feat!: replace postgresql-ha with CloudNativePG

The bundled `postgresql-ha` sub-chart was the only HA-ready database option, but it pinned us to a Bitnami chart
whose images are no longer freely distributed, and it bundled repmgr and pgpool into the release. Operating a
Postgres cluster through a Helm release also means the chart has to reimplement failover, backup and upgrade
orchestration that a dedicated operator already solves.

CloudNativePG is the de-facto standard operator for Postgres on Kubernetes and handles instance management,
streaming replication, switchover and rolling upgrades itself. The operator is deliberately *not* part of this
chart: cluster-scoped CRDs and controllers do not belong into an application release and would conflict with an
operator that is already installed. The chart only renders the namespaced `Cluster` resource, so the operator can
be managed independently.

Because the operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`. Existing users
of `postgresql` or an external database are therefore unaffected.

Credentials follow the chart-wide `secrets.*` convention. Only the password is read from a Secret, because
CloudNativePG requires `bootstrap.initdb.database` and `bootstrap.initdb.owner` as literals in the `Cluster` spec
and cannot resolve them from a Secret. The password is injected into the `init-app-ini` container as
`GITEA__database__PASSWD` instead of being written into the generated `app.ini`.

BREAKING CHANGE: The `postgresql-ha` sub-chart and all `postgresql-ha.*` values have been removed. There is no
in-place migration path between the two deployments: dump the database of the old `postgresql-ha` release with
`pg_dump`, remove the `postgresql-ha` values, deploy the chart with `cloudnativePG.enabled=true` and restore the
dump. Setting `postgresql-ha` now fails the release with a pointer to the changelog.

Co-authored-by: Copilot <copilot@github.com>

.github/copilot-instructions.md

@@ -2,7 +2,7 @@
 
 ## Project Overview
 
-Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster.
+Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, Valkey, and Valkey-cluster. The HA-ready database is provisioned as a CloudNativePG `Cluster` resource, the operator itself is not part of the chart.
 
 ## Build & Test
 

Chart.lock

@@ -2,11 +2,8 @@ dependencies:
 - name: postgresql
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 16.7.27
-- name: postgresql-ha
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 16.3.2
 - name: valkey
   repository: https://valkey.io/valkey-helm
   version: 0.10.0
-digest: sha256:1afecbf0d4fc9f48e31417573d4bed7e0ac7848040b9e0c5f3989ada9d1f944f
+digest: sha256:40619b69b9527f2044de588b227cf6b174011d4aa16cc048690cc970ce9ecd35
-generated: "2026-07-20T19:52:11.548874634+02:00"
+generated: "2026-10-03T23:18:30.630364276+02:00"

Chart.yaml

@@ -41,11 +41,6 @@ dependencies:
     repository: oci://registry-1.docker.io/bitnamicharts
     version: 16.7.27
     condition: postgresql.enabled
-  # https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml
-  - name: postgresql-ha
-    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 16.3.2
-    condition: postgresql-ha.enabled
   # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
   - name: valkey
     repository: https://valkey.io/valkey-helm

README.md

@@ -58,7 +58,7 @@
   - [ReadinessProbe](#readinessprobe)
   - [StartupProbe](#startupprobe)
   - [valkey](#valkey)
-  - [PostgreSQL HA](#postgresql-ha)
+  - [CloudNativePG](#cloudnativepg)
   - [PostgreSQL](#postgresql)
   - [Advanced](#advanced)
 - [Contributing](#contributing)
@@ -97,10 +97,13 @@ Users can also configure their own external providers via the configuration.
 
 ### HA Dependencies
 
-These dependencies are enabled by default:
+- PostgreSQL ([CloudNativePG](https://cloudnative-pg.io/)), disabled by default
+- Valkey ([Official Valkey Helm Chart](https://github.com/valkey-io/valkey-helm)), enabled by default
 
-- PostgreSQL HA ([Bitnami PostgreSQL-HA](https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml))
+CloudNativePG is **not** bundled as a sub-chart.
-- Valkey ([Official Valkey Helm Chart](https://github.com/valkey-io/valkey-helm))
+Only the `Cluster` resource is rendered by this chart, the [CloudNativePG operator](https://cloudnative-pg.io/documentation/current/installation_upgrade/) must already be installed cluster-wide.
+Because that operator cannot be assumed to be present, `cloudnativePG.enabled` defaults to `false`.
+Set it to `true` once the operator is installed, or use either the `postgresql` sub-chart or an external database instead.
 
 ### Non-HA Dependencies
 
@@ -122,7 +125,7 @@ Alternatively you can also use a versioning helper tool like [renovate](https://
 
 Please double-check the image repository and available tags in the sub-chart:
 
-- [PostgreSQL-HA](https://hub.docker.com/r/bitnami/postgresql-repmgr/tags)
+- [CloudNativePG](https://github.com/cloudnative-pg/postgres-containers/pkgs/container/postgresql)
 - [PostgreSQL](https://hub.docker.com/r/bitnami/postgresql/tags)
 - [Valkey](https://hub.docker.com/r/valkey/valkey/tags)
 
@@ -223,17 +226,20 @@ _All default settings are made directly in the generated `app.ini`, not in the V
 #### Database defaults
 
 If a builtIn database is enabled the database configuration is set automatically.
-For example, PostgreSQL builtIn will appear in the `app.ini` as:
+For example, the CloudNativePG `Cluster` will appear in the `app.ini` as:
 
 ```ini
 [database]
 DB_TYPE = postgres
-HOST = RELEASE-NAME-postgresql.default.svc.cluster.local:5432
+HOST = RELEASE-NAME-postgresql-rw.default.svc.cluster.local:5432
 NAME = gitea
-PASSWD = gitea
 USER = gitea
 ```
 
+`PASSWD` is not part of the generated `app.ini`.
+It is injected into the `init-app-ini` init container as the `GITEA__database__PASSWD` environment variable, sourced
+from the credentials Secret referenced by `cloudnativePG.credentials`, and merged into the `app.ini` at startup.
+
 #### Server defaults
 
 The server defaults are a bit more complex.
@@ -346,7 +352,7 @@ If HA is not needed/desired, the following configurations can be used to deploy
      enabled: true
    postgresql:
      enabled: true
-   postgresql-ha:
+   cloudnativePG:
      enabled: false
 
    persistence:
@@ -377,7 +383,7 @@ If HA is not needed/desired, the following configurations can be used to deploy
      enabled: false
    postgresql:
      enabled: false
-   postgresql-ha:
+   cloudnativePG:
      enabled: false
 
    persistence:
@@ -489,7 +495,7 @@ Priority (highest to lowest) for defining app.ini variables:
 Any external database listed in [https://docs.gitea.com/installation/database-prep/](https://docs.gitea.com/installation/database-prep/) can be used instead of the built-in PostgreSQL.
 In fact, it is **highly recommended** to use an external database to ensure a stable Gitea installation longterm.
 
-If an external database is used, no matter which type, make sure to set `postgresql.enabled` to `false` to disable the use of the built-in PostgreSQL.
+If an external database is used, no matter which type, make sure to set `postgresql.enabled` and `cloudnativePG.enabled` to `false` to disable the use of the built-in PostgreSQL.
 
 ```yaml
 gitea:
@@ -505,7 +511,7 @@ gitea:
 postgresql:
   enabled: false
 
-postgresql-ha:
+cloudnativePG:
   enabled: false
 ```
 
@@ -1035,8 +1041,8 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `deployment.labels`                                | Labels for the deployment.                                                                                                                                                                     | `{}`               |
 | `deployment.affinity`                              | Affinity for the deployment.                                                                                                                                                                   | `{}`               |
 | `deployment.dnsConfig`                             | dnsConfig of the Gitea deployment.                                                                                                                                                             | `{}`               |
-| `deployment.gitea.env`                             | Additional environment variables to pass to the gitea container.                                                                                                                               | `[]`               |
+| `deployment.gitea.env`                             | Additional environment variables to pass to the Gitea container.                                                                                                                               | `[]`               |
-| `deployment.gitea.envFrom`                         | List of environment variables mounted from configMaps or secrets for the gitea container.                                                                                                      | `[]`               |
+| `deployment.gitea.envFrom`                         | List of environment variables mounted from configMaps or secrets for the Gitea container.                                                                                                      | `[]`               |
 | `deployment.gitea.image.registry`                  | image registry, e.g. gcr.io,docker.io.                                                                                                                                                         | `docker.gitea.com` |
 | `deployment.gitea.image.repository`                | Image to start for this pod.                                                                                                                                                                   | `gitea`            |
 | `deployment.gitea.image.tag`                       | Visit: [Image tag](https://hub.docker.com/r/gitea/gitea/tags?page=1&ordering=last_updated). Defaults to `appVersion` within Chart.yaml.                                                        | `""`               |
@@ -1122,7 +1128,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `gatewayAPI.core.backendTLSPolicy.targetRefs`                   | Target references for the BackendTLSPolicy. Defaults to the HTTP service.                                                                                                  | `[]`    |
 | `gatewayAPI.core.backendTLSPolicy.validation`                   | Validation configuration (required when enabled). See `docs/gateway-api.md`.                                                                                               | `{}`    |
 | `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`.                                                                                  |         |
-| `gatewayAPI.core.backendTLSPolicy.validation.hostname`          | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the gitea server certificate. See `docs/gateway-api.md`. |         |
+| `gatewayAPI.core.backendTLSPolicy.validation.hostname`          | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. |         |
 | `gatewayAPI.core.httpRoute.enabled`                             | Render an HTTPRoute resource.                                                                                                                                              | `false` |
 | `gatewayAPI.core.httpRoute.annotations`                         | Annotations applied to the HTTPRoute.                                                                                                                                      | `{}`    |
 | `gatewayAPI.core.httpRoute.labels`                              | Additional labels applied to the HTTPRoute.                                                                                                                                | `{}`    |
@@ -1153,7 +1159,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `ingress.hosts[0].host`          | Default Ingress host.                                                                           | `git.example.com` |
 | `ingress.hosts[0].paths[0].path` | Default Ingress path.                                                                           | `/`               |
 | `ingress.tls`                    | Ingress tls settings.                                                                           | `[]`              |
-| `namespace`                      | An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified. | `""`              |
+| `namespace`                      | An explicit namespace to deploy Gitea into. Defaults to the release namespace if not specified. | `""`              |
 
 ### Network
 
@@ -1213,7 +1219,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `secrets.config.existingSecret.secretName`       | Name of the already existing config Secret.                                                                                                                                                               | `""`                 |
 | `secrets.config.new.annotations`                 | Annotations for the config Secret.                                                                                                                                                                        | `{}`                 |
 | `secrets.config.new.labels`                      | Labels for the config Secret.                                                                                                                                                                             | `{}`                 |
-| `secrets.gpg.enabled`                            | Enable mounting of a GPG key to sign git commits.                                                                                                                                                         | `false`              |
+| `secrets.gpg.enabled`                            | Enable mounting of a GPG key to sign Git commits.                                                                                                                                                         | `false`              |
 | `secrets.gpg.addSHASumAnnotation`                | Add a pod annotation with the SHA sum of the GPG key Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).              | `false`              |
 | `secrets.gpg.existingSecret.enabled`             | Use an already existing Secret instead of creating the GPG key Secret.                                                                                                                                    | `false`              |
 | `secrets.gpg.existingSecret.secretName`          | Name of the already existing GPG key Secret.                                                                                                                                                              | `""`                 |
@@ -1370,6 +1376,37 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `gitea.startupProbe.successThreshold`    | Success threshold for startup probe.             | `1`     |
 | `gitea.startupProbe.failureThreshold`    | Failure threshold for startup probe.             | `10`    |
 
+### CloudNativePG
+
+| Name                                                   | Description                                                                                                                                                                                      | Value                       |
+| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------- |
+| `cloudnativePG.enabled`                                | Provision a CloudNativePG `Cluster` for Gitea. Requires the CloudNativePG operator to be installed in the cluster.                                                                               | `false`                     |
+| `cloudnativePG.annotations`                            | Annotations for the CloudNativePG `Cluster`.                                                                                                                                                     | `{}`                        |
+| `cloudnativePG.labels`                                 | Additional labels for the CloudNativePG `Cluster`.                                                                                                                                               | `{}`                        |
+| `cloudnativePG.image.registry`                         | Image registry.                                                                                                                                                                                  | `ghcr.io`                   |
+| `cloudnativePG.image.repository`                       | Image repository.                                                                                                                                                                                | `cloudnative-pg/postgresql` |
+| `cloudnativePG.image.tag`                              | Image tag.                                                                                                                                                                                       | `18.0`                      |
+| `cloudnativePG.instances`                              | Number of PostgreSQL instances. Values greater than `1` provision a HA-ready cluster with streaming replication.                                                                                 | `3`                         |
+| `cloudnativePG.credentials.addSHASumAnnotation`        | Add a pod annotation with the SHA sum of the credentials Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation). | `false`                     |
+| `cloudnativePG.credentials.database`                   | Name of the database to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret.                                                               | `gitea`                     |
+| `cloudnativePG.credentials.username`                   | Name of the database owner to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret.                                                         | `gitea`                     |
+| `cloudnativePG.credentials.existingSecret.enabled`     | Use an already existing Secret instead of creating the credentials Secret.                                                                                                                       | `false`                     |
+| `cloudnativePG.credentials.existingSecret.secretName`  | Name of the already existing credentials Secret. Must be of type `kubernetes.io/basic-auth` and its `username` must match `cloudnativePG.credentials.username`.                                  | `""`                        |
+| `cloudnativePG.credentials.existingSecret.passwordKey` | Key of the password in the existing credentials Secret.                                                                                                                                          | `password`                  |
+| `cloudnativePG.credentials.new.annotations`            | Annotations for the credentials Secret.                                                                                                                                                          | `{}`                        |
+| `cloudnativePG.credentials.new.labels`                 | Labels for the credentials Secret.                                                                                                                                                               | `{}`                        |
+| `cloudnativePG.credentials.new.password`               | Password of the database owner.                                                                                                                                                                  | `gitea`                     |
+| `cloudnativePG.postgresql.parameters`                  | Custom PostgreSQL configuration parameters.                                                                                                                                                      | `{}`                        |
+| `cloudnativePG.storage.size`                           | Size of the data volume.                                                                                                                                                                         | `10Gi`                      |
+| `cloudnativePG.storage.storageClass`                   | Storage class of the data volume. Defaults to the cluster's default storage class.                                                                                                               | `""`                        |
+| `cloudnativePG.walStorage.enabled`                     | Store the write-ahead log on a dedicated volume.                                                                                                                                                 | `false`                     |
+| `cloudnativePG.walStorage.size`                        | Size of the write-ahead log volume.                                                                                                                                                              | `2Gi`                       |
+| `cloudnativePG.walStorage.storageClass`                | Storage class of the write-ahead log volume. Defaults to the cluster's default storage class.                                                                                                    | `""`                        |
+| `cloudnativePG.monitoring.enablePodMonitor`            | Create a `PodMonitor` for the CloudNativePG `Cluster`.                                                                                                                                           | `false`                     |
+| `cloudnativePG.affinity`                               | Affinity for the PostgreSQL pods.                                                                                                                                                                | `{}`                        |
+| `cloudnativePG.priorityClassName`                      | Priority class name for the PostgreSQL pods.                                                                                                                                                     | `""`                        |
+| `cloudnativePG.resources`                              | Kubernetes resources for the PostgreSQL containers.                                                                                                                                              | `{}`                        |
+
 ### valkey
 
 | Name                                       | Description                                        | Value                      |
@@ -1394,28 +1431,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `valkey.metrics.exporter.image.repository` | Image repository.                                  | `oliver006/redis_exporter` |
 | `valkey.metrics.exporter.image.tag`        | Image tag.                                         | `""`                       |
 
-### PostgreSQL HA
-
-| Name                                               | Description                                                       | Value                             |
-| -------------------------------------------------- | ----------------------------------------------------------------- | --------------------------------- |
-| `postgresql-ha.enabled`                            | Enable PostgreSQL HA.                                             | `true`                            |
-| `postgresql-ha.global.postgresql.database`         | Name for a custom database to create (overrides `auth.database`). | `gitea`                           |
-| `postgresql-ha.global.postgresql.username`         | Name for a custom user to create (overrides `auth.username`).     | `gitea`                           |
-| `postgresql-ha.global.postgresql.password`         | Name for a custom password to create (overrides `auth.password`). | `gitea`                           |
-| `postgresql-ha.metrics.image.repository`           | Image repository, eg. `bitnamilegacy/postgres-exporter`.          | `bitnamilegacy/postgres-exporter` |
-| `postgresql-ha.postgresql.image.repository`        | Image repository, eg. `bitnamilegacy/postgresql-repmgr`.          | `bitnamilegacy/postgresql-repmgr` |
-| `postgresql-ha.postgresql.repmgrPassword`          | Repmgr Password.                                                  | `changeme2`                       |
-| `postgresql-ha.postgresql.postgresPassword`        | postgres Password.                                                | `changeme1`                       |
-| `postgresql-ha.postgresql.password`                | Password for the `gitea` user (overrides `auth.password`).        | `changeme4`                       |
-| `postgresql-ha.pgpool.adminPassword`               | pgpool adminPassword.                                             | `changeme3`                       |
-| `postgresql-ha.pgpool.image.repository`            | Image repository, eg. `bitnamilegacy/pgpool`.                     | `bitnamilegacy/pgpool`            |
-| `postgresql-ha.pgpool.srCheckPassword`             | pgpool srCheckPassword.                                           | `changeme4`                       |
-| `postgresql-ha.service.ports.postgresql`           | PostgreSQL service port (overrides `service.ports.postgresql`).   | `5432`                            |
-| `postgresql-ha.persistence.enabled`                | Enable persistence.                                               | `true`                            |
-| `postgresql-ha.persistence.storageClass`           | Persistent Volume Storage Class.                                  | `""`                              |
-| `postgresql-ha.persistence.size`                   | PVC Storage Request for PostgreSQL HA volume.                     | `10Gi`                            |
-| `postgresql-ha.volumePermissions.image.repository` | Image repository, eg. `bitnamilegacy/os-shell`.                   | `bitnamilegacy/os-shell`          |
-
 ### PostgreSQL
 
 | Name                                                    | Description                                                       | Value                             |
@@ -1466,7 +1481,7 @@ If you miss this, blindly upgrading may delete your Postgres instance and you ma
 - All Secrets created by this chart are now configured through the new `secrets` section.
   It exposes `annotations`, `labels`, a checksum-annotation toggle and an `existingSecret` reference for each of the
   `admin`, `config`, `gpg`, `init`, `inlineConfig` and `metrics` Secrets.
-  
+
 - The `gitea.admin` object has been replaced by `secrets.admin`.
   The chart fails to render if `gitea.admin` is still set.
   Migrate as follows:
@@ -1687,11 +1702,23 @@ If you want to switch to a RWX volume and go for HA, you need to
 
 If you are running with a non-HA PG DB from a previous chart release, you need to set
 
-- `postgresql-ha.enabled=false`
+- `cloudnativePG.enabled=false`
 - `postgresql.enabled=true`
 
 This is needed to stay with your existing single-instance DB (as the HA-variant is the new default).
 
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable-next-line -->
+**Transitioning from Postgres HA to CloudNativePG**
+<!-- prettier-ignore-end -->
+
+The `postgresql-ha` sub-chart has been replaced by a [CloudNativePG](https://cloudnative-pg.io/) `Cluster` resource, configured via `cloudnativePG`.
+The CloudNativePG operator is not bundled with this chart and has to be installed cluster-wide beforehand.
+
+There is no in-place migration path between the two: dump the database of the old `postgresql-ha` deployment with `pg_dump`, remove the `postgresql-ha` values and deploy the chart with `cloudnativePG.enabled=true`.
+Afterwards restore the dump into the new cluster.
+Alternatively, point the new `Cluster` at the existing data via one of the [CloudNativePG bootstrap methods](https://cloudnative-pg.io/documentation/current/bootstrap/).
+
 <!-- prettier-ignore-start -->
 <!-- markdownlint-disable-next-line -->
 **Change of env-to-ini prefix**

docs/ha-setup.md

@@ -28,8 +28,8 @@ In addition, the following components are required for full HA-readiness:
 - A HA-ready cache (`valkey-cluster`)
 - A HA-ready DB
 
-`postgres.enabled`, which default to `true`, must be set to `false` for a HA setup.
+`postgresql.enabled`, which defaults to `false`, must stay disabled for a HA setup.
-The default `postgres` chart dependency is not HA-ready (there's a dedicated `postgres-ha` chart).
+The `postgresql` chart dependency is not HA-ready, use the `cloudnativePG` option instead.
 
 The following sections discuss each of the components in more detail.
 Note that for each component discussed, the shown configurations only provides a (working) starting point, not necessarily the most optimal setup.
@@ -153,15 +153,33 @@ persistence:
 
 ## Database
 
-If you do not have an HA-ready DB, using a managed database service in the cloud might be the easiest and most robust solution.
+By enabling `cloudnativePG`, the chart renders a [CloudNativePG](https://cloudnative-pg.io/) `Cluster`, which provides a HA-ready PostgreSQL via streaming replication.
-Remember: disable the built-in `postgres` dependency and configure the database connection manually via `gitea.config.database`:
+The CloudNativePG operator itself is not part of this chart and has to be [installed cluster-wide](https://cloudnative-pg.io/documentation/current/installation_upgrade/) beforehand.
+For that reason the option is disabled by default.
 
 ```yml
+cloudnativePG:
+  enabled: true
+  instances: 3
+  storage:
+    size: 10Gi
+    storageClass: <storage class>
+  walStorage:
+    enabled: true
+    size: 2Gi
+    storageClass: <storage class>
+```
+
+If you do not want to run the operator, using a managed database service in the cloud might be the easiest and most robust solution.
+Remember: keep `cloudnativePG` and `postgresql` disabled and configure the database connection manually via `gitea.config.database`:
+
+```yml
+cloudnativePG:
+  enabled: false
+postgresql:
+  enabled: false
+
 gitea:
-  database:
-    builtIn:
-      postgresql:
-        enabled: false
   config:
     database:
       DB_TYPE: postgres

templates/_clusters.tpl

@@ -0,0 +1,24 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.cluster.cloudnativePG.annotations" -}}
+{{- with .Values.cloudnativePG.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.cluster.cloudnativePG.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.cloudnativePG.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* names */}}
+
+{{- define "gitea.cluster.cloudnativePG.name" -}}
+{{ include "gitea.fullname" . }}-postgresql
+{{- end }}

templates/_helpers.tpl

@@ -174,9 +174,9 @@ app.kubernetes.io/name: {{ include "gitea.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
-{{- define "postgresql-ha.dns" -}}
+{{- define "cloudnativePG.dns" -}}
-{{- if (index .Values "postgresql-ha").enabled -}}
+{{- if .Values.cloudnativePG.enabled -}}
-{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}}
+{{- printf "%s-rw.%s.svc.%s:5432" (include "gitea.cluster.cloudnativePG.name" .) (.Values.namespace | default .Release.Namespace) .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
 
@@ -441,14 +441,14 @@ https
 {{- end -}}
 
 {{- define "gitea.inline_configuration.defaults.database" -}}
-  {{- if (index .Values "postgresql-ha" "enabled") -}}
+  {{- if .Values.cloudnativePG.enabled -}}
+    {{/* PASSWD is injected as an env-to-ini variable from the credentials Secret. */}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}
     {{- if not (.Values.gitea.config.database.HOST) -}}
-      {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql-ha.dns" .) -}}
+      {{- $_ := set .Values.gitea.config.database "HOST"      (include "cloudnativePG.dns" .) -}}
     {{- end -}}
-    {{- $_ := set .Values.gitea.config.database "NAME"      (index .Values "postgresql-ha" "global" "postgresql" "database") -}}
+    {{- $_ := set .Values.gitea.config.database "NAME"      .Values.cloudnativePG.credentials.database -}}
-    {{- $_ := set .Values.gitea.config.database "USER"      (index .Values "postgresql-ha" "global" "postgresql" "username") -}}
+    {{- $_ := set .Values.gitea.config.database "USER"      .Values.cloudnativePG.credentials.username -}}
-    {{- $_ := set .Values.gitea.config.database "PASSWD"    (index .Values "postgresql-ha" "global" "postgresql" "password") -}}
   {{- end -}}
   {{- if (index .Values "postgresql" "enabled") -}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}

templates/_initContainers.tpl

@@ -84,6 +84,13 @@
       value: /tmp/existing-envs
     - name: ENV_TO_INI_MOUNT_POINT
       value: /env-to-ini-mounts
+    {{- if .Values.cloudnativePG.enabled }}
+    - name: GITEA__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          key: {{ include "gitea.secret.cloudnativePG.passwordKey" . }}
+          name: {{ include "gitea.secret.cloudnativePG.name" . }}
+    {{- end }}
     {{- if .Values.deployment.gitea.env }}
     {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
     {{- end }}

templates/_pods.tpl

@@ -9,6 +9,11 @@
 checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
 {{- end }}
 
+{{/* secret - cloudnativePG */}}
+{{- if and .Values.cloudnativePG.enabled .Values.cloudnativePG.credentials.addSHASumAnnotation }}
+checksum/cloudnativePG: {{ include "gitea.secret.checksum" (list . "cloudnativePG") }}
+{{- end }}
+
 {{/* secret - config */}}
 {{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
 checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}

templates/_secrets.tpl

@@ -8,6 +8,12 @@
 {{- end }}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.annotations" -}}
+{{- with .Values.cloudnativePG.credentials.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.annotations" -}}
 {{- with .Values.secrets.config.new.annotations }}
 {{- toYaml . -}}
@@ -49,7 +55,11 @@ Arguments: (list $root $key)
 {{- define "gitea.secret.checksum" -}}
 {{- $root := index . 0 -}}
 {{- $key := index . 1 -}}
-{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
+{{- $config := index $root.Values.secrets $key -}}
+{{- if eq $key "cloudnativePG" -}}
+{{- $config = $root.Values.cloudnativePG.credentials -}}
+{{- end -}}
+{{- if $config.existingSecret.enabled -}}
 {{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
 {{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
 {{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
@@ -68,6 +78,13 @@ Arguments: (list $root $key)
 {{- end }}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.cloudnativePG.credentials.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
 {{- define "gitea.secret.config.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.config.new.labels }}
@@ -113,6 +130,14 @@ Arguments: (list $root $key)
 {{- end -}}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.name" -}}
+{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
+{{ required "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" .Values.cloudnativePG.credentials.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.cluster.cloudnativePG.name" . }}-app
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.config.name" -}}
 {{- if .Values.secrets.config.existingSecret.enabled -}}
 {{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
@@ -179,6 +204,14 @@ username
 {{- end -}}
 {{- end }}
 
+{{- define "gitea.secret.cloudnativePG.passwordKey" -}}
+{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
+{{ .Values.cloudnativePG.credentials.existingSecret.passwordKey }}
+{{- else -}}
+password
+{{- end -}}
+{{- end }}
+
 {{- define "gitea.secret.gpg.gpgHomeKey" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}

templates/cluster.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.cloudnativePG.enabled -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.cloudnativePG.image.registry -}}
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  {{- with (include "gitea.cluster.cloudnativePG.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.cluster.cloudnativePG.labels" . | nindent 4 }}
+  name: {{ include "gitea.cluster.cloudnativePG.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  affinity:
+    {{- toYaml .Values.cloudnativePG.affinity | nindent 4 }}
+  bootstrap:
+    initdb:
+      database: {{ .Values.cloudnativePG.credentials.database | quote }}
+      owner: {{ .Values.cloudnativePG.credentials.username | quote }}
+      secret:
+        name: {{ include "gitea.secret.cloudnativePG.name" . }}
+  imageName: {{ printf "%s/%s:%s" $registry .Values.cloudnativePG.image.repository (.Values.cloudnativePG.image.tag | toString) | quote }}
+  instances: {{ .Values.cloudnativePG.instances }}
+  monitoring:
+    enablePodMonitor: {{ .Values.cloudnativePG.monitoring.enablePodMonitor }}
+  postgresql:
+    parameters:
+      {{- toYaml .Values.cloudnativePG.postgresql.parameters | nindent 6 }}
+  priorityClassName: {{ .Values.cloudnativePG.priorityClassName | quote }}
+  resources:
+    {{- toYaml .Values.cloudnativePG.resources | nindent 4 }}
+  storage:
+    size: {{ .Values.cloudnativePG.storage.size | quote }}
+    {{- with .Values.cloudnativePG.storage.storageClass }}
+    storageClass: {{ . | quote }}
+    {{- end }}
+  {{- if .Values.cloudnativePG.walStorage.enabled }}
+  walStorage:
+    size: {{ .Values.cloudnativePG.walStorage.size | quote }}
+    {{- with .Values.cloudnativePG.walStorage.storageClass }}
+    storageClass: {{ . | quote }}
+    {{- end }}
+  {{- end }}
+{{- end -}}

templates/deprecation.yaml

@@ -95,6 +95,11 @@
     {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
   {{- end -}}
 
+  {{/* POSTGRESQL HA */}}
+  {{- if index .Values "postgresql-ha" -}}
+    {{- fail "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}}
+  {{- end -}}
+
   {{/* PRIORITY CLASS NAME */}}
   {{- if .Values.priorityClassName -}}
     {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}

templates/secret_cloudnativePG.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.cloudnativePG.enabled (not .Values.cloudnativePG.credentials.existingSecret.enabled) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.cloudnativePG.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.cloudnativePG.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.cloudnativePG.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: kubernetes.io/basic-auth
+data:
+  password: {{ required "`cloudnativePG.credentials.new.password` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.new.password | b64enc | quote }}
+  {{- /* CloudNativePG requires the username of a basic-auth bootstrap Secret to match the owner of the Cluster. */}}
+  username: {{ required "`cloudnativePG.credentials.username` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.username | b64enc | quote }}
+{{- end -}}

templates/secret_config.yaml

@@ -22,8 +22,8 @@ data:
 {{- define "gitea.config.assertions" -}}
 
   {{- /*assert that only one PG dep is enabled */ -}}
-  {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
+  {{- if and (.Values.postgresql.enabled) (.Values.cloudnativePG.enabled) -}}
-    {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
+    {{- fail "Only one of postgresql or cloudnativePG can be enabled at the same time." -}}
   {{- end }}
 
   {{- /* multiple replicas assertions */ -}}

unittests/helm/cluster/basics.yaml

@@ -0,0 +1,131 @@
+suite: Test cluster basics
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "Render nothing when cloudnativePG is disabled"
+    templates:
+      - templates/cluster.yaml
+      - templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: "Render the Cluster with the default values"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - containsDocument:
+          kind: Cluster
+          apiVersion: postgresql.cnpg.io/v1
+          name: gitea-unittests-postgresql
+          namespace: testing
+      - equal:
+          path: spec.instances
+          value: 3
+      - equal:
+          path: spec.imageName
+          value: "ghcr.io/cloudnative-pg/postgresql:18.0"
+      - equal:
+          path: spec.bootstrap.initdb
+          value:
+            database: "gitea"
+            owner: "gitea"
+            secret:
+              name: gitea-unittests-postgresql-app
+      - equal:
+          path: spec.storage.size
+          value: "10Gi"
+      - notExists:
+          path: spec.storage.storageClass
+      - notExists:
+          path: spec.walStorage
+
+  - it: "Render the credential Secret with the default values"
+    template: templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-postgresql-app
+          namespace: testing
+      - equal:
+          path: type
+          value: kubernetes.io/basic-auth
+      - equal:
+          path: data.password
+          decodeBase64: true
+          value: "gitea"
+      - equal:
+          path: data.username
+          decodeBase64: true
+          value: "gitea"
+      - notExists:
+          path: data.database
+      - notExists:
+          path: stringData
+
+  - it: "Render no credential Secret when an existing Secret is used"
+    template: templates/secret_cloudnativePG.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: "Reference the existing Secret in the Cluster"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+          database: my-database
+          username: my-username
+    asserts:
+      - equal:
+          path: spec.bootstrap.initdb
+          value:
+            database: "my-database"
+            owner: "my-username"
+            secret:
+              name: my-credentials
+
+  - it: "Apply the storage and walStorage customizations"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        storage:
+          size: 1337Mi
+          storageClass: my-storage-class
+        walStorage:
+          enabled: true
+          size: 42Mi
+          storageClass: my-wal-storage-class
+    asserts:
+      - equal:
+          path: spec.storage
+          value:
+            size: "1337Mi"
+            storageClass: "my-storage-class"
+      - equal:
+          path: spec.walStorage
+          value:
+            size: "42Mi"
+            storageClass: "my-wal-storage-class"

unittests/helm/config/database.yaml

@@ -0,0 +1,59 @@
+suite: Test config database
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "Connect to the read-write Service of the CloudNativePG Cluster"
+    template: templates/secret_inlineConfig.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: data.database
+          decodeBase64: true
+          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
+
+  - it: "Connect to the read-write Service of the CloudNativePG Cluster with a custom cluster domain"
+    template: templates/secret_inlineConfig.yaml
+    set:
+      clusterDomain: my-special-cluster.local
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: data.database
+          decodeBase64: true
+          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.my-special-cluster.local:5432
+
+  - it: "Connect to the configured CloudNativePG database"
+    template: templates/secret_inlineConfig.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          database: gitea-database
+          username: gitea-username
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data.database
+          decodeBase64: true
+          value: |-
+            DB_TYPE=postgres
+            HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
+            NAME=gitea-database
+            USER=gitea-username
+
+  - it: "Fail when postgresql and cloudnativePG are enabled at the same time"
+    template: templates/secret_config.yaml
+    set:
+      postgresql:
+        enabled: true
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "Only one of postgresql or cloudnativePG can be enabled at the same time."

unittests/helm/dependency-checks/customizationIntegrityPostgresql.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 set:
-  postgresql-ha:
+  cloudnativePG:
     enabled: false
   postgresql:
     enabled: true

unittests/helm/dependency-checks/customizationIntegrityPostgresqlHA.yaml

@@ -1,129 +0,0 @@
-suite: Test dependency customization integrity of postgresql-ha
-release:
-  name: gitea-unittests
-  namespace: testing
-set:
-  postgresql:
-    enabled: false
-  postgresql-ha:
-    enabled: true
-    global:
-      postgresql:
-        database: gitea-database
-        password: gitea-password
-        username: gitea-username
-    postgresql:
-      repmgrPassword: custom-password-repmgr
-      postgresPassword: custom-password-postgres
-      password: custom-password-overwritten-by-global-postgresql-password
-    pgpool:
-      adminPassword: custom-password-pgpool
-      srCheckPassword: custom-password-sr-check
-    service:
-      ports:
-        postgresql: 1234
-    persistence:
-      size: 1337Mi
-tests:
-  - it: "[postgresql-ha] Apply the database settings"
-    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
-    asserts:
-      - documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: POSTGRES_DB
-            value: "gitea-database"
-      - documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: POSTGRES_USER
-            value: "gitea-username"
-  - it: "[postgresql-ha] Apply the database passwords"
-    template: charts/postgresql-ha/templates/postgresql/secrets.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data["repmgr-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXJlcG1ncg=="
-      - documentIndex: 0
-        equal:
-          path: data["postgres-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXBvc3RncmVz"
-      - documentIndex: 0
-        equal:
-          path: data["password"]
-          value: "Z2l0ZWEtcGFzc3dvcmQ=" # postgresql-ha.postgresql.password is overwritten by postgresql-ha.global.postgresql.password and should not be referenced here
-  - it: "[postgresql-ha] Apply pgpool.adminPassword"
-    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data["admin-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
-  - it: "[postgresql-ha] Apply pgpool.srCheckPassword"
-    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data["sr-check-password"]
-          value: "Y3VzdG9tLXBhc3N3b3JkLXNyLWNoZWNr"
-  - it: "[postgresql-ha] Apply persistence.size"
-    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
-          value: "1337Mi"
-  - it: "[postgresql-ha] Apply service.ports.postgresql"
-    template: charts/postgresql-ha/templates/pgpool/service.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: spec.ports[0].port
-          value: 1234
-  - it: "[postgresql-ha] Render the referenced Service"
-    template: charts/postgresql-ha/templates/pgpool/service.yaml
-    asserts:
-      - containsDocument:
-          kind: Service
-          apiVersion: v1
-          name: gitea-unittests-postgresql-ha-pgpool
-          namespace: testing
-  - it: "[gitea] Connect to the pgpool Service"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
-  - it: "[gitea] Connect to the pgpool Service with a custom cluster domain"
-    set:
-      clusterDomain: my-special-cluster.local
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
-  - it: "[gitea] Connect to the configured database"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: NAME=gitea-database
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: USER=gitea-username
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: PASSWD=gitea-password

unittests/helm/dependency-checks/majorImageBump.yaml

@@ -3,25 +3,12 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "[postgresql-ha] Detect major image version upgrades"
-    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
-    set:
-      postgresql:
-        enabled: false
-      postgresql-ha:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: spec.template.spec.containers[0].image
-          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnamilegacy/postgresql-repmgr:17.+$
   - it: "[postgresql] Detect major image version upgrades"
     template: charts/postgresql/templates/primary/statefulset.yaml
     set:
       postgresql:
         enabled: true
-      postgresql-ha:
+      cloudnativePG:
         enabled: false
     asserts:
       - documentIndex: 0

unittests/helm/deployment/checksumAnnotations.yaml

@@ -5,6 +5,7 @@ release:
 templates:
   - templates/deployment.yaml
   - templates/secret_admin.yaml
+  - templates/secret_cloudnativePG.yaml
   - templates/secret_config.yaml
   - templates/secret_gpg.yaml
   - templates/secret_init.yaml
@@ -14,6 +15,8 @@ tests:
   - it: "Omit the checksum annotations by default"
     template: templates/deployment.yaml
     set:
+      cloudnativePG.enabled: true
+
       secrets.admin.enabled: true
       secrets.config.enabled: true
       secrets.gpg.enabled: true
@@ -26,6 +29,8 @@ tests:
     asserts:
       - notExists:
           path: spec.template.metadata.annotations["checksum/admin"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/cloudnativePG"]
       - notExists:
           path: spec.template.metadata.annotations["checksum/config"]
       - notExists:
@@ -40,6 +45,9 @@ tests:
   - it: "Add a checksum annotation for every Secret when addSHASumAnnotation is enabled"
     template: templates/deployment.yaml
     set:
+      cloudnativePG.credentials.addSHASumAnnotation: true
+      cloudnativePG.enabled: true
+
       secrets.admin.addSHASumAnnotation: true
       secrets.admin.enabled: true
 
@@ -63,6 +71,8 @@ tests:
     asserts:
       - exists:
           path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/cloudnativePG"]
       - exists:
           path: spec.template.metadata.annotations["checksum/config"]
       - exists:

unittests/helm/deployment/cloudnativePG.yaml

@@ -0,0 +1,67 @@
+suite: Test deployment cloudnativePG credentials
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/deployment.yaml
+  - templates/secret_cloudnativePG.yaml
+tests:
+  - it: "Inject no database password when cloudnativePG is disabled"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+          any: true
+
+  - it: "Inject the database password from the rendered Secret"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: gitea-unittests-postgresql-app
+
+  - it: "Inject the database password from an existing Secret"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: my-credentials
+            passwordKey: my-password-key
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: GITEA__database__PASSWD
+            valueFrom:
+              secretKeyRef:
+                key: my-password-key
+                name: my-credentials
+
+  - it: "Fail when an existing Secret is used without a name"
+    template: templates/deployment.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        credentials:
+          existingSecret:
+            enabled: true
+            secretName: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled"

unittests/helm/deprecation/deployment.yaml

@@ -98,6 +98,13 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead."
+  - it: "Fail when the removed `postgresql-ha` value is set"
+    set:
+      postgresql-ha:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster."
   - it: "Fail when the removed `priorityClassName` value is set"
     set:
       priorityClassName: high-priority

values.yaml

@@ -1112,6 +1112,86 @@ gitea:
     successThreshold: 1
     failureThreshold: 10
 
+## @section CloudNativePG
+# The CloudNativePG operator itself is not part of this chart. It must be installed cluster-wide beforehand:
+# https://cloudnative-pg.io/documentation/current/installation_upgrade/
+cloudnativePG:
+  ## @param cloudnativePG.enabled Provision a CloudNativePG `Cluster` for Gitea. Requires the CloudNativePG operator to be installed in the cluster.
+  enabled: false
+
+  ## @param cloudnativePG.annotations Annotations for the CloudNativePG `Cluster`.
+  ## @param cloudnativePG.labels Additional labels for the CloudNativePG `Cluster`.
+  annotations: {}
+  labels: {}
+
+  ## @param cloudnativePG.image.registry Image registry.
+  ## @param cloudnativePG.image.repository Image repository.
+  ## @param cloudnativePG.image.tag Image tag.
+  image:
+    registry: ghcr.io
+    repository: cloudnative-pg/postgresql
+    tag: "18.0"
+
+  ## @param cloudnativePG.instances Number of PostgreSQL instances. Values greater than `1` provision a HA-ready cluster with streaming replication.
+  instances: 3
+
+  credentials:
+    ## @param cloudnativePG.credentials.addSHASumAnnotation Add a pod annotation with the SHA sum of the credentials Secret to trigger a rollout on change. Further information can be found in the [documentation](./README.md#secret-checksum-annotation).
+    addSHASumAnnotation: false
+
+    ## @param cloudnativePG.credentials.database Name of the database to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret.
+    ## @param cloudnativePG.credentials.username Name of the database owner to create. CloudNativePG requires it as a literal in the `Cluster`, hence it cannot be sourced from a Secret.
+    database: gitea
+    username: gitea
+
+    ## @param cloudnativePG.credentials.existingSecret.enabled Use an already existing Secret instead of creating the credentials Secret.
+    ## @param cloudnativePG.credentials.existingSecret.secretName Name of the already existing credentials Secret. Must be of type `kubernetes.io/basic-auth` and its `username` must match `cloudnativePG.credentials.username`.
+    ## @param cloudnativePG.credentials.existingSecret.passwordKey Key of the password in the existing credentials Secret.
+    existingSecret:
+      enabled: false
+      secretName: ""
+      passwordKey: password
+
+    ## @param cloudnativePG.credentials.new.annotations Annotations for the credentials Secret.
+    ## @param cloudnativePG.credentials.new.labels Labels for the credentials Secret.
+    ## @param cloudnativePG.credentials.new.password Password of the database owner.
+    new:
+      annotations: {}
+      labels: {}
+      password: gitea
+
+  ## @param cloudnativePG.postgresql.parameters Custom PostgreSQL configuration parameters.
+  postgresql:
+    parameters: {}
+
+  ## @param cloudnativePG.storage.size Size of the data volume.
+  ## @param cloudnativePG.storage.storageClass Storage class of the data volume. Defaults to the cluster's default storage class.
+  storage:
+    size: 10Gi
+    storageClass: ""
+
+  ## @param cloudnativePG.walStorage.enabled Store the write-ahead log on a dedicated volume.
+  ## @param cloudnativePG.walStorage.size Size of the write-ahead log volume.
+  ## @param cloudnativePG.walStorage.storageClass Storage class of the write-ahead log volume. Defaults to the cluster's default storage class.
+  walStorage:
+    enabled: false
+    size: 2Gi
+    storageClass: ""
+
+  ## @param cloudnativePG.monitoring.enablePodMonitor Create a `PodMonitor` for the CloudNativePG `Cluster`.
+  monitoring:
+    enablePodMonitor: false
+
+  ## @param cloudnativePG.affinity Affinity for the PostgreSQL pods.
+  affinity: {}
+
+  ## @param cloudnativePG.priorityClassName Priority class name for the PostgreSQL pods.
+  priorityClassName: ""
+
+  ## @param cloudnativePG.resources Kubernetes resources for the PostgreSQL containers.
+  resources: {}
+
+
 ## @section valkey
 valkey:
   ## @param valkey.enabled Enable valkey standalone or replicated.
@@ -1170,62 +1250,6 @@ valkey:
         repository: oliver006/redis_exporter
         tag: ""
 
-## @section PostgreSQL HA
-postgresql-ha:
-  ## @param postgresql-ha.enabled Enable PostgreSQL HA.
-  enabled: true
-
-  ## @param postgresql-ha.global.postgresql.database Name for a custom database to create (overrides `auth.database`).
-  ## @param postgresql-ha.global.postgresql.username Name for a custom user to create (overrides `auth.username`).
-  ## @param postgresql-ha.global.postgresql.password Name for a custom password to create (overrides `auth.password`).
-  global:
-    postgresql:
-      database: gitea
-      password: gitea
-      username: gitea
-
-  ## @param postgresql-ha.metrics.image.repository Image repository, eg. `bitnamilegacy/postgres-exporter`.
-  metrics:
-    image:
-      repository: bitnamilegacy/postgres-exporter
-
-  ## @param postgresql-ha.postgresql.image.repository Image repository, eg. `bitnamilegacy/postgresql-repmgr`.
-  ## @param postgresql-ha.postgresql.repmgrPassword Repmgr Password.
-  ## @param postgresql-ha.postgresql.postgresPassword postgres Password.
-  ## @param postgresql-ha.postgresql.password Password for the `gitea` user (overrides `auth.password`).
-  postgresql:
-    image:
-      repository: bitnamilegacy/postgresql-repmgr
-    repmgrPassword: changeme2
-    postgresPassword: changeme1
-    password: changeme4
-
-  ## @param postgresql-ha.pgpool.adminPassword pgpool adminPassword.
-  ## @param postgresql-ha.pgpool.image.repository Image repository, eg. `bitnamilegacy/pgpool`.
-  ## @param postgresql-ha.pgpool.srCheckPassword pgpool srCheckPassword.
-  pgpool:
-    adminPassword: changeme3
-    image:
-      repository: bitnamilegacy/pgpool
-    srCheckPassword: changeme4
-
-  ## @param postgresql-ha.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`).
-  service:
-    ports:
-      postgresql: 5432
-
-  ## @param postgresql-ha.persistence.enabled Enable persistence.
-  ## @param postgresql-ha.persistence.storageClass Persistent Volume Storage Class.
-  ## @param postgresql-ha.persistence.size PVC Storage Request for PostgreSQL HA volume.
-  persistence:
-    enabled: true
-    storageClass: ""
-    size: 10Gi
-
-  ## @param postgresql-ha.volumePermissions.image.repository Image repository, eg. `bitnamilegacy/os-shell`.
-  volumePermissions:
-    image:
-      repository: bitnamilegacy/os-shell
 
 ## @section PostgreSQL
 postgresql: