refactor(serviceAccount)!: group the values into existingServiceAccount and new

The previous notation mixed two concerns in a single flat dict: `create`/`name` decided whether the chart manages the
ServiceAccount or only references an externally provided one, while the remaining keys only ever applied to a
chart-managed ServiceAccount. That made `name` ambiguous, because it either renamed the generated object or pointed to a
foreign one, and it forced the deployment to guard the reference with `or .Values.serviceAccount.create
.Values.serviceAccount.name`.

The values are now grouped the same way as `persistence`, which was restructured in dfe087c. `serviceAccount.enabled`
controls whether the pod uses a ServiceAccount at all, `serviceAccount.existingServiceAccount` references an externally
managed object and `serviceAccount.new` holds the properties of the object created by the chart. The templates follow
the established helper layout in `templates/gitea/_serviceAccounts.tpl`.

Two latent bugs are fixed along the way. The annotation helper was defined as `gitea.secret.admin.annotations`, so the
`gitea.serviceAccount.annotations` include in the template never resolved. And the duplicated name helper
`gitea.serviceAccountName` in `templates/_helpers.tpl` is removed in favour of `gitea.serviceAccount.name`.

BREAKING CHANGE:
- `serviceAccount.create` does no longer exist. Use `serviceAccount.enabled` instead. The default changed from `false`
  to `true`, so a ServiceAccount is now created unless it is explicitly disabled.
- `serviceAccount.name` does no longer exist. Use `serviceAccount.existingServiceAccount.enabled` together with
  `serviceAccount.existingServiceAccount.existingServiceAccountName` to reference an externally managed ServiceAccount.
- `serviceAccount.annotations`, `serviceAccount.labels`, `serviceAccount.automountServiceAccountToken` and
  `serviceAccount.imagePullSecrets` moved below `serviceAccount.new`.

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -1275,14 +1275,15 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 
 ### ServiceAccount
 
-| Name                                          | Description                                                                                                                               | Value   |
-| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `serviceAccount.create`                       | Enable the creation of a ServiceAccount.                                                                                                  | `false` |
-| `serviceAccount.name`                         | Name of the created ServiceAccount, defaults to release name. Can also link to an externally provided ServiceAccount that should be used. | `""`    |
-| `serviceAccount.automountServiceAccountToken` | Enable/disable auto mounting of the service account token.                                                                                | `false` |
-| `serviceAccount.imagePullSecrets`             | Image pull secrets, available to the ServiceAccount.                                                                                      | `[]`    |
-| `serviceAccount.annotations`                  | Custom annotations for the ServiceAccount.                                                                                                | `{}`    |
-| `serviceAccount.labels`                       | Custom labels for the ServiceAccount.                                                                                                     | `{}`    |
+| Name                                                               | Description                                                | Value   |
+| ------------------------------------------------------------------ | ---------------------------------------------------------- | ------- |
+| `serviceAccount.enabled`                                           | Assign the pod to use the ServiceAccount.                  | `true`  |
+| `serviceAccount.existingServiceAccount.enabled`                    | Enable using an existing ServiceAccount.                   | `false` |
+| `serviceAccount.existingServiceAccount.existingServiceAccountName` | Name of the existing ServiceAccount to use.                | `""`    |
+| `serviceAccount.new.annotations`                                   | Custom annotations for the ServiceAccount.                 | `{}`    |
+| `serviceAccount.new.labels`                                        | Custom labels for the ServiceAccount.                      | `{}`    |
+| `serviceAccount.new.automountServiceAccountToken`                  | Enable/disable auto mounting of the service account token. | `false` |
+| `serviceAccount.new.imagePullSecrets`                              | Image pull secrets, available to the ServiceAccount.       | `[]`    |
 
 ### Persistence
 

templates/_helpers.tpl

@@ -493,10 +493,6 @@ https
   {{- end -}}
 {{- end -}}
 
-{{- define "gitea.serviceAccountName" -}}
-{{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
-{{- end -}}
-
 {{- define "ingress.annotations" -}}
   {{- if .Values.ingress.annotations }}
   annotations:

templates/gitea/_serviceAccounts.tpl

@@ -0,0 +1,38 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.serviceAccount.annotations" -}}
+{{- with .Values.serviceAccount.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.serviceAccount.enabled" -}}
+{{- if and .Values.serviceAccount.enabled (not .Values.serviceAccount.existingServiceAccount.enabled) -}}
+true
+{{- else -}}
+false
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.serviceAccount.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.serviceAccount.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* name */}}
+
+{{- define "gitea.serviceAccount.name" -}}
+{{- if .Values.serviceAccount.existingServiceAccount.enabled -}}
+{{ required "serviceAccount.existingServiceAccount.existingServiceAccountName is required when serviceAccount.existingServiceAccount.enabled is true" .Values.serviceAccount.existingServiceAccount.existingServiceAccountName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}
+{{- end }}
+{{- end }}

templates/gitea/deployment.yaml

@@ -42,8 +42,8 @@ spec:
       {{- if .Values.deployment.schedulerName }}
       schedulerName: "{{ .Values.deployment.schedulerName }}"
       {{- end }}
-      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
-      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
+      {{- if .Values.serviceAccount.enabled }}
+      serviceAccountName: {{ include "gitea.serviceAccount.name" . }}
       {{- end }}
       {{- if .Values.deployment.priorityClassName }}
       priorityClassName: "{{ .Values.deployment.priorityClassName }}"

templates/gitea/serviceAccount.yaml

@@ -1,20 +1,20 @@
-{{- if .Values.serviceAccount.create }}
+{{- if eq (include "gitea.serviceAccount.enabled" .) "true" }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "gitea.serviceAccountName" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-    {{- with .Values.serviceAccount.labels }}
-    {{- . | toYaml | nindent 4 }}
-  {{- end }}
-  {{- with .Values.serviceAccount.annotations }}
+  {{- with (include "gitea.serviceAccount.annotations" .) }}
   annotations:
-    {{- . | toYaml | nindent 4 }}
+    {{- . | nindent 4 }}
   {{- end }}
-automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
-{{- with .Values.serviceAccount.imagePullSecrets }}
+  {{- with (include "gitea.serviceAccount.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.serviceAccount.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+automountServiceAccountToken: {{ .Values.serviceAccount.new.automountServiceAccountToken }}
+{{- with .Values.serviceAccount.new.imagePullSecrets }}
 imagePullSecrets:
   {{- . | toYaml | nindent 2 }}
 {{- end }}

unittests/helm/serviceAccount/serviceAccount.yaml

@@ -0,0 +1,102 @@
+chart:
+  appVersion: 1.27.3 # renovate: datasource=docker registryUrl=https://docker.gitea.com depName=gitea
+release:
+  name: gitea-unittests
+  namespace: testing
+suite: ServiceAccount template
+templates:
+  - templates/gitea/serviceAccount.yaml
+tests:
+  - it: Render the ServiceAccount by default
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: ServiceAccount
+          apiVersion: v1
+          name: gitea-unittests
+          namespace: testing
+      - notExists:
+          path: metadata.annotations
+      - equal:
+          path: metadata.labels
+          value:
+            app: gitea
+            app.kubernetes.io/instance: gitea-unittests
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: gitea
+            app.kubernetes.io/version: 1.27.3 # renovate: datasource=docker registryUrl=https://docker.gitea.com depName=gitea
+            helm.sh/chart: gitea-0.0.0
+            version: 1.27.3 # renovate: datasource=docker registryUrl=https://docker.gitea.com depName=gitea
+      - equal:
+          path: automountServiceAccountToken
+          value: false
+      - notExists:
+          path: imagePullSecrets
+
+  - it: Skip rendering when serviceAccount.enabled is false
+    set:
+      serviceAccount:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: Skip rendering when an existing ServiceAccount is used
+    set:
+      serviceAccount:
+        existingServiceAccount:
+          enabled: true
+          existingServiceAccountName: externally-existing-serviceaccount
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: Add custom labels when serviceAccount.new.labels is defined
+    set:
+      serviceAccount:
+        new:
+          labels:
+            custom: label
+    asserts:
+      - equal:
+          path: metadata.labels.custom
+          value: label
+
+  - it: Add custom annotations when serviceAccount.new.annotations is defined
+    set:
+      serviceAccount:
+        new:
+          annotations:
+            myCustom: annotation
+    asserts:
+      - equal:
+          path: metadata.annotations.myCustom
+          value: annotation
+
+  - it: Mount the token when serviceAccount.new.automountServiceAccountToken is true
+    set:
+      serviceAccount:
+        new:
+          automountServiceAccountToken: true
+    asserts:
+      - equal:
+          path: automountServiceAccountToken
+          value: true
+
+  - it: Reference image pull secrets when serviceAccount.new.imagePullSecrets is defined
+    set:
+      serviceAccount:
+        new:
+          imagePullSecrets:
+            - name: testing-image-pull-secret
+            - name: another-pull-secret
+    asserts:
+      - contains:
+          path: imagePullSecrets
+          content:
+            name: testing-image-pull-secret
+      - contains:
+          path: imagePullSecrets
+          content:
+            name: another-pull-secret

unittests/helm/serviceaccount/basic.yaml

@@ -1,82 +0,0 @@
-suite: ServiceAccount template (basic)
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/serviceAccount.yaml
-tests:
-  - it: skips rendering by default
-    asserts:
-      - hasDocuments:
-          count: 0
-  - it: renders default ServiceAccount object with serviceAccount.create=true
-    set:
-      serviceAccount.create: true
-    asserts:
-      - hasDocuments:
-          count: 1
-      - containsDocument:
-          kind: ServiceAccount
-          apiVersion: v1
-          name: gitea-unittests
-      - equal:
-          path: automountServiceAccountToken
-          value: false
-      - notExists:
-          path: imagePullSecrets
-      - notExists:
-          path: metadata.annotations
-  - it: allows for adding custom labels
-    set:
-      serviceAccount:
-        create: true
-        labels:
-          custom: label
-    asserts:
-      - equal:
-          path: metadata.labels.custom
-          value: label
-  - it: allows for adding custom annotations
-    set:
-      serviceAccount:
-        create: true
-        annotations:
-          myCustom: annotation
-    asserts:
-      - equal:
-          path: metadata.annotations.myCustom
-          value: annotation
-  - it: allows to override the generated name
-    set:
-      serviceAccount:
-        create: true
-        name: provided-serviceaccount-name
-    asserts:
-      - equal:
-          path: metadata.name
-          value: provided-serviceaccount-name
-  - it: allows to mount the token
-    set:
-      serviceAccount:
-        create: true
-        automountServiceAccountToken: true
-    asserts:
-      - equal:
-          path: automountServiceAccountToken
-          value: true
-  - it: allows to reference image pull secrets
-    set:
-      serviceAccount:
-        create: true
-        imagePullSecrets:
-          - name: testing-image-pull-secret
-          - name: another-pull-secret
-    asserts:
-      - contains:
-          path: imagePullSecrets
-          content:
-            name: testing-image-pull-secret
-      - contains:
-          path: imagePullSecrets
-          content:
-            name: another-pull-secret

unittests/helm/serviceaccount/reference.yaml

@@ -1,37 +0,0 @@
-suite: ServiceAccount template (reference)
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/serviceAccount.yaml
-  - templates/gitea/deployment.yaml
-  - templates/gitea/secret_admin.yaml
-  - templates/gitea/secret_config.yaml
-  - templates/gitea/secret_gpg.yaml
-  - templates/gitea/secret_init.yaml
-  - templates/gitea/secret_inlineConfig.yaml
-  - templates/gitea/secret_metrics.yaml
-tests:
-  - it: does not modify the deployment by default
-    template: templates/gitea/deployment.yaml
-    asserts:
-      - notExists:
-          path: spec.serviceAccountName
-  - it: adds the reference to the deployment with serviceAccount.create=true
-    template: templates/gitea/deployment.yaml
-    set:
-      serviceAccount.create: true
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: gitea-unittests
-  - it: allows referencing an externally created ServiceAccount to the deployment
-    template: templates/gitea/deployment.yaml
-    set:
-      serviceAccount:
-        create: false # explicitly set to define rendering behavior
-        name: "externally-existing-serviceaccount"
-    asserts:
-      - equal:
-          path: spec.template.spec.serviceAccountName
-          value: externally-existing-serviceaccount

values.yaml

@@ -82,7 +82,6 @@ deployment:
     image:
       registry: "docker.gitea.com"
       repository: gitea
-      # Overrides the image tag whose default is the chart appVersion.
       tag: ""
       digest: ""
       pullPolicy: IfNotPresent
@@ -869,20 +868,26 @@ service:
 
 
 ## @section ServiceAccount
-## @param serviceAccount.create Enable the creation of a ServiceAccount.
-## @param serviceAccount.name Name of the created ServiceAccount, defaults to release name. Can also link to an externally provided ServiceAccount that should be used.
-## @param serviceAccount.automountServiceAccountToken Enable/disable auto mounting of the service account token.
-## @param serviceAccount.imagePullSecrets Image pull secrets, available to the ServiceAccount.
-## @param serviceAccount.annotations Custom annotations for the ServiceAccount.
-## @param serviceAccount.labels Custom labels for the ServiceAccount.
 serviceAccount:
-  create: false
-  name: ""
-  automountServiceAccountToken: false
-  imagePullSecrets: []
-  # - name: private-registry-access
-  annotations: {}
-  labels: {}
+  ## @param serviceAccount.enabled Assign the pod to use the ServiceAccount.
+  enabled: true
+
+  ## @param serviceAccount.existingServiceAccount.enabled Enable using an existing ServiceAccount.
+  ## @param serviceAccount.existingServiceAccount.existingServiceAccountName Name of the existing ServiceAccount to use.
+  existingServiceAccount:
+    enabled: false
+    existingServiceAccountName: ""
+
+  ## @param serviceAccount.new.annotations Custom annotations for the ServiceAccount.
+  ## @param serviceAccount.new.labels Custom labels for the ServiceAccount.
+  ## @param serviceAccount.new.automountServiceAccountToken Enable/disable auto mounting of the service account token.
+  ## @param serviceAccount.new.imagePullSecrets Image pull secrets, available to the ServiceAccount.
+  new:
+    annotations: {}
+    labels: {}
+    automountServiceAccountToken: false
+    imagePullSecrets: []
+    # - name: private-registry-access
 
 ## @section Persistence
 persistence: