asd

fix(ci): adapt release workflow
2026-02-15 19:33:48 +01:00 · 2026-02-15 18:45:42 +01:00 · 2026-02-15 18:43:33 +01:00 · 2026-02-15 16:52:47 +01:00 · 2025-12-18 20:11:38 +01:00 · 2025-11-05 19:11:28 +01:00
140 changed files with 3703 additions and 6762 deletions
@@ -0,0 +1,125 @@
 #!/bin/bash
 set -e -o pipefail
 chart_file="Chart.yaml"
 if [ ! -f "${chart_file}" ]; then
  echo "ERROR: ${chart_file} not found!" 1>&2
  exit 1
 fi
 default_new_tag="$(git tag --sort=-version:refname | head -n 1)"
 default_old_tag="$(git tag --sort=-version:refname | head -n 2 | tail -n 1)"
 if [ -z "${1}" ]; then
  echo "Enter start tag [${default_old_tag}]:"
  read -r old_tag
  if [ -z "${old_tag}" ]; then
    old_tag="${default_old_tag}"
  fi
  while [ -z "$(git tag --list "${old_tag}")" ]; do
    echo "ERROR: Tag '${old_tag}' not found!" 1>&2
    echo "Enter start tag [${default_old_tag}]:"
    read -r old_tag
    if [ -z "${old_tag}" ]; then
      old_tag="${default_old_tag}"
    fi
  done
 else
  old_tag=${1}
  if [ -z "$(git tag --list "${old_tag}")" ]; then
    echo "ERROR: Tag '${old_tag}' not found!" 1>&2
    exit 1
  fi
 fi
 if [ -z "${2}" ]; then
  echo "Enter end tag [${default_new_tag}]:"
  read -r new_tag
  if [ -z "${new_tag}" ]; then
    new_tag="${default_new_tag}"
  fi
  while [ -z "$(git tag --list "${new_tag}")" ]; do
    echo "ERROR: Tag '${new_tag}' not found!" 1>&2
    echo "Enter end tag [${default_new_tag}]:"
    read -r new_tag
    if [ -z "${new_tag}" ]; then
      new_tag="${default_new_tag}"
    fi
  done
 else
  new_tag=${2}
  if [ -z "$(git tag --list "${new_tag}")" ]; then
    echo "ERROR: Tag '${new_tag}' not found!" 1>&2
    exit 1
  fi
 fi
 change_log_yaml=$(mktemp)
 echo "[]" > "${change_log_yaml}"
 function map_type_to_kind() {
  case "${1}" in
    feat)
      echo "added"
    ;;
    fix)
      echo "fixed"
    ;;
    chore|style|test|ci|docs|refac)
      echo "changed"
    ;;
    revert)
      echo "removed"
    ;;
    sec)
      echo "security"
    ;;
    *)
      echo "skip"
    ;;
  esac
 }
 commit_titles="$(git log --pretty=format:"%s" "${old_tag}..${new_tag}")"
 echo "INFO: Generate change log entries from ${old_tag} until ${new_tag}"
 while IFS= read -r line; do
  if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
    type="${BASH_REMATCH[1]}"
    kind=$(map_type_to_kind "${type}")
    if [ "${kind}" == "skip" ]; then
      continue
    fi
    desc="${BASH_REMATCH[3]}"
    echo "- ${kind}: ${desc}"
    jq --arg kind "${kind}" --arg description "${desc}" '. += [ $ARGS.named ]' < "${change_log_yaml}" > "${change_log_yaml}.new"
    mv "${change_log_yaml}.new" "${change_log_yaml}"
  fi
 done <<< "${commit_titles}"
 if [ -s "${change_log_yaml}" ]; then
  yq --inplace --input-format json --output-format yml "${change_log_yaml}"
  yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${change_log_yaml}\") | sort_keys(.)" "${chart_file}"
 else
  echo "ERROR: Changelog file is empty: ${change_log_yaml}" 1>&2
  exit 1
 fi
 rm "${change_log_yaml}"
 regexp=".*-alpha-[0-9]+(\.[0-9]+){,2}$"
 if [[ "${new_tag}" =~ $regexp ]]; then
  yq --inplace '.annotations."artifacthub.io/prerelease" = "true"' "${chart_file}"
 else
  yq --inplace '.annotations."artifacthub.io/prerelease" = "false"' "${chart_file}"
 fi
@@ -0,0 +1,86 @@
 #!/bin/bash
 DEFAULT_GITEA_SERVER_URL="${GITHUB_SERVER_URL:-"https://gitea.com"}"
 DEFAULT_GITEA_REPOSITORY="${GITHUB_REPOSITORY:-"gitea/helm-gitea"}"
 DEFAULT_GITEA_TOKEN="${ISSUE_RW_TOKEN:-""}"
 if [ -z "${1}" ]; then
  read -p "Enter hostname of the Gitea instance [${DEFAULT_GITEA_SERVER_URL}]: " CURRENT_GITEA_SERVER_URL
  if [ -z "${CURRENT_GITEA_SERVER_URL}" ]; then
    CURRENT_GITEA_SERVER_URL="${DEFAULT_GITEA_SERVER_URL}"
  fi
 else
  CURRENT_GITEA_SERVER_URL=$1
 fi
 if [ -z "${2}" ]; then
  read -p "Enter name of the git repository [${DEFAULT_GITEA_REPOSITORY}]: " CURRENT_GITEA_REPOSITORY
  if [ -z "${CURRENT_GITEA_REPOSITORY}" ]; then
    CURRENT_GITEA_REPOSITORY="${DEFAULT_GITEA_REPOSITORY}"
  fi
 else
  CURRENT_GITEA_REPOSITORY=$2
 fi
 if [ -z "${3}" ]; then
  read -p "Enter token to access the Gitea instance [${DEFAULT_GITEA_TOKEN}]: " CURRENT_GITEA_TOKEN
  if [ -z "${CURRENT_GITEA_TOKEN}" ]; then
    CURRENT_GITEA_TOKEN="${DEFAULT_GITEA_TOKEN}"
  fi
 else
  CURRENT_GITEA_TOKEN=$3
 fi
 if ! git sv rn -o /tmp/changelog.md; then
  echo "ERROR: Failed to generate /tmp/changelog.md" 1>&2
  exit 1
 fi
 CURL_ARGS=(
  "--data-urlencode" "q=Changelog for upcoming version"
  # "--data-urlencode=\"q=Changelog for upcoming version\""
  "--data-urlencode" "state=open"
  "--fail"
  "--header" "Accept: application/json"
  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
  "--request" "GET"
  "--silent"
 )
 if ! ISSUE_NUMBER="$(curl "${CURL_ARGS[@]}" "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues" | jq '.[].number')"; then
  echo "ERROR: Failed query issue number" 1>&2
  exit 1
 fi
 export ISSUE_NUMBER
 if ! echo "" | jq --raw-input --slurp --arg title "Changelog for upcoming version" --arg body "$(cat /tmp/changelog.md)" '{title: $title, body: $body}' 1> /tmp/payload.json; then
  echo "ERROR: Failed to create JSON payload file" 1>&2
  exit 1
 fi
 CURL_ARGS=(
  "--data" "@/tmp/payload.json"
  "--fail"
  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
  "--header" "Content-Type: application/json"
  "--location"
  "--silent"
  "--output" "/dev/null"
 )
 if [ -z "${ISSUE_NUMBER}" ]; then
  if ! curl "${CURL_ARGS[@]}" --request POST "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues"; then
    echo "ERROR: Failed to create new issue!" 1>&2
    exit 1
  else
    echo "INFO: Successfully created new issue!"
  fi
 else
  if ! curl "${CURL_ARGS[@]}" --request PATCH "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"; then
    echo "ERROR: Failed to update issue with ID ${ISSUE_NUMBER}!" 1>&2
    exit 1
  else
    echo "INFO: Successfully updated existing issue with ID ${ISSUE_NUMBER}!"
    echo "INFO: ${CURRENT_GITEA_SERVER_URL}/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"
  fi
 fi
@@ -1,23 +0,0 @@
 name: Bash
 on:
  pull_request:
    types: [ "opened", "reopened", "synchronize" ]
  push:
    branches:
    - '**'
    tags-ignore:
    - '**'
  workflow_dispatch: {}
 jobs:
  bash-unittest:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      with:
        submodules: true
    - env:
          TERM: xterm
      name: Run bash unittests
      run: make bash/unittest
@@ -1,32 +0,0 @@
 name: changelog
 on:
  push:
    branches:
      - main
 jobs:
  changelog:
    runs-on: ubuntu-latest
    container: docker.io/thegeeklab/git-sv:2.1.3
    steps:
      - name: install tools
        run: |
          apk add -q --update --no-cache nodejs curl jq sed
      - uses: actions/checkout@v7.0.0
        with:
          fetch-depth: 0
      - name: Generate upcoming changelog
        run: |
          git sv rn -o changelog.md
          export RELEASE_NOTES=$(cat changelog.md)
          export ISSUE_NUMBER=$(curl -s "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues?state=open&q=Changelog%20for%20upcoming%20version" | jq '.[].number')
          echo $RELEASE_NOTES
          JSON_DATA=$(echo "" | jq -Rs --arg title 'Changelog for upcoming version' --arg body "$(cat changelog.md)" '{title: $title, body: $body}')
          if [ -z "$ISSUE_NUMBER" ]; then
            curl -s -X POST "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
          else
            curl -s -X PATCH "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues/$ISSUE_NUMBER" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
          fi
@@ -1,16 +1,17 @@
-name: Commit Linter
+name: Rum commitlint
 on:
  pull_request:
-    branches: [ "*" ]
+    branches: [ '**' ]
    types: [ "opened", "edited" ]
 jobs:
  check-and-test:
    container: docker.io/commitlint/commitlint:19.9.1
    name: Execute commitlint
    runs-on: ubuntu-latest
    container: docker.io/commitlint/commitlint:21.2.1
    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@v5.0.0
-      - name: Verify PR title
+      - name: Check PR title
        run: |
          echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json
@@ -1,41 +0,0 @@
 name: Helm
 on:
  pull_request:
    types: [ "opened", "reopened", "synchronize" ]
  push:
    branches:
    - '**'
    tags-ignore:
    - '**'
  workflow_dispatch: {}
 jobs:
  helm-lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
      with:
        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
    - name: Update helm dependencies
      run: helm dependency update
    - name: Lint helm files
      run: |
        helm lint --values values.yaml .
  helm-unittest:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
      with:
        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
    - env:
        HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
      name: Install helm-unittest
      run: helm plugin install --verify=false --version "${HELM_UNITTEST_VERSION}" https://github.com/helm-unittest/helm-unittest
    - name: Update helm dependencies
      run: helm dependency update
    - name: Execute helm unittests
      run: helm unittest --strict --file 'unittests/**/*.yaml' .
@@ -0,0 +1,75 @@
 name: Run Helm tests
 on:
  pull_request:
    branches: [ '**' ]
  push:
    branches: [ '**' ]
    tags-ignore: [ '**' ]
  workflow_call: {}
 env:
  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
  HELM_UNITTEST_VERSION: "v1.0.1"
 jobs:
  helm-lint:
    container: docker.io/alpine/helm:3.18.6
    name: Execute helm lint
    runs-on: ubuntu-latest
    steps:
      - name: Install additional tools
        run: |
          apk update
          apk add --update bash make nodejs
      - uses: actions/checkout@v5.0.0
      - name: Install helm chart dependencies
        run: helm dependency build
      - name: Execute helm lint
        run: helm lint
  helm-template:
    container: docker.io/alpine/helm:3.18.6
    name: Execute helm template
    runs-on: ubuntu-latest
    steps:
      - name: Install additional tools
        run: |
          apk update
          apk add --update bash make nodejs
      - uses: actions/checkout@v5.0.0
      - name: Install helm chart dependencies
        run: helm dependency build
      - name: Execute helm template
        run: helm template --debug gitea-helm .
  helm-unittest:
    container: docker.io/alpine/helm:3.18.6
    name: Execute helm unittest
    runs-on: ubuntu-latest
    steps:
      - name: Install additional tools
        run: |
          apk update
          apk add --update bash make nodejs npm yamllint ncurses
      - uses: actions/checkout@v5.0.0
      - name: Install helm chart dependencies
        run: helm dependency build
      - name: Install helm plugin 'unittest'
        run: |
          helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
          git submodule update --init --recursive
      - name: Execute helm unittest
        env:
          TERM: xterm
        run: make unittests
      # - name: verify readme
      #   run: |
      #     make readme
      #     git diff --exit-code --name-only README.md
      # - name: yaml lint
      #   uses: https://github.com/ibiqlik/action-yamllint@v3
@@ -1,44 +0,0 @@
 name: Markdown linter
 on:
  pull_request:
    paths: [ "**/*.md" ]
    types: [ "opened", "reopened", "synchronize" ]
  push:
    branches:
    - '**'
    paths: [ "**/*.md" ]
    tags-ignore:
    - '**'
  workflow_dispatch: {}
 jobs:
  markdown-link-checker:
    container:
      image: docker.io/library/node:26.8.2-alpine
    runs-on: ubuntu-latest
    steps:
    - name: Install tooling
      run: |
        apk update
        apk add git npm
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
    - name: Verify links in markdown files
      run: |
        npm install
        npm run readme:link
  markdown-lint:
    container:
      image: docker.io/library/node:26.8.2-alpine
    runs-on: ubuntu-latest
    steps:
    - name: Install tooling
      run: |
        apk update
        apk add git
    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
    - name: Lint markdown files
      run: |
        npm install
        npm run readme:lint
@@ -0,0 +1,52 @@
 name: Markdown linter
 on:
  pull_request:
    types: [ "opened", "reopened", "synchronize" ]
  push:
    branches: [ '**' ]
    tags-ignore: [ '**' ]
  workflow_dispatch: {}
 jobs:
  readme-link:
    container:
      image: docker.io/library/node:24.9.0-alpine
    name: Execute npm run readme:link
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5.0.0
    - name: Execute npm run readme:link
      run: |
        npm install
        npm run readme:link
  readme-lint:
    container:
      image: docker.io/library/node:24.9.0-alpine
    name: Execute npm run readme:lint
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v5.0.0
    - name: Execute npm run readme:lint
      run: |
        npm install
        npm run readme:lint
  readme-parameters:
    container:
      image: docker.io/library/node:24.9.0-alpine
    name: Execute npm run readme:parameters
    runs-on: ubuntu-latest
    steps:
    - name: Install tooling
      run: |
        apk update
        apk add git
    - uses: actions/checkout@v5.0.0
    - name: Execute npm run readme:parameters
      run: |
        npm install
        npm run readme:parameters
    - name: Compare diff
      run: git diff --exit-code --name-only README.md
@@ -1,94 +1,160 @@
-name: generate-chart
+name: Release
 env:
  GPG_PRIVATE_KEY_FILE: ${{ runner.temp }}/private.key
  GPG_PRIVATE_KEY_FINGERPRINT: ${{ vars.GPG_PRIVATE_KEY_FINGERPRINT }}
  GPG_PRIVATE_KEY_PASSPHRASE_FILE: ${{ runner.temp }}/passphrase.txt
 on:
  push:
-    tags:
+    tags: [ '**' ]
      - "*"
 jobs:
-  generate-chart-publish:
+  publish-chart:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: azure/setup-helm@v4.3.1
        with:
          version: "v4.0.1" # renovate: datasource=github-tags depName=helm/helm
      - name: Install helm plugins
        env:
          HELM_SIGSTORE_VERSION: "0.3.0" # renovate: datasource=github-tags depName=sigstore/helm-sigstore extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
          HELM_SCHEMA_VALUES_VERSION: "2.3.1" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
          HELM_UNITTEST_VERSION: "1.0.3" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
        run: |
          helm plugin install --verify=false https://github.com/sigstore/helm-sigstore.git --version "${HELM_SIGSTORE_VERSION}" 1> /dev/null
          helm plugin install --verify=false https://github.com/losisin/helm-values-schema-json.git --version "${HELM_SCHEMA_VALUES_VERSION}" 1> /dev/null
          helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest.git --version "${HELM_UNITTEST_VERSION}" 1> /dev/null
          helm plugin list
      - name: GPG configuration
        env:
          GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
          GPG_PRIVATE_KEY: ${{ secrets.GPGSIGN_KEY }}
        run: |
          # Configure GPG and GPG Agent
          mkdir --parents "${HOME}/.gnupg"
          chmod 0700 "${HOME}/.gnupg"
          cat > "${HOME}/.gnupg/gpg.conf" <<EOF
          use-agent
          pinentry-mode loopback
          EOF
          cat > "${HOME}/.gnupg/gpg-agent.conf" <<EOF
          allow-loopback-pinentry
          max-cache-ttl 86400
          default-cache-ttl 86400
          EOF
          gpgconf --kill gpg-agent
          gpgconf --launch gpg-agent
          # Import GPG private key
          cat 1> "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
          cat 1> "${GPG_PRIVATE_KEY_FILE}" <<< "${GPG_PRIVATE_KEY}"
          gpg --batch --yes --passphrase-fd 0 --import "${GPG_PRIVATE_KEY_FILE}" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
          # Export GPG keyring
          gpg --batch --yes --export "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/pubring.gpg"
          gpg --batch --yes --passphrase-fd 0 --export-secret-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/secring.gpg" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
      - uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0
      - name: Install packages via apt
        run: |
          apt update --yes
          apt install --yes curl ca-certificates curl gnupg jq
      - name: Install helm
        env:
          # renovate: datasource=docker depName=alpine/helm
          HELM_VERSION: "3.21.3"
        run: |
          curl --fail --location --output /dev/stdout --silent --show-error https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
          mv linux-$(dpkg --print-architecture)/helm /usr/local/bin/
          rm --force --recursive linux-$(dpkg --print-architecture) helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz
          helm version
      - name: Install docker-ce via apt
        run: |
          install -m 0755 -d /etc/apt/keyrings
          curl --fail --location --silent --show-error https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
          chmod a+r /etc/apt/keyrings/docker.gpg
          echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
          apt update --yes
          apt install --yes python3 python3-pip apt-transport-https docker-ce-cli
      - name: Install awscli
        run: |
          pip install awscli --break-system-packages
          aws --version
      - name: Import GPG key
        id: import_gpg
        uses: https://github.com/crazy-max/ghaction-import-gpg@v7
        with:
          gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
          passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
          fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
      - name: Add Artifacthub.io annotations
        uses: volker-raschek/ah-annotations@v0.2.0
      # Using helm gpg plugin as 'helm package --sign' has issues with gpg2: https://github.com/helm/helm/issues/2843
      - name: package chart
        run: |
-          echo ${{ secrets.DOCKER_CHARTS_PASSWORD }} | docker login -u ${{ secrets.DOCKER_CHARTS_USERNAME }} --password-stdin
+          NEW_TAG="$(git tag --sort=-version:refname | head --lines 1)"
-          # FIXME: use upstream after https://github.com/technosophos/helm-gpg/issues/1 is solved
+          OLD_TAG="$(git tag --sort=-version:refname | head --lines 2 | tail --lines 1)"
-          helm plugin install https://github.com/pat-s/helm-gpg
+          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
      - name: Extract meta information
        run: |
          echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut --delimiter '/' --fields 3)" >> $GITHUB_ENV
          echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
          echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut --delimiter '/' --fields 2)" >> $GITHUB_ENV
          echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut --delimiter '/' --fields 1)" >> $GITHUB_ENV
      - name: Package chart
        run: |
          helm dependency build
-          helm package --version "${GITHUB_REF#refs/tags/v}" ./
+          helm package \
-          mkdir gitea
+            --sign \
-          mv gitea*.tgz gitea/
+            --key "$(gpg --with-colons --list-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" | grep uid | cut --delimiter ':' --fields 10)" \
-          curl --fail --location --output gitea/index.yaml --silent --show-error https://dl.gitea.com/charts/index.yaml
+            --keyring "${HOME}/.gnupg/secring.gpg" \
-          helm repo index gitea/ --url https://dl.gitea.com/charts --merge gitea/index.yaml
+            --passphrase-file "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" \
-          # push to dockerhub
+            --version "${PACKAGE_VERSION}" ./
          echo ${{ secrets.DOCKER_CHARTS_PASSWORD }} | helm registry login -u ${{ secrets.DOCKER_CHARTS_USERNAME }} registry-1.docker.io --password-stdin
          helm push gitea/gitea-${GITHUB_REF#refs/tags/v}.tgz oci://registry-1.docker.io/giteacharts
          helm registry logout registry-1.docker.io
-      - name: Copy files to Cloudflare R2
+      - uses: docker/login-action@v3.7.0
        with:
          username: ${{ secrets.DOCKER_IO_USERNAME }}
          password: ${{ secrets.DOCKER_IO_PASSWORD }}
      - name: Upload package as OCI artifact to docker.io
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          DOCKER_IO_REPO_NAME: ${{ vars.DOCKER_IO_REPO_NAME }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
        run: |
-          aws s3 sync gitea/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com
+          helm push *-${PACKAGE_VERSION}.tgz "oci://registry-1.docker.io/${DOCKER_IO_REPO_NAME}"
-  release-gitea:
+      - uses: docker/login-action@v3.7.0
-    needs: generate-chart-publish
+        with:
-    runs-on: ubuntu-latest
+          registry: ${{ github.server_url }}
-    container: docker.io/thegeeklab/git-sv:2.1.3
+          username: ${{ secrets.GITEA_PACKAGE_REGISTRY_USERNAME }}
-    steps:
+          password: ${{ secrets.GITEA_PACKAGE_REGISTRY_TOKEN }}
-      - name: install tools
+
      - name: Upload package as OCI artifact to Gitea
        run: |
-          apk add -q --update --no-cache nodejs
+          helm push ${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz "oci://${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}"
-      - uses: actions/checkout@v7.0.0
+
      # - name: Build new index.yaml
      #   run: |
      #     mkdir gitea
      #     curl \
      #       --fail \
      #       --header \
      #       --location \
      #       --output gitea/index.yaml \
      #       --show-error \
      #       --silent \
      #         https://dl.gitea.com/charts/index.yaml
      #     helm repo index \
      #       --merge gitea/index.yaml \
      #       --url https://dl.gitea.com/charts \
      #         gitea/
      # - uses: aws-actions/configure-aws-credentials@v6.0.0
      #   with:
      #     aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
      #     aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      #     aws-region: ${{ secrets.AWS_REGION }}
      # - name: Upload package as Helm chart to AWS S3
      #   run: |
      #     aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET }}/charts/
  publish-release-notes:
    needs: publish-chart
    runs-on: ubuntu-latest
    steps:
      - name: Install gitsv
        env:
          GITSV_VERSION: v2.0.9 # renovate: datasource=github-releases depName=thegeeklab/git-sv
        run: |
          curl \
            --fail \
            --location \
            --output git-sv \
            --output-dir /usr/local/bin \
            --silent \
            --show-error \
              https://github.com/thegeeklab/git-sv/releases/download/${GITSV_VERSION}/git-sv-linux-$(dpkg --print-architecture)
          git-sv --version
      - uses: actions/checkout@v6.0.0
        with:
          fetch-tags: true
          fetch-depth: 0
@@ -96,12 +162,12 @@ jobs:
      - name: Create changelog
        run: |
          git sv current-version
-          git sv release-notes -t ${GITHUB_REF#refs/tags/} -o CHANGELOG.md
+          git sv release-notes -t "${PACKAGE_VERSION}" -o CHANGELOG.md
-          sed -i '1,2d' CHANGELOG.md # remove version
+          sed -i '1,2d' CHANGELOG.md
          cat CHANGELOG.md
      - name: Release
-        uses: https://github.com/akkuman/gitea-release-action@v1
+        uses: akkuman/gitea-release-action@v1.3.5
        with:
          body_path: CHANGELOG.md
          token: "${{ secrets.RELEASE_TOKEN }}"
@@ -0,0 +1,29 @@
 name: Update changelog
 on:
  push:
    branches: [ "main" ]
  workflow_dispatch: {}
 jobs:
  changelog:
    runs-on: ubuntu-latest
    steps:
      - name: Install packages via apt-get
        run: |
          apt-get update &&
          apt-get install --yes curl jq
      - uses: actions/checkout@v5.0.0
        with:
          fetch-depth: 0
      - name: Install git-sv
        env:
          GIT_SV_VERSION: v2.0.4 # renovate: datasource=github-releases depName=thegeeklab/git-sv
        run: |
          curl --fail --location --output /usr/local/bin/git-sv --silent --show-error https://github.com/thegeeklab/git-sv/releases/download/${GIT_SV_VERSION}/git-sv-linux-$(dpkg --print-architecture)
          chmod +x /usr/local/bin/git-sv
          git-sv --version
      - name: Update changelog issue
        env:
          ISSUE_RW_TOKEN: ${{ secrets.ISSUE_RW_TOKEN }}
        run: .gitea/scripts/update-changelog.sh
@@ -1,66 +0,0 @@
 # Gitea Helm Chart — Copilot Instructions
 ## Project Overview
 Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster.
 ## Build & Test
 ```bash
 make missing-dot       # Check if the @param annotations are missing a trailing dot.
 make readme            # Regenerate README.md parameter table + lint + link checker
 make helm/unittest     # Run Helm unit tests (helm-unittest plugin required)
 make bash/unittest     # Run bash/bats script tests (requires git submodule init)
 ```
 Always run `make readme` after changing `values.yaml` `@param` annotations.
 Always run `make helm/unittest` after changing templates or unit tests.
 ## Conventions
 ### values.yaml
 - Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
 - Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
 - Top-level keys are sorted alphabetically within their section group.
 - Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
 ```yaml
 image:
  registry: docker.io
  repository: library/busybox
  tag: 0.1.0
 ```
 ### Templates
 - Helm templates live in `templates/`. Helpers live in `templates/_helpers.tpl`.
 - Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
 - Use `include "gitea.fullname"` for naming resources.
 - Use `fail` for required-value validation with clear error messages referencing the full values path.
 - Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
 - Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
 - Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
 - Use as prefix of YAML files the resource kind (e.g., `deployment.yaml` for `Deployment` resources). If there are multiple resources of the same kind, use a descriptive suffix (e.g., `deployment_metrics.yaml` for a `Deployment` related to metrics).
 - Short names like `pvc` for Persistent Volume Claims or `svc` for Services are not allowed in file names or key names.
 ### Unit Tests
 - Helm unit tests live in `unittests/helm/` mirroring the template structure.
 - Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
 - Each test must set all required values explicitly — do not rely on cross-test state.
 - The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint.yaml`. Use `make yamllint` to run the linter.
 - The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
 - Each unit test must explicitly set a custom namespace and release name, rather than relying on defaults.
 ### Commits & PRs
 - Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
 - See `CONTRIBUTING.md` for full PR requirements.
 - Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
 - Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
 ### Documentation
 - `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
 - `README.md` parameter tables are auto-generated — never edit them manually.
@@ -36,6 +36,6 @@ unittests/
 .prettierignore
 .yamllint
 CODEOWNERS
-renovate.json
+renovate.json5
 .commitlintrc.json
 .gitsv/
@@ -0,0 +1,8 @@
 {
  "projectBaseUrl":"${workspaceFolder}",
  "ignorePatterns": [
    {
      "pattern": "^http://localhost"
    }
  ]
 }
@@ -1,10 +1,7 @@
 {
    "yaml.schemas": {
-        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
+        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.1/schema/helm-testsuite.json": [
            "/unittests/**/*.yaml"
        ],
        "https://docs.renovatebot.com/renovate-schema.json":[
          "renovate.json"
        ]
    },
    "yaml.schemaStore.enable": true,
@@ -1,21 +1,20 @@
 ---
 extends: default
 ignore: |
  charts
  .yamllint
  node_modules
  templates
  unittests/bash
 rules:
  braces:
    max-spaces-inside: 2
  comments:
    min-spaces-from-content: 1
  comments-indentation: disable
  document-start: disable
  line-length: disable
  truthy:
    allowed-values: ['true', 'false']
-    check-keys: false
+    check-keys: False
    level: error
  line-length: disable
  document-start: disable
  comments:
    min-spaces-from-content: 1
  braces:
    max-spaces-inside: 2
@@ -1 +1 @@
-* @volker.raschek @ChristopherHX
+* @rossigee @volker.raschek @ChristopherHX
@@ -37,14 +37,14 @@ For local development and testing of pull requests, the following workflow can
 be used:
 1. Install `minikube` and `helm`.
-2. Start a `minikube` cluster via `minikube start`.
+1. Start a `minikube` cluster via `minikube start`.
-3. From the `gitea/helm-gitea` directory execute the following command.
+1. From the `gitea/helm-gitea` directory execute the following command.
   This will install the dependencies listed in `Chart.yml` and deploy the current state of the helm chart found locally.
   If you want to test a branch, make sure to switch to the respective branch first.
   `helm install --dependency-update gitea . -f values.yaml`.
-4. Gitea is now deployed in `minikube`. To access it, it's port needs to be forwarded first from `minikube` to localhost
+1. Gitea is now deployed in `minikube`.
-   first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at
+   To access it, it's port needs to be forwarded first from `minikube` to localhost first via `kubectl --namespace
-   `localhost:3000`.
+default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000).
 ### Unit tests
@@ -5,8 +5,11 @@ dependencies:
 - name: postgresql-ha
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 16.3.2
 - name: valkey-cluster
  repository: oci://registry-1.docker.io/bitnamicharts
  version: 3.0.24
 - name: valkey
-  repository: https://valkey.io/valkey-helm
+  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 0.10.0
+  version: 3.0.31
-digest: sha256:1afecbf0d4fc9f48e31417573d4bed7e0ac7848040b9e0c5f3989ada9d1f944f
+digest: sha256:ceb6a1890cfdc2627abb85d3e2a4baa64d30afd21dcfabce978a824a67f0a2bb
-generated: "2026-07-20T19:52:11.548874634+02:00"
+generated: "2025-08-30T00:03:04.59764502Z"
@@ -3,7 +3,8 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-appVersion: 1.27.3
+# renovate datasource=github-releases depName=go-gitea/gitea extractVersion=^v(?<version>.*)$
 appVersion: 1.24.6
 icon: https://gitea.com/assets/img/logo.svg
 annotations:
@@ -25,6 +26,9 @@ sources:
  - https://docker.gitea.com/gitea
 maintainers:
  # https://gitea.com/rossigee
  - name: Ross Golder
    email: ross@golder.org
  # https://gitea.com/volker.raschek
  - name: Markus Pesch
    email: markus.pesch+apps@cryptic.systems
@@ -46,8 +50,13 @@ dependencies:
    repository: oci://registry-1.docker.io/bitnamicharts
    version: 16.3.2
    condition: postgresql-ha.enabled
  # https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml
  - name: valkey-cluster
    repository: oci://registry-1.docker.io/bitnamicharts
    version: 3.0.24
    condition: valkey-cluster.enabled
  # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
  - name: valkey
-    repository: https://valkey.io/valkey-helm
+    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 0.10.0
+    version: 3.0.31
    condition: valkey.enabled
@@ -1,67 +1,29 @@
 SHELL := /usr/bin/env bash -O globstar
-# CLEAN
+.PHONY: prepare-environment
-# ==============================================================================
+prepare-environment:
-PHONY+=clean
+	npm install
 clean:
 	-rm -rf charts *.tar.gz *.tar.gz.sig node_modules
-# MISSING DOT
+.PHONY: readme
-# ==============================================================================
+readme: prepare-environment
-PHONY+=missing-dot
+	npm run readme:parameters
-missing-dot:
+	npm run readme:lint
 	grep --perl-regexp '## @(param|skip).*[^.]$$' values.yaml
-# README
+.PHONY: unittests
-# ==============================================================================
+unittests: unittests-helm unittests-bash
 PHONY+=readme
 readme: readme/link readme/lint readme/parameters
-PHONY+=readme/link
+.PHONY: unittests-helm
-readme/link:
+unittests-helm:
-	npm install && npm run readme:link
+	helm unittest --strict -f 'unittests/helm/**/*.yaml' -f 'unittests/helm/values-conflicting-checks.yaml' ./
-PHONY+=readme/lint
+.PHONY: unittests-bash
-readme/lint:
+unittests-bash:
 	npm install && npm run readme:lint
 PHONY+=readme/parameters
 readme/parameters:
 	npm install && npm run readme:parameters
 # HELM DEPENDENCIES
 # ==============================================================================
 PHONY+=helm/dependency-update
 helm/dependency-update:
 	helm dependency update
 # HELM UNITTESTS
 # ==============================================================================
 PHONY+=helm/unittest
 helm/unittest:
 	helm unittest --strict --file 'unittests/helm/**/*.yaml' --file 'unittests/helm/values-conflicting-checks.yaml' ./
 # BASH PREPARE
 # ==============================================================================
 PHONY+=bash/prepare
 bash/prepare:
 	git submodule init
 	git submodule update
 # BASH UNITTESTS
 # ==============================================================================
 PHONY+=bash/unittest
 bash/unittest:
 	./unittests/bash/bats/bin/bats --pretty ./unittests/bash/tests/**/*.bats
-# YAML LINT
+.PHONY: update-helm-dependencies
-# ==============================================================================
+update-helm-dependencies:
-PHONY+=yamllint
+	helm dependency update
 yamllint:
 	yamllint -c .yamllint.yaml .
-# PHONY
+.PHONY: yamllint
-# ==============================================================================
+yamllint:
-# Declare the contents of the PHONY variable as phony. We keep that information
+	yamllint -c .yamllint .
 # in a variable so we can use it in if_changed.
 .PHONY: ${PHONY}
@@ -1,269 +0,0 @@
 # Gateway API
 This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
 alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
 are rendered:
 - `HTTPRoute` — required for HTTP traffic
 - `TCPRoute` — optional, typically for SSH (port 22)
 - `BackendTLSPolicy` — optional, for encrypted backend traffic
 - `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
 All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
 The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
 ## Prerequisites
 | Resource               | API version                          | Status (as of writing) |
 | ---------------------- | ------------------------------------ | ---------------------- |
 | `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
 | `TCPRoute`             | `gateway.networking.k8s.io/v1`       | GA (v1.4+)             |
 | `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
 | `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
 ## Common topology
 Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
 ```yaml
 gatewayAPI:
  core:
    httpRoute:
      enabled: true
      tls: true            # the shared Gateway terminates TLS
      hostnames:
        - git.example.com
      parentRefs:
        - group: gateway.networking.k8s.io
          kind: Gateway
          name: shared-gateway
          namespace: gateway-system
          sectionName: https-gitea   # pin to a specific listener (see below)
    tcpRoute:
      enabled: true
      parentRefs:
        - group: gateway.networking.k8s.io
          kind: Gateway
          name: shared-gateway
          namespace: gateway-system
          sectionName: ssh
 ```
 With this configuration:
 - `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
 - Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
 - The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
 - Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
 ### Why `sectionName` matters
 Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
 that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
 to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
 (e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
 side typically looks like:
 ```yaml
 listeners:
  - name: https-gitea
    port: 443
    protocol: HTTPS
    hostname: git.example.com
    tls:
      certificateRefs:
        - name: git-example-com-tls
    allowedRoutes:
      kinds:
        - kind: HTTPRoute
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: gitea
  - name: ssh
    port: 22
    protocol: TCP
    allowedRoutes:
      kinds:
        - kind: TCPRoute
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: gitea
 ```
 ### Sharing a hostname between HTTP and SSH
 HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
 clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
 and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
 extra configuration.
 If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
 cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
 ```yaml
 gitea:
  config:
    server:
      SSH_DOMAIN: gitea-ssh.example.com
 ```
 ## BackendTLSPolicy
 Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
 `PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
 verify the backend certificate before forwarding the request.
 ### Configuring Gitea to serve HTTPS directly
 Gitea serves HTTPS via three `[server]` app.ini options
 ([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
 cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths:
 ```yaml
 gitea:
  config:
    server:
      PROTOCOL: https
      CERT_FILE: /etc/gitea-tls/tls.crt
      KEY_FILE: /etc/gitea-tls/tls.key
 deployment:
  gitea:
    volumeMounts:
      - name: gitea-tls
        mountPath: /etc/gitea-tls
        readOnly: true
  volumes:
    - name: gitea-tls
      secret:
        secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
 ```
 - Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
  official image); absolute paths are clearer.
 - Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
 - For chained certs, the server cert comes first, intermediates after.
 - The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
  (3000 by default) is now speaking HTTPS instead of HTTP.
 ### BackendTLSPolicy example
 Verify the backend with a CA bundle stored in a `ConfigMap`:
 ```yaml
 gatewayAPI:
  core:
    backendTLSPolicy:
      enabled: true
      validation:
        hostname: gitea.svc.cluster.local
        caCertificateRefs:
          - name: gitea-backend-ca
            group: ""
            kind: ConfigMap
 ```
 This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
 (`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
 API; the template fails fast if omitted.
 ### System CA trust and explicit targetRefs
 To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
 and `targetRefs`:
 ```yaml
 gatewayAPI:
  core:
    backendTLSPolicy:
      enabled: true
      targetRefs:
        - group: ""
          kind: Service
          name: gitea-sidecar
      validation:
        hostname: sidecar.gitea.svc.cluster.local
        wellKnownCACertificates: System
 ```
 Notes:
 - `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
 - `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
  (otherwise stick with `caCertificateRefs`).
 - The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
  `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
 ## Raising the request body size limit (NGINX Gateway Fabric)
 NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
 Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
 images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
 `nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
 API. NGINX Gateway Fabric instead reads the limit from a
 [`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
 This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
 **not** impose a default request body size limit, so large uploads work without any extra configuration —
 leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
 ```yaml
 gatewayAPI:
  enabled: true
  nginx:
    clientSettingsPolicies:
      enabled: true
      body:
        maxSize: 100m   # bytes, or with a k / m / g suffix; 0 disables the limit
 ```
 This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
 (`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
 template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
 are supported too.
 To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
 override `targetRef`:
 ```yaml
 gatewayAPI:
  nginx:
    clientSettingsPolicies:
      enabled: true
      targetRef:
        group: gateway.networking.k8s.io
        kind: Gateway
        name: shared-gateway
      body:
        maxSize: 100m
 ```
 Notes:
 - `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
  attaching it to an `HTTPRoute` scopes it to that route only.
 - The policy must live in the same namespace as its `targetRef`.
 - Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
  `[packages]` sections) — raising the proxy limit alone is not always sufficient.
 ## Interaction with `ingress` and `route`
 The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
 1. `route.host` (when `route.enabled`)
 2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
 3. First `ingress.hosts[0].host`
 4. The in-cluster Service DNS name
 Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
 ## SSH considerations
 - `TCPRoute` is GA since Gateway API v1.4. Older CRD bundles only ship the `v1alpha2` version, so make sure the installed CRDs are at least v1.4.
 - If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
 - The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.
@@ -14,7 +14,7 @@ They might cost a bit more than using a self-hosted k8s variant but are usually
 Also they can be centrally managed and are not linked to the Gitea helm chart or namespace.
 Please consider using external services before you start with your Gitea HA setup, it will make your life (and the life of the Gitea maintainers) easier.
-This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `deployment.replicas` is set to a value > 1.
+This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `replicaCount` is set to a value > 1.
 Nevertheless, we cannot guarantee for every possible combination of Gitea settings to work together perfectly in a HA setup.
 As a general advice, we recommend to have a test environment aside on which to test possible changes/upgrades before applying these to a production installation.
@@ -175,4 +175,4 @@ gitea:
 - Currently Cron jobs are run on all replicas as no leader election is implemented.
  See [https://github.com/go-gitea/gitea/issues/13791](https://github.com/go-gitea/gitea/issues/13791) for a discussion and possible solution.
- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases.
+- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases. 
@@ -9,13 +9,13 @@
    "npm": ">=8.0.0"
  },
  "scripts": {
-    "readme:link": "markdown-link-check *.md",
+    "readme:link": "markdown-link-check --config .markdownlink.json *.md",
    "readme:lint": "markdownlint *.md -f",
    "readme:parameters": "readme-generator -v values.yaml -r README.md"
  },
  "devDependencies": {
    "@bitnami/readme-generator-for-helm": "^2.5.0",
    "markdown-link-check": "^3.13.6",
-    "markdownlint-cli": "^0.49.0"
+    "markdownlint-cli": "^0.45.0"
  }
 }
@@ -1,136 +0,0 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "gitea>gitea/renovate-config",
    "helpers:pinGitHubActionDigests",
    ":automergeMinor",
    "schedule:automergeDaily",
    "schedule:weekends"
  ],
  "labels": [
    "kind/dependency"
  ],
  "digest": {
    "automerge": true
  },
  "automergeStrategy": "squash",
  "git-submodules": {
    "enabled": true
  },
  "customManagers": [
    {
      "description": "Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions",
      "customType": "regex",
      "managerFilePatterns": [
        "/.gitea/workflows/.+\\.ya?ml$/"
      ],
      "matchStrings": [
        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s"
      ]
    },
    {
      "description": "Detect helm-unittest yaml schema file",
      "customType": "regex",
      "managerFilePatterns": [
        "/.vscode/settings\\.json$/"
      ],
      "matchStrings": [
        "https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json"
      ],
      "datasourceTemplate": "github-releases"
    },
    {
      "description": "Automatically detect new Gitea releases",
      "customType": "regex",
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "gitea/gitea",
      "extractVersionTemplate": "^v(?<version>.*)$",
      "managerFilePatterns": [
        "/(^|/)Chart\\.ya?ml$/"
      ],
      "matchStrings": [
        "^appVersion:\\s+[\"']?(?<currentVersion>\\S+)[\"']?$"
      ]
    }
  ],
  "lockFileMaintenance": {
    "enabled": true,
    "commitMessageAction": "update",
    "commitMessageTopic": "lockfiles",
    "schedule": [
      "at any time"
    ]
  },
  "packageRules": [
    {
      "groupName": "subcharts (minor & patch)",
      "matchManagers": [
        "helmv3"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch",
        "digest"
      ]
    },
    {
      "groupName": "bats testing framework",
      "matchManagers": [
        "git-submodules"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch",
        "digest"
      ]
    },
    {
      "groupName": "workflow dependencies (minor & patch)",
      "matchManagers": [
        "github-actions",
        "npm",
        "custom.regex"
      ],
      "matchUpdateTypes": [
        "minor",
        "patch",
        "digest"
      ],
      "matchFileNames": [
        "!Chart.yaml"
      ]
    },
    {
      "description": "Update README.md on changes in values.yaml",
      "matchManagers": [
        "helm-values"
      ],
      "postUpgradeTasks": {
        "commands": [
          "install-tool node",
          "make readme"
        ],
        "fileFilters": [
          "README.md"
        ],
        "executionMode": "update"
      }
    },
    {
      "description": "Override changelog url for Helm image, to have release notes in our PRs",
      "matchDepNames": [
        "alpine/helm"
      ],
      "changelogUrl": "https://github.com/helm/helm"
    },
    {
      "description": "Bump Gitea as fast as possible - not only on weekends",
      "matchDepNames": [
        "go-gitea/gitea"
      ],
      "schedule": [
        "at any time"
      ]
    }
  ]
 }
@@ -0,0 +1,132 @@
 {
  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
  extends: [
    'gitea>gitea/renovate-config',
    ':automergeMinor',
    'schedule:automergeDaily',
    'schedule:weekends',
  ],
  labels: [
    'kind/dependency',
  ],
  digest: {
    automerge: true,
  },
  automergeStrategy: 'squash',
  'git-submodules': {
    enabled: true,
  },
  customManagers: [
    {
      description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
      customType: 'regex',
      managerFilePatterns: [
        '/.gitea/workflows/.+\\.ya?ml$/',
      ],
      matchStrings: [
        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
      ],
    },
    {
      description: 'Detect helm-unittest yaml schema file',
      customType: 'regex',
      managerFilePatterns: [
        '/.vscode/settings\\.json$/',
      ],
      matchStrings: [
        'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
      ],
      datasourceTemplate: 'github-releases',
    },
    {
      description: 'Automatically detect new Gitea releases',
      customType: 'regex',
      managerFilePatterns: [
        '/(^|/)Chart\\.yaml$/',
      ],
      matchStrings: [
        '# renovate datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) extractVersion=(?<extractVersion>\\S+)\\nappVersion:\\s?(?<currentValue>\\S+)\\n',
      ],
    },
  ],
  lockFileMaintenance: {
    "enabled": true,
    "commitMessageAction": "update",
    "commitMessageTopic": "lockfiles",
    schedule: [
      'at any time',
    ]
  },
  packageRules: [
    {
      groupName: 'subcharts (minor & patch)',
      matchManagers: [
        'helmv3',
      ],
      matchUpdateTypes: [
        'minor',
        'patch',
        'digest',
      ],
    },
    {
      groupName: 'bats testing framework',
      matchManagers: [
        'git-submodules',
      ],
      matchUpdateTypes: [
        'minor',
        'patch',
        'digest',
      ],
    },
    {
      groupName: 'workflow dependencies (minor & patch)',
      matchManagers: [
        'github-actions',
        'npm',
        'custom.regex',
      ],
      matchUpdateTypes: [
        'minor',
        'patch',
        'digest',
      ],
      matchFileNames: [
        '!Chart.yaml',
      ],
    },
    {
      description: 'Update README.md on changes in values.yaml',
      matchManagers: [
        'helm-values',
      ],
      postUpgradeTasks: {
        commands: [
          'install-tool node',
          'make readme',
        ],
        fileFilters: [
          'README.md',
        ],
        executionMode: 'update',
      },
    },
    {
      description: 'Override changelog url for Helm image, to have release notes in our PRs',
      matchDepNames: [
        'alpine/helm',
      ],
      changelogUrl: 'https://github.com/helm/helm',
    },
    {
      description: 'Bump Gitea as fast as possible - not only on weekends',
      matchDepNames: [
        'go-gitea/gitea',
      ],
      schedule: [
        'at any time',
      ],
    },
  ],
 }
@@ -78,6 +78,7 @@ function env2ini::reload_preset_envs() {
  rm $TMP_EXISTING_ENVS_FILE
 }
 function env2ini::process_config_file() {
  local config_file="${1}"
  local section="$(basename "${config_file}")"
@@ -150,4 +151,4 @@ if [ -f ${GITEA_APP_INI} ]; then
  unset GITEA__SERVER__LFS_JWT_SECRET
 fi
-gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
+environment-to-ini -o $GITEA_APP_INI
@@ -1,12 +1,5 @@
 1. Get the application URL by running these commands:
-{{- if .Values.route.enabled }}
+{{- if .Values.ingress.enabled }}
  {{- if .Values.route.host }}
  {{ include "gitea.public_protocol" . }}://{{ tpl .Values.route.host . }}{{ .Values.route.path }}
  {{- else }}
  export ROUTE_HOST=$(kubectl get route --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} -o jsonpath="{.spec.host}")
  echo {{ include "gitea.public_protocol" . }}://$ROUTE_HOST{{ .Values.route.path }}
  {{- end }}
 {{- else if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
  {{- range .paths }}
  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
@@ -1,30 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.backendTLSPolicy.annotations" -}}
 {{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* enabled */}}
 {{- define "gitea.backendTLSPolicy.enabled" -}}
 {{- if and .Values.gatewayAPI.enabled
          .Values.gatewayAPI.core.backendTLSPolicy.enabled
 -}}
 true
 {{- else -}}
 false
 {{- end -}}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.backendTLSPolicy.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
@@ -1,30 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.clientSettingsPolicies.annotations" -}}
 {{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* enabled */}}
 {{- define "gitea.clientSettingsPolicies.enabled" -}}
 {{- if and .Values.gatewayAPI.enabled
          .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
 -}}
 true
 {{- else -}}
 false
 {{- end -}}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.clientSettingsPolicies.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
@@ -1,38 +0,0 @@
 {{/* annotations */}}
 {{- define "gitea.deployment.annotations" -}}
 {{- with .Values.deployment.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* initContainers */}}
 {{- define "gitea.deployment.initContainers" -}}
 {{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }}
 {{- range $index, $entry := .Values.deployment.initContainers }}
 {{- if and (hasKey $entry "container") (hasKey $entry "link") }}
 {{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }}
 {{- else if hasKey $entry "container" }}
 {{- list $entry.container | toYaml | nindent 0 }}
 {{- else if hasKey $entry "link" }}
 {{- if not (has $entry.link $links) }}
 {{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }}
 {{- end }}
 {{- with include (printf "gitea.initContainer.%s" $entry.link) $ }}
 {{- nindent 0 . }}
 {{- end }}
 {{- else }}
 {{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }}
 {{- end }}
 {{- end }}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.deployment.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.deployment.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
@@ -43,25 +43,15 @@ Create chart name and version as used by the chart label.
 Create image name and tag used by the deployment.
 */}}
 {{- define "gitea.image" -}}
-{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}}
+{{- $fullOverride := .Values.image.fullOverride | default "" -}}
-{{- end -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
-
+{{- $repository := .Values.image.repository -}}
 {{/*
 Create image name and tag from an arbitrary `image` dict.
 Arguments: (list $root $image)
 */}}
 {{- define "gitea.image.name" -}}
 {{- $root := index . 0 -}}
 {{- $image := index . 1 -}}
 {{- $fullOverride := $image.fullOverride | default "" -}}
 {{- $registry := $root.Values.global.imageRegistry | default $image.registry -}}
 {{- $repository := $image.repository -}}
 {{- $separator := ":" -}}
-{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}}
+{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
-{{- $rootless := ternary "-rootless" "" ($image.rootless) -}}
+{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
 {{- $digest := "" -}}
-{{- if $image.digest }}
+{{- if .Values.image.digest }}
-    {{- $digest = (printf "@%s" ($image.digest | toString)) -}}
+    {{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
 {{- end -}}
 {{- if $fullOverride }}
    {{- printf "%s" $fullOverride -}}
@@ -86,73 +76,22 @@ imagePullSecrets:
 {{- end }}
 {{- end -}}
 {{/*
-Return true when OpenShift compatibility defaults should be rendered.
+Storage Class
 If openshift.enabled is unset, auto-detect via the SCC API.
 */}}
-{{- define "gitea.openshift.enabled" -}}
+{{- define "gitea.persistence.storageClass" -}}
-{{- if kindIs "bool" .Values.openshift.enabled -}}
+{{- $storageClass :=  (tpl ( default "" .Values.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
-{{ ternary "true" "false" .Values.openshift.enabled }}
+{{- if $storageClass }}
-{{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" -}}
+storageClassName: {{ $storageClass | quote }}
-true
+{{- end }}
 {{- else -}}
 false
 {{- end -}}
 {{- end -}}
 {{/*
-Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean.
+Common annotations
 */}}
-{{- define "gitea.hostUsers" -}}
+{{- define "gitea.annotations" -}}
-{{- if kindIs "bool" .Values.deployment.hostUsers -}}
+{{- end }}
 {{ ternary "true" "false" .Values.deployment.hostUsers }}
 {{- end -}}
 {{- end -}}
 {{/*
 Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
 */}}
 {{- define "gitea.deployment.securityContext" -}}
 {{- $securityContext := deepCopy .Values.deployment.securityContext -}}
 {{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $securityContext "fsGroup")) -}}
 {{- $_ := set $securityContext "fsGroup" 1000 -}}
 {{- end -}}
 {{- if gt (len $securityContext) 0 -}}
 {{ toYaml $securityContext }}
 {{- end -}}
 {{- end -}}
 {{/*
 Render container securityContext with OpenShift restricted SCC defaults when enabled.
 */}}
 {{- define "gitea.containerSecurityContext" -}}
 {{- $root := index . 0 -}}
 {{- $containerSecurityContext := deepCopy (index . 1) -}}
 {{- if eq (include "gitea.openshift.enabled" $root | trim) "true" -}}
 {{- $containerSecurityContext = mergeOverwrite (dict
  "allowPrivilegeEscalation" false
  "capabilities" (dict "drop" (list "ALL"))
  "runAsNonRoot" true
  "seccompProfile" (dict "type" "RuntimeDefault")
 ) $containerSecurityContext -}}
 {{- end -}}
 {{- if gt (len $containerSecurityContext) 0 -}}
 {{ toYaml $containerSecurityContext }}
 {{- end -}}
 {{- end -}}
 {{/*
 Render the securityContext for init containers that execute Gitea/GPG commands.
 These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
 */}}
 {{- define "gitea.commandInitContainerSecurityContext" -}}
 {{- $root := index . 0 -}}
 {{- $containerSecurityContext := deepCopy (index . 1) -}}
 {{- if and (ne (include "gitea.openshift.enabled" $root | trim) "true") (not (hasKey $containerSecurityContext "runAsUser")) -}}
 {{- $_ := set $containerSecurityContext "runAsUser" 1000 -}}
 {{- end -}}
 {{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
 {{- end -}}
 {{/*
 Common labels
@@ -161,8 +100,8 @@ Common labels
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}
 {{ include "gitea.selectorLabels" . }}
-app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
@@ -170,8 +109,8 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}-act-runner
 {{ include "gitea.selectorLabels.actRunner" . }}
-app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
@@ -201,20 +140,28 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 {{- define "valkey.dns" -}}
-{{- if (index .Values "valkey").enabled -}}
+{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
-{{- printf "redis://:%s@%s-valkey.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index (index .Values "valkey").auth.aclUsers "default").password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").service.port -}}
+{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
 {{- else if (index .Values "valkey-cluster").enabled -}}
 {{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
 {{- else if (index .Values "valkey").enabled -}}
 {{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
 {{- end -}}
 {{- end -}}
 {{- define "valkey.port" -}}
-{{- if (index .Values "valkey").enabled -}}
+{{- if (index .Values "valkey-cluster").enabled -}}
-{{ (index .Values "valkey").service.port }}
+{{ (index .Values "valkey-cluster").service.ports.valkey }}
 {{- else if (index .Values "valkey").enabled -}}
 {{ (index .Values "valkey").master.service.ports.valkey }}
 {{- end -}}
 {{- end -}}
 {{- define "valkey.servicename" -}}
-{{- if (index .Values "valkey").enabled -}}
+{{- if (index .Values "valkey-cluster").enabled -}}
-{{- printf "%s-valkey.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
 {{- else if (index .Values "valkey").enabled -}}
 {{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
@@ -222,18 +169,6 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 {{- define "gitea.public_hostname" -}}
 {{- if and .Values.route.enabled .Values.route.host -}}
 {{ tpl .Values.route.host . }}
 {{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
 {{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
 {{- else if gt (len .Values.ingress.hosts) 0 -}}
 {{ tpl (index .Values.ingress.hosts 0).host $ }}
 {{- else -}}
 {{ include "gitea.default_domain" . }}
 {{- end -}}
 {{- end -}}
 {{- define "gitea.ldap_settings" -}}
 {{- $idx := index . 0 }}
 {{- $values := index . 1 }}
@@ -284,11 +219,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 {{- define "gitea.public_protocol" -}}
-{{- if and .Values.route.enabled .Values.route.tls.termination -}}
+{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
 https
 {{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
 https
 {{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
 https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
@@ -302,7 +233,7 @@ https
  {{- $generals := list -}}
  {{- $inlines := dict -}}
-  {{- range $key, $value := .Values.gitea.config }}
+  {{- range $key, $value := .Values.gitea.config  }}
    {{- if kindIs "map" $value }}
      {{- if gt (len $value) 0 }}
        {{- $section := default list (get $inlines $key) -}}
@@ -381,7 +312,7 @@ https
    {{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
  {{- end -}}
  {{- /* valkey queue */ -}}
-  {{- if (index .Values "valkey").enabled -}}
+  {{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
    {{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
    {{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
    {{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
@@ -421,7 +352,11 @@ https
    {{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
  {{- end -}}
  {{- if not (.Values.gitea.config.server.DOMAIN) -}}
-    {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.public_hostname" .) -}}
+    {{- if gt (len .Values.ingress.hosts) 0 -}}
      {{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
    {{- else -}}
      {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
    {{- end -}}
  {{- end -}}
  {{- if not .Values.gitea.config.server.ROOT_URL -}}
    {{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}
@@ -433,7 +368,7 @@ https
    {{- $_ := set .Values.gitea.config.server "SSH_PORT" .Values.service.ssh.port -}}
  {{- end -}}
  {{- if not (hasKey .Values.gitea.config.server "START_SSH_SERVER") -}}
-    {{- if .Values.deployment.gitea.image.rootless -}}
+    {{- if .Values.image.rootless -}}
      {{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "true" -}}
      {{- if not (hasKey .Values.gitea.config.server "SSH_LISTEN_PORT") -}}
        {{- if not .Values.gitea.config.server.SSH_LISTEN_PORT -}}
@@ -486,13 +421,21 @@ https
 {{- define "gitea.container-additional-mounts" -}}
  {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
-  {{- if gt (len .Values.deployment.gitea.volumeMounts) 0 -}}
+  {{- if gt (len .Values.extraContainerVolumeMounts) 0 -}}
-    {{- toYaml .Values.deployment.gitea.volumeMounts -}}
+    {{- toYaml .Values.extraContainerVolumeMounts -}}
  {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
    {{- toYaml .Values.extraVolumeMounts -}}
  {{- end -}}
 {{- end -}}
 {{- define "gitea.gpg-key-secret-name" -}}
 {{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
 {{- end -}}
 {{- define "gitea.serviceAccountName" -}}
 {{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
 {{- end -}}
 {{- define "ingress.annotations" -}}
  {{- if .Values.ingress.annotations }}
  annotations:
@@ -505,6 +448,14 @@ https
  {{- end }}
 {{- end -}}
 {{- define "gitea.admin.passwordMode" -}}
 {{- if has .Values.gitea.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
 {{ .Values.gitea.admin.passwordMode }}
 {{- else -}}
 {{ printf "gitea.admin.passwordMode must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.gitea.admin.passwordMode | fail }}
 {{- end -}}
 {{- end -}}
 {{/* Create a functioning probe object for rendering. Given argument must be either a livenessProbe, readinessProbe, or startupProbe */}}
 {{- define "gitea.deployment.probe" -}}
  {{- $probe := unset . "enabled" -}}
@@ -522,3 +473,7 @@ https
  {{- end -}}
  {{- toYaml $probe -}}
 {{- end -}}
 {{- define "gitea.metrics-secret-name" -}}
 {{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
 {{- end -}}
@@ -1,30 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.httpRoute.annotations" -}}
 {{- with .Values.gatewayAPI.core.httpRoute.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* enabled */}}
 {{- define "gitea.httpRoute.enabled" -}}
 {{- if and .Values.gatewayAPI.enabled
          .Values.gatewayAPI.core.httpRoute.enabled
 -}}
 true
 {{- else -}}
 false
 {{- end -}}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.httpRoute.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.gatewayAPI.core.httpRoute.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
@@ -1,32 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.ingress.annotations" -}}
 {{- with .Values.ingress.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{- define "gitea.ingress.enabled" -}}
 {{- if and .Values.ingress.enabled .Values.service.http.enabled -}}
 true
 {{- else -}}
 false
 {{- end }}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.ingress.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.ingress.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{/* name */}}
 {{- define "gitea.ingress.name" -}}
 {{ include "gitea.fullname" . }}
 {{- end }}
@@ -1,304 +0,0 @@
 {{/* initDirectories */}}
 {{- define "gitea.initContainer.initDirectories" -}}
 {{- $config := .Values.deployment.initDirectories -}}
 - name: init-directories
  image: "{{ include "gitea.image.name" (list . $config.image) }}"
  imagePullPolicy: {{ $config.image.pullPolicy }}
  command:
    - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
  env:
    - name: GITEA_APP_INI
      value: /data/gitea/conf/app.ini
    - name: GITEA_CUSTOM
      value: /data/gitea
    - name: GITEA_WORK_DIR
      value: /data
    - name: GITEA_TEMP
      value: /tmp/gitea
    {{- if .Values.deployment.gitea.env }}
    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
    {{- end }}
    {{- if .Values.secrets.gpg.enabled }}
    - name: GNUPGHOME
      valueFrom:
        secretKeyRef:
          name: {{ include "gitea.secret.gpg.name" . }}
          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
    {{- end }}
    {{- with $config.env }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with $config.envFrom }}
  envFrom:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  volumeMounts:
    - name: init
      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
    - name: temp
      mountPath: /tmp
    - name: data
      mountPath: /data
      {{- if .Values.persistence.new.subPath }}
      subPath: {{ .Values.persistence.new.subPath }}
      {{- end }}
    {{- include "gitea.init-additional-mounts" . | nindent 4 }}
    {{- with $config.volumeMounts }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
  securityContext:
    {{- . | nindent 4 }}
  {{- end }}
  resources:
    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
 {{- end }}
 {{/* initAppIni */}}
 {{- define "gitea.initContainer.initAppIni" -}}
 {{- $config := .Values.deployment.initAppIni -}}
 - name: init-app-ini
  image: "{{ include "gitea.image.name" (list . $config.image) }}"
  imagePullPolicy: {{ $config.image.pullPolicy }}
  {{- if .Values.gitea.extraEnvSourceFile }}
  command:
  - "/bin/bash"
  - "-c"
  args:
  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
  {{- else }}
  command:
  - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
  {{- end }}
  env:
    - name: GITEA_APP_INI
      value: /data/gitea/conf/app.ini
    - name: GITEA_CUSTOM
      value: /data/gitea
    - name: GITEA_WORK_DIR
      value: /data
    - name: GITEA_TEMP
      value: /tmp/gitea
    - name: TMP_EXISTING_ENVS_FILE
      value: /tmp/existing-envs
    - name: ENV_TO_INI_MOUNT_POINT
      value: /env-to-ini-mounts
    {{- if .Values.deployment.gitea.env }}
    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
    {{- end }}
    {{- if .Values.gitea.additionalConfigFromEnvs }}
    {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }}
    {{- end }}
    {{- with $config.env }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with $config.envFrom }}
  envFrom:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  volumeMounts:
    - name: config
      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
    - name: temp
      mountPath: /tmp
    - name: data
      mountPath: /data
      {{- if .Values.persistence.new.subPath }}
      subPath: {{ .Values.persistence.new.subPath }}
      {{- end }}
    - name: inline-config-sources
      mountPath: /env-to-ini-mounts/inlines/
    {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
    - name: additional-config-sources-{{ $idx }}
      mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
    {{- end }}
    {{- include "gitea.init-additional-mounts" . | nindent 4 }}
    {{- with $config.volumeMounts }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
  securityContext:
    {{- . | nindent 4 }}
  {{- end }}
  resources:
    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
 {{- end }}
 {{/* initConfigureGPG */}}
 {{- define "gitea.initContainer.initConfigureGPG" -}}
 {{- $config := .Values.deployment.initConfigureGPG -}}
 {{- if .Values.secrets.gpg.enabled -}}
 - name: configure-gpg
  image: "{{ include "gitea.image.name" (list . $config.image) }}"
  {{- if .Values.gitea.extraEnvSourceFile }}
  command:
  - "/bin/bash"
  - "-c"
  args:
  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
  {{- else }}
  command:
  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
  {{- end }}
  imagePullPolicy: {{ $config.image.pullPolicy }}
  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
  securityContext:
    {{- . | nindent 4 }}
  {{- end }}
  env:
    - name: GNUPGHOME
      valueFrom:
        secretKeyRef:
          name: {{ include "gitea.secret.gpg.name" . }}
          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
    - name: TMP_RAW_GPG_KEY
      value: /raw/private.asc
    {{- with $config.env }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with $config.envFrom }}
  envFrom:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  volumeMounts:
    - name: init
      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
    - name: data
      mountPath: /data
      {{- if .Values.persistence.new.subPath }}
      subPath: {{ .Values.persistence.new.subPath }}
      {{- end }}
    - name: gpg-private-key
      mountPath: /raw
      readOnly: true
    {{- if .Values.extraVolumeMounts }}
    {{- toYaml .Values.extraVolumeMounts | nindent 4 }}
    {{- end }}
    {{- with $config.volumeMounts }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  resources:
    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
 {{- end }}
 {{- end }}
 {{/* initConfigureGitea */}}
 {{- define "gitea.initContainer.initConfigureGitea" -}}
 {{- $config := .Values.deployment.initConfigureGitea -}}
 - name: configure-gitea
  image: "{{ include "gitea.image.name" (list . $config.image) }}"
  {{- if .Values.gitea.extraEnvSourceFile }}
  command:
  - "/bin/bash"
  - "-c"
  args:
  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
  {{- else }}
  command:
  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
  {{- end }}
  imagePullPolicy: {{ $config.image.pullPolicy }}
  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
  securityContext:
    {{- . | nindent 4 }}
  {{- end }}
  env:
    - name: GITEA_APP_INI
      value: /data/gitea/conf/app.ini
    - name: GITEA_CUSTOM
      value: /data/gitea
    - name: GITEA_WORK_DIR
      value: /data
    - name: GITEA_TEMP
      value: /tmp/gitea
    {{- if $config.image.rootless }}
    - name: HOME
      value: /data/gitea/git
    {{- end }}
    {{- if .Values.gitea.ldap }}
    {{- range $idx, $value := .Values.gitea.ldap }}
    {{- if $value.existingSecret }}
    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
      valueFrom:
        secretKeyRef:
          key:  bindDn
          name: {{ $value.existingSecret }}
    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
      valueFrom:
        secretKeyRef:
          key:  bindPassword
          name: {{ $value.existingSecret }}
    {{- else }}
    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
      value: {{ $value.bindDn | quote }}
    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
      value: {{ $value.bindPassword | quote }}
    {{- end }}
    {{- end }}
    {{- end }}
    {{- if .Values.gitea.oauth }}
    {{- range $idx, $value := .Values.gitea.oauth }}
    {{- if $value.existingSecret }}
    - name: GITEA_OAUTH_KEY_{{ $idx }}
      valueFrom:
        secretKeyRef:
          key:  key
          name: {{ $value.existingSecret }}
    - name: GITEA_OAUTH_SECRET_{{ $idx }}
      valueFrom:
        secretKeyRef:
          key:  secret
          name: {{ $value.existingSecret }}
    {{- end }}
    {{- end }}
    {{- end }}
    {{- if .Values.secrets.admin.enabled }}
    - name: GITEA_ADMIN_USERNAME
      valueFrom:
        secretKeyRef:
          key: {{ include "gitea.secret.admin.usernameKey" . }}
          name: {{ include "gitea.secret.admin.name" . }}
    - name: GITEA_ADMIN_PASSWORD
      valueFrom:
        secretKeyRef:
          key: {{ include "gitea.secret.admin.passwordKey" . }}
          name: {{ include "gitea.secret.admin.name" . }}
    - name: GITEA_ADMIN_EMAIL
      valueFrom:
        secretKeyRef:
          key: {{ include "gitea.secret.admin.emailKey" . }}
          name: {{ include "gitea.secret.admin.name" . }}
    - name: GITEA_ADMIN_PASSWORD_MODE
      value: {{ include "gitea.secret.admin.passwordMode" $ }}
    {{- end }}
    {{- if .Values.deployment.gitea.env }}
    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
    {{- end }}
    {{- with $config.env }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with $config.envFrom }}
  envFrom:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  volumeMounts:
    - name: init
      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
    - name: temp
      mountPath: /tmp
    - name: data
      mountPath: /data
      {{- if .Values.persistence.new.subPath }}
      subPath: {{ .Values.persistence.new.subPath }}
      {{- end }}
    {{- include "gitea.init-additional-mounts" . | nindent 4 }}
    {{- with $config.volumeMounts }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  resources:
    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
 {{- end }}
@@ -0,0 +1,19 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.networkPolicy.annotations" -}}
 {{ include "gitea.annotations" . }}
 {{- if .Values.networkPolicy.annotations }}
 {{ toYaml .Values.networkPolicy.annotations }}
 {{- end }}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.networkPolicy.labels" -}}
 {{ include "gitea.labels" . }}
 {{- if .Values.networkPolicy.labels }}
 {{ toYaml .Values.networkPolicy.labels }}
 {{- end }}
 {{- end }}
@@ -1,38 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.persistentVolumeClaim.annotations" -}}
 {{- with .Values.persistence.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* enabled */}}
 {{- define "gitea.persistentVolumeClaim.enabled" -}}
 {{- if and .Values.persistence.enabled (not .Values.persistence.existingPersistentVolumeClaim.enabled) -}}
 true
 {{- else -}}
 false
 {{- end }}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.persistentVolumeClaim.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.persistence.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{/* name */}}
 {{- define "gitea.persistentVolumeClaim.name" -}}
 {{- if .Values.persistence.existingPersistentVolumeClaim.enabled -}}
 {{ required "persistence.existingPersistentVolumeClaim.persistentVolumeClaimName is required when persistence.existingPersistentVolumeClaim.enabled is true" .Values.persistence.existingPersistentVolumeClaim.persistentVolumeClaimName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}
 {{- end }}
 {{- end }}
@@ -0,0 +1,17 @@
 ---
 {{/* labels */}}
 {{- define "gitea.pod.labels" -}}
 {{- include "gitea.labels" . }}
 {{- if .Values.deployment.labels }}
 {{ toYaml .Values.deployment.labels }}
 {{- end }}
 {{- end }}
 {{- define "gitea.pod.selectorLabels" -}}
 {{- include "gitea.selectorLabels" . }}
 {{- if .Values.deployment.labels }}
 {{ toYaml .Values.deployment.labels }}
 {{- end }}
 {{- end }}
@@ -1,52 +0,0 @@
 ---
 {{/* annotations */}}
 {{- define "gitea.pod.annotations" -}}
 {{/* secret - admin */}}
 {{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }}
 checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
 {{- end }}
 {{/* secret - config */}}
 {{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
 checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}
 {{- end }}
 {{/* secret - gpg */}}
 {{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }}
 checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }}
 {{- end }}
 {{/* secret - init */}}
 {{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }}
 checksum/init: {{ include "gitea.secret.checksum" (list . "init") }}
 {{- end }}
 {{/* secret - inlineConfig */}}
 {{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }}
 checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }}
 {{- end }}
 {{/* secret - metrics */}}
 {{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }}
 checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }}
 {{- end }}
 {{/* secret - ldap */}}
 {{- range $idx, $value := .Values.gitea.ldap }}
 checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
 {{- end }}
 {{/* secret - oauth */}}
 {{- range $idx, $value := .Values.gitea.oauth }}
 checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
 {{- end }}
 {{/* custom pod annotations */}}
 {{- with .Values.gitea.podAnnotations }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
@@ -1,206 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.secret.admin.annotations" -}}
 {{- with .Values.secrets.admin.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.config.annotations" -}}
 {{- with .Values.secrets.config.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.gpg.annotations" -}}
 {{- with .Values.secrets.gpg.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.init.annotations" -}}
 {{- with .Values.secrets.init.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.inlineConfig.annotations" -}}
 {{- with .Values.secrets.inlineConfig.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.metrics.annotations" -}}
 {{- with .Values.secrets.metrics.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* checksums */}}
 {{/*
 SHA sum of a Secret, used to trigger a rollout whenever its content changes.
 User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
 cluster still holds their pre-upgrade state.
 Arguments: (list $root $key)
 */}}
 {{- define "gitea.secret.checksum" -}}
 {{- $root := index . 0 -}}
 {{- $key := index . 1 -}}
 {{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
 {{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
 {{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
 {{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
 {{- else -}}
 {{- include (printf "%s/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
 {{- end -}}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.secret.admin.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.admin.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.config.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.config.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.gpg.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.gpg.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.init.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.init.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.inlineConfig.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.inlineConfig.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{- define "gitea.secret.metrics.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.secrets.metrics.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{/* names */}}
 {{- define "gitea.secret.admin.name" -}}
 {{- if .Values.secrets.admin.existingSecret.enabled -}}
 {{ required "`secrets.admin.existingSecret.secretName` must be set when `secrets.admin.existingSecret.enabled` is enabled" .Values.secrets.admin.existingSecret.secretName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}-admin
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.config.name" -}}
 {{- if .Values.secrets.config.existingSecret.enabled -}}
 {{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}-config
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.gpg.name" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}-gpg-key
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.init.name" -}}
 {{- if .Values.secrets.init.existingSecret.enabled -}}
 {{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}-init
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.inlineConfig.name" -}}
 {{- if .Values.secrets.inlineConfig.existingSecret.enabled -}}
 {{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}-inline-config
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.metrics.name" -}}
 {{- if .Values.secrets.metrics.existingSecret.enabled -}}
 {{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}-metrics
 {{- end -}}
 {{- end }}
 {{/* keys */}}
 {{- define "gitea.secret.admin.emailKey" -}}
 {{- if .Values.secrets.admin.existingSecret.enabled -}}
 {{ .Values.secrets.admin.existingSecret.emailKey }}
 {{- else -}}
 email
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.admin.passwordKey" -}}
 {{- if .Values.secrets.admin.existingSecret.enabled -}}
 {{ .Values.secrets.admin.existingSecret.passwordKey }}
 {{- else -}}
 password
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.admin.usernameKey" -}}
 {{- if .Values.secrets.admin.existingSecret.enabled -}}
 {{ .Values.secrets.admin.existingSecret.usernameKey }}
 {{- else -}}
 username
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.gpg.gpgHomeKey" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
 {{- else -}}
 gpgHome
 {{- end -}}
 {{- end }}
 {{- define "gitea.secret.gpg.privateKeyKey" -}}
 {{- if .Values.secrets.gpg.existingSecret.enabled -}}
 {{ .Values.secrets.gpg.existingSecret.privateKeyKey }}
 {{- else -}}
 privateKey
 {{- end -}}
 {{- end }}
 {{/* misc */}}
 {{- define "gitea.secret.admin.passwordMode" -}}
 {{- if has .Values.secrets.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
 {{ .Values.secrets.admin.passwordMode }}
 {{- else -}}
 {{ printf "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.secrets.admin.passwordMode | fail }}
 {{- end -}}
 {{- end }}
@@ -1,38 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.serviceAccount.annotations" -}}
 {{- with .Values.serviceAccount.new.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* enabled */}}
 {{- define "gitea.serviceAccount.enabled" -}}
 {{- if and .Values.serviceAccount.enabled (not .Values.serviceAccount.existingServiceAccount.enabled) -}}
 true
 {{- else -}}
 false
 {{- end }}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.serviceAccount.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.serviceAccount.new.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
 {{/* name */}}
 {{- define "gitea.serviceAccount.name" -}}
 {{- if .Values.serviceAccount.existingServiceAccount.enabled -}}
 {{ required "serviceAccount.existingServiceAccount.existingServiceAccountName is required when serviceAccount.existingServiceAccount.enabled is true" .Values.serviceAccount.existingServiceAccount.existingServiceAccountName }}
 {{- else -}}
 {{ include "gitea.fullname" . }}
 {{- end }}
 {{- end }}
@@ -1,11 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* names */}}
 {{- define "gitea.service.http.name" -}}
 {{ include "gitea.fullname" . }}-http
 {{- end }}
 {{- define "gitea.service.ssh.name" -}}
 {{ include "gitea.fullname" . }}-ssh
 {{- end }}
@@ -1,30 +0,0 @@
 {{/* vim: set filetype=mustache: */}}
 {{/* annotations */}}
 {{- define "gitea.tcpRoute.annotations" -}}
 {{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
 {{- toYaml . -}}
 {{- end }}
 {{- end }}
 {{/* enabled */}}
 {{- define "gitea.tcpRoute.enabled" -}}
 {{- if and .Values.gatewayAPI.enabled
           .Values.gatewayAPI.core.tcpRoute.enabled
 -}}
 true
 {{- else -}}
 false
 {{- end -}}
 {{- end }}
 {{/* labels */}}
 {{- define "gitea.tcpRoute.labels" -}}
 {{ include "gitea.labels" . }}
 {{- with .Values.gatewayAPI.core.tcpRoute.labels }}
 {{ toYaml . }}
 {{- end }}
 {{- end }}
@@ -1,30 +0,0 @@
 {{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
 {{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
 {{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
 {{- end }}
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
  {{- with (include "gitea.backendTLSPolicy.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.backendTLSPolicy.labels" .) }}
  labels:
    {{- . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
  targetRefs:
    {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
    {{- else }}
    - group: ""
      kind: Service
      name: {{ include "gitea.service.http.name" . }}
    {{- end }}
  validation:
    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
 {{- end }}
@@ -0,0 +1,3 @@
 {{- if .Values.actions -}}
    {{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
 {{- end -}}
@@ -1,30 +0,0 @@
 {{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
 {{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
 {{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
 {{- end }}
 ---
 apiVersion: gateway.nginx.org/v1alpha1
 kind: ClientSettingsPolicy
 metadata:
  {{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.clientSettingsPolicies.labels" .) }}
  labels:
    {{- . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
  targetRef:
    {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
    {{- else }}
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: {{ include "gitea.fullname" . }}
    {{- end }}
  body:
    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
 {{- end }}
@@ -0,0 +1,57 @@
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "gitea.fullname" . }}-inline-config
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
 type: Opaque
 stringData:
  {{- include "gitea.inline_configuration" . | nindent 2 }}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
 type: Opaque
 stringData:
 {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
  assertions: |
    {{- /*assert that only one PG dep is enabled */ -}}
    {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
      {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
    {{- end }}
    {{- /* multiple replicas assertions */ -}}
    {{- if gt (.Values.replicaCount | int) 1 -}}
      {{- if .Values.gitea.config.cron -}}
        {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
          {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
            {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
          {{- end }}
        {{- end }}
      {{- end }}
      {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}}
        {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}}
      {{- end }}
      {{- if .Values.gitea.config.indexer -}}
        {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
          {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
        {{- end }}
        {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
          {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
            {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
              {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
                {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
              {{- end }}
            {{- end }}
          {{- end }}
        {{- end }}
      {{- end }}
    {{- end }}
@@ -1,75 +1,289 @@
 {{- if .Values.deployment.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  {{- with (include "gitea.deployment.annotations" . | fromYaml) }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.deployment.labels" . | fromYaml) }}
  labels:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  annotations:
    {{- if .Values.deployment.annotations }}
    {{- toYaml .Values.deployment.annotations | nindent 4 }}
    {{- end }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
    {{- if .Values.deployment.labels }}
    {{- toYaml .Values.deployment.labels | nindent 4 }}
    {{- end }}
 spec:
-  replicas: {{ .Values.deployment.replicas }}
+  replicas: {{ .Values.replicaCount }}
  strategy:
-    type: {{ .Values.deployment.strategy.type }}
+    type: {{ .Values.strategy.type }}
-    {{- if eq .Values.deployment.strategy.type "RollingUpdate" }}
+    {{- if eq .Values.strategy.type "RollingUpdate" }}
    rollingUpdate:
-      maxUnavailable: {{ .Values.deployment.strategy.rollingUpdate.maxUnavailable }}
+      maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
-      maxSurge: {{ .Values.deployment.strategy.rollingUpdate.maxSurge }}
+      maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
    {{- end }}
  selector:
    matchLabels:
-      {{- include "gitea.selectorLabels" . | nindent 6 }}
+      {{- include "gitea.pod.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with (include "gitea.pod.annotations" . | fromYaml) }}
      annotations:
-        {{- toYaml . | nindent 8 }}
+        checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
-      {{- end }}
+        {{- range $idx, $value := .Values.gitea.ldap }}
-      labels:
+        checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
        {{- include "gitea.labels" . | nindent 8 }}
        {{- if .Values.deployment.labels }}
        {{- toYaml .Values.deployment.labels | nindent 8 }}
        {{- end }}
        {{- range $idx, $value := .Values.gitea.oauth }}
        checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
        {{- end }}
        {{- with .Values.gitea.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "gitea.pod.labels" . | nindent 8 }}
    spec:
-      {{- $hostUsers := include "gitea.hostUsers" . | trim }}
+      {{- if .Values.schedulerName }}
-      {{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
+      schedulerName: "{{ .Values.schedulerName }}"
      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
      {{- if .Values.deployment.schedulerName }}
      schedulerName: "{{ .Values.deployment.schedulerName }}"
      {{- end }}
-      {{- if .Values.serviceAccount.enabled }}
+      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
-      serviceAccountName: {{ include "gitea.serviceAccount.name" . }}
+      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
      {{- end }}
-      {{- if .Values.deployment.priorityClassName }}
+      {{- if .Values.priorityClassName }}
-      priorityClassName: "{{ .Values.deployment.priorityClassName }}"
+      priorityClassName: "{{ .Values.priorityClassName }}"
      {{- end }}
      {{- if $hostUsers }}
      hostUsers: {{ $hostUsers }}
      {{- end }}
      {{- include "gitea.images.pullSecrets" . | nindent 6 }}
      {{- if $securityContext }}
      securityContext:
-        {{- $securityContext | nindent 8 }}
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      {{- end }}
      initContainers:
-        {{- include "gitea.deployment.initContainers" . | trim | nindent 8 }}
+        {{- if .Values.preExtraInitContainers }}
        {{- toYaml .Values.preExtraInitContainers | nindent 8 }}
        {{- end }}
        - name: init-directories
          image: "{{ include "gitea.image" . }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
          env:
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
            {{- if .Values.deployment.env }}
            {{- toYaml .Values.deployment.env | nindent 12 }}
            {{- end }}
            {{- if .Values.signing.enabled }}
            - name: GNUPGHOME
              value: {{ .Values.signing.gpgHome }}
            {{- end }}
          volumeMounts:
            - name: init
              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data
              {{- if .Values.persistence.subPath }}
              subPath: {{ .Values.persistence.subPath }}
              {{- end }}
            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
          securityContext:
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          resources:
            {{- toYaml .Values.initContainers.resources | nindent 12 }}
        - name: init-app-ini
          image: "{{ include "gitea.image" . }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
          - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
          env:
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
            - name: TMP_EXISTING_ENVS_FILE
              value: /tmp/existing-envs
            - name: ENV_TO_INI_MOUNT_POINT
              value: /env-to-ini-mounts
            {{- if .Values.deployment.env }}
            {{- toYaml .Values.deployment.env | nindent 12 }}
            {{- end }}
            {{- if .Values.gitea.additionalConfigFromEnvs }}
            {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
            {{- end }}
          volumeMounts:
            - name: config
              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data
              {{- if .Values.persistence.subPath }}
              subPath: {{ .Values.persistence.subPath }}
              {{- end }}
            - name: inline-config-sources
              mountPath: /env-to-ini-mounts/inlines/
            {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
            - name: additional-config-sources-{{ $idx }}
              mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
            {{- end }}
            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
          securityContext:
            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          resources:
            {{- toYaml .Values.initContainers.resources | nindent 12 }}
        {{- if .Values.signing.enabled }}
        - name: configure-gpg
          image: "{{ include "gitea.image" . }}"
          command:
          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
            {{- $csc := deepCopy .Values.containerSecurityContext -}}
            {{- if not (hasKey $csc "runAsUser") -}}
            {{- $_ := set $csc "runAsUser" 1000 -}}
            {{- end -}}
            {{- toYaml $csc | nindent 12 }}
          env:
            - name: GNUPGHOME
              value: {{ .Values.signing.gpgHome }}
            - name: TMP_RAW_GPG_KEY
              value: /raw/private.asc
          volumeMounts:
            - name: init
              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
            - name: data
              mountPath: /data
              {{- if .Values.persistence.subPath }}
              subPath: {{ .Values.persistence.subPath }}
              {{- end }}
            - name: gpg-private-key
              mountPath: /raw
              readOnly: true
            {{- if .Values.extraVolumeMounts }}
            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
            {{- end }}
          resources:
            {{- toYaml .Values.initContainers.resources | nindent 12 }}
        {{- end }}
        - name: configure-gitea
          image: "{{ include "gitea.image" . }}"
          command:
          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          securityContext:
            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
            {{- $csc := deepCopy .Values.containerSecurityContext -}}
            {{- if not (hasKey $csc "runAsUser") -}}
            {{- $_ := set $csc "runAsUser" 1000 -}}
            {{- end -}}
            {{- toYaml $csc | nindent 12 }}
          env:
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
              value: /data/gitea
            - name: GITEA_WORK_DIR
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
            {{- if .Values.image.rootless }}
            - name: HOME
              value: /data/gitea/git
            {{- end }}
            {{- if .Values.gitea.ldap }}
            {{- range $idx, $value := .Values.gitea.ldap }}
            {{- if $value.existingSecret }}
            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
              valueFrom:
                secretKeyRef:
                  key:  bindDn
                  name: {{ $value.existingSecret }}
            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
              valueFrom:
                secretKeyRef:
                  key:  bindPassword
                  name: {{ $value.existingSecret }}
            {{- else }}
            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
              value: {{ $value.bindDn | quote }}
            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
              value: {{ $value.bindPassword | quote }}
            {{- end }}
            {{- end }}
            {{- end }}
            {{- if .Values.gitea.oauth }}
            {{- range $idx, $value := .Values.gitea.oauth }}
            {{- if $value.existingSecret }}
            - name: GITEA_OAUTH_KEY_{{ $idx }}
              valueFrom:
                secretKeyRef:
                  key:  key
                  name: {{ $value.existingSecret }}
            - name: GITEA_OAUTH_SECRET_{{ $idx }}
              valueFrom:
                secretKeyRef:
                  key:  secret
                  name: {{ $value.existingSecret }}
            {{- end }}
            {{- end }}
            {{- end }}
            {{- if .Values.gitea.admin.existingSecret }}
            - name: GITEA_ADMIN_USERNAME
              valueFrom:
                secretKeyRef:
                  key:  username
                  name: {{ .Values.gitea.admin.existingSecret }}
            - name: GITEA_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  key:  password
                  name: {{ .Values.gitea.admin.existingSecret }}
            {{- else }}
            - name: GITEA_ADMIN_USERNAME
              value: {{ .Values.gitea.admin.username | quote }}
            - name: GITEA_ADMIN_PASSWORD
              value: {{ .Values.gitea.admin.password | quote }}
            {{- end }}
            - name: GITEA_ADMIN_PASSWORD_MODE
              value: {{ include "gitea.admin.passwordMode" $ }}
            {{- if .Values.deployment.env }}
            {{- toYaml .Values.deployment.env | nindent 12 }}
            {{- end }}
          volumeMounts:
            - name: init
              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data
              {{- if .Values.persistence.subPath }}
              subPath: {{ .Values.persistence.subPath }}
              {{- end }}
            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
          resources:
            {{- toYaml .Values.initContainers.resources | nindent 12 }}
        {{- if .Values.postExtraInitContainers }}
        {{- toYaml .Values.postExtraInitContainers | nindent 8 }}
        {{- end }}
      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
          env:
            # SSH Port values have to be set here as well for openssh configuration
            - name: SSH_LISTEN_PORT
              value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
            - name: SSH_PORT
              value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
-            {{- if not .Values.deployment.gitea.image.rootless }}
+            {{- if not .Values.image.rootless }}
            - name: SSH_LOG_LEVEL
              value: {{ .Values.gitea.ssh.logLevel | quote }}
            {{- end }}
@@ -81,35 +295,26 @@ spec:
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
-            {{- with .Values.deployment.gitea.resources }}
+            {{- if and (hasKey .Values.resources "limits") (hasKey .Values.resources.limits "cpu") }}
            {{- if and (hasKey . "limits") (hasKey (.limits | default dict) "cpu") }}
            - name: GOMAXPROCS
              valueFrom:
                resourceFieldRef:
                  divisor: "1"
                  resource: limits.cpu
            {{- end }}
            {{- end }}
            - name: TMPDIR
              value: /tmp/gitea
-            {{- if .Values.deployment.gitea.image.rootless }}
+            {{- if .Values.image.rootless }}
            - name: HOME
              value: /data/gitea/git
            {{- end }}
-            {{- if .Values.secrets.gpg.enabled }}
+            {{- if .Values.signing.enabled }}
            - name: GNUPGHOME
-              valueFrom:
+              value: {{ .Values.signing.gpgHome }}
                secretKeyRef:
                  name: {{ include "gitea.secret.gpg.name" . }}
                  key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
            {{- end }}
-            {{- if .Values.deployment.gitea.env }}
+            {{- if .Values.deployment.env }}
-            {{- toYaml .Values.deployment.gitea.env | nindent 12 }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
            {{- end }}
          {{- with .Values.deployment.gitea.envFrom }}
          envFrom:
            {{- toYaml . | nindent 12 }}
          {{- end }}
          ports:
            - name: ssh
              containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
@@ -135,18 +340,21 @@ spec:
            {{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
          {{- end }}
          resources:
-            {{- toYaml (.Values.deployment.gitea.resources | default dict) | nindent 12 }}
+            {{- toYaml .Values.resources | nindent 12 }}
          {{- if $containerSecurityContext }}
          securityContext:
-            {{- $containerSecurityContext | nindent 12 }}
+            {{- /* Honor the deprecated securityContext variable when defined */ -}}
-          {{- end }}
+            {{- if .Values.containerSecurityContext -}}
            {{ toYaml .Values.containerSecurityContext | nindent 12 -}}
            {{- else -}}
            {{ toYaml .Values.securityContext | nindent 12 -}}
            {{- end }}
          volumeMounts:
            - name: temp
              mountPath: /tmp
            - name: data
              mountPath: /data
-              {{- if .Values.persistence.new.subPath }}
+              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.new.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
              {{- end }}
            {{- include "gitea.container-additional-mounts" . | nindent 12 }}
        {{- if .Values.extraContainers }}
@@ -156,66 +364,63 @@ spec:
      hostAliases:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.deployment.nodeSelector }}
+      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-    {{- with .Values.deployment.affinity }}
+    {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
    {{- end }}
-    {{- with .Values.deployment.topologySpreadConstraints }}
+    {{- with .Values.topologySpreadConstraints }}
      topologySpreadConstraints:
        {{- toYaml . | nindent 8 }}
    {{- end }}
-    {{- with .Values.deployment.tolerations }}
+    {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
    {{- end }}
-    {{- if .Values.deployment.dnsConfig }}
+    {{- if .Values.dnsConfig }}
      dnsConfig:
-        {{- toYaml .Values.deployment.dnsConfig | nindent 8 }}
+        {{- toYaml .Values.dnsConfig | nindent 8 }}
    {{- end }}
    {{- with .Values.deployment.resources }}
      resources:
        {{- toYaml . | nindent 8 }}
    {{- end }}
      volumes:
        - name: init
          secret:
-            secretName: {{ include "gitea.secret.init.name" . }}
+            secretName: {{ include "gitea.fullname" . }}-init
            defaultMode: 110
        - name: config
          secret:
-            secretName: {{ include "gitea.secret.config.name" . }}
+            secretName: {{ include "gitea.fullname" . }}
            defaultMode: 110
-        {{- if gt (len .Values.deployment.volumes) 0 }}
+        {{- if gt (len .Values.extraVolumes) 0 }}
-        {{- toYaml .Values.deployment.volumes | nindent 8 }}
+        {{- toYaml .Values.extraVolumes | nindent 8 }}
        {{- end }}
        - name: inline-config-sources
          secret:
-            secretName: {{ include "gitea.secret.inlineConfig.name" . }}
+            secretName: {{ include "gitea.fullname" . }}-inline-config
        {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
        - name: additional-config-sources-{{ $idx }}
          {{- toYaml $value | nindent 10 }}
        {{- end }}
        - name: temp
          emptyDir: {}
-        {{- if .Values.secrets.gpg.enabled }}
+        {{- if .Values.signing.enabled }}
        - name: gpg-private-key
          secret:
-            secretName: {{ include "gitea.secret.gpg.name" . }}
+            secretName: {{ include "gitea.gpg-key-secret-name" . }}
            items:
-              - key: {{ include "gitea.secret.gpg.privateKeyKey" . }}
+              - key: privateKey
                path: private.asc
            defaultMode: 0100
        {{- end }}
  {{- if .Values.persistence.enabled }}
    {{- if .Values.persistence.mount }}
        - name: data
          persistentVolumeClaim:
-            claimName: {{ include "gitea.persistentVolumeClaim.name" . }}
+            claimName: {{ .Values.persistence.claimName }}
-  {{- else }}
+    {{- end }}
  {{- else if not .Values.persistence.enabled }}
        - name: data
          emptyDir: {}
  {{- end }}
 {{- end }}
@@ -14,12 +14,12 @@
  {{- if kindIs "map" .Values.gitea.ldap -}}
    {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
  {{- end -}}
-
+  
  {{/* OAUTH SOURCES */}}
  {{- if kindIs "map" .Values.gitea.oauth -}}
    {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
  {{- end -}}
-
+  
  {{/* BUILTIN */}}
  {{- if .Values.gitea.cache -}}
    {{- if .Values.gitea.cache.builtIn -}}
@@ -31,107 +31,4 @@
      {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
    {{- end -}}
  {{- end -}}
  {{- if .Values.gitea.admin -}}
    {{- fail "`gitea.admin` does no longer exist. Please refer to the changelog and configure `secrets.admin` instead." -}}
  {{- end -}}
  {{/* SIGNING */}}
  {{- if .Values.signing -}}
    {{- fail "`signing` does no longer exist. Please refer to the changelog and configure `secrets.gpg` instead." -}}
  {{- end -}}
  {{/* AFFINITY */}}
  {{- if .Values.affinity -}}
    {{- fail "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead." -}}
  {{- end -}}
  {{/* CONTAINER SECURITY CONTEXT */}}
  {{- if .Values.containerSecurityContext -}}
    {{- fail "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead." -}}
  {{- end -}}
  {{/* DEPLOYMENT ENV */}}
  {{- if .Values.deployment.env -}}
    {{- fail "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead." -}}
  {{- end -}}
  {{/* DNS CONFIG */}}
  {{- if .Values.dnsConfig -}}
    {{- fail "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." -}}
  {{- end -}}
  {{/* EXTRA CONTAINER VOLUME MOUNTS */}}
  {{- if .Values.extraContainerVolumeMounts -}}
    {{- fail "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." -}}
  {{- end -}}
  {{/* EXTRA VOLUMES */}}
  {{- if .Values.extraVolumes -}}
    {{- fail "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." -}}
  {{- end -}}
  {{/* NODE SELECTOR */}}
  {{- if .Values.nodeSelector -}}
    {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}
  {{- end -}}
  {{/* OPENSHIFT HOST USERS */}}
  {{- if hasKey .Values.openshift "hostUsers" -}}
    {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
  {{- end -}}
  {{/* PRIORITY CLASS NAME */}}
  {{- if .Values.priorityClassName -}}
    {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}
  {{- end -}}
  {{/* POD SECURITY CONTEXT */}}
  {{- if .Values.podSecurityContext -}}
    {{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
  {{- end -}}
  {{/* POST EXTRA INIT CONTAINERS */}}
  {{- if .Values.postExtraInitContainers -}}
    {{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}}
  {{- end -}}
  {{/* PRE EXTRA INIT CONTAINERS */}}
  {{- if .Values.preExtraInitContainers -}}
    {{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}}
  {{- end -}}
  {{/* RESOURCES */}}
  {{- if .Values.resources -}}
    {{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}
  {{- end -}}
  {{/* REPLICA COUNT */}}
  {{- if .Values.replicaCount -}}
    {{- fail "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead." -}}
  {{- end -}}
  {{/* SCHEDULER NAME */}}
  {{- if .Values.schedulerName -}}
    {{- fail "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead." -}}
  {{- end -}}
  {{/* SECURITY CONTEXT */}}
  {{- if .Values.securityContext -}}
    {{- fail "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead." -}}
  {{- end -}}
  {{/* STRATEGY */}}
  {{- if .Values.strategy -}}
    {{- fail "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." -}}
  {{- end -}}
  {{/* TOLERATIONS */}}
  {{- if .Values.tolerations -}}
    {{- fail "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead." -}}
  {{- end -}}
  {{/* TOPOLOGY SPREAD CONSTRAINTS */}}
  {{- if .Values.topologySpreadConstraints -}}
    {{- fail "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead." -}}
  {{- end -}}
 {{- end -}}
@@ -1,8 +1,8 @@
 {{- range .Values.extraDeploy }}
 ---
 {{- if typeIs "string" . }}
-    {{ tpl . $ }}
+    {{- tpl . $ }}
 {{- else }}
-    {{ tpl (. | toYaml) $ }}
+    {{- tpl (. | toYaml) $ }}
 {{- end }}
 {{- end }}
@@ -0,0 +1,17 @@
 {{- if .Values.signing.enabled -}}
 {{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
  {{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}}
 {{- end }}
 {{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "gitea.gpg-key-secret-name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
 type: Opaque
 data:
  privateKey: {{ .Values.signing.privateKey | b64enc }}
 {{- end }}
 {{- end }}
@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
+  name: {{ include "gitea.fullname" . }}-http
-    {{- toYaml .Values.service.http.annotations | nindent 4 }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
    {{- if .Values.service.http.labels }}
    {{- toYaml .Values.service.http.labels  | nindent 4 }}
    {{- end }}
-  name: {{ include "gitea.service.http.name" . }}
+  annotations:
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+    {{- toYaml .Values.service.http.annotations | nindent 4 }}
 spec:
  type: {{ .Values.service.http.type }}
  {{- if eq .Values.service.http.type "LoadBalancer" }}
@@ -1,42 +0,0 @@
 {{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  {{- with (include "gitea.httpRoute.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.httpRoute.labels" .) }}
  labels:
    {{- . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
  parentRefs:
    {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
    {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
    {{- else }}
    {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
    {{- end }}
  {{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
  hostnames:
    {{- tpl (toYaml .) $ | nindent 4 }}
  {{- end }}
  rules:
    {{- if .Values.gatewayAPI.core.httpRoute.rules }}
    {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
    {{- else }}
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - group: ""
          kind: Service
          name: {{ include "gitea.service.http.name" . }}
          port: {{ .Values.service.http.port }}
          weight: 1
    {{- end }}
 {{- end }}
@@ -1,20 +1,29 @@
-{{- if eq (include "gitea.ingress.enabled" .) "true" -}}
+{{- if .Values.ingress.enabled -}}
---
+{{- $fullName := include "gitea.fullname" . -}}
 {{- $httpPort := .Values.service.http.port -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  {{- with (include "gitea.ingress.annotations" .) }}
+  name: {{ $fullName }}
-  annotations:
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.ingress.labels" .) }}
  labels:
-    {{- . | nindent 4 }}
+    {{- include "gitea.labels" . | nindent 4 }}
-  {{- end }}
+  annotations:
-  name: {{ include "gitea.ingress.name" . }}
+    {{- range $key, $value := .Values.ingress.annotations }}
-  namespace: {{ .Release.Namespace }}
+      {{ $key }}: {{ $value | quote }}
    {{- end }}
 spec:
  ingressClassName: {{ tpl .Values.ingress.className . }}
 {{- if .Values.ingress.tls }}
  tls:
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ tpl . $ | quote }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
 {{- end }}
  rules:
    {{- range .Values.ingress.hosts }}
    - host: {{ tpl .host $ | quote }}
@@ -27,17 +36,17 @@ spec:
            pathType: {{ default "Prefix" $.Values.ingress.pathType }}
            backend:
              service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
          {{- else }}
          - path: {{ .path | default "/" }}
            pathType: {{ .pathType | default "Prefix" }}
            backend:
              service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
          {{- end }}
          {{- end }}
          {{- else }}
@@ -45,19 +54,9 @@ spec:
            pathType: "Prefix"
            backend:
              service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
          {{- end }}
    {{- end }}
  {{- if .Values.ingress.tls }}
  tls:
    {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ tpl . $ | quote }}
      {{- end }}
      secretName: {{ .secretName }}
    {{- end }}
  {{- end }}
 {{- end }}
@@ -1,15 +1,10 @@
 {{- if not .Values.secrets.init.existingSecret.enabled -}}
 apiVersion: v1
 kind: Secret
 metadata:
-  {{- with (include "gitea.secret.init.annotations" .) }}
+  name: {{ include "gitea.fullname" . }}-init
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.init.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.init.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
 type: Opaque
 stringData:
 {{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
@@ -26,7 +21,7 @@ stringData:
    # END: initPreScript
    {{- end }}
-    {{- if not .Values.deployment.gitea.image.rootless }}
+    {{- if not .Values.image.rootless }}
    chown -v 1000:1000 /data
    {{- end }}
    mkdir -pv /data/git/.ssh
@@ -35,12 +30,12 @@ stringData:
    # prepare temp directory structure
    mkdir -pv "${GITEA_TEMP}"
-    {{- if not .Values.deployment.gitea.image.rootless }}
+    {{- if not .Values.image.rootless }}
    chown -v 1000:1000 "${GITEA_TEMP}"
    {{- end }}
    chmod -v ug+rwx "${GITEA_TEMP}"
-    {{ if .Values.secrets.gpg.enabled -}}
+    {{ if .Values.signing.enabled -}}
    if [ ! -d "${GNUPGHOME}" ]; then
      mkdir -pv "${GNUPGHOME}"
      chmod -v 700 "${GNUPGHOME}"
@@ -66,10 +61,10 @@ stringData:
    function test_valkey_connection() {
      local RETRY=0
      local MAX=30
-
+      
      echo 'Wait for valkey to become avialable...'
      until [ "${RETRY}" -ge "${MAX}" ]; do
-        RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
+        nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
        RETRY=$[${RETRY}+1]
        echo "...not ready yet (${RETRY}/${MAX})"
      done
@@ -82,9 +77,9 @@ stringData:
    test_valkey_connection
    {{- end }}
-
+    {{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
    {{- if .Values.secrets.admin.enabled }}
    function configure_admin_user() {
      local full_admin_list=$(gitea admin user list --admin)
      local actual_user_table=''
@@ -110,7 +105,7 @@ stringData:
      local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
      if [[ -z "${ACCOUNT_ID}" ]]; then
        local -a create_args
-        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
+        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
          create_args+=(--must-change-password=true)
        else
@@ -128,7 +123,7 @@ stringData:
          #   should add it to prevent requiring frequent admin password resets.
          local -a change_args
          change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
-          if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
+          if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
            change_args+=(--must-change-password=false)
          fi
          gitea admin user change-password "${change_args[@]}"
@@ -230,5 +225,4 @@ stringData:
    configure_oauth
-    echo '==== END GITEA CONFIGURATION ===='
+    echo '==== END GITEA CONFIGURATION ===='
 {{- end }}
@@ -0,0 +1,12 @@
 {{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}}
 apiVersion: v1
 kind: Secret
 metadata:
  name: {{ include "gitea.metrics-secret-name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
 type: Opaque
 data:
  token: {{ .Values.gitea.metrics.token  | b64enc }}
 {{- end }}
@@ -0,0 +1,32 @@
 {{- if .Values.networkPolicy.enabled }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  {{- with (include "gitea.networkPolicy.annotations" . | fromYaml) }}
  annotations:
    {{- tpl (toYaml .) $ | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.networkPolicy.labels" . | fromYaml) }}
  labels:
    {{- toYaml . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Release.Namespace }}
 spec:
  podSelector:
    matchLabels:
      {{- include "gitea.pod.selectorLabels" $ | nindent 6 }}
  {{- with .Values.networkPolicy.policyTypes }}
  policyTypes:
  {{- toYaml . | nindent 2 }}
  {{- end }}
  {{- with .Values.networkPolicy.egress }}
  egress:
  {{- toYaml . | nindent 2 }}
  {{- end }}
  {{- with .Values.networkPolicy.ingress }}
  ingress:
  {{- toYaml . | nindent 2 }}
  {{- end }}
 {{- end }}
@@ -1,33 +0,0 @@
 {{- if eq (include "gitea.persistentVolumeClaim.enabled" .) "true" }}
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
  {{- with (include "gitea.persistentVolumeClaim.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.persistentVolumeClaim.labels" .) }}
  labels:
    {{- . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.persistentVolumeClaim.name" . }}
  namespace: {{ .Release.Namespace }}
 spec:
  accessModes:
  {{- if gt (.Values.deployment.replicas | int) 1 }}
      - ReadWriteMany
  {{- else }}
    {{- .Values.persistence.new.accessModes | toYaml | nindent 4 }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.persistence.new.size }}
  {{- with .Values.persistence.new.storageClassName }}
  storageClassName: {{ . }}
  {{- end }}
  volumeMode: Filesystem
  {{- with .Values.persistence.new.persistentVolumeName }}
  volumeName: {{ . }}
  {{- end }}
 {{- end }}
@@ -0,0 +1,26 @@
 {{- if and .Values.persistence.enabled .Values.persistence.create }}
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
  name: {{ .Values.persistence.claimName }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  annotations:
 {{ .Values.persistence.annotations | toYaml | indent 4}}
  labels:
 {{ .Values.persistence.labels | toYaml | indent 4}}
 spec:
  accessModes:
  {{- if gt (.Values.replicaCount | int) 1 }}
      - ReadWriteMany
  {{- else }}
    {{- .Values.persistence.accessModes | toYaml | nindent 4 }}
  {{- end }}
  volumeMode: Filesystem
  {{- include "gitea.persistence.storageClass" . | nindent 2 }}
  {{- with .Values.persistence.volumeName }}
  volumeName: {{ . }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.persistence.size }}
 {{- end }}
@@ -1,52 +0,0 @@
 {{- if .Values.route.enabled -}}
 {{- $fullName := include "gitea.fullname" . -}}
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
  name: {{ $fullName }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
  {{- with .Values.route.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 spec:
  {{- if .Values.route.host }}
  host: {{ tpl .Values.route.host . | quote }}
  {{- end }}
  {{- if .Values.route.path }}
  path: {{ tpl .Values.route.path . | quote }}
  {{- end }}
  to:
    kind: Service
    name: {{ include "gitea.service.http.name" . }}
  port:
    targetPort: http
  wildcardPolicy: {{ .Values.route.wildcardPolicy }}
  {{- with .Values.route.tls }}
  {{- if .termination }}
  tls:
    termination: {{ .termination }}
    {{- if .insecureEdgeTerminationPolicy }}
    insecureEdgeTerminationPolicy: {{ .insecureEdgeTerminationPolicy }}
    {{- end }}
    {{- if .key }}
    key: |
      {{- .key | nindent 6 }}
    {{- end }}
    {{- if .certificate }}
    certificate: |
      {{- .certificate | nindent 6 }}
    {{- end }}
    {{- if .caCertificate }}
    caCertificate: |
      {{- .caCertificate | nindent 6 }}
    {{- end }}
    {{- if .destinationCACertificate }}
    destinationCACertificate: |
      {{- .destinationCACertificate | nindent 6 }}
    {{- end }}
  {{- end }}
  {{- end }}
 {{- end }}
@@ -1,21 +0,0 @@
 {{- if and (.Values.secrets.admin.enabled) (not .Values.secrets.admin.existingSecret.enabled) -}}
 {{- if or (empty .Values.secrets.admin.new.username) (empty .Values.secrets.admin.new.password) -}}
  {{- fail "Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`" -}}
 {{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
  {{- with (include "gitea.secret.admin.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.admin.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.admin.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 data:
  email: {{ .Values.secrets.admin.new.email | b64enc }}
  password: {{ .Values.secrets.admin.new.password | b64enc }}
  username: {{ .Values.secrets.admin.new.username | b64enc }}
 {{- end }}
@@ -1,59 +0,0 @@
 {{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
 {{- $assertions := include "gitea.config.assertions" . -}}
 {{- if not .Values.secrets.config.existingSecret.enabled -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  {{- with (include "gitea.secret.config.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.config.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.config.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 stringData:
 {{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
  assertions: |
    {{- $assertions | nindent 4 }}
 {{- end }}
 {{- define "gitea.config.assertions" -}}
  {{- /*assert that only one PG dep is enabled */ -}}
  {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
    {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
  {{- end }}
  {{- /* multiple replicas assertions */ -}}
  {{- if gt (.Values.deployment.replicas | int) 1 -}}
    {{- if .Values.gitea.config.cron -}}
      {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
        {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
          {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
        {{- end }}
      {{- end }}
    {{- end }}
    {{- if eq (first .Values.persistence.new.accessModes) "ReadWriteOnce" -}}
      {{- fail "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany." -}}
    {{- end }}
    {{- if .Values.gitea.config.indexer -}}
      {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
        {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
      {{- end }}
      {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
        {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
          {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
            {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
              {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
            {{- end }}
          {{- end }}
        {{- end }}
      {{- end }}
    {{- end }}
  {{- end }}
 {{- end }}
@@ -1,20 +0,0 @@
 {{- if and (.Values.secrets.gpg.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
 {{- if empty .Values.secrets.gpg.new.privateKey -}}
  {{- fail "Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`" -}}
 {{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
  {{- with (include "gitea.secret.gpg.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.gpg.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.gpg.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 data:
  gpgHome: {{ .Values.secrets.gpg.new.gpgHome | b64enc }}
  privateKey: {{ .Values.secrets.gpg.new.privateKey | b64enc }}
 {{- end }}
@@ -1,19 +0,0 @@
 {{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}}
 {{- $inlineConfiguration := include "gitea.inline_configuration" . -}}
 {{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}}
 ---
 apiVersion: v1
 kind: Secret
 metadata:
  {{- with (include "gitea.secret.inlineConfig.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.inlineConfig.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 stringData:
  {{- $inlineConfiguration | nindent 2 }}
 {{- end }}
@@ -1,16 +0,0 @@
 {{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}}
 apiVersion: v1
 kind: Secret
 metadata:
  {{- with (include "gitea.secret.metrics.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  labels:
    {{- include "gitea.secret.metrics.labels" . | nindent 4 }}
  name: {{ include "gitea.secret.metrics.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 data:
  token: {{ .Values.gitea.metrics.token  | b64enc }}
 {{- end }}
@@ -1,21 +0,0 @@
 {{- if eq (include "gitea.serviceAccount.enabled" .) "true" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  {{- with (include "gitea.serviceAccount.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.serviceAccount.labels" .) }}
  labels:
    {{- . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.serviceAccount.name" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 automountServiceAccountToken: {{ .Values.serviceAccount.new.automountServiceAccountToken }}
 {{- with .Values.serviceAccount.new.imagePullSecrets }}
 imagePullSecrets:
  {{- . | toYaml | nindent 2 }}
 {{- end }}
 {{- end }}
@@ -0,0 +1,21 @@
 {{- if .Values.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "gitea.serviceAccountName" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
    {{- with .Values.serviceAccount.labels }}
    {{- . | toYaml | nindent 4 }}
  {{- end }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
    {{- . | toYaml | nindent 4 }}
  {{- end }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- with .Values.serviceAccount.imagePullSecrets }}
 imagePullSecrets:
  {{- . | toYaml | nindent 2 }}
 {{- end }}
 {{- end }}
@@ -36,7 +36,7 @@ spec:
    authorization:
      type: Bearer
      credentials:
-        name: {{ include "gitea.secret.metrics.name" . }}
+        name: {{ include "gitea.metrics-secret-name" . }}
        key: token
        optional: false
    {{- end }}
@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
+  name: {{ include "gitea.fullname" . }}-ssh
-    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
  labels:
    {{- include "gitea.labels" . | nindent 4 }}
    {{- if .Values.service.ssh.labels }}
    {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
    {{- end }}
-  name: {{ include "gitea.service.ssh.name" . }}
+  annotations:
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
 spec:
  type: {{ .Values.service.ssh.type }}
  {{- if eq .Values.service.ssh.type "LoadBalancer" }}
@@ -1,34 +0,0 @@
 {{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: TCPRoute
 metadata:
  {{- with (include "gitea.tcpRoute.annotations" .) }}
  annotations:
    {{- . | nindent 4 }}
  {{- end }}
  {{- with (include "gitea.tcpRoute.labels" .) }}
  labels:
    {{- . | nindent 4 }}
  {{- end }}
  name: {{ include "gitea.fullname" . }}
  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
  parentRefs:
    {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
    {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
    {{- else }}
    {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
    {{- end }}
  rules:
    {{- if .Values.gatewayAPI.core.tcpRoute.rules }}
    {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
    {{- else }}
    - backendRefs:
        - group: ""
          kind: Service
          name: {{ include "gitea.service.ssh.name" . }}
          port: {{ .Values.service.ssh.port }}
          weight: 1
    {{- end }}
 {{- end }}
@@ -9,19 +9,10 @@ metadata:
  annotations:
    "helm.sh/hook": test-success
 spec:
  {{- $hostUsers := include "gitea.hostUsers" . | trim }}
  {{- $testContainerSecurityContext := include "gitea.containerSecurityContext" (list . (dict)) | trim }}
  {{- if $hostUsers }}
  hostUsers: {{ $hostUsers }}
  {{- end }}
  containers:
    - name: wget
      image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
      {{- if $testContainerSecurityContext }}
      securityContext:
        {{- $testContainerSecurityContext | nindent 8 }}
      {{- end }}
      command: ['wget']
-      args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}']
+      args:  ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
  restartPolicy: Never
 {{- end }}
@@ -9,51 +9,27 @@ function setup() {
  export GITEA_APP_INI="$BATS_TEST_TMPDIR/app.ini"
  export TMP_EXISTING_ENVS_FILE="$BATS_TEST_TMPDIR/existing-envs"
  export ENV_TO_INI_MOUNT_POINT="$BATS_TEST_TMPDIR/env-to-ini-mounts"
  export GITEA_EDIT_INI_EXPECTED=0
  export PATH="$BATS_TEST_TMPDIR/bin:$PATH"
-  mkdir -p "$BATS_TEST_TMPDIR/bin"
+  stub gitea \
-  cat >"$BATS_TEST_TMPDIR/bin/gitea" <<'EOF'
+      "generate secret INTERNAL_TOKEN : echo 'mocked-internal-token'" \
-#!/usr/bin/env bash
+      "generate secret SECRET_KEY : echo 'mocked-secret-key'" \
-set -euo pipefail
+      "generate secret JWT_SECRET : echo 'mocked-jwt-secret'" \
-
+      "generate secret LFS_JWT_SECRET : echo 'mocked-lfs-jwt-secret'"
 case "$*" in
  'generate secret INTERNAL_TOKEN')
    echo 'mocked-internal-token'
    ;;
  'generate secret SECRET_KEY')
    echo 'mocked-secret-key'
    ;;
  'generate secret JWT_SECRET')
    echo 'mocked-jwt-secret'
    ;;
  'generate secret LFS_JWT_SECRET')
    echo 'mocked-lfs-jwt-secret'
    ;;
  "config edit-ini --apply-env --config $GITEA_APP_INI --out $GITEA_APP_INI")
    if [ "$GITEA_EDIT_INI_EXPECTED" -eq 1 ]; then
      echo 'Stubbed gitea config edit-ini was called!'
      exit 0
    fi
    echo 'Unexpected gitea config edit-ini invocation' >&2
    exit 127
    ;;
  *)
    echo "Unexpected gitea invocation: $*" >&2
    exit 127
    ;;
 esac
 EOF
  chmod +x "$BATS_TEST_TMPDIR/bin/gitea"
 }
 function teardown() {
-  :
+  unstub gitea
  # This condition exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
  if [ $ENV_TO_INI_EXPECTED -eq 1 ]; then
    unstub environment-to-ini
  fi
 }
-function expect_gitea_config_edit_ini_call() {
+# This function exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
-  export GITEA_EDIT_INI_EXPECTED=1
+function expect_environment_to_ini_call() {
  export ENV_TO_INI_EXPECTED=1
  stub environment-to-ini \
    "-o $GITEA_APP_INI : echo 'Stubbed environment-to-ini was called!'"
 }
 function execute_test_script() {
@@ -80,18 +56,18 @@ function write_mounted_file() {
 }
@test "works as expected when nothing is configured" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  run $PROJECT_ROOT/scripts/init-containers/config/config_environment.sh
  assert_success
  assert_line '...Initial secrets generated'
  assert_line 'Reloading preset envs...'
  assert_line '=== All configuration sources loaded ==='
-  assert_line 'Stubbed gitea config edit-ini was called!'
+  assert_line 'Stubbed environment-to-ini was called!'
 }
@test "exports initial secrets" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  run execute_test_script
  assert_success
@@ -102,7 +78,7 @@ function write_mounted_file() {
 }
@test "does NOT export initial secrets when app.ini already exists" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  touch $GITEA_APP_INI
  run execute_test_script
@@ -116,7 +92,7 @@ function write_mounted_file() {
 }
@test "ensures that preset environment variables take precedence over auto-generated ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
  run execute_test_script
@@ -126,7 +102,7 @@ function write_mounted_file() {
 }
@test "ensures that preset environment variables take precedence over mounted ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
  write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
@@ -141,7 +117,7 @@ EOF
 }
@test "ensures that additionals take precedence over inlines" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
 EOF
@@ -160,7 +136,7 @@ EOF
 }
@test "ensures that dotted/dashed sections are properly masked" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
 EOF
@@ -176,7 +152,7 @@ EOF
 ##### THIS IS A BUG, BUT I WANT IT TO BE COVERED BY TESTS #####
 ###############################################################
@test "ensures uppercase section and setting names (🐞)" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  export GITEA__oauth2__JwT_Secret="pre-defined-jwt-secret"
  write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_progress_PREFIXES=WIP:,[WIP]
@@ -191,7 +167,7 @@ EOF
 }
@test "treats top-level configuration as section-less" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
  write_mounted_file "inlines" "_generals_" "$(cat << EOF
 APP_NAME=Hello top-level configuration
 RUN_MODE=dev
@@ -1,64 +0,0 @@
 suite: Admin secret template
 release:
  name: gitea-unittests
  namespace: testing
 templates:
  - templates/secret_admin.yaml
 tests:
  - it: skips rendering when the admin user is disabled
    set:
      secrets.admin.enabled: false
    asserts:
      - hasDocuments:
          count: 0
  - it: skips rendering using an existing secret reference
    set:
      secrets.admin.enabled: true
      secrets.admin.existingSecret.enabled: true
      secrets.admin.existingSecret.secretName: "external-secret-reference"
    asserts:
      - hasDocuments:
          count: 0
  - it: fails rendering without credentials
    set:
      secrets.admin.new.password: ""
    asserts:
      - failedTemplate:
          errorMessage: Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`
  - it: renders the secret specification with the default credentials
    asserts:
      - hasDocuments:
          count: 1
      - documentIndex: 0
        containsDocument:
          kind: Secret
          apiVersion: v1
          name: gitea-unittests-admin
      - isNotNullOrEmpty:
          path: metadata.labels
      - equal:
          path: data.email
          value: "Z2l0ZWFAbG9jYWwuZG9tYWlu"
      - equal:
          path: data.password
          value: "cjhzQThDUEhEOSFidDZk"
      - equal:
          path: data.username
          value: "Z2l0ZWFfYWRtaW4="
  - it: supports custom annotations and labels
    set:
      secrets.admin.new.annotations:
        custom-annotation: annotation-value
      secrets.admin.new.labels:
        custom-label: label-value
    asserts:
      - equal:
          path: metadata.annotations["custom-annotation"]
          value: annotation-value
      - equal:
          path: metadata.labels["custom-label"]
          value: label-value
@@ -0,0 +1,12 @@
 suite: Check if actions raises an error
 release:
  name: gitea-unittests
  namespace: testing
 tests:
  - it: fails when trying to configure actions due to removal
    set:
      actions:
        enabled: true
    asserts:
      - failedTemplate:
          errorMessage: The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9.
@@ -3,17 +3,17 @@ release:
  name: gitea-unittests
  namespace: testing
 templates:
-  - templates/secret_inlineConfig.yaml
+  - templates/config.yaml
 tests:
  - it: "actions are enabled by default (based on vanilla Gitea behavior)"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    asserts:
      - documentIndex: 0
        notExists:
          path: stringData.actions
  - it: "actions can be disabled via inline config"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      gitea.config.actions.ENABLED: false
    asserts:
@@ -3,9 +3,26 @@ release:
  name: gitea-unittests
  namespace: testing
 tests:
-  - it: "cache is configured correctly for valkey"
+  - it: "cache is configured correctly for valkey-cluster"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: true
      valkey:
        enabled: false
    asserts:
      - documentIndex: 0
        equal:
          path: stringData.cache
          value: |-
            ADAPTER=redis
            HOST=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
  - it: "cache is configured correctly for valkey"
    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: true
    asserts:
@@ -14,11 +31,13 @@ tests:
          path: stringData.cache
          value: |-
            ADAPTER=redis
-            HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            HOST=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-  - it: "cache is configured correctly for 'memory' when valkey is disabled"
+  - it: "cache is configured correctly for 'memory' when valkey (or valkey-cluster) is disabled"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: false
    asserts:
@@ -29,9 +48,11 @@ tests:
            ADAPTER=memory
            HOST=
-  - it: "cache can be customized when valkey is disabled"
+  - it: "cache can be customized when valkey (or valkey-cluster) is disabled"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: false
      gitea.config.cache.ADAPTER: custom-adapter
@@ -1,15 +0,0 @@
 suite: config template | config_environment.sh
 release:
  name: gitea-unittests
  namespace: testing
 templates:
  - templates/secret_admin.yaml
  - templates/secret_config.yaml
 tests:
  - it: uses `gitea config edit-ini` to write app.ini from environment variables
    template: templates/secret_config.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData["config_environment.sh"]
          pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
@@ -4,7 +4,7 @@ release:
  namespace: testing
 tests:
  - it: metrics token is set
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      gitea:
        metrics:
@@ -18,7 +18,7 @@ tests:
            ENABLED=true
            TOKEN=somepassword
  - it: metrics token is empty
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      gitea:
        metrics:
@@ -31,7 +31,7 @@ tests:
          value: |-
            ENABLED=true
  - it: metrics token is nil
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      gitea:
        metrics:
@@ -44,7 +44,7 @@ tests:
          value: |-
            ENABLED=true
  - it: does not configures a token if metrics are disabled
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      gitea:
        metrics:
@@ -3,9 +3,26 @@ release:
  name: gitea-unittests
  namespace: testing
 tests:
-  - it: "queue is configured correctly for valkey"
+  - it: "queue is configured correctly for valkey-cluster"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: true
      valkey:
        enabled: false
    asserts:
      - documentIndex: 0
        equal:
          path: stringData.queue
          value: |-
            CONN_STR=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
            TYPE=redis
  - it: "queue is configured correctly for valkey"
    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: true
    asserts:
@@ -13,12 +30,14 @@ tests:
        equal:
          path: stringData.queue
          value: |-
-            CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            CONN_STR=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
            TYPE=redis
-  - it: "queue is configured correctly for 'levelDB' when valkey is disabled"
+  - it: "queue is configured correctly for 'levelDB' when valkey (and valkey-cluster) is disabled"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: false
    asserts:
@@ -29,9 +48,11 @@ tests:
            CONN_STR=
            TYPE=level
-  - it: "queue can be customized when valkey is disabled"
+  - it: "queue can be customized when valkey (and valkey-cluster) are disabled"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: false
      gitea.config.queue.TYPE: custom-type
@@ -4,7 +4,7 @@ release:
  namespace: testing
 tests:
  - it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
@@ -22,7 +22,7 @@ tests:
  ################################################
  - it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      ingress:
        hosts: []
@@ -43,7 +43,7 @@ tests:
  ################################################
  - it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      gitea.config.server.DOMAIN: provided.example.com
      ingress:
@@ -65,94 +65,3 @@ tests:
        matchRegex:
          path: stringData.server
          pattern: \nROOT_URL=http://provided.example.com
  ################################################
  - it: "[route enabled] uses route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
    template: templates/secret_inlineConfig.yaml
    set:
      route:
        enabled: true
        host: route.example.com
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nDOMAIN=route.example.com
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nSSH_DOMAIN=route.example.com
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nROOT_URL=http://route.example.com
  ################################################
  - it: "[route tls termination] uses https for ROOT_URL"
    template: templates/secret_inlineConfig.yaml
    set:
      route:
        enabled: true
        host: route.example.com
        tls:
          termination: edge
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nROOT_URL=https://route.example.com
  ################################################
  - it: "[HTTPRoute enabled] uses first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
    template: templates/secret_inlineConfig.yaml
    set:
      ingress:
        hosts: []
      gatewayAPI:
        enabled: true
        core:
          httpRoute:
            enabled: true
            hostnames:
              - gw.example.com
            parentRefs:
              - name: shared-gateway
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nDOMAIN=gw.example.com
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nSSH_DOMAIN=gw.example.com
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nROOT_URL=http://gw.example.com
  ################################################
  - it: "[HTTPRoute tls] switches ROOT_URL to https"
    template: templates/secret_inlineConfig.yaml
    set:
      ingress:
        hosts: []
      gatewayAPI:
        enabled: true
        core:
          httpRoute:
            enabled: true
            tls: true
            hostnames:
              - gw.example.com
            parentRefs:
              - name: shared-gateway
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.server
          pattern: \nROOT_URL=https://gw.example.com
@@ -3,9 +3,26 @@ release:
  name: gitea-unittests
  namespace: testing
 tests:
-  - it: "session is configured correctly for valkey"
+  - it: "session is configured correctly for valkey-cluster"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: true
      valkey:
        enabled: false
    asserts:
      - documentIndex: 0
        equal:
          path: stringData.session
          value: |-
            PROVIDER=redis
            PROVIDER_CONFIG=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
  - it: "session is configured correctly for valkey"
    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: true
    asserts:
@@ -14,11 +31,13 @@ tests:
          path: stringData.session
          value: |-
            PROVIDER=redis
-            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-  - it: "session is configured correctly for 'memory' when valkey is disabled"
+  - it: "session is configured correctly for 'memory' when valkey (and valkey-cluster) is disabled"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: false
    asserts:
@@ -29,9 +48,11 @@ tests:
            PROVIDER=memory
            PROVIDER_CONFIG=
-  - it: "session can be customized when valkey is disabled"
+  - it: "session can be customized when valkey (and valkey-cluster) is disabled"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: false
      gitea.config.session.PROVIDER: custom-provider
@@ -106,23 +106,14 @@ tests:
          name: gitea-unittests-postgresql-ha-pgpool
          namespace: testing
  - it: "[gitea] connects to pgpool service"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.database
          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
  - it: "[gitea] connects to pgpool service with custom cluster domain"
    set:
      clusterDomain: my-special-cluster.local
    template: templates/secret_inlineConfig.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.database
          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
  - it: "[gitea] connects to configured database"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
@@ -65,23 +65,14 @@ tests:
          name: gitea-unittests-postgresql
          namespace: testing
  - it: "[gitea] connects to postgresql service"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.database
          pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
  - it: "[gitea] connects to postgresql service with custom cluster domain"
    set:
      clusterDomain: my-special-cluster.local
    template: templates/secret_inlineConfig.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData.database
          pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234
  - it: "[gitea] connects to configured database"
-    template: templates/secret_inlineConfig.yaml
+    template: templates/config.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
@@ -0,0 +1,90 @@
 suite: Dependency checks | Customization integrity | valkey-cluster
 release:
  name: gitea-unittests
  namespace: testing
 set:
  valkey:
    enabled: false
  valkey-cluster:
    enabled: true
    usePassword: false
    cluster:
      nodes: 5
      replicas: 2
 tests:
  - it: "[valkey-cluster] configures correct nodes/replicas"
    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
    asserts:
      - documentIndex: 0
        equal:
          path: spec.replicas
          value: 5
      - documentIndex: 0
        matchRegex:
          path: spec.template.spec.containers[0].args[0]
          pattern: VALKEY_CLUSTER_REPLICAS="2"
  - it: "[valkey-cluster] support auth-less connections"
    asserts:
      - template: charts/valkey-cluster/templates/secret.yaml
        hasDocuments:
          count: 0
      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
        documentIndex: 0
        contains:
          path: spec.template.spec.containers[0].env
          content:
            name: ALLOW_EMPTY_PASSWORD
            value: "yes"
  - it: "[valkey-cluster] support auth-full connections"
    set:
      valkey-cluster:
        usePassword: true
    asserts:
      - template: charts/valkey-cluster/templates/secret.yaml
        containsDocument:
          kind: Secret
          apiVersion: v1
          name: gitea-unittests-valkey-cluster
          namespace: testing
      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
        documentIndex: 0
        contains:
          path: spec.template.spec.containers[0].env
          content:
            name: REDISCLI_AUTH
            valueFrom:
              secretKeyRef:
                name: gitea-unittests-valkey-cluster
                key: valkey-password
      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
        documentIndex: 0
        contains:
          path: spec.template.spec.containers[0].env
          content:
            name: REDISCLI_AUTH
            valueFrom:
              secretKeyRef:
                name: gitea-unittests-valkey-cluster
                key: valkey-password
  - it: "[valkey-cluster] renders the referenced service"
    template: charts/valkey-cluster/templates/headless-svc.yaml
    asserts:
      - containsDocument:
          kind: Service
          apiVersion: v1
          name: gitea-unittests-valkey-cluster-headless
          namespace: testing
      - documentIndex: 0
        contains:
          path: spec.ports
          content:
            name: tcp-redis
            port: 6379
            targetPort: tcp-redis
  - it: "[gitea] waits for valkey-cluster to be up and running"
    template: templates/init.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData["configure_gitea.sh"]
          pattern: nc -vz -w2 gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local 6379
@@ -3,50 +3,50 @@ release:
  name: gitea-unittests
  namespace: testing
 set:
  valkey-cluster:
    enabled: false
  valkey:
    enabled: true
-    auth:
+    architecture: standalone
-      enabled: true
+    global:
-      aclUsers:
+      valkey:
-        default:
+        password: gitea-password
-          permissions: "~* &* +@all"
+    master:
-          password: gitea-password
+      count: 2
 tests:
-  - it: "[valkey] valkey.auth.aclUsers.default.password is applied as expected"
+  - it: "[valkey] configures correct 'master' nodes"
    template: charts/valkey/templates/primary/application.yaml
    asserts:
      - documentIndex: 0
        equal:
          path: spec.replicas
          value: 1
  - it: "[valkey] valkey.global.valkey.password is applied as expected"
    template: charts/valkey/templates/secret.yaml
    asserts:
      - documentIndex: 0
        equal:
-          path: data.default-password
+          path: data["valkey-password"]
          value: "Z2l0ZWEtcGFzc3dvcmQ="
  - it: "[valkey] renders the referenced service"
-    template: charts/valkey/templates/service.yaml
+    template: charts/valkey/templates/headless-svc.yaml
    asserts:
      - containsDocument:
          kind: Service
          apiVersion: v1
-          name: gitea-unittests-valkey
+          name: gitea-unittests-valkey-headless
          namespace: testing
      - documentIndex: 0
        contains:
          path: spec.ports
          content:
-            name: tcp
+            name: tcp-redis
            port: 6379
-            targetPort: tcp
+            targetPort: redis
            protocol: TCP
  - it: "[gitea] waits for valkey to be up and running"
-    template: templates/secret_init.yaml
+    template: templates/init.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData["configure_gitea.sh"]
-          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
+          pattern: nc -vz -w2 gitea-unittests-valkey-headless.testing.svc.cluster.local 6379
  - it: "[gitea] waits for valkey to be up and running with custom cluster domain"
    set:
      clusterDomain: my-special-cluster.local
    template: templates/secret_init.yaml
    asserts:
      - documentIndex: 0
        matchRegex:
          path: stringData["configure_gitea.sh"]
          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379
@@ -15,7 +15,7 @@ tests:
        matchRegex:
          path: spec.template.spec.containers[0].image
          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnamilegacy/postgresql-repmgr:17.+$
+          pattern: bitnami/postgresql-repmgr:17.+$
  - it: "[postgresql] ensures we detect major image version upgrades"
    template: charts/postgresql/templates/primary/statefulset.yaml
    set:
@@ -28,10 +28,25 @@ tests:
        matchRegex:
          path: spec.template.spec.containers[0].image
          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnamilegacy/postgresql:17.+$
+          pattern: bitnami/postgresql:17.+$
-  - it: "[valkey] ensures we detect major image version upgrades"
+  - it: "[valkey-cluster] ensures we detect major image version upgrades"
-    template: charts/valkey/templates/deploy_valkey.yaml
+    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
    set:
      valkey-cluster:
        enabled: true
      valkey:
        enabled: false
    asserts:
      - documentIndex: 0
        matchRegex:
          path: spec.template.spec.containers[0].image
          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
          pattern: bitnami/valkey-cluster:8.+$
  - it: "[valkey] ensures we detect major image version upgrades"
    template: charts/valkey/templates/primary/application.yaml
    set:
      valkey-cluster:
        enabled: false
      valkey:
        enabled: true
    asserts:
@@ -39,4 +54,4 @@ tests:
        matchRegex:
          path: spec.template.spec.containers[0].image
          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: valkey/valkey:9.+$
+          pattern: bitnami/valkey:8.+$
@@ -4,22 +4,15 @@ release:
  namespace: testing
 templates:
  - templates/deployment.yaml
-  - templates/secret_admin.yaml
+  - templates/config.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: fails with multiple replicas and "GIT_GC_REPOS" enabled
-    template: templates/secret_config.yaml
+    template: templates/deployment.yaml
    set:
-      deployment:
+      replicaCount: 2
        replicas: 2
      persistence:
-        new:
+        accessModes:
-          accessModes:
+          - ReadWriteMany
            - ReadWriteMany
      gitea:
        config:
          cron:
@@ -29,22 +22,19 @@ tests:
      - failedTemplate:
          errorMessage: "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'."
  - it: fails with multiple replicas and RWX file system not set
-    template: templates/secret_config.yaml
+    template: templates/deployment.yaml
    set:
-      deployment:
+      replicaCount: 2
        replicas: 2
    asserts:
      - failedTemplate:
-          errorMessage: "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany."
+          errorMessage: "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany."
  - it: fails with multiple replicas and bleve issue indexer
-    template: templates/secret_config.yaml
+    template: templates/deployment.yaml
    set:
-      deployment:
+      replicaCount: 2
        replicas: 2
      persistence:
-        new:
+        accessModes:
-          accessModes:
+          - ReadWriteMany
            - ReadWriteMany
      gitea:
        config:
          indexer:
@@ -53,14 +43,12 @@ tests:
      - failedTemplate:
          errorMessage: "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)."
  - it: fails with multiple replicas and bleve repo indexer
-    template: templates/secret_config.yaml
+    template: templates/deployment.yaml
    set:
-      deployment:
+      replicaCount: 2
        replicas: 2
      persistence:
-        new:
+        accessModes:
-          accessModes:
+          - ReadWriteMany
            - ReadWriteMany
      gitea:
        config:
          indexer:
@@ -1,103 +0,0 @@
 suite: deployment template (admin user)
 release:
  name: gitea-unittests
  namespace: testing
 templates:
  - templates/deployment.yaml
  - templates/secret_admin.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: reads the admin credentials from the generated secret
    template: templates/deployment.yaml
    asserts:
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_USERNAME
            valueFrom:
              secretKeyRef:
                key: username
                name: gitea-unittests-admin
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_PASSWORD
            valueFrom:
              secretKeyRef:
                key: password
                name: gitea-unittests-admin
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_EMAIL
            valueFrom:
              secretKeyRef:
                key: email
                name: gitea-unittests-admin
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_PASSWORD_MODE
            value: keepUpdated
  - it: reads the admin credentials from the configured keys of an existing secret
    template: templates/deployment.yaml
    set:
      secrets.admin.existingSecret.enabled: true
      secrets.admin.existingSecret.secretName: custom-admin-secret
      secrets.admin.existingSecret.emailKey: custom-email
      secrets.admin.existingSecret.passwordKey: custom-password
      secrets.admin.existingSecret.usernameKey: custom-username
    asserts:
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_USERNAME
            valueFrom:
              secretKeyRef:
                key: custom-username
                name: custom-admin-secret
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_PASSWORD
            valueFrom:
              secretKeyRef:
                key: custom-password
                name: custom-admin-secret
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_EMAIL
            valueFrom:
              secretKeyRef:
                key: custom-email
                name: custom-admin-secret
  - it: omits the admin environment when the admin user is disabled
    template: templates/deployment.yaml
    set:
      secrets.admin.enabled: false
    asserts:
      - notContains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_USERNAME
          any: true
      - notContains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: GITEA_ADMIN_PASSWORD_MODE
          any: true
  - it: fails on an unsupported password mode
    template: templates/deployment.yaml
    set:
      secrets.admin.passwordMode: unsupported
    asserts:
      - failedTemplate:
          errorMessage: "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: 'unsupported'"
@@ -4,12 +4,7 @@ release:
  namespace: testing
 templates:
  - templates/deployment.yaml
-  - templates/secret_admin.yaml
+  - templates/config.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: renders a deployment
    template: templates/deployment.yaml
@@ -20,13 +15,6 @@ tests:
          kind: Deployment
          apiVersion: apps/v1
          name: gitea-unittests
  - it: renders no deployment when disabled
    template: templates/deployment.yaml
    set:
      deployment.enabled: false
    asserts:
      - hasDocuments:
          count: 0
  - it: deployment labels are set
    template: templates/deployment.yaml
    set:
@@ -41,47 +29,6 @@ tests:
          path: spec.template.metadata.labels
          content:
            hello: world
      - isNotSubset:
          path: spec.selector.matchLabels
          content:
            hello: world
  - it: deployment labels are not in selector matchLabels
    template: templates/deployment.yaml
    set:
      deployment.labels:
        custom-label: custom-value
        another-label: another-value
    asserts:
      - equal:
          path: spec.selector.matchLabels
          value:
            app.kubernetes.io/name: gitea
            app.kubernetes.io/instance: gitea-unittests
  - it: deployment labels are always rendered
    template: templates/deployment.yaml
    asserts:
      - isSubset:
          path: metadata.labels
          content:
            app: gitea
            app.kubernetes.io/name: gitea
            app.kubernetes.io/instance: gitea-unittests
            app.kubernetes.io/managed-by: Helm
  - it: deployment annotations are undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: metadata.annotations
  - it: deployment annotations are set
    template: templates/deployment.yaml
    set:
      deployment.annotations:
        hello: world
    asserts:
      - equal:
          path: metadata.annotations
          value:
            hello: world
  - it: nodeSelector is undefined
    asserts:
      - notExists:
@@ -89,7 +36,7 @@ tests:
        template: templates/deployment.yaml
  - it: nodeSelector is defined
    set:
-      deployment.nodeSelector:
+      nodeSelector:
        foo: bar
        bar: foo
    asserts:
@@ -99,149 +46,6 @@ tests:
            foo: bar
            bar: foo
        template: templates/deployment.yaml
  - it: affinity is undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.affinity
  - it: affinity is defined
    template: templates/deployment.yaml
    set:
      deployment.affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
    asserts:
      - equal:
          path: spec.template.spec.affinity
          value:
            nodeAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                nodeSelectorTerms:
                  - matchExpressions:
                      - key: kubernetes.io/os
                        operator: In
                        values:
                          - linux
  - it: dnsConfig is undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.dnsConfig
  - it: dnsConfig is defined
    template: templates/deployment.yaml
    set:
      deployment.dnsConfig:
        nameservers:
          - 192.0.2.1
        options:
          - name: ndots
            value: "2"
    asserts:
      - equal:
          path: spec.template.spec.dnsConfig
          value:
            nameservers:
              - 192.0.2.1
            options:
              - name: ndots
                value: "2"
  - it: priorityClassName is undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.priorityClassName
  - it: priorityClassName is defined
    template: templates/deployment.yaml
    set:
      deployment.priorityClassName: high-priority
    asserts:
      - equal:
          path: spec.template.spec.priorityClassName
          value: high-priority
  - it: schedulerName is undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.schedulerName
  - it: schedulerName is defined
    template: templates/deployment.yaml
    set:
      deployment.schedulerName: stork
    asserts:
      - equal:
          path: spec.template.spec.schedulerName
          value: stork
  - it: strategy defaults to a rolling update
    template: templates/deployment.yaml
    asserts:
      - equal:
          path: spec.strategy
          value:
            type: RollingUpdate
            rollingUpdate:
              maxUnavailable: 0
              maxSurge: 100%
  - it: strategy omits rollingUpdate for other strategy types
    template: templates/deployment.yaml
    set:
      deployment.strategy.type: Recreate
    asserts:
      - equal:
          path: spec.strategy
          value:
            type: Recreate
  - it: tolerations are undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.tolerations
  - it: tolerations are defined
    template: templates/deployment.yaml
    set:
      deployment.tolerations:
        - key: database/type
          operator: Equal
          value: postgres
          effect: NoSchedule
    asserts:
      - equal:
          path: spec.template.spec.tolerations
          value:
            - key: database/type
              operator: Equal
              value: postgres
              effect: NoSchedule
  - it: topologySpreadConstraints are undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.topologySpreadConstraints
  - it: topologySpreadConstraints are defined
    template: templates/deployment.yaml
    set:
      deployment.topologySpreadConstraints:
        - topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          maxSkew: 1
          labelSelector:
            matchLabels:
              app.kubernetes.io/instance: gitea-unittests
    asserts:
      - equal:
          path: spec.template.spec.topologySpreadConstraints
          value:
            - topologyKey: kubernetes.io/hostname
              whenUnsatisfiable: DoNotSchedule
              maxSkew: 1
              labelSelector:
                matchLabels:
                  app.kubernetes.io/instance: gitea-unittests
  - it: "injects TMP_EXISTING_ENVS_FILE as environment variable to 'init-app-ini' init container"
    template: templates/deployment.yaml
@@ -259,37 +63,10 @@ tests:
          content:
            name: ENV_TO_INI_MOUNT_POINT
            value: /env-to-ini-mounts
  - it: "deployment.gitea.env is injected into all init containers and the gitea container"
    template: templates/deployment.yaml
    set:
      deployment.gitea.env:
        - name: VARIABLE
          value: my-value
    asserts:
      - contains:
          path: spec.template.spec.initContainers[0].env
          content:
            name: VARIABLE
            value: my-value
      - contains:
          path: spec.template.spec.initContainers[1].env
          content:
            name: VARIABLE
            value: my-value
      - contains:
          path: spec.template.spec.initContainers[2].env
          content:
            name: VARIABLE
            value: my-value
      - contains:
          path: spec.template.spec.containers[0].env
          content:
            name: VARIABLE
            value: my-value
  - it: CPU resources are defined as well as GOMAXPROCS
    template: templates/deployment.yaml
    set:
-      deployment.gitea.resources:
+      resources:
        limits:
          cpu: 200ms
          memory: 200Mi
@@ -314,45 +91,6 @@ tests:
            requests:
              cpu: 100ms
              memory: 100Mi
  - it: container resources default to an empty map and GOMAXPROCS is omitted
    template: templates/deployment.yaml
    asserts:
      - equal:
          path: spec.template.spec.containers[0].resources
          value: {}
      - notContains:
          path: spec.template.spec.containers[0].env
          content:
            name: GOMAXPROCS
            valueFrom:
              resourceFieldRef:
                divisor: "1"
                resource: limits.cpu
  - it: pod level resources are undefined
    template: templates/deployment.yaml
    asserts:
      - notExists:
          path: spec.template.spec.resources
  - it: pod level resources are defined
    template: templates/deployment.yaml
    set:
      deployment.resources:
        limits:
          cpu: 500m
          memory: 512Mi
        requests:
          cpu: 250m
          memory: 256Mi
    asserts:
      - equal:
          path: spec.template.spec.resources
          value:
            limits:
              cpu: 500m
              memory: 512Mi
            requests:
              cpu: 250m
              memory: 256Mi
  - it: Init containers have correct volumeMount path
    template: templates/deployment.yaml
    set:
@@ -1,158 +0,0 @@
 suite: deployment template (checksum annotations)
 release:
  name: gitea-unittests
  namespace: testing
 templates:
  - templates/deployment.yaml
  - templates/secret_admin.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: omits the checksum annotations by default
    template: templates/deployment.yaml
    set:
      secrets.admin.enabled: true
      secrets.config.enabled: true
      secrets.gpg.enabled: true
      secrets.gpg.new.privateKey: |
        -----BEGIN PGP PRIVATE KEY BLOCK-----
        -----END PGP PRIVATE KEY BLOCK-----
      secrets.init.enabled: true
      secrets.inlineConfig.enabled: true
      secrets.metrics.enabled: true
    asserts:
      - notExists:
          path: spec.template.metadata.annotations["checksum/admin"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/config"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/gpg"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/init"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/inlineConfig"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/metrics"]
  - it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled
    template: templates/deployment.yaml
    set:
      secrets.admin.addSHASumAnnotation: true
      secrets.admin.enabled: true
      secrets.config.addSHASumAnnotation: true
      secrets.config.enabled: true
      secrets.gpg.addSHASumAnnotation: true
      secrets.gpg.enabled: true
      secrets.gpg.new.privateKey: |
        -----BEGIN PGP PRIVATE KEY BLOCK-----
        -----END PGP PRIVATE KEY BLOCK-----
      secrets.init.addSHASumAnnotation: true
      secrets.init.enabled: true
      secrets.inlineConfig.addSHASumAnnotation: true
      secrets.inlineConfig.enabled: true
      secrets.metrics.addSHASumAnnotation: true
      secrets.metrics.enabled: true
    asserts:
      - exists:
          path: spec.template.metadata.annotations["checksum/admin"]
      - exists:
          path: spec.template.metadata.annotations["checksum/config"]
      - exists:
          path: spec.template.metadata.annotations["checksum/gpg"]
      - exists:
          path: spec.template.metadata.annotations["checksum/init"]
      - exists:
          path: spec.template.metadata.annotations["checksum/inlineConfig"]
      - exists:
          path: spec.template.metadata.annotations["checksum/metrics"]
  - it: omits the checksum annotation of a single disabled Secret only
    template: templates/deployment.yaml
    set:
      secrets.admin.addSHASumAnnotation: false
      secrets.admin.enabled: true
      secrets.config.addSHASumAnnotation: false
      secrets.config.enabled: true
      secrets.gpg.addSHASumAnnotation: false
      secrets.gpg.enabled: true
      secrets.gpg.new.privateKey: |
        -----BEGIN PGP PRIVATE KEY BLOCK-----
        -----END PGP PRIVATE KEY BLOCK-----
      secrets.init.addSHASumAnnotation: false
      secrets.init.enabled: true
      secrets.inlineConfig.addSHASumAnnotation: false
      secrets.inlineConfig.enabled: true
      secrets.metrics.addSHASumAnnotation: false
      secrets.metrics.enabled: true
    asserts:
      - notExists:
          path: spec.template.metadata.annotations["checksum/admin"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/config"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/gpg"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/init"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/inlineConfig"]
      - notExists:
          path: spec.template.metadata.annotations["checksum/metrics"]
  - it: adds the checksum of Secrets provided by the user
    template: templates/deployment.yaml
    set:
      secrets.admin.enabled: true
      secrets.admin.addSHASumAnnotation: true
      secrets.admin.existingSecret.enabled: true
      secrets.admin.existingSecret.secretName: custom-admin
      secrets.config.enabled: true
      secrets.config.addSHASumAnnotation: true
      secrets.config.existingSecret.enabled: true
      secrets.config.existingSecret.secretName: custom-config
      secrets.gpg.enabled: true
      secrets.gpg.addSHASumAnnotation: true
      secrets.gpg.existingSecret.enabled: true
      secrets.gpg.existingSecret.secretName: custom-gpg
      secrets.init.enabled: true
      secrets.init.addSHASumAnnotation: true
      secrets.init.existingSecret.enabled: true
      secrets.init.existingSecret.secretName: custom-init
      secrets.inlineConfig.enabled: true
      secrets.inlineConfig.addSHASumAnnotation: true
      secrets.inlineConfig.existingSecret.enabled: true
      secrets.inlineConfig.existingSecret.secretName: custom-inline-config
      secrets.metrics.enabled: true
      secrets.metrics.addSHASumAnnotation: true
      secrets.metrics.existingSecret.enabled: true
      secrets.metrics.existingSecret.secretName: custom-metrics
    asserts:
      - exists:
          path: spec.template.metadata.annotations["checksum/admin"]
      - exists:
          path: spec.template.metadata.annotations["checksum/config"]
      - exists:
          path: spec.template.metadata.annotations["checksum/gpg"]
      - exists:
          path: spec.template.metadata.annotations["checksum/init"]
      - exists:
          path: spec.template.metadata.annotations["checksum/inlineConfig"]
      - exists:
          path: spec.template.metadata.annotations["checksum/metrics"]
@@ -4,12 +4,7 @@ release:
  namespace: testing
 templates:
  - templates/deployment.yaml
-  - templates/secret_admin.yaml
+  - templates/config.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: Renders a deployment
    template: templates/deployment.yaml
@@ -1,208 +0,0 @@
 suite: deprecation template (deployment)
 release:
  name: gitea-unittests
  namespace: testing
 templates:
  - templates/deprecation.yaml
 tests:
  - it: renders nothing with the default values
    asserts:
      - hasDocuments:
          count: 0
  - it: fails when the removed `affinity` value is set
    set:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/os
                    operator: In
                    values:
                      - linux
    asserts:
      - failedTemplate:
          errorMessage: "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead."
  - it: fails when the removed `containerSecurityContext` value is set
    set:
      containerSecurityContext:
        runAsUser: 1000
    asserts:
      - failedTemplate:
          errorMessage: "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead."
  - it: fails when the removed `deployment.env` value is set
    set:
      deployment.env:
        - name: VARIABLE
          value: my-value
    asserts:
      - failedTemplate:
          errorMessage: "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead."
  - it: fails when the removed `dnsConfig` value is set
    set:
      dnsConfig:
        nameservers:
          - 192.0.2.1
    asserts:
      - failedTemplate:
          errorMessage: "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead."
  - it: fails when the removed `extraContainerVolumeMounts` value is set
    set:
      extraContainerVolumeMounts:
        - name: postgres-ssl-vol
          mountPath: /pg-ssl
    asserts:
      - failedTemplate:
          errorMessage: "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead."
  - it: fails when the removed `extraVolumes` value is set
    set:
      extraVolumes:
        - name: postgres-ssl-vol
          secret:
            secretName: gitea-postgres-ssl
    asserts:
      - failedTemplate:
          errorMessage: "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead."
  - it: fails when the removed `nodeSelector` value is set
    set:
      nodeSelector:
        foo: bar
    asserts:
      - failedTemplate:
          errorMessage: "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead."
  - it: fails when the removed `openshift.hostUsers` value is set
    set:
      openshift.hostUsers: false
    asserts:
      - failedTemplate:
          errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead."
  - it: fails when the removed `priorityClassName` value is set
    set:
      priorityClassName: high-priority
    asserts:
      - failedTemplate:
          errorMessage: "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead."
  - it: fails when the removed `podSecurityContext` value is set
    set:
      podSecurityContext:
        fsGroup: 1000
    asserts:
      - failedTemplate:
          errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead."
  - it: fails when the removed `postExtraInitContainers` value is set
    set:
      postExtraInitContainers:
        - name: post-init-container
          image: docker.io/library/busybox
    asserts:
      - failedTemplate:
          errorMessage: "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead."
  - it: fails when the removed `preExtraInitContainers` value is set
    set:
      preExtraInitContainers:
        - name: pre-init-container
          image: docker.io/library/busybox
    asserts:
      - failedTemplate:
          errorMessage: "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead."
  - it: fails when the removed `resources` value is set
    set:
      resources:
        limits:
          cpu: 100m
    asserts:
      - failedTemplate:
          errorMessage: "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead."
  - it: fails when the removed `replicaCount` value is set
    set:
      replicaCount: 2
    asserts:
      - failedTemplate:
          errorMessage: "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead."
  - it: fails when the removed `schedulerName` value is set
    set:
      schedulerName: stork
    asserts:
      - failedTemplate:
          errorMessage: "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead."
  - it: fails when the removed `securityContext` value is set
    set:
      securityContext:
        runAsUser: 1000
    asserts:
      - failedTemplate:
          errorMessage: "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead."
  - it: fails when the removed `strategy` value is set
    set:
      strategy:
        type: Recreate
    asserts:
      - failedTemplate:
          errorMessage: "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead."
  - it: fails when the removed `tolerations` value is set
    set:
      tolerations:
        - key: database/type
          operator: Equal
          value: postgres
          effect: NoSchedule
    asserts:
      - failedTemplate:
          errorMessage: "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead."
  - it: fails when the removed `topologySpreadConstraints` value is set
    set:
      topologySpreadConstraints:
        - topologyKey: kubernetes.io/hostname
    asserts:
      - failedTemplate:
          errorMessage: "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead."
  - it: skips the deprecation checks when `checkDeprecation` is disabled
    set:
      checkDeprecation: false
      affinity:
        nodeAffinity: {}
      containerSecurityContext:
        runAsUser: 1000
      deployment.env:
        - name: VARIABLE
          value: my-value
      dnsConfig:
        nameservers:
          - 192.0.2.1
      extraContainerVolumeMounts:
        - name: postgres-ssl-vol
          mountPath: /pg-ssl
      extraVolumes:
        - name: postgres-ssl-vol
          secret:
            secretName: gitea-postgres-ssl
      nodeSelector:
        foo: bar
      podSecurityContext:
        fsGroup: 1000
      postExtraInitContainers:
        - name: post-init-container
          image: docker.io/library/busybox
      preExtraInitContainers:
        - name: pre-init-container
          image: docker.io/library/busybox
      priorityClassName: high-priority
      replicaCount: 2
      resources:
        limits:
          cpu: 100m
      schedulerName: stork
      securityContext:
        runAsUser: 1000
      strategy:
        type: Recreate
      tolerations:
        - key: database/type
          operator: Equal
          value: postgres
          effect: NoSchedule
      topologySpreadConstraints:
        - topologyKey: kubernetes.io/hostname
    asserts:
      - hasDocuments:
          count: 0
@@ -1,87 +0,0 @@
 suite: deployment template (extraEnvSourceFile)
 release:
  name: gitea-unittests
  namespace: testing
 templates:
  - templates/deployment.yaml
  - templates/secret_admin.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: uses direct execution when extraEnvSourceFile is not set
    template: templates/deployment.yaml
    asserts:
      - equal:
          path: spec.template.spec.initContainers[1].command
          value: ["/usr/sbinx/config_environment.sh"]
      - notExists:
          path: spec.template.spec.initContainers[1].args
      - equal:
          path: spec.template.spec.initContainers[2].command
          value: ["/usr/sbinx/configure_gitea.sh"]
      - notExists:
          path: spec.template.spec.initContainers[2].args
  - it: sources env file in init-app-ini when extraEnvSourceFile is set
    template: templates/deployment.yaml
    set:
      gitea:
        extraEnvSourceFile: /vault/secrets/gitea
    asserts:
      - equal:
          path: spec.template.spec.initContainers[1].command
          value: ["/bin/bash", "-c"]
      - matchRegex:
          path: spec.template.spec.initContainers[1].args[0]
          pattern: source /vault/secrets/gitea
      - matchRegex:
          path: spec.template.spec.initContainers[1].args[0]
          pattern: config_environment\.sh
  - it: sources env file in configure-gitea when extraEnvSourceFile is set
    template: templates/deployment.yaml
    set:
      gitea:
        extraEnvSourceFile: /vault/secrets/gitea
    asserts:
      - equal:
          path: spec.template.spec.initContainers[2].command
          value: ["/bin/bash", "-c"]
      - matchRegex:
          path: spec.template.spec.initContainers[2].args[0]
          pattern: source /vault/secrets/gitea
      - matchRegex:
          path: spec.template.spec.initContainers[2].args[0]
          pattern: configure_gitea\.sh
  - it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
    template: templates/deployment.yaml
    set:
      secrets.gpg.enabled: true
      secrets.gpg.existingSecret.enabled: true
      secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
      gitea:
        extraEnvSourceFile: /vault/secrets/gitea
    asserts:
      - equal:
          path: spec.template.spec.initContainers[2].command
          value: ["/bin/bash", "-c"]
      - matchRegex:
          path: spec.template.spec.initContainers[2].args[0]
          pattern: source /vault/secrets/gitea
      - matchRegex:
          path: spec.template.spec.initContainers[2].args[0]
          pattern: configure_gpg_environment\.sh
  - it: includes file existence check in source command
    template: templates/deployment.yaml
    set:
      gitea:
        extraEnvSourceFile: /vault/secrets/gitea
    asserts:
      - matchRegex:
          path: spec.template.spec.initContainers[1].args[0]
          pattern: "test -f /vault/secrets/gitea"
@@ -4,12 +4,7 @@ release:
  namespace: testing
 templates:
  - templates/deployment.yaml
-  - templates/secret_admin.yaml
+  - templates/config.yaml
  - templates/secret_config.yaml
  - templates/secret_gpg.yaml
  - templates/secret_init.yaml
  - templates/secret_inlineConfig.yaml
  - templates/secret_metrics.yaml
 tests:
  - it: Render the deployment (default)
    asserts:
@@ -23,9 +18,7 @@ tests:
  - it: Render the deployment (signing)
    set:
-      secrets.gpg.enabled: true
+      signing.enabled: true
      secrets.gpg.existingSecret.enabled: true
      secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
    asserts:
      - hasDocuments:
          count: 1
@@ -37,20 +30,13 @@ tests:
  - it: Render the deployment (extraInitContainers)
    set:
-      deployment.initContainers:
+      postExtraInitContainers:
-        - container:
+        - name: foo
-            name: bar
+          image: docker.io/library/busybox:latest
-            image: docker.io/library/busybox:latest
+      preExtraInitContainers:
-        - link: "initDirectories"
+        - name: bar
-        - link: "initAppIni"
+          image: docker.io/library/busybox:latest
-        - link: "initConfigureGPG"
+      signing.enabled: true
        - link: "initConfigureGitea"
        - container:
            name: foo
            image: docker.io/library/busybox:latest
      secrets.gpg.enabled: true
      secrets.gpg.existingSecret.enabled: true
      secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
    asserts:
      - hasDocuments:
          count: 1
@@ -59,55 +45,15 @@ tests:
          path: spec.template.spec.initContainers
          count: 6
        template: templates/deployment.yaml
-      - equal:
+      - contains:
-          path: spec.template.spec.initContainers[0].name
+          path: spec.template.spec.initContainers
-          value: bar
+          content:
        template: templates/deployment.yaml
      - equal:
          path: spec.template.spec.initContainers[5].name
          value: foo
        template: templates/deployment.yaml
  - it: renders the chart-managed init containers in the configured order
    template: templates/deployment.yaml
    set:
      deployment.initContainers:
        - link: "initConfigureGitea"
        - link: "initDirectories"
    asserts:
      - equal:
          path: spec.template.spec.initContainers[0].name
          value: configure-gitea
      - equal:
          path: spec.template.spec.initContainers[1].name
          value: init-directories
  - it: fails when an init container entry sets both container and link
    template: templates/deployment.yaml
    set:
      deployment.initContainers:
        - link: "initDirectories"
          container:
            name: foo
            image: docker.io/library/busybox:latest
-    asserts:
+        template: templates/deployment.yaml
-      - failedTemplate:
+      - contains:
-          errorMessage: "deployment.initContainers[0]: `container` and `link` are mutually exclusive"
+          path: spec.template.spec.initContainers
-
+          content:
-  - it: fails when an init container entry sets neither container nor link
+            name: bar
-    template: templates/deployment.yaml
+            image: docker.io/library/busybox:latest
-    set:
+        template: templates/deployment.yaml
      deployment.initContainers:
        - name: foo
    asserts:
      - failedTemplate:
          errorMessage: "deployment.initContainers[0]: either `container` or `link` must be set"
  - it: fails when an init container links to an unknown configuration
    template: templates/deployment.yaml
    set:
      deployment.initContainers:
        - link: "initSomething"
    asserts:
      - failedTemplate:
          errorMessage: "deployment.initContainers[0]: unknown link `initSomething`, expected one of: initAppIni, initConfigureGPG, initConfigureGitea, initDirectories"
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
volker.raschek	3219f22a68	asd Run Helm tests / Execute helm lint (push) Successful in 9s Details Run Helm tests / Execute helm template (push) Successful in 17s Details Run Helm tests / Execute helm unittest (push) Successful in 26s Details Markdown linter / Execute npm run readme:lint (push) Successful in 8s Details Markdown linter / Execute npm run readme:link (push) Successful in 35s Details Markdown linter / Execute npm run readme:parameters (push) Successful in 9s Details Release / publish-chart (push) Failing after 54s Details Release / publish-release-notes (push) Has been skipped Details	2026-02-15 19:33:48 +01:00
volker.raschek	cdd75f2e77	fix(ci): adapt release workflow Run Helm tests / Execute helm lint (push) Successful in 14s Details Run Helm tests / Execute helm unittest (push) Successful in 27s Details Run Helm tests / Execute helm template (push) Successful in 50s Details Markdown linter / Execute npm run readme:link (push) Successful in 27s Details Markdown linter / Execute npm run readme:parameters (push) Successful in 12s Details Markdown linter / Execute npm run readme:lint (push) Successful in 36s Details Release / publish-chart (push) Failing after 24s Details Release / publish-release-notes (push) Has been skipped Details	2026-02-15 18:45:42 +01:00
volker.raschek	c96824da7f	fix(ci): adapt release workflow	2026-02-15 18:43:33 +01:00
volker.raschek	5851fe7c4c	fix(scripts): support pre-releases	2026-02-15 16:52:47 +01:00
volker.raschek	5c39511d9a	fix(deployment): adapt nodeSelector test	2025-12-18 20:11:38 +01:00
volker.raschek	935b82ab0e	fix(Makefile): add yamllint as dedicated target	2025-11-05 19:11:28 +01:00
volker.raschek	1b22954570	fix(deployment): avoid duplicated nodeSelector #980	2025-11-05 19:11:28 +01:00
volker.raschek	3da31782dd	fix(Chart): add annotation 'artifacthub.io/links'	2025-10-12 12:15:58 +02:00
volker.raschek	4d6db83c28	fix(ci): improve workflows (#959 ) Run Helm tests / Execute helm lint (push) Successful in 11s Details Run Helm tests / Execute helm template (push) Failing after 11s Details Run Helm tests / Execute helm unittest (push) Successful in 28s Details Markdown linter / Execute npm run readme:link (push) Successful in 36s Details Markdown linter / Execute npm run readme:lint (push) Successful in 8s Details Markdown linter / Execute npm run readme:parameters (push) Successful in 27s Details 🤖 Split up helm chart workflows The following patch adapts the CI workflows. The worflows has been splitted into dedicated parts. For example the `helm template` and `helm unittest` command is now a seperate step to notice that a change affects the template mechanism but not the unittest. This was priviously not possible, because both commands were part of one step. 🤖 Changelog Issue Additionally has the changelog workflow be improved. The shell commands has been migrated to a dedicated file named `.gitea/scripts/changelog.sh`. This has the advantage, that the shellcheck plugin of IDE's support developers by developing such shell scripts. Furthermore, the used container image has been replaced by the ubuntu:latest image of the act_runner. This make it more comfortable in using `curl` or `jq`, because the complete set of features/flags are avialable instead of the previously used container image `docker.io/thegeeklab/git-sv:2.0.5`. Final note to the shell script `changelog.sh`, this can now be executed locally as well as on ARM-based act_runners and helps to test the helm chart in own Gitea environments beforehand. 🤖 Markdown linter In addition, a new workflow for markdown files has now been introduced. This checks the `README.md` file for links, ensures that it is properly formatted, and verifies that the parameters match those in `values.yaml`. Here, too, the commands have been outsourced to separate jobs so that more precise interaction is possible in the event of an error. ⚠️ Warning This patch also requires an adjustment in branch protection. There, the workflows that must be successful before a merge must be redefined. Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/959 Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Markus Pesch <markus.pesch@cryptic.systems> Co-committed-by: Markus Pesch <markus.pesch@cryptic.systems>	2025-10-03 07:38:26 +00:00
volker.raschek	72606192a6	refactor(structure): remove leading gitea directory (#958 ) The following pull request removes the `gitea` directory. With regard to maintaining act_runners in a separate git repository or helm chart, this additional directory becomes redundant. Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/958 Reviewed-by: DaanSelen <daanselen@noreply.gitea.com> Co-authored-by: Markus Pesch <markus.pesch@cryptic.systems> Co-committed-by: Markus Pesch <markus.pesch@cryptic.systems>	2025-10-02 11:36:47 +00:00
volker.raschek	fb407618dc	feat: support network policies (#952 ) The following patch adds support for network policies. The patch does not contain any specific network policies, as it is uncertain in which environment and with which access rights gitea will be deployed. With regard to third-party components such as PostgreSQL or Valkey, the network policy may need to be adjusted. Whether this happens directly in the helm chart or whether the user has to enter it themselves is open to discussion. During testing, I defined a few sample network policies to get Gitea up and running. These are only examples. Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/952 Reviewed-by: DaanSelen <daanselen@noreply.gitea.com> Co-authored-by: Markus Pesch <markus.pesch@cryptic.systems> Co-committed-by: Markus Pesch <markus.pesch@cryptic.systems>	2025-09-22 07:05:21 +00:00
`@@ -1 +1 @@`
	`* @volker.raschek @ChristopherHX`	`* @rossigee @volker.raschek @ChristopherHX`