feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

templates/_secrets.tpl

@@ -8,6 +8,12 @@
 {{- end }}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.annotations" -}}
+{{- with .Values.cloudnativePG.credentials.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.annotations" -}}
 {{- with .Values.secrets.config.new.annotations }}
 {{- toYaml . -}}
@@ -49,7 +55,11 @@ Arguments: (list $root $key)
 {{- define "gitea.secret.checksum" -}}
 {{- $root := index . 0 -}}
 {{- $key := index . 1 -}}
-{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
+{{- $config := index $root.Values.secrets $key -}}
+{{- if eq $key "cloudnativePG" -}}
+{{- $config = $root.Values.cloudnativePG.credentials -}}
+{{- end -}}
+{{- if $config.existingSecret.enabled -}}
 {{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
 {{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
 {{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
@@ -68,6 +78,13 @@ Arguments: (list $root $key)
 {{- end }}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.cloudnativePG.credentials.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.config.new.labels }}
@@ -113,6 +130,14 @@ Arguments: (list $root $key)
 {{- end -}}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.name" -}}
+{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
+{{ required "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" .Values.cloudnativePG.credentials.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.cluster.cloudnativePG.name" . }}-app
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.config.name" -}}
 {{- if .Values.secrets.config.existingSecret.enabled -}}
 {{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
@@ -179,6 +204,14 @@ username
 {{- end -}}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.passwordKey" -}}
+{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
+{{ .Values.cloudnativePG.credentials.existingSecret.passwordKey }}
+{{- else -}}
+password
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.gpg.gpgHomeKey" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}