feat(deployment)!: move image to deployment.gitea.image

The `image` values only ever configured the Gitea container itself — registry, repository, tag, digest,
pull policy and the rootless variant are all consumed by the `gitea` container and its init containers.
Keeping them at the top level suggested a chart-wide scope that never existed and separated them from the
other container-scoped settings that already live under `deployment.gitea` (`env`, `resources`).
Moving the block makes the container configuration self-contained and continues the consolidation of all
pod- and Deployment-scoped values under the `deployment` dict.

`imagePullSecrets` intentionally stays top-level, because it is a pod-level setting that also applies to
`extraContainers` and is paired with `global.imagePullSecrets`.

BREAKING CHANGE: `image` no longer exists. Use `deployment.gitea.image` instead. Values still set under
`image` are silently ignored, which would drop a pinned `tag` or `digest` and roll out the chart default
(`appVersion`) instead — review your values before upgrading.

Co-authored-by: Copilot <copilot@github.com>

templates/_helpers.tpl

@@ -43,15 +43,15 @@ Create chart name and version as used by the chart label.
 Create image name and tag used by the deployment.
 */}}
 {{- define "gitea.image" -}}
-{{- $fullOverride := .Values.image.fullOverride | default "" -}}
-{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
-{{- $repository := .Values.image.repository -}}
+{{- $fullOverride := .Values.deployment.gitea.image.fullOverride | default "" -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.deployment.gitea.image.registry -}}
+{{- $repository := .Values.deployment.gitea.image.repository -}}
 {{- $separator := ":" -}}
-{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
-{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
+{{- $tag := .Values.deployment.gitea.image.tag | default .Chart.AppVersion | toString -}}
+{{- $rootless := ternary "-rootless" "" (.Values.deployment.gitea.image.rootless) -}}
 {{- $digest := "" -}}
-{{- if .Values.image.digest }}
-    {{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
+{{- if .Values.deployment.gitea.image.digest }}
+    {{- $digest = (printf "@%s" (.Values.deployment.gitea.image.digest | toString)) -}}
 {{- end -}}
 {{- if $fullOverride }}
     {{- printf "%s" $fullOverride -}}
@@ -175,8 +175,8 @@ Common labels
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}
 {{ include "gitea.selectorLabels" . }}
-app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
 
@@ -184,8 +184,8 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}-act-runner
 {{ include "gitea.selectorLabels.actRunner" . }}
-app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
 
@@ -316,7 +316,7 @@ https
   {{- $generals := list -}}
   {{- $inlines := dict -}}
 
-  {{- range $key, $value := .Values.gitea.config  }}
+  {{- range $key, $value := .Values.gitea.config }}
     {{- if kindIs "map" $value }}
       {{- if gt (len $value) 0 }}
         {{- $section := default list (get $inlines $key) -}}
@@ -447,7 +447,7 @@ https
     {{- $_ := set .Values.gitea.config.server "SSH_PORT" .Values.service.ssh.port -}}
   {{- end -}}
   {{- if not (hasKey .Values.gitea.config.server "START_SSH_SERVER") -}}
-    {{- if .Values.image.rootless -}}
+    {{- if .Values.deployment.gitea.image.rootless -}}
       {{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "true" -}}
       {{- if not (hasKey .Values.gitea.config.server "SSH_LISTEN_PORT") -}}
         {{- if not .Values.gitea.config.server.SSH_LISTEN_PORT -}}
@@ -540,4 +540,3 @@ https
   {{- end -}}
   {{- toYaml $probe -}}
 {{- end -}}
-

templates/gitea/deployment.yaml

@@ -89,7 +89,7 @@ spec:
         {{- end }}
         - name: init-directories
           image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
           command:
             - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
           env:
@@ -130,7 +130,7 @@ spec:
             {{- toYaml .Values.initContainers.resources | nindent 12 }}
         - name: init-app-ini
           image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
           {{- if .Values.gitea.extraEnvSourceFile }}
           command:
           - "/bin/bash"
@@ -196,7 +196,7 @@ spec:
           command:
           - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
           {{- end }}
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
           {{- if $commandInitContainerSecurityContext }}
           securityContext:
             {{- $commandInitContainerSecurityContext | nindent 12 }}
@@ -238,7 +238,7 @@ spec:
           command:
           - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
           {{- end }}
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
           {{- if $commandInitContainerSecurityContext }}
           securityContext:
             {{- $commandInitContainerSecurityContext | nindent 12 }}
@@ -252,7 +252,7 @@ spec:
               value: /data
             - name: GITEA_TEMP
               value: /tmp/gitea
-            {{- if .Values.image.rootless }}
+            {{- if .Values.deployment.gitea.image.rootless }}
             - name: HOME
               value: /data/gitea/git
             {{- end }}
@@ -335,14 +335,14 @@ spec:
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
           env:
             # SSH Port values have to be set here as well for openssh configuration
             - name: SSH_LISTEN_PORT
               value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
             - name: SSH_PORT
               value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
-            {{- if not .Values.image.rootless }}
+            {{- if not .Values.deployment.gitea.image.rootless }}
             - name: SSH_LOG_LEVEL
               value: {{ .Values.gitea.ssh.logLevel | quote }}
             {{- end }}
@@ -365,7 +365,7 @@ spec:
             {{- end }}
             - name: TMPDIR
               value: /tmp/gitea
-            {{- if .Values.image.rootless }}
+            {{- if .Values.deployment.gitea.image.rootless }}
             - name: HOME
               value: /data/gitea/git
             {{- end }}

templates/gitea/secret_init.yaml

@@ -26,7 +26,7 @@ stringData:
     # END: initPreScript
     {{- end }}
 
-    {{- if not .Values.image.rootless }}
+    {{- if not .Values.deployment.gitea.image.rootless }}
     chown -v 1000:1000 /data
     {{- end }}
     mkdir -pv /data/git/.ssh
@@ -35,7 +35,7 @@ stringData:
 
     # prepare temp directory structure
     mkdir -pv "${GITEA_TEMP}"
-    {{- if not .Values.image.rootless }}
+    {{- if not .Values.deployment.gitea.image.rootless }}
     chown -v 1000:1000 "${GITEA_TEMP}"
     {{- end }}
     chmod -v ug+rwx "${GITEA_TEMP}"