            - name: testing-image-pull-secret
+            - name: another-pull-secret
+    asserts:
+      - contains:
+          path: imagePullSecrets
+          content:
+            name: testing-image-pull-secret
+      - contains:
+          path: imagePullSecrets
+          content:
+            name: another-pull-secret
@@ -1,82 +0,0 @@
-suite: ServiceAccount template (basic)
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/serviceAccount.yaml
-tests:
-  - it: skips rendering by default
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: renders default ServiceAccount object with serviceAccount.create=true
-    set:
-      serviceAccount.create: true
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: ServiceAccount
-          apiVersion: v1
-          name: gitea-unittests
-      - equal:
-          path: automountServiceAccountToken
-          value: false
-      - notExists:
-          path: imagePullSecrets
-      - notExists:
-          path: metadata.annotations
-  - it: allows for adding custom labels
-    set:
-      serviceAccount:
-        create: true
-        labels:
-          custom: label
-    asserts:
-      - equal:
-          path: metadata.labels.custom
-          value: label
-  - it: allows for adding custom annotations
-    set:
-      serviceAccount:
-        create: true
-        annotations:
-          myCustom: annotation
-    asserts:
-      - equal:
-          path: metadata.annotations.myCustom
-          value: annotation
-  - it: allows to override the generated name
-    set:
-      serviceAccount:
-        create: true
-        name: provided-serviceaccount-name
-    asserts:
-      - equal:
-          path: metadata.name
-          value: provided-serviceaccount-name
-  - it: allows to mount the token
-    set:
-      serviceAccount:
-        create: true
-        automountServiceAccountToken: true
-    asserts:
-      - equal:
-          path: automountServiceAccountToken
-          value: true
-  - it: allows to reference image pull secrets
-    set:
-      serviceAccount:
-        create: true
-        imagePullSecrets:
-          - name: testing-image-pull-secret
-          - name: another-pull-secret
-    asserts:
-      - contains:
-          path: imagePullSecrets
-          content:
-            name: testing-image-pull-secret
-      - contains:
-          path: imagePullSecrets
-          content:
-            name: another-pull-secret
@@ -1,37 +0,0 @@
-suite: ServiceAccount template (reference)
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/serviceAccount.yaml
-  - templates/gitea/deployment.yaml
-  - templates/gitea/secret_admin.yaml
-  - templates/gitea/secret_config.yaml
-  - templates/gitea/secret_gpg.yaml
-  - templates/gitea/secret_init.yaml
-  - templates/gitea/secret_inlineConfig.yaml
-  - templates/gitea/secret_metrics.yaml
-tests:
-  - it: does not modify the deployment by default
-    template: templates/gitea/deployment.yaml
-    asserts:
-      - notExists:
-          path: spec.serviceAccountName
-  - it: adds the reference to the deployment with serviceAccount.create=true
-    template: templates/gitea/deployment.yaml
-    set:
-      serviceAccount.create: true
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: gitea-unittests
-  - it: allows referencing an externally created ServiceAccount to the deployment
-    template: templates/gitea/deployment.yaml
-    set:
-      serviceAccount:
-        create: false # explicitly set to define rendering behavior
-        name: "externally-existing-serviceaccount"
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: externally-existing-serviceaccount