feat(deployment)!: move security contexts into the deployment dict

`podSecurityContext` and `containerSecurityContext` are both Deployment-scoped: the former is rendered into
`spec.template.spec.securityContext`, the latter into the securityContext of the Gitea container and the
chart-managed init containers. Keeping them at the top level hid that pod/container distinction behind a
naming convention and separated them from the other pod- and container-scoped settings that already live
under `deployment` and `deployment.gitea`.

`podSecurityContext` therefore becomes `deployment.securityContext` and `containerSecurityContext` becomes
`deployment.gitea.securityContext`, which makes the scope obvious from the values path alone and continues
the consolidation started with `deployment.gitea.env`, `deployment.gitea.resources` and
`deployment.gitea.image`.

The template helpers keep their argument-based signatures, because `gitea.containerSecurityContext` is also
used by the Helm test pod and is not bound to a single values path.

Both removed keys are covered by the deprecation check so that a silently dropped security context cannot
lead to containers unexpectedly running as root or without the configured capability set.

BREAKING CHANGE: `podSecurityContext` and `containerSecurityContext` no longer exist. Use
`deployment.securityContext` and `deployment.gitea.securityContext` instead. Installations that still set
the old keys will fail to render unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>

templates/_helpers.tpl

@@ -104,13 +104,13 @@ Return the pod's hostUsers setting when OpenShift compatibility is enabled.
 {{/*
 Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
 */}}
-{{- define "gitea.podSecurityContext" -}}
-{{- $podSecurityContext := deepCopy .Values.podSecurityContext -}}
-{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $podSecurityContext "fsGroup")) -}}
-{{- $_ := set $podSecurityContext "fsGroup" 1000 -}}
+{{- define "gitea.deployment.securityContext" -}}
+{{- $securityContext := deepCopy .Values.deployment.securityContext -}}
+{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $securityContext "fsGroup")) -}}
+{{- $_ := set $securityContext "fsGroup" 1000 -}}
 {{- end -}}
-{{- if gt (len $podSecurityContext) 0 -}}
-{{ toYaml $podSecurityContext }}
+{{- if gt (len $securityContext) 0 -}}
+{{ toYaml $securityContext }}
 {{- end -}}
 {{- end -}}
 
@@ -150,7 +150,7 @@ These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
 Render the runtime container securityContext while honoring the deprecated securityContext value.
 */}}
 {{- define "gitea.runtimeContainerSecurityContext" -}}
-{{- $containerSecurityContext := deepCopy .Values.containerSecurityContext -}}
+{{- $containerSecurityContext := deepCopy .Values.deployment.gitea.securityContext -}}
 {{- if and (eq (len $containerSecurityContext) 0) .Values.securityContext -}}
 {{- $containerSecurityContext = deepCopy .Values.securityContext -}}
 {{- end -}}

templates/gitea/deployment.yaml

@@ -62,9 +62,9 @@ spec:
         {{- end }}
     spec:
       {{- $hostUsers := include "gitea.hostUsers" . | trim }}
-      {{- $podSecurityContext := include "gitea.podSecurityContext" . | trim }}
-      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.containerSecurityContext)) | trim }}
-      {{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.containerSecurityContext)) | trim }}
+      {{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
+      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
+      {{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
       {{- $runtimeContainerSecurityContext := include "gitea.runtimeContainerSecurityContext" . | trim }}
       {{- if .Values.deployment.schedulerName }}
       schedulerName: "{{ .Values.deployment.schedulerName }}"
@@ -79,9 +79,9 @@ spec:
       hostUsers: {{ $hostUsers }}
       {{- end }}
       {{- include "gitea.images.pullSecrets" . | nindent 6 }}
-      {{- if $podSecurityContext }}
+      {{- if $securityContext }}
       securityContext:
-        {{- $podSecurityContext | nindent 8 }}
+        {{- $securityContext | nindent 8 }}
       {{- end }}
       initContainers:
         {{- if .Values.preExtraInitContainers }}

templates/gitea/deprecation.yaml

@@ -45,6 +45,11 @@
     {{- fail "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead." -}}
   {{- end -}}
 
+  {{/* CONTAINER SECURITY CONTEXT */}}
+  {{- if .Values.containerSecurityContext -}}
+    {{- fail "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead." -}}
+  {{- end -}}
+
   {{/* DEPLOYMENT ENV */}}
   {{- if .Values.deployment.env -}}
     {{- fail "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead." -}}
@@ -65,6 +70,11 @@
     {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}
   {{- end -}}
 
+  {{/* POD SECURITY CONTEXT */}}
+  {{- if .Values.podSecurityContext -}}
+    {{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
+  {{- end -}}
+
   {{/* RESOURCES */}}
   {{- if .Values.resources -}}
     {{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}