refactor!: move openshift.hostUsers to deployment.hostUsers

The PodSpec `hostUsers` field has nothing to do with the OpenShift compatibility profile. It only selects whether the
pod shares the host's user namespace, which is a plain Kubernetes feature. Nesting it below `openshift` implied that it
requires OpenShift and, worse, the helper only rendered it when `openshift.enabled` evaluated to `true`, so the setting
was silently ignored on vanilla Kubernetes clusters.

`gitea.hostUsers` now reads `deployment.hostUsers` and no longer depends on the OpenShift profile. The value is only
rendered when it is an actual boolean, so the field stays omitted for `null` and the platform default applies.

BREAKING CHANGE: `openshift.hostUsers` has been removed. Configure `deployment.hostUsers` instead.

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -289,15 +289,18 @@ openshift:
 ```
 
 When enabled, the chart applies `allowPrivilegeEscalation: false`, drops all
-Linux capabilities, sets `runAsNonRoot: true`, uses
+Linux capabilities, sets `runAsNonRoot: true` and uses
-`seccompProfile.type: RuntimeDefault`, and leaves `hostUsers` unset unless
+`seccompProfile.type: RuntimeDefault`.
-`openshift.hostUsers` is explicitly overridden.
 
 The deployment keeps the existing vanilla Kubernetes behavior when OpenShift
 compatibility is disabled. Auto-detection relies on the
 `security.openshift.io/v1/SecurityContextConstraints` API, so set
 `openshift.enabled: true` explicitly when rendering outside a live cluster.
 
+The PodSpec `hostUsers` field is independent of the OpenShift profile and is only
+rendered when `deployment.hostUsers` is set to a boolean. When left unset, the
+field is omitted so the platform default applies.
+
 If you also want to expose Gitea through an OpenShift Route, enable the optional Route resource:
 
 ```yaml
@@ -1042,6 +1045,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `deployment.gitea.resources`                       | Compute Resources required by Gitea container. Cannot be updated.                                                                                                                              | `nil`              |
 | `deployment.gitea.securityContext`                 | Security context of the Gitea container. Used as fallback for the chart-managed init containers.                                                                                               | `{}`               |
 | `deployment.gitea.volumeMounts`                    | Additional volume mounts.                                                                                                                                                                      | `[]`               |
+| `deployment.hostUsers`                             | Use the host's user namespace. When unset, the field is omitted so the platform default is used.                                                                                               | `nil`              |
 | `deployment.initContainers`                        | List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration.                    | `[]`               |
 | `deployment.initDirectories.env`                   | Additional environment variables to pass to the init container.                                                                                                                                | `[]`               |
 | `deployment.initDirectories.envFrom`               | List of environment variables mounted from configMaps or secrets for the initDirectories container.                                                                                            | `[]`               |
@@ -1165,7 +1169,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | Name                  | Description                                                                                                                          | Value |
 | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ----- |
 | `openshift.enabled`   | Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API. | `nil` |
-| `openshift.hostUsers` | Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used.       | `nil` |
 | `podDisruptionBudget` | Pod disruption budget                                                                                                                | `{}`  |
 
 ### Route

templates/_helpers.tpl

@@ -101,13 +101,11 @@ false
 {{- end -}}
 
 {{/*
-Return the pod's hostUsers setting when OpenShift compatibility is enabled.
+Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean.
 */}}
 {{- define "gitea.hostUsers" -}}
-{{- if eq (include "gitea.openshift.enabled" . | trim) "true" -}}
+{{- if kindIs "bool" .Values.deployment.hostUsers -}}
-{{- if kindIs "bool" .Values.openshift.hostUsers -}}
+{{ ternary "true" "false" .Values.deployment.hostUsers }}
-{{ ternary "true" "false" .Values.openshift.hostUsers }}
-{{- end -}}
 {{- end -}}
 {{- end -}}
 

templates/gitea/deprecation.yaml

@@ -75,6 +75,11 @@
     {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}
   {{- end -}}
 
+  {{/* OPENSHIFT HOST USERS */}}
+  {{- if hasKey .Values.openshift "hostUsers" -}}
+    {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
+  {{- end -}}
+
   {{/* PRIORITY CLASS NAME */}}
   {{- if .Values.priorityClassName -}}
     {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}

unittests/helm/deployment/deprecations.yaml

@@ -70,6 +70,12 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead."
+  - it: fails when the removed `openshift.hostUsers` value is set
+    set:
+      openshift.hostUsers: false
+    asserts:
+      - failedTemplate:
+          errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead."
   - it: fails when the removed `priorityClassName` value is set
     set:
       priorityClassName: high-priority

unittests/helm/deployment/openshift.yaml

@@ -79,8 +79,8 @@ tests:
     set:
       openshift:
         enabled: true
-        hostUsers: true
       deployment:
+        hostUsers: true
         securityContext:
           fsGroup: 1000620000
         gitea:
@@ -107,6 +107,7 @@ tests:
     set:
       openshift:
         enabled: true
+      deployment:
         hostUsers: false
     asserts:
       - equal:

unittests/helm/tests/test-http-connection.yaml

@@ -26,6 +26,7 @@ tests:
     set:
       openshift:
         enabled: true
+      deployment:
         hostUsers: false
     asserts:
       - equal:

values.yaml

@@ -133,6 +133,9 @@ deployment:
     #   mountPath: /configmap
     #   readOnly: true
 
+  ## @param deployment.hostUsers Use the host's user namespace. When unset, the field is omitted so the platform default is used.
+  hostUsers: ~
+
   ## @param deployment.initContainers [array] List of initContainers. The order is important. First init container in the list will be executed first. The link refers to the corresponding init container configuration.
   initContainers:
   # - container:
@@ -609,25 +612,23 @@ ingress:
 ## @param namespace An explicit namespace to deploy gitea into. Defaults to the release namespace if not specified
 namespace: ""
 
+
 ## @section Network
 ## @param clusterDomain Domain of the Cluster. Domain is part of internally issued certificates.
 clusterDomain: cluster.local
 
+
 ## @section Image
 ## @param imagePullSecrets Secret to use for pulling the image
 imagePullSecrets: []
 
+
 ## @section Security
 # Security context is only usable with rootless image due to image design
 ## @param openshift.enabled Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API.
-## @param openshift.hostUsers Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used.
 openshift:
   enabled: null
-  hostUsers: null
 
-## @deprecated The securityContext variable has been split two:
-## - deployment.gitea.securityContext
-## - deployment.securityContext.
 
 ## @param podDisruptionBudget Pod disruption budget
 podDisruptionBudget: {}