feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/deployment/checksumAnnotations.yaml

@@ -5,6 +5,7 @@ release:
 templates:
   - templates/deployment.yaml
   - templates/secret_admin.yaml
+  - templates/secret_cloudnativePG.yaml
   - templates/secret_config.yaml
   - templates/secret_gpg.yaml
   - templates/secret_init.yaml
@@ -14,6 +15,8 @@ tests:
   - it: "Omit the checksum annotations by default"
     template: templates/deployment.yaml
     set:
+      cloudnativePG.enabled: true
+
       secrets.admin.enabled: true
       secrets.config.enabled: true
       secrets.gpg.enabled: true
@@ -26,6 +29,8 @@ tests:
     asserts:
       - notExists:
           path: spec.template.metadata.annotations["checksum/admin"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/cloudnativePG"]
       - notExists:
           path: spec.template.metadata.annotations["checksum/config"]
       - notExists:
@@ -40,6 +45,9 @@ tests:
   - it: "Add a checksum annotation for every Secret when addSHASumAnnotation is enabled"
     template: templates/deployment.yaml
     set:
+      cloudnativePG.credentials.addSHASumAnnotation: true
+      cloudnativePG.enabled: true
+
       secrets.admin.addSHASumAnnotation: true
       secrets.admin.enabled: true
 
@@ -63,6 +71,8 @@ tests:
     asserts:
       - exists:
           path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/cloudnativePG"]
       - exists:
           path: spec.template.metadata.annotations["checksum/config"]
       - exists:

unittests/helm/deployment/cloudnativePG.yaml

@@ -0,0 +1,67 @@
+suite: Test deployment cloudnativePG credentials
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/deployment.yaml
+  - templates/secret_cloudnativePG.yaml
+tests:
+  - it: "Inject no database password when cloudnativePG is disabled"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+          any: true
+
+  - it: "Inject the database password from the rendered Secret"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: gitea-unittests-postgresql-app
+
+  - it: "Inject the database password from an existing Secret"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+            passwordKey: my-password-key
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+            valueFrom:
+              secretKeyRef:
+                key: my-password-key
+                name: my-credentials
+
+  - it: "Fail when an existing Secret is used without a name"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled"