feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/cluster/basics.yaml

@@ -0,0 +1,131 @@
+suite: Test cluster basics
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "Render nothing when cloudnativePG is disabled"
+    templates:
+      - templates/cluster.yaml
+      - templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: "Render the Cluster with the default values"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - containsDocument:
+          kind: Cluster
+          apiVersion: postgresql.cnpg.io/v1
+          name: gitea-unittests-postgresql
+          namespace: testing
+      - equal:
+          path: spec.instances
+          value: 3
+      - equal:
+          path: spec.imageName
+          value: "ghcr.io/cloudnative-pg/postgresql:18.0"
+      - equal:
+          path: spec.bootstrap.initdb
+          value:
+            database: "gitea"
+            owner: "gitea"
+            secret:
+              name: gitea-unittests-postgresql-app
+      - equal:
+          path: spec.storage.size
+          value: "10Gi"
+      - notExists:
+          path: spec.storage.storageClass
+      - notExists:
+          path: spec.walStorage
+
+  - it: "Render the credential Secret with the default values"
+    template: templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-postgresql-app
+          namespace: testing
+      - equal:
+          path: type
+          value: kubernetes.io/basic-auth
+      - equal:
+          path: data.password
+          decodeBase64: true
+          value: "gitea"
+      - equal:
+          path: data.username
+          decodeBase64: true
+          value: "gitea"
+      - notExists:
+          path: data.database
+      - notExists:
+          path: stringData
+
+  - it: "Render no credential Secret when an existing Secret is used"
+    template: templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: "Reference the existing Secret in the Cluster"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+          database: my-database
+          username: my-username
+    asserts:
+      - equal:
+          path: spec.bootstrap.initdb
+          value:
+            database: "my-database"
+            owner: "my-username"
+            secret:
+              name: my-credentials
+
+  - it: "Apply the storage and walStorage customizations"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        storage:
+          size: 1337Mi
+          storageClass: my-storage-class
+        walStorage:
+          enabled: true
+          size: 42Mi
+          storageClass: my-wal-storage-class
+    asserts:
+      - equal:
+          path: spec.storage
+          value:
+            size: "1337Mi"
+            storageClass: "my-storage-class"
+      - equal:
+          path: spec.walStorage
+          value:
+            size: "42Mi"
+            storageClass: "my-wal-storage-class"

unittests/helm/config/database.yaml

@@ -0,0 +1,59 @@
+suite: Test config database
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "Connect to the read-write Service of the CloudNativePG Cluster"
+    template: templates/secret_inlineConfig.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: data.database
+          decodeBase64: true
+          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
+
+  - it: "Connect to the read-write Service of the CloudNativePG Cluster with a custom cluster domain"
+    template: templates/secret_inlineConfig.yaml
+    set:
+      clusterDomain: my-special-cluster.local
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: data.database
+          decodeBase64: true
+          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.my-special-cluster.local:5432
+
+  - it: "Connect to the configured CloudNativePG database"
+    template: templates/secret_inlineConfig.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          database: gitea-database
+          username: gitea-username
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data.database
+          decodeBase64: true
+          value: |-
+            DB_TYPE=postgres
+            HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
+            NAME=gitea-database
+            USER=gitea-username
+
+  - it: "Fail when postgresql and cloudnativePG are enabled at the same time"
+    template: templates/secret_config.yaml
+    set:
+      postgresql:
+        enabled: true
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "Only one of postgresql or cloudnativePG can be enabled at the same time."

unittests/helm/dependency-checks/customizationIntegrityPostgresql.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 set:
-  postgresql-ha:
+  cloudnativePG:
     enabled: false
   postgresql:
     enabled: true

unittests/helm/dependency-checks/customizationIntegrityPostgresqlHA.yaml

@@ -1,129 +0,0 @@
-suite: Test dependency customization integrity of postgresql-ha
-release:
-  name: gitea-unittests
-  namespace: testing
-set:
-  postgresql:
-    enabled: false
-  postgresql-ha:
-    enabled: true
-    global:
-      postgresql:
-        database: gitea-database
-        password: gitea-password
-        username: gitea-username
-    postgresql:
-      repmgrPassword: custom-password-repmgr
-      postgresPassword: custom-password-postgres
-      password: custom-password-overwritten-by-global-postgresql-password
-    pgpool:
-      adminPassword: custom-password-pgpool
-      srCheckPassword: custom-password-sr-check
-    service:
-      ports:
-        postgresql: 1234
-    persistence:
-      size: 1337Mi
-tests:
-  - it: "[postgresql-ha] Apply the database settings"
-    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
-    asserts:
-      - documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: POSTGRES_DB
-            value: "gitea-database"
-      - documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: POSTGRES_USER
-            value: "gitea-username"
-  - it: "[postgresql-ha] Apply the database passwords"
-    template: charts/postgresql-ha/templates/postgresql/secrets.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data["repmgr-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXJlcG1ncg=="
-      - documentIndex: 0
-        equal:
-          path: data["postgres-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXBvc3RncmVz"
-      - documentIndex: 0
-        equal:
-          path: data["password"]
-          value: "Z2l0ZWEtcGFzc3dvcmQ=" # postgresql-ha.postgresql.password is overwritten by postgresql-ha.global.postgresql.password and should not be referenced here
-  - it: "[postgresql-ha] Apply pgpool.adminPassword"
-    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data["admin-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
-  - it: "[postgresql-ha] Apply pgpool.srCheckPassword"
-    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data["sr-check-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXNyLWNoZWNr"
-  - it: "[postgresql-ha] Apply persistence.size"
-    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
-          value: "1337Mi"
-  - it: "[postgresql-ha] Apply service.ports.postgresql"
-    template: charts/postgresql-ha/templates/pgpool/service.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: spec.ports[0].port
-          value: 1234
-  - it: "[postgresql-ha] Render the referenced Service"
-    template: charts/postgresql-ha/templates/pgpool/service.yaml
-    asserts:
-      - containsDocument:
-          kind: Service
-          apiVersion: v1
-          name: gitea-unittests-postgresql-ha-pgpool
-          namespace: testing
-  - it: "[gitea] Connect to the pgpool Service"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
-  - it: "[gitea] Connect to the pgpool Service with a custom cluster domain"
-    set:
-      clusterDomain: my-special-cluster.local
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
-  - it: "[gitea] Connect to the configured database"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: NAME=gitea-database
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: USER=gitea-username
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: PASSWD=gitea-password

unittests/helm/dependency-checks/majorImageBump.yaml

@@ -3,25 +3,12 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "[postgresql-ha] Detect major image version upgrades"
-    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
-    set:
-      postgresql:
-        enabled: false
-      postgresql-ha:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: spec.template.spec.containers[0].image
-          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnamilegacy/postgresql-repmgr:17.+$
   - it: "[postgresql] Detect major image version upgrades"
     template: charts/postgresql/templates/primary/statefulset.yaml
     set:
       postgresql:
         enabled: true
-      postgresql-ha:
+      cloudnativePG:
         enabled: false
     asserts:
       - documentIndex: 0

unittests/helm/deployment/checksumAnnotations.yaml

@@ -5,6 +5,7 @@ release:
 templates:
   - templates/deployment.yaml
   - templates/secret_admin.yaml
+  - templates/secret_cloudnativePG.yaml
   - templates/secret_config.yaml
   - templates/secret_gpg.yaml
   - templates/secret_init.yaml
@@ -14,6 +15,8 @@ tests:
   - it: "Omit the checksum annotations by default"
     template: templates/deployment.yaml
     set:
+      cloudnativePG.enabled: true
+
       secrets.admin.enabled: true
       secrets.config.enabled: true
       secrets.gpg.enabled: true
@@ -26,6 +29,8 @@ tests:
     asserts:
       - notExists:
           path: spec.template.metadata.annotations["checksum/admin"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/cloudnativePG"]
       - notExists:
           path: spec.template.metadata.annotations["checksum/config"]
       - notExists:
@@ -40,6 +45,9 @@ tests:
   - it: "Add a checksum annotation for every Secret when addSHASumAnnotation is enabled"
     template: templates/deployment.yaml
     set:
+      cloudnativePG.credentials.addSHASumAnnotation: true
+      cloudnativePG.enabled: true
+
       secrets.admin.addSHASumAnnotation: true
       secrets.admin.enabled: true
 
@@ -63,6 +71,8 @@ tests:
     asserts:
       - exists:
           path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/cloudnativePG"]
       - exists:
           path: spec.template.metadata.annotations["checksum/config"]
       - exists:

unittests/helm/deployment/cloudnativePG.yaml

@@ -0,0 +1,67 @@
+suite: Test deployment cloudnativePG credentials
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/deployment.yaml
+  - templates/secret_cloudnativePG.yaml
+tests:
+  - it: "Inject no database password when cloudnativePG is disabled"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+          any: true
+
+  - it: "Inject the database password from the rendered Secret"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: gitea-unittests-postgresql-app
+
+  - it: "Inject the database password from an existing Secret"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+            passwordKey: my-password-key
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+            valueFrom:
+              secretKeyRef:
+                key: my-password-key
+                name: my-credentials
+
+  - it: "Fail when an existing Secret is used without a name"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled"

unittests/helm/deprecation/deployment.yaml

@@ -98,6 +98,13 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead."
+  - it: "Fail when the removed `postgresql-ha` value is set"
+    set:
+      postgresql-ha:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster."
   - it: "Fail when the removed `priorityClassName` value is set"
     set:
       priorityClassName: high-priority