feat(deployment)!: move extraVolumes and extraContainerVolumeMounts into the deployment dict

Both values are Deployment-scoped: `extraVolumes` is rendered into `spec.template.spec.volumes` and
`extraContainerVolumeMounts` only into the volumeMounts of the Gitea container. The `extra*` prefix said
nothing about that scope and left them sitting at the top level, far away from the pod- and container-scoped
settings that already live under `deployment` and `deployment.gitea`.

They therefore become `deployment.volumes` and `deployment.gitea.volumeMounts`, which makes the target
resource and container obvious from the values path alone and continues the consolidation started with
`deployment.gitea.env`, `deployment.gitea.image`, `deployment.gitea.resources` and the security contexts.

`extraInitVolumeMounts` stays where it is for now, because it targets the init containers rather than the
Gitea container. The deprecated `extraVolumeMounts` fallback is kept intact and now points at
`deployment.gitea.volumeMounts` in its documentation.

Both removed keys are covered by the deprecation check, because silently ignoring them would drop mounted
TLS certificates, custom themes or client certs and leave Gitea running with a broken or unexpected
configuration.

BREAKING CHANGE: `extraVolumes` and `extraContainerVolumeMounts` no longer exist. Use `deployment.volumes`
and `deployment.gitea.volumeMounts` instead. Installations that still set the old keys will fail to render
unless `checkDeprecation` is set to `false`.

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -894,15 +894,16 @@ Custom themes can be added via k8s secrets and referencing them in `values.yaml`
 The [http provider](https://registry.terraform.io/providers/hashicorp/http/latest/docs/data-sources/http) is useful here.
 
 ```yaml
-extraVolumes:
+deployment:
-  - name: gitea-themes
+  gitea:
-    secret:
+    volumeMounts:
-      secretName: gitea-themes
-
-extraVolumeMounts:
       - name: gitea-themes
         readOnly: true
         mountPath: "/data/gitea/public/assets/css"
+  volumes:
+    - name: gitea-themes
+      secret:
+        secretName: gitea-themes
 ```
 
 The secret can be created via `terraform`:
@@ -1015,6 +1016,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `deployment.gitea.image.fullOverride`              | Completely overrides the image registry, path/image, tag and digest. **Adjust `deployment.gitea.image.rootless` accordingly and review [Rootless defaults](#rootless-defaults).** | `""`               |
 | `deployment.gitea.resources`                       | Compute Resources required by Gitea container. Cannot be updated.                                                                                                                 | `nil`              |
 | `deployment.gitea.securityContext`                 | Security context of the Gitea container and the chart-managed init containers.                                                                                                    | `{}`               |
+| `deployment.gitea.volumeMounts`                    | Additional volume mounts.                                                                                                                                                         | `[]`               |
 | `deployment.nodeSelector`                          | NodeSelector for the deployment                                                                                                                                                   | `{}`               |
 | `deployment.priorityClassName`                     | priorityClassName for the deployment                                                                                                                                              | `""`               |
 | `deployment.replicas`                              | Number of replicas for the Gitea deployment.                                                                                                                                      | `1`                |
@@ -1027,6 +1029,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `deployment.terminationGracePeriodSeconds`         | How long to wait until forcefully kill the pod                                                                                                                                    | `60`               |
 | `deployment.tolerations`                           | Tolerations of the Gitea deployment.                                                                                                                                              | `[]`               |
 | `deployment.topologySpreadConstraints`             | TopologySpreadConstraints for the deployment                                                                                                                                      | `[]`               |
+| `deployment.volumes`                               | Additional volumes to mount into the pods of the Gitea deployment.                                                                                                                | `[]`               |
 
 ### Gateway API
 
@@ -1201,7 +1204,7 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 ### Persistence
 
 | Name                                              | Description                                                                                        | Value                  |
-| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------- |
+| ------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ---------------------- |
 | `persistence.enabled`                             | Enable persistent storage                                                                          | `true`                 |
 | `persistence.create`                              | Whether to create the persistentVolumeClaim for shared storage                                     | `true`                 |
 | `persistence.mount`                               | Whether the persistentVolumeClaim should be mounted (even if not created)                          | `true`                 |
@@ -1216,8 +1219,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `extraContainers`                                 | Additional sidecar containers to run in the pod                                                    | `[]`                   |
 | `preExtraInitContainers`                          | Additional init containers to run in the pod before Gitea runs it owns init containers.            | `[]`                   |
 | `postExtraInitContainers`                         | Additional init containers to run in the pod after Gitea runs it owns init containers.             | `[]`                   |
-| `extraVolumes`                                    | Additional volumes to mount to the Gitea deployment                                                   | `[]`                   |
-| `extraContainerVolumeMounts`                      | Mounts that are only mapped into the Gitea runtime/main container, to e.g. override custom templates. | `[]`                   |
 | `extraInitVolumeMounts`                           | Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration. | `[]`                   |
 | `extraVolumeMounts`                               | **DEPRECATED** Additional volume mounts for init containers and the Gitea main container           | `[]`                   |
 

docs/gateway-api.md

@@ -122,7 +122,7 @@ verify the backend certificate before forwarding the request.
 
 Gitea serves HTTPS via three `[server]` app.ini options
 ([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
-cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths:
+cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths:
 
 ```yaml
 gitea:
@@ -132,14 +132,16 @@ gitea:
       CERT_FILE: /etc/gitea-tls/tls.crt
       KEY_FILE: /etc/gitea-tls/tls.key
 
-extraVolumes:
+deployment:
-  - name: gitea-tls
+  gitea:
-    secret:
+    volumeMounts:
-      secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
-extraContainerVolumeMounts:
       - name: gitea-tls
         mountPath: /etc/gitea-tls
         readOnly: true
+  volumes:
+    - name: gitea-tls
+      secret:
+        secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
 ```
 
 - Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the

templates/_helpers.tpl

@@ -489,8 +489,8 @@ https
 
 {{- define "gitea.container-additional-mounts" -}}
   {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
-  {{- if gt (len .Values.extraContainerVolumeMounts) 0 -}}
+  {{- if gt (len .Values.deployment.gitea.volumeMounts) 0 -}}
-    {{- toYaml .Values.extraContainerVolumeMounts -}}
+    {{- toYaml .Values.deployment.gitea.volumeMounts -}}
   {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
     {{- toYaml .Values.extraVolumeMounts -}}
   {{- end -}}

templates/gitea/deployment.yaml

@@ -457,8 +457,8 @@ spec:
           secret:
             secretName: {{ include "gitea.secret.config.name" . }}
             defaultMode: 110
-        {{- if gt (len .Values.extraVolumes) 0 }}
+        {{- if gt (len .Values.deployment.volumes) 0 }}
-        {{- toYaml .Values.extraVolumes | nindent 8 }}
+        {{- toYaml .Values.deployment.volumes | nindent 8 }}
         {{- end }}
         - name: inline-config-sources
           secret:

templates/gitea/deprecation.yaml

@@ -60,6 +60,16 @@
     {{- fail "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." -}}
   {{- end -}}
 
+  {{/* EXTRA CONTAINER VOLUME MOUNTS */}}
+  {{- if .Values.extraContainerVolumeMounts -}}
+    {{- fail "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." -}}
+  {{- end -}}
+
+  {{/* EXTRA VOLUMES */}}
+  {{- if .Values.extraVolumes -}}
+    {{- fail "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." -}}
+  {{- end -}}
+
   {{/* NODE SELECTOR */}}
   {{- if .Values.nodeSelector -}}
     {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}

unittests/helm/deployment/deprecations.yaml

@@ -46,6 +46,23 @@ tests:
     asserts:
       - failedTemplate:
           errorMessage: "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead."
+  - it: fails when the removed `extraContainerVolumeMounts` value is set
+    set:
+      extraContainerVolumeMounts:
+        - name: postgres-ssl-vol
+          mountPath: /pg-ssl
+    asserts:
+      - failedTemplate:
+          errorMessage: "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead."
+  - it: fails when the removed `extraVolumes` value is set
+    set:
+      extraVolumes:
+        - name: postgres-ssl-vol
+          secret:
+            secretName: gitea-postgres-ssl
+    asserts:
+      - failedTemplate:
+          errorMessage: "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead."
   - it: fails when the removed `nodeSelector` value is set
     set:
       nodeSelector:
@@ -130,6 +147,13 @@ tests:
       dnsConfig:
         nameservers:
           - 192.0.2.1
+      extraContainerVolumeMounts:
+        - name: postgres-ssl-vol
+          mountPath: /pg-ssl
+      extraVolumes:
+        - name: postgres-ssl-vol
+          secret:
+            secretName: gitea-postgres-ssl
       nodeSelector:
         foo: bar
       podSecurityContext:

values.yaml

@@ -120,6 +120,12 @@ deployment:
     #   runAsNonRoot: true
     #   runAsUser: 1000
 
+    ## @param deployment.gitea.volumeMounts Additional volume mounts.
+    volumeMounts: []
+    # - name: my-configmap-volume
+    #   mountPath: /configmap
+    #   readOnly: true
+
   ## @param deployment.nodeSelector NodeSelector for the deployment
   nodeSelector: {}
 
@@ -176,6 +182,16 @@ deployment:
   #       app.kubernetes.io/instance: gitea
 
 
+  ## @param deployment.volumes Additional volumes to mount into the pods of the Gitea deployment.
+  volumes: []
+  # - name: my-configmap-volume
+  #   config:
+  #     name: my-configmap
+  # - name: my-secret-volume
+  #   secret:
+  #     secretName: my-secret
+
+
 ## @section Gateway API
 ## See docs/gateway-api.md for full guidance.
 gatewayAPI:
@@ -594,20 +610,11 @@ postExtraInitContainers: []
 #   image: docker.io/library/busybox
 #   command: [ /bin/sh, -c, 'echo "Hello world! I am a post init container."' ]
 
-## @param extraVolumes Additional volumes to mount to the Gitea deployment
-extraVolumes: []
-# - name: postgres-ssl-vol
-#   secret:
-#     secretName: gitea-postgres-ssl
-
-## @param extraContainerVolumeMounts Mounts that are only mapped into the Gitea runtime/main container, to e.g. override custom templates.
-extraContainerVolumeMounts: []
-
 ## @param extraInitVolumeMounts Mounts that are only mapped into the init-containers. Can be used for additional preconfiguration.
 extraInitVolumeMounts: []
 
 ## @deprecated The extraVolumeMounts variable has been split two:
-## - extraContainerVolumeMounts
+## - deployment.gitea.volumeMounts
 ## - extraInitVolumeMounts
 ## As an example, can be used to mount a client cert when connecting to an external Postgres server.
 ## @param extraVolumeMounts **DEPRECATED** Additional volume mounts for init containers and the Gitea main container