feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

templates/_clusters.tpl

@@ -0,0 +1,24 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.cluster.cloudnativePG.annotations" -}}
+{{- with .Values.cloudnativePG.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.cluster.cloudnativePG.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.cloudnativePG.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* names */}}
+
+{{- define "gitea.cluster.cloudnativePG.name" -}}
+{{ include "gitea.fullname" . }}-postgresql
+{{- end }}

templates/_helpers.tpl

@@ -174,9 +174,9 @@ app.kubernetes.io/name: {{ include "gitea.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
-{{- define "postgresql-ha.dns" -}}
-{{- if (index .Values "postgresql-ha").enabled -}}
-{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}}
+{{- define "cloudnativePG.dns" -}}
+{{- if .Values.cloudnativePG.enabled -}}
+{{- printf "%s-rw.%s.svc.%s:5432" (include "gitea.cluster.cloudnativePG.name" .) (.Values.namespace | default .Release.Namespace) .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
 
@@ -441,14 +441,14 @@ https
 {{- end -}}
 
 {{- define "gitea.inline_configuration.defaults.database" -}}
-  {{- if (index .Values "postgresql-ha" "enabled") -}}
+  {{- if .Values.cloudnativePG.enabled -}}
+    {{/* PASSWD is injected as an env-to-ini variable from the credentials Secret. */}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}
     {{- if not (.Values.gitea.config.database.HOST) -}}
-      {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql-ha.dns" .) -}}
+      {{- $_ := set .Values.gitea.config.database "HOST"      (include "cloudnativePG.dns" .) -}}
     {{- end -}}
-    {{- $_ := set .Values.gitea.config.database "NAME"      (index .Values "postgresql-ha" "global" "postgresql" "database") -}}
-    {{- $_ := set .Values.gitea.config.database "USER"      (index .Values "postgresql-ha" "global" "postgresql" "username") -}}
-    {{- $_ := set .Values.gitea.config.database "PASSWD"    (index .Values "postgresql-ha" "global" "postgresql" "password") -}}
+    {{- $_ := set .Values.gitea.config.database "NAME"      .Values.cloudnativePG.credentials.database -}}
+    {{- $_ := set .Values.gitea.config.database "USER"      .Values.cloudnativePG.credentials.username -}}
   {{- end -}}
   {{- if (index .Values "postgresql" "enabled") -}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}

templates/_initContainers.tpl

@@ -84,6 +84,13 @@
       value: /tmp/existing-envs
     - name: ENV_TO_INI_MOUNT_POINT
       value: /env-to-ini-mounts
+    {{- if .Values.cloudnativePG.enabled }}
+    - name: GITEA__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          key: {{ include "gitea.secret.cloudnativePG.passwordKey" . }}
+          name: {{ include "gitea.secret.cloudnativePG.name" . }}
+    {{- end }}
     {{- if .Values.deployment.gitea.env }}
     {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
     {{- end }}

templates/_pods.tpl

@@ -9,6 +9,11 @@
 checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
 {{- end }}
 
+{{/* secret - cloudnativePG */}}
+{{- if and .Values.cloudnativePG.enabled .Values.cloudnativePG.credentials.addSHASumAnnotation }}
+checksum/cloudnativePG: {{ include "gitea.secret.checksum" (list . "cloudnativePG") }}
+{{- end }}
+
 {{/* secret - config */}}
 {{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
 checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}

templates/_secrets.tpl

@@ -8,6 +8,12 @@
 {{- end }}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.annotations" -}}
+{{- with .Values.cloudnativePG.credentials.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.annotations" -}}
 {{- with .Values.secrets.config.new.annotations }}
 {{- toYaml . -}}
@@ -49,7 +55,11 @@ Arguments: (list $root $key)
 {{- define "gitea.secret.checksum" -}}
 {{- $root := index . 0 -}}
 {{- $key := index . 1 -}}
-{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
+{{- $config := index $root.Values.secrets $key -}}
+{{- if eq $key "cloudnativePG" -}}
+{{- $config = $root.Values.cloudnativePG.credentials -}}
+{{- end -}}
+{{- if $config.existingSecret.enabled -}}
 {{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
 {{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
 {{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
@@ -68,6 +78,13 @@ Arguments: (list $root $key)
 {{- end }}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.cloudnativePG.credentials.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.config.new.labels }}
@@ -113,6 +130,14 @@ Arguments: (list $root $key)
 {{- end -}}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.name" -}}
+{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
+{{ required "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" .Values.cloudnativePG.credentials.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.cluster.cloudnativePG.name" . }}-app
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.config.name" -}}
 {{- if .Values.secrets.config.existingSecret.enabled -}}
 {{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
@@ -179,6 +204,14 @@ username
 {{- end -}}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.passwordKey" -}}
+{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
+{{ .Values.cloudnativePG.credentials.existingSecret.passwordKey }}
+{{- else -}}
+password
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.gpg.gpgHomeKey" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}

templates/cluster.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.cloudnativePG.enabled -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.cloudnativePG.image.registry -}}
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  {{- with (include "gitea.cluster.cloudnativePG.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.cluster.cloudnativePG.labels" . | nindent 4 }}
+  name: {{ include "gitea.cluster.cloudnativePG.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  affinity:
+    {{- toYaml .Values.cloudnativePG.affinity | nindent 4 }}
+  bootstrap:
+    initdb:
+      database: {{ .Values.cloudnativePG.credentials.database | quote }}
+      owner: {{ .Values.cloudnativePG.credentials.username | quote }}
+      secret:
+        name: {{ include "gitea.secret.cloudnativePG.name" . }}
+  imageName: {{ printf "%s/%s:%s" $registry .Values.cloudnativePG.image.repository (.Values.cloudnativePG.image.tag | toString) | quote }}
+  instances: {{ .Values.cloudnativePG.instances }}
+  monitoring:
+    enablePodMonitor: {{ .Values.cloudnativePG.monitoring.enablePodMonitor }}
+  postgresql:
+    parameters:
+      {{- toYaml .Values.cloudnativePG.postgresql.parameters | nindent 6 }}
+  priorityClassName: {{ .Values.cloudnativePG.priorityClassName | quote }}
+  resources:
+    {{- toYaml .Values.cloudnativePG.resources | nindent 4 }}
+  storage:
+    size: {{ .Values.cloudnativePG.storage.size | quote }}
+    {{- with .Values.cloudnativePG.storage.storageClass }}
+    storageClass: {{ . | quote }}
+    {{- end }}
+  {{- if .Values.cloudnativePG.walStorage.enabled }}
+  walStorage:
+    size: {{ .Values.cloudnativePG.walStorage.size | quote }}
+    {{- with .Values.cloudnativePG.walStorage.storageClass }}
+    storageClass: {{ . | quote }}
+    {{- end }}
+  {{- end }}
+{{- end -}}

templates/deprecation.yaml

@@ -95,6 +95,11 @@
     {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
   {{- end -}}
 
+  {{/* POSTGRESQL HA */}}
+  {{- if index .Values "postgresql-ha" -}}
+    {{- fail "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}}
+  {{- end -}}
+
   {{/* PRIORITY CLASS NAME */}}
   {{- if .Values.priorityClassName -}}
     {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}

templates/secret_cloudnativePG.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.cloudnativePG.enabled (not .Values.cloudnativePG.credentials.existingSecret.enabled) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.cloudnativePG.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.cloudnativePG.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.cloudnativePG.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: kubernetes.io/basic-auth
+data:
+  password: {{ required "`cloudnativePG.credentials.new.password` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.new.password | b64enc | quote }}
+  {{- /* CloudNativePG requires the username of a basic-auth bootstrap Secret to match the owner of the Cluster. */}}
+  username: {{ required "`cloudnativePG.credentials.username` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.username | b64enc | quote }}
+{{- end -}}

templates/secret_config.yaml

@@ -22,8 +22,8 @@ data:
 {{- define "gitea.config.assertions" -}}
 
   {{- /*assert that only one PG dep is enabled */ -}}
-  {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
-    {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
+  {{- if and (.Values.postgresql.enabled) (.Values.cloudnativePG.enabled) -}}
+    {{- fail "Only one of postgresql or cloudnativePG can be enabled at the same time." -}}
   {{- end }}
 
   {{- /* multiple replicas assertions */ -}}