fix(ci): improve workflows (#959)

🤖 Split up helm chart workflows

The following patch adapts the CI workflows. The worflows has been splitted into
dedicated parts. For example the `helm template` and `helm unittest` command is
now a seperate step to notice that a change affects the template mechanism but
not the unittest. This was priviously not possible, because both commands were
part of one step.

🤖 Changelog Issue

Additionally has the changelog workflow be improved. The shell commands has
been migrated to a dedicated file named `.gitea/scripts/changelog.sh`. This has
the advantage, that the shellcheck plugin of IDE's support developers by
developing such shell scripts. Furthermore, the used container image has been
replaced by the ubuntu:latest image of the act_runner. This make it more
comfortable in using `curl` or `jq`, because the complete set of features/flags
are
avialable instead of the previously used container image
`docker.io/thegeeklab/git-sv:2.0.5`. Final note to the shell script
`changelog.sh`, this can now be executed locally as well as on ARM-based
act_runners and helps to test the helm chart in own Gitea environments
beforehand.

🤖 Markdown linter

In addition, a new workflow for markdown files has now been introduced. This
checks the `README.md` file for links, ensures that it is properly formatted,
and verifies that the parameters match those in `values.yaml`. Here, too, the
commands have been outsourced to separate jobs so that more precise interaction
is possible in the event of an error.

⚠️ Warning

This patch also requires an adjustment in branch protection. There, the
workflows that must be successful before a merge must be redefined.

Reviewed-on: https://gitea.com/gitea/helm-gitea/pulls/959
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Markus Pesch <markus.pesch@cryptic.systems>
Co-committed-by: Markus Pesch <markus.pesch@cryptic.systems>

.editorconfig

@@ -9,7 +9,4 @@ indent_size = 2
 end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = false
-insert_final_newline = false
-
-[Makefile]
-indent_style = tab
+insert_final_newline = false

.gitea/scripts/update-changelog.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+
+DEFAULT_GITEA_SERVER_URL="${GITHUB_SERVER_URL:-"https://gitea.com"}"
+DEFAULT_GITEA_REPOSITORY="${GITHUB_REPOSITORY:-"gitea/helm-gitea"}"
+DEFAULT_GITEA_TOKEN="${ISSUE_RW_TOKEN:-""}"
+
+if [ -z "${1}" ]; then
+  read -p "Enter hostname of the Gitea instance [${DEFAULT_GITEA_SERVER_URL}]: " CURRENT_GITEA_SERVER_URL
+  if [ -z "${CURRENT_GITEA_SERVER_URL}" ]; then
+    CURRENT_GITEA_SERVER_URL="${DEFAULT_GITEA_SERVER_URL}"
+  fi
+else
+  CURRENT_GITEA_SERVER_URL=$1
+fi
+
+if [ -z "${2}" ]; then
+  read -p "Enter name of the git repository [${DEFAULT_GITEA_REPOSITORY}]: " CURRENT_GITEA_REPOSITORY
+  if [ -z "${CURRENT_GITEA_REPOSITORY}" ]; then
+    CURRENT_GITEA_REPOSITORY="${DEFAULT_GITEA_REPOSITORY}"
+  fi
+else
+  CURRENT_GITEA_REPOSITORY=$2
+fi
+
+if [ -z "${3}" ]; then
+  read -p "Enter token to access the Gitea instance [${DEFAULT_GITEA_TOKEN}]: " CURRENT_GITEA_TOKEN
+  if [ -z "${CURRENT_GITEA_TOKEN}" ]; then
+    CURRENT_GITEA_TOKEN="${DEFAULT_GITEA_TOKEN}"
+  fi
+else
+  CURRENT_GITEA_TOKEN=$3
+fi
+
+if ! git sv rn -o /tmp/changelog.md; then
+  echo "ERROR: Failed to generate /tmp/changelog.md" 1>&2
+  exit 1
+fi
+
+CURL_ARGS=(
+  "--data-urlencode" "q=Changelog for upcoming version"
+  # "--data-urlencode=\"q=Changelog for upcoming version\""
+  "--data-urlencode" "state=open"
+  "--fail"
+  "--header" "Accept: application/json"
+  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
+  "--request" "GET"
+  "--silent"
+)
+
+if ! ISSUE_NUMBER="$(curl "${CURL_ARGS[@]}" "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues" | jq '.[].number')"; then
+  echo "ERROR: Failed query issue number" 1>&2
+  exit 1
+fi
+export ISSUE_NUMBER
+
+if ! echo "" | jq --raw-input --slurp --arg title "Changelog for upcoming version" --arg body "$(cat /tmp/changelog.md)" '{title: $title, body: $body}' 1> /tmp/payload.json; then
+  echo "ERROR: Failed to create JSON payload file" 1>&2
+  exit 1
+fi
+
+CURL_ARGS=(
+  "--data" "@/tmp/payload.json"
+  "--fail"
+  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
+  "--header" "Content-Type: application/json"
+  "--location"
+  "--silent"
+  "--output" "/dev/null"
+)
+
+if [ -z "${ISSUE_NUMBER}" ]; then
+  if ! curl "${CURL_ARGS[@]}" --request POST "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues"; then
+    echo "ERROR: Failed to create new issue!" 1>&2
+    exit 1
+  else
+    echo "INFO: Successfully created new issue!"
+  fi
+else
+  if ! curl "${CURL_ARGS[@]}" --request PATCH "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"; then
+    echo "ERROR: Failed to update issue with ID ${ISSUE_NUMBER}!" 1>&2
+    exit 1
+  else
+    echo "INFO: Successfully updated existing issue with ID ${ISSUE_NUMBER}!"
+    echo "INFO: ${CURRENT_GITEA_SERVER_URL}/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"
+  fi
+fi

.gitea/workflows/changelog.yml

@@ -1,32 +0,0 @@
-name: changelog
-
-on:
-  push:
-    branches:
-      - main
-
-jobs:
-  changelog:
-    runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:2.1.3
-    steps:
-      - name: install tools
-        run: |
-          apk add -q --update --no-cache nodejs curl jq sed
-      - uses: actions/checkout@v7.0.0
-        with:
-          fetch-depth: 0
-      - name: Generate upcoming changelog
-        run: |
-          git sv rn -o changelog.md
-          export RELEASE_NOTES=$(cat changelog.md)
-          export ISSUE_NUMBER=$(curl -s "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues?state=open&q=Changelog%20for%20upcoming%20version" | jq '.[].number')
-
-          echo $RELEASE_NOTES
-          JSON_DATA=$(echo "" | jq -Rs --arg title 'Changelog for upcoming version' --arg body "$(cat changelog.md)" '{title: $title, body: $body}')
-
-          if [ -z "$ISSUE_NUMBER" ]; then
-            curl -s -X POST "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
-          else
-            curl -s -X PATCH "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues/$ISSUE_NUMBER" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
-          fi

.gitea/workflows/commitlint.yml

@@ -1,19 +1,17 @@
-name: commitlint
+name: Rum commitlint
 
 on:
   pull_request:
-    branches:
-      - "*"
-    types:
-      - opened
-      - edited
+    branches: [ '**' ]
+    types: [ "opened", "edited" ]
 
 jobs:
   check-and-test:
+    container: docker.io/commitlint/commitlint:19.9.1
+    name: Execute commitlint
     runs-on: ubuntu-latest
-    container: docker.io/commitlint/commitlint:21.2.1
     steps:
-      - uses: actions/checkout@v7.0.0
-      - name: check PR title
+      - uses: actions/checkout@v5.0.0
+      - name: Check PR title
         run: |
           echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json

.gitea/workflows/helm.yml

@@ -0,0 +1,75 @@
+name: Run Helm tests
+
+on:
+  pull_request:
+    branches: [ '**' ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+  workflow_call: {}
+
+env:
+  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
+  HELM_UNITTEST_VERSION: "v1.0.1"
+
+jobs:
+  helm-lint:
+    container: docker.io/alpine/helm:3.18.6
+    name: Execute helm lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install additional tools
+        run: |
+          apk update
+          apk add --update bash make nodejs
+      - uses: actions/checkout@v5.0.0
+      - name: Install helm chart dependencies
+        run: helm dependency build
+      - name: Execute helm lint
+        run: helm lint
+
+  helm-template:
+    container: docker.io/alpine/helm:3.18.6
+    name: Execute helm template
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install additional tools
+        run: |
+          apk update
+          apk add --update bash make nodejs
+      - uses: actions/checkout@v5.0.0
+      - name: Install helm chart dependencies
+        run: helm dependency build
+      - name: Execute helm template
+        run: helm template --debug gitea-helm .
+
+  helm-unittest:
+    container: docker.io/alpine/helm:3.18.6
+    name: Execute helm unittest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install additional tools
+        run: |
+          apk update
+          apk add --update bash make nodejs npm yamllint ncurses
+      - uses: actions/checkout@v5.0.0
+      - name: Install helm chart dependencies
+        run: helm dependency build
+      - name: Install helm plugin 'unittest'
+        run: |
+          helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
+          git submodule update --init --recursive
+      - name: Execute helm unittest
+        env:
+          TERM: xterm
+        run: make unittests
+
+
+
+
+      # - name: verify readme
+      #   run: |
+      #     make readme
+      #     git diff --exit-code --name-only README.md
+      # - name: yaml lint
+      #   uses: https://github.com/ibiqlik/action-yamllint@v3

.gitea/workflows/markdown-linters.yml

@@ -0,0 +1,52 @@
+name: Markdown linter
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
+  workflow_dispatch: {}
+
+jobs:
+  readme-link:
+    container:
+      image: docker.io/library/node:24.9.0-alpine
+    name: Execute npm run readme:link
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5.0.0
+    - name: Execute npm run readme:link
+      run: |
+        npm install
+        npm run readme:link
+
+  readme-lint:
+    container:
+      image: docker.io/library/node:24.9.0-alpine
+    name: Execute npm run readme:lint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5.0.0
+    - name: Execute npm run readme:lint
+      run: |
+        npm install
+        npm run readme:lint
+
+  readme-parameters:
+    container:
+      image: docker.io/library/node:24.9.0-alpine
+    name: Execute npm run readme:parameters
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install tooling
+      run: |
+        apk update
+        apk add git
+    - uses: actions/checkout@v5.0.0
+    - name: Execute npm run readme:parameters
+      run: |
+        npm install
+        npm run readme:parameters
+    - name: Compare diff
+      run: git diff --exit-code --name-only README.md

.gitea/workflows/release-version.yml

@@ -2,14 +2,13 @@ name: generate-chart
 
 on:
   push:
-    tags:
-      - "*"
+    tags: [ '**' ]
 
 jobs:
   generate-chart-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v5.0.0
         with:
           fetch-depth: 0
 
@@ -21,13 +20,22 @@ jobs:
       - name: Install helm
         env:
           # renovate: datasource=docker depName=alpine/helm
-          HELM_VERSION: "3.21.3"
+          HELM_VERSION: "3.18.6"
         run: |
           curl --fail --location --output /dev/stdout --silent --show-error https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
           mv linux-$(dpkg --print-architecture)/helm /usr/local/bin/
           rm --force --recursive linux-$(dpkg --print-architecture) helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz
           helm version
 
+      - name: Install yq
+        env:
+          YQ_VERSION: v4.45.4 # renovate: datasource=github-releases depName=mikefarah/yq
+        run: |
+          curl --fail --location --output /dev/stdout --silent --show-error https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
+          mv yq_linux_$(dpkg --print-architecture) /usr/local/bin
+          rm --force --recursive yq_linux_$(dpkg --print-architecture) yq_linux_$(dpkg --print-architecture).tar.gz
+          yq --version
+
       - name: Install docker-ce via apt
         run: |
           install -m 0755 -d /etc/apt/keyrings
@@ -44,17 +52,23 @@ jobs:
 
       - name: Import GPG key
         id: import_gpg
-        uses: https://github.com/crazy-max/ghaction-import-gpg@v7
+        uses: https://github.com/crazy-max/ghaction-import-gpg@v6
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
 
       - name: Add Artifacthub.io annotations
-        uses: volker-raschek/ah-annotations@v0.2.0
+        run: |
+          NEW_TAG="$(git tag --sort=-version:refname | head --lines 1)"
+          OLD_TAG="$(git tag --sort=-version:refname | head --lines 2 | tail --lines 1)"
+          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
+
+      - name: Print Chart.yaml on stdout
+        run: cat Chart.yaml
 
       # Using helm gpg plugin as 'helm package --sign' has issues with gpg2: https://github.com/helm/helm/issues/2843
-      - name: package chart
+      - name: Package Helm chart
         run: |
           echo ${{ secrets.DOCKER_CHARTS_PASSWORD }} | docker login -u ${{ secrets.DOCKER_CHARTS_USERNAME }} --password-stdin
           # FIXME: use upstream after https://github.com/technosophos/helm-gpg/issues/1 is solved
@@ -70,25 +84,26 @@ jobs:
           helm push gitea/gitea-${GITHUB_REF#refs/tags/v}.tgz oci://registry-1.docker.io/giteacharts
           helm registry logout registry-1.docker.io
 
-      - name: Copy files to Cloudflare R2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+      - name: Configure AWS credentials
+        uses: https://github.com/aws-actions/configure-aws-credentials@v5
+        with:
+          aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Copy files to S3 and clear cache
         run: |
-          aws s3 sync gitea/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com
+          aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET}}/charts/
 
   release-gitea:
+    container: docker.io/thegeeklab/git-sv:2.0.5
     needs: generate-chart-publish
     runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:2.1.3
     steps:
-      - name: install tools
+      - name: Install packages via apt
         run: |
           apk add -q --update --no-cache nodejs
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v5.0.0
         with:
           fetch-tags: true
           fetch-depth: 0

.gitea/workflows/test-pr.yml

@@ -1,50 +0,0 @@
-name: check-and-test
-
-on:
-  pull_request:
-    branches:
-      - "*"
-  push:
-    branches:
-      - main
-
-env:
-  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
-  HELM_UNITTEST_VERSION: "v1.1.1"
-
-jobs:
-  check-and-test:
-    runs-on: ubuntu-latest
-    container: docker.io/alpine/helm:4.2.3
-    steps:
-      - name: install tools
-        run: |
-          apk update
-          apk add --update bash make nodejs npm yamllint ncurses
-      - uses: actions/checkout@v7.0.0
-      - name: define helm repositories
-        run: |
-          helm repo add bitnami https://charts.bitnami.com/bitnami
-          helm repo add valkey https://valkey.io/valkey-helm
-          helm repo update
-      - name: install chart dependencies
-        run: helm dependency build
-      - name: lint
-        run: helm lint .
-      - name: template
-        run: helm template --debug gitea-helm .
-      - name: prepare unit test environment
-        run: |
-          helm plugin install --verify=false --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
-          git submodule update --init --recursive
-      - name: unit tests
-        env:
-          TERM: xterm
-        run: |
-          make unittests
-      - name: verify readme
-        run: |
-          make readme
-          git diff --exit-code --name-only README.md
-      - name: yaml lint
-        uses: https://github.com/ibiqlik/action-yamllint@v3

.gitea/workflows/update-changelog.yml

@@ -0,0 +1,29 @@
+name: Update changelog
+
+on:
+  push:
+    branches: [ "main" ]
+  workflow_dispatch: {}
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install packages via apt-get
+        run: |
+          apt-get update &&
+          apt-get install --yes curl jq
+      - uses: actions/checkout@v5.0.0
+        with:
+          fetch-depth: 0
+      - name: Install git-sv
+        env:
+          GIT_SV_VERSION: v2.0.4 # renovate: datasource=github-releases depName=thegeeklab/git-sv
+        run: |
+          curl --fail --location --output /usr/local/bin/git-sv --silent --show-error https://github.com/thegeeklab/git-sv/releases/download/${GIT_SV_VERSION}/git-sv-linux-$(dpkg --print-architecture)
+          chmod +x /usr/local/bin/git-sv
+          git-sv --version
+      - name: Update changelog issue
+        env:
+          ISSUE_RW_TOKEN: ${{ secrets.ISSUE_RW_TOKEN }}
+        run: .gitea/scripts/update-changelog.sh

.github/copilot-instructions.md

@@ -1,62 +0,0 @@
-# Gitea Helm Chart — Copilot Instructions
-
-## Project Overview
-
-Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster.
-
-## Build & Test
-
-```bash
-make readme            # Regenerate README.md parameter table + lint
-make unittests-helm    # Run Helm unit tests (helm-unittest plugin required)
-make unittests-bash    # Run bash/bats script tests (requires git submodule init)
-make unittests         # Both of the above
-```
-
-Always run `make readme` after changing `values.yaml` `@param` annotations.
-Always run `make unittests-helm` after changing templates or unit tests.
-
-## Conventions
-
-### values.yaml
-
-- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
-- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
-- Top-level keys are sorted alphabetically within their section group.
-- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
-
-```yaml
-image:
-  registry: docker.io
-  repository: library/busybox
-  tag: 0.1.0
-```
-
-### Templates
-
-- Helm templates live in `templates/gitea/`. Helpers live in `templates/_helpers.tpl`.
-- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
-- Use `include "gitea.fullname"` for naming resources.
-- Use `fail` for required-value validation with clear error messages referencing the full values path.
-- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
-- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
-- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
-
-### Unit Tests
-
-- Helm unit tests live in `unittests/helm/` mirroring the template structure.
-- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
-- Each test must set all required values explicitly — do not rely on cross-test state.
-- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint`. Use `make yamllint` to run the linter.
-
-### Commits & PRs
-
-- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
-- See `CONTRIBUTING.md` for full PR requirements.
-- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
-- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
-
-### Documentation
-
-- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
-- `README.md` parameter tables are auto-generated — never edit them manually.

.markdownlink.json

@@ -0,0 +1,8 @@
+{
+  "projectBaseUrl":"${workspaceFolder}",
+  "ignorePatterns": [
+    {
+      "pattern": "^http://localhost"
+    }
+  ]
+}

.vscode/settings.json

@@ -1,11 +1,7 @@
 {
     "yaml.schemas": {
-        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
+        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.1/schema/helm-testsuite.json": [
             "/unittests/**/*.yaml"
-        ],
-        "https://docs.renovatebot.com/renovate-schema.json":[
-          "renovate.json",
-          "renovate.json5"
         ]
     },
     "yaml.schemaStore.enable": true,

CODEOWNERS

@@ -1 +1 @@
-* @volker.raschek @ChristopherHX
+* @rossigee @volker.raschek @ChristopherHX

CONTRIBUTING.md

@@ -44,8 +44,7 @@ be used:
    `helm install --dependency-update gitea . -f values.yaml`.
 1. Gitea is now deployed in `minikube`.
    To access it, it's port needs to be forwarded first from `minikube` to localhost first via `kubectl --namespace
-default port-forward svc/gitea-http 3000:3000`.
-   Now Gitea is accessible at [http://localhost:3000](http://localhost:3000).
+default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000).
 
 ### Unit tests
 

Chart.lock

@@ -5,8 +5,11 @@ dependencies:
 - name: postgresql-ha
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 16.3.2
+- name: valkey-cluster
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 3.0.24
 - name: valkey
-  repository: https://valkey.io/valkey-helm
-  version: 0.10.0
-digest: sha256:1afecbf0d4fc9f48e31417573d4bed7e0ac7848040b9e0c5f3989ada9d1f944f
-generated: "2026-07-20T19:52:11.548874634+02:00"
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 3.0.31
+digest: sha256:ceb6a1890cfdc2627abb85d3e2a4baa64d30afd21dcfabce978a824a67f0a2bb
+generated: "2025-08-30T00:03:04.59764502Z"

Chart.yaml

@@ -3,14 +3,10 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-appVersion: 1.27.2
+# renovate datasource=github-releases depName=go-gitea/gitea extractVersion=^v(?<version>.*)$
+appVersion: 1.24.6
 icon: https://gitea.com/assets/img/logo.svg
 
-annotations:
-  artifacthub.io/links: |
-    - name: support
-      url: https://gitea.com/gitea/helm-gitea/issues
-
 keywords:
   - git
   - issue tracker
@@ -18,19 +14,23 @@ keywords:
   - wiki
   - gitea
   - gogs
-
 sources:
   - https://gitea.com/gitea/helm-gitea
   - https://github.com/go-gitea/gitea
   - https://docker.gitea.com/gitea
-
 maintainers:
+  # https://gitea.com/rossigee
+  - name: Ross Golder
+    email: ross@golder.org
+
   # https://gitea.com/volker.raschek
   - name: Markus Pesch
     email: markus.pesch+apps@cryptic.systems
+
   # https://gitea.com/DaanSelen
   - name: Daan Selen
     email: dselen@nerthus.nl
+
   # https://gitea.com/ChristopherHX
   - name: Christopher Homberger
     email: christopher.homberger@web.de
@@ -46,8 +46,13 @@ dependencies:
     repository: oci://registry-1.docker.io/bitnamicharts
     version: 16.3.2
     condition: postgresql-ha.enabled
+  # https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml
+  - name: valkey-cluster
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 3.0.24
+    condition: valkey-cluster.enabled
   # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
   - name: valkey
-    repository: https://valkey.io/valkey-helm
-    version: 0.10.0
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 3.0.31
     condition: valkey.enabled

Makefile

@@ -20,10 +20,7 @@ unittests-helm:
 unittests-bash:
 	./unittests/bash/bats/bin/bats --pretty ./unittests/bash/tests/**/*.bats
 
-.PHONY: update-helm-dependencies
+.PHONY: helm
 update-helm-dependencies:
 	helm dependency update
-
-.PHONY: yamllint
-yamllint:
-	yamllint -c .yamllint .
+  

README.md

@@ -17,7 +17,7 @@
     - [Rootless Defaults](#rootless-defaults)
     - [Session, Cache and Queue](#session-cache-and-queue)
   - [Single-Pod Configurations](#single-pod-configurations)
-  - [Additional _app.ini_ settings](#additional-appini-settings)
+  - [Additional app.ini settings](#additional-appini-settings)
     - [User defined environment variables in app.ini](#user-defined-environment-variables-in-appini)
   - [External Database](#external-database)
   - [Ports and external url](#ports-and-external-url)
@@ -43,8 +43,6 @@
   - [Security](#security)
   - [Service](#service)
   - [Ingress](#ingress)
-  - [Route](#route)
-  - [Gateway API](#gateway-api)
   - [deployment](#deployment)
   - [ServiceAccount](#serviceaccount)
   - [Persistence](#persistence-1)
@@ -54,6 +52,7 @@
   - [LivenessProbe](#livenessprobe)
   - [ReadinessProbe](#readinessprobe)
   - [StartupProbe](#startupprobe)
+  - [valkey-cluster](#valkey-cluster)
   - [valkey](#valkey)
   - [PostgreSQL HA](#postgresql-ha)
   - [PostgreSQL](#postgresql)
@@ -73,7 +72,7 @@ Additionally, this chart allows to provide LDAP and admin user configuration wit
 ## Update and versioning policy
 
 The Gitea helm chart versioning does not follow Gitea's versioning.
-The latest chart version can be looked up in [https://dl.gitea.com/charts](https://dl.gitea.com/charts) or in the [repository releases](https://gitea.com/gitea/helm-gitea/releases).
+The latest chart version can be looked up in [https://dl.gitea.com/charts/](https://dl.gitea.com/charts/) or in the [repository releases](https://gitea.com/gitea/helm-gitea/releases).
 
 The chart aims to follow Gitea's releases closely.
 There might be times when the chart is behind the latest Gitea release.
@@ -97,13 +96,14 @@ Users can also configure their own external providers via the configuration.
 These dependencies are enabled by default:
 
 - PostgreSQL HA ([Bitnami PostgreSQL-HA](https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml))
-- Valkey ([Official Valkey Helm Chart](https://github.com/valkey-io/valkey-helm))
+- Valkey-Cluster ([Bitnami Valkey-Cluster](https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml))
 
 ### Non-HA Dependencies
 
 Alternatively, the following non-HA replacements are available:
 
 - PostgreSQL ([Bitnami PostgreSQL](https://github.com/bitnami/charts/blob/main/bitnami/postgresql/Chart.yaml))
+- Valkey ([Bitnami Valkey](https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml))
 
 ### Dependency Versioning
 
@@ -121,7 +121,8 @@ Please double-check the image repository and available tags in the sub-chart:
 
 - [PostgreSQL-HA](https://hub.docker.com/r/bitnami/postgresql-repmgr/tags)
 - [PostgreSQL](https://hub.docker.com/r/bitnami/postgresql/tags)
-- [Valkey](https://hub.docker.com/r/valkey/valkey/tags)
+- [Valkey Cluster](https://hub.docker.com/r/bitnami/valkey-cluster/tags)
+- [Valkey](https://hub.docker.com/r/bitnami/valkey/tags)
 
 and look up the image tag which fits your needs on Dockerhub.
 
@@ -265,7 +266,7 @@ If `.Values.image.rootless: true`, then the following will occur. In case you us
 
 - `$HOME` becomes `/data/gitea/git`
 
-  [see deployment.yaml](./templates/gitea/deployment.yaml) template inside (init-)container "env" declarations
+  [see deployment.yaml](./templates/deployment.yaml) template inside (init-)container "env" declarations
 
 - `START_SSH_SERVER: true` (Unless explicity overwritten by `gitea.config.server.START_SSH_SERVER`)
 
@@ -277,43 +278,7 @@ If `.Values.image.rootless: true`, then the following will occur. In case you us
 
 - `SSH_LOG_LEVEL` environment variable is not injected into the container
 
-  [see deployment.yaml](./templates/gitea/deployment.yaml) template inside container "env" declarations
-
-#### OpenShift Compatibility
-
-When installing on OpenShift, enable the compatibility profile so chart-managed pods render SCC-safe defaults and the Gitea init containers stop forcing `runAsUser: 1000`:
-
-```yaml
-openshift:
-  enabled: true
-```
-
-When enabled, the chart applies `allowPrivilegeEscalation: false`, drops all
-Linux capabilities, sets `runAsNonRoot: true`, uses
-`seccompProfile.type: RuntimeDefault`, and leaves `hostUsers` unset unless
-`openshift.hostUsers` is explicitly overridden.
-
-The deployment keeps the existing vanilla Kubernetes behavior when OpenShift
-compatibility is disabled. Auto-detection relies on the
-`security.openshift.io/v1/SecurityContextConstraints` API, so set
-`openshift.enabled: true` explicitly when rendering outside a live cluster.
-
-If you also want to expose Gitea through an OpenShift Route, enable the optional Route resource:
-
-```yaml
-route:
-  enabled: true
-  host: git.apps.example.com
-  tls:
-    termination: edge
-```
-
-When `route.host` is set, the chart uses it for `DOMAIN`, `SSH_DOMAIN`, and `ROOT_URL`. Setting `route.tls.termination` also switches the default `ROOT_URL` scheme to `https`.
-
-#### Gateway API
-
-The chart can also expose Gitea through Gateway API resources (`HTTPRoute`, `TCPRoute`, `BackendTLSPolicy`, and optionally `Gateway`).
-See [docs/gateway-api.md](docs/gateway-api.md) for the full guide, including how routes interact with `ROOT_URL`/`DOMAIN` resolution and recommended topologies.
+  [see deployment.yaml](./templates/deployment.yaml) template inside container "env" declarations
 
 #### Session, Cache and Queue
 
@@ -323,7 +288,7 @@ If Valkey Cluster is disabled, the chart will fall back to the Gitea defaults wh
 While these will work and even not cause immediate issues after startup, **they are not recommended for production use**.
 Reasons being that a single pod will take on all the work for `session` and `cache` tasks in its available memory.
 It is likely that the pod will run out of memory or will face substantial memory spikes, depending on the workload.
-External tools such as `valkey` or `memcached` handle these workloads much better.
+External tools such as `valkey-cluster` or `memcached` handle these workloads much better.
 
 ### Single-Pod Configurations
 
@@ -336,6 +301,8 @@ If HA is not needed/desired, the following configurations can be used to deploy
    <summary>values.yml</summary>
 
    ```yaml
+   valkey-cluster:
+     enabled: false
    valkey:
      enabled: true
    postgresql:
@@ -367,6 +334,8 @@ If HA is not needed/desired, the following configurations can be used to deploy
    <summary>values.yml</summary>
 
    ```yaml
+   valkey-cluster:
+     enabled: false
    valkey:
      enabled: false
    postgresql:
@@ -391,7 +360,7 @@ If HA is not needed/desired, the following configurations can be used to deploy
 
    </details>
 
-### Additional _app.ini_ settings
+### Additional app.ini settings
 
 > **The [generic](https://docs.gitea.com/administration/config-cheat-sheet#overall-default)
 > section cannot be defined that way.**
@@ -412,7 +381,7 @@ gitea:
 ```
 
 This would mount the two additional volumes (`oauth` and `some-additionals`) from different sources to the init container where the _app.ini_ gets updated.
-All files mounted that way will be read and converted to environment variables and then added to the _app.ini_ using [Gitea config edit-ini](https://docs.gitea.com/administration/config-cheat-sheet#use-environment-variables-to-setup-gitea).
+All files mounted that way will be read and converted to environment variables and then added to the _app.ini_ using [environment-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini).
 
 The key of such additional source represents the section inside the _app.ini_.
 The value for each key can be multiline ini-like definitions.
@@ -453,10 +422,10 @@ Users are able to define their own environment variables, which are loaded into
 We also support to directly interact with the generated _app.ini_.
 
 To inject self defined variables into the _app.ini_ a certain format needs to be honored.
-This is described in detail on the [Gitea config edit-ini](https://docs.gitea.com/administration/config-cheat-sheet#use-environment-variables-to-setup-gitea) page.
+This is described in detail on the [env-to-ini](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini) page.
 
 Prior to Gitea 1.20 and Chart 9.0.0 the helm chart had a custom prefix `ENV_TO_INI`.
-After the support for a custom prefix was removed in Gitea core, the prefix was changed to `GITEA`.
+After the support for a custom prefix was removed in Gite core, the prefix was changed to `GITEA`.
 
 For example a database setting needs to have the following format:
 
@@ -569,13 +538,19 @@ More about this issue [under this link](https://gitea.com/gitea/helm-gitea/issue
 
 ### Cache
 
-The cache handling is done via `valkey` (via the [official Valkey Helm chart](https://github.com/valkey-io/valkey-helm)) by default.
+The cache handling is done via `valkey-cluster` (via the `bitnami` chart) by default.
+This deployment is HA-ready but can also be used for single-pod deployments.
+By default, 6 replicas are deployed for a working `valkey-cluster` deployment.
+Many cloud providers offer a managed valkey service, which can be used instead of the built-in `valkey-cluster`.
 
 ```yaml
-valkey:
+valkey-cluster:
   enabled: true
 ```
 
+⚠️ The valkey charts [do not work well with special characters in the password](https://gitea.com/gitea/helm-chart/issues/690).
+Consider omitting such or open an issue in the Bitnami repo and let us know once this got fixed.
+
 ### Persistence
 
 Gitea will be deployed as a deployment.
@@ -1000,14 +975,12 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 
 ### Security
 
-| Name                       | Description                                                                                                                          | Value |
-| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ----- |
-| `openshift.enabled`        | Enable OpenShift compatibility defaults for chart-managed pods. Defaults to auto-detect based on the SecurityContextConstraints API. | `nil` |
-| `openshift.hostUsers`      | Override the PodSpec hostUsers field for chart-managed pods. When unset, the field is omitted so the platform default is used.       | `nil` |
-| `podSecurityContext`       | Pod security context. On non-OpenShift clusters the chart defaults `fsGroup` to `1000` when this map is empty.                       | `{}`  |
-| `containerSecurityContext` | Security context                                                                                                                     | `{}`  |
-| `securityContext`          | Run init and Gitea containers as a specific securityContext                                                                          | `{}`  |
-| `podDisruptionBudget`      | Pod disruption budget                                                                                                                | `{}`  |
+| Name                         | Description                                                     | Value  |
+| ---------------------------- | --------------------------------------------------------------- | ------ |
+| `podSecurityContext.fsGroup` | Set the shared file system group for all containers in the pod. | `1000` |
+| `containerSecurityContext`   | Security context                                                | `{}`   |
+| `securityContext`            | Run init and Gitea containers as a specific securityContext     | `{}`   |
+| `podDisruptionBudget`        | Pod disruption budget                                           | `{}`   |
 
 ### Service
 
@@ -1053,52 +1026,6 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `ingress.hosts[0].paths[0].path` | Default Ingress path            | `/`               |
 | `ingress.tls`                    | Ingress tls settings            | `[]`              |
 
-### Route
-
-| Name                                      | Description                                                                                                    | Value   |
-| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------- | ------- |
-| `route.enabled`                           | Enable OpenShift Route                                                                                         | `false` |
-| `route.annotations`                       | Route annotations                                                                                              | `{}`    |
-| `route.host`                              | Route host. When unset, OpenShift may generate one and Gitea URL defaults fall back to ingress/service values. | `""`    |
-| `route.path`                              | Route path                                                                                                     | `""`    |
-| `route.wildcardPolicy`                    | Route wildcard policy                                                                                          | `None`  |
-| `route.tls.termination`                   | Route TLS termination type                                                                                     | `nil`   |
-| `route.tls.insecureEdgeTerminationPolicy` | Route insecure edge termination policy                                                                         | `nil`   |
-| `route.tls.key`                           | Route TLS key                                                                                                  | `nil`   |
-| `route.tls.certificate`                   | Route TLS certificate                                                                                          | `nil`   |
-| `route.tls.caCertificate`                 | Route TLS CA certificate                                                                                       | `nil`   |
-| `route.tls.destinationCACertificate`      | Route destination CA certificate                                                                               | `nil`   |
-
-### Gateway API
-
-| Name                                                            | Description                                                                                                                                                                | Value   |
-| --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
-| `gatewayAPI.enabled`                                            | Enable deployment of Gateway API resources                                                                                                                                 | `false` |
-| `gatewayAPI.core.backendTLSPolicy.enabled`                      | Render a BackendTLSPolicy resource for encrypted backend traffic                                                                                                           | `false` |
-| `gatewayAPI.core.backendTLSPolicy.annotations`                  | Annotations applied to the BackendTLSPolicy                                                                                                                                | `{}`    |
-| `gatewayAPI.core.backendTLSPolicy.labels`                       | Additional labels applied to the BackendTLSPolicy                                                                                                                          | `{}`    |
-| `gatewayAPI.core.backendTLSPolicy.targetRefs`                   | Target references for the BackendTLSPolicy. Defaults to the HTTP service.                                                                                                  | `[]`    |
-| `gatewayAPI.core.backendTLSPolicy.validation`                   | Validation configuration (required when enabled). See `docs/gateway-api.md`.                                                                                               | `{}`    |
-| `gatewayAPI.core.backendTLSPolicy.validation.caCertificateRefs` | CA certificate references for the BackendTLSPolicy validation. See `docs/gateway-api.md`.                                                                                  |         |
-| `gatewayAPI.core.backendTLSPolicy.validation.hostname`          | Hostname for the BackendTLSPolicy validation. Must be the Common Name (CN) or a Subject Alternative Name (SAN) of the Gitea server certificate. See `docs/gateway-api.md`. |         |
-| `gatewayAPI.core.httpRoute.enabled`                             | Render an HTTPRoute resource                                                                                                                                               | `false` |
-| `gatewayAPI.core.httpRoute.annotations`                         | Annotations applied to the HTTPRoute                                                                                                                                       | `{}`    |
-| `gatewayAPI.core.httpRoute.labels`                              | Additional labels applied to the HTTPRoute                                                                                                                                 | `{}`    |
-| `gatewayAPI.core.httpRoute.tls`                                 | When true, treat the upstream Gateway as terminating TLS so `ROOT_URL` uses `https`.                                                                                       | `false` |
-| `gatewayAPI.core.httpRoute.parentRefs`                          | Parent gateway references (required when enabled).                                                                                                                         | `[]`    |
-| `gatewayAPI.core.httpRoute.hostnames`                           | List of hostnames for the HTTPRoute.                                                                                                                                       | `[]`    |
-| `gatewayAPI.core.httpRoute.rules`                               | Custom routing rules. Defaults to a PathPrefix `/` rule targeting the HTTP service.                                                                                        | `[]`    |
-| `gatewayAPI.core.tcpRoute.enabled`                              | Render a TCPRoute resource (typically for SSH)                                                                                                                             | `false` |
-| `gatewayAPI.core.tcpRoute.annotations`                          | Annotations applied to the TCPRoute                                                                                                                                        | `{}`    |
-| `gatewayAPI.core.tcpRoute.labels`                               | Additional labels applied to the TCPRoute                                                                                                                                  | `{}`    |
-| `gatewayAPI.core.tcpRoute.parentRefs`                           | Parent gateway references (required when enabled).                                                                                                                         | `[]`    |
-| `gatewayAPI.core.tcpRoute.rules`                                | Custom routing rules. Defaults to a rule targeting the SSH service.                                                                                                        | `[]`    |
-| `gatewayAPI.nginx.clientSettingsPolicies.enabled`               | Render a ClientSettingsPolicy (NGINX Gateway Fabric) to raise the client request body limit                                                                                | `false` |
-| `gatewayAPI.nginx.clientSettingsPolicies.annotations`           | Annotations applied to the ClientSettingsPolicy                                                                                                                            | `{}`    |
-| `gatewayAPI.nginx.clientSettingsPolicies.labels`                | Additional labels applied to the ClientSettingsPolicy                                                                                                                      | `{}`    |
-| `gatewayAPI.nginx.clientSettingsPolicies.targetRef`             | Target reference for the ClientSettingsPolicy. Defaults to the chart's HTTPRoute.                                                                                          | `{}`    |
-| `gatewayAPI.nginx.clientSettingsPolicies.body`                  | Client body settings (required when enabled), e.g. `maxSize`. See `docs/gateway-api.md`.                                                                                   | `{}`    |
-
 ### deployment
 
 | Name                                       | Description                                            | Value |
@@ -1171,30 +1098,29 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 
 ### Gitea
 
-| Name                                         | Description                                                                                                                                                                     | Value                |
-| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
-| `gitea.admin.username`                       | Username for the Gitea admin user                                                                                                                                               | `gitea_admin`        |
-| `gitea.admin.existingSecret`                 | Use an existing secret to store admin user credentials                                                                                                                          | `nil`                |
-| `gitea.admin.password`                       | Password for the Gitea admin user                                                                                                                                               | `r8sA8CPHD9!bt6d`    |
-| `gitea.admin.email`                          | Email for the Gitea admin user                                                                                                                                                  | `gitea@local.domain` |
-| `gitea.admin.passwordMode`                   | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated                                                   | `keepUpdated`        |
-| `gitea.metrics.enabled`                      | Enable Gitea metrics                                                                                                                                                            | `false`              |
-| `gitea.metrics.token`                        | used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public.                                                               | `nil`                |
-| `gitea.metrics.serviceMonitor.enabled`       | Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally.                                                  | `false`              |
-| `gitea.metrics.serviceMonitor.interval`      | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used.                                                                       | `""`                 |
-| `gitea.metrics.serviceMonitor.relabelings`   | RelabelConfigs to apply to samples before scraping.                                                                                                                             | `[]`                 |
-| `gitea.metrics.serviceMonitor.scheme`        | HTTP scheme to use for scraping. For example `http` or `https`. Default is http.                                                                                                | `""`                 |
-| `gitea.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended. If not specified, global Prometheus scrape timeout is used.                                                                            | `""`                 |
-| `gitea.metrics.serviceMonitor.tlsConfig`     | TLS configuration to use when scraping the metric endpoint by Prometheus.                                                                                                       | `{}`                 |
-| `gitea.ldap`                                 | LDAP configuration                                                                                                                                                              | `[]`                 |
-| `gitea.oauth`                                | OAuth configuration                                                                                                                                                             | `[]`                 |
-| `gitea.config.server.SSH_PORT`               | SSH port for rootlful Gitea image                                                                                                                                               | `22`                 |
-| `gitea.config.server.SSH_LISTEN_PORT`        | SSH port for rootless Gitea image                                                                                                                                               | `2222`               |
-| `gitea.additionalConfigSources`              | Additional configuration from secret or configmap                                                                                                                               | `[]`                 |
-| `gitea.additionalConfigFromEnvs`             | Additional configuration sources from environment variables                                                                                                                     | `[]`                 |
-| `gitea.extraEnvSourceFile`                   | Source environment variables from a file during init container startup. This is especially useful for reading environment variable files generated by the Vault agent-injector. | `nil`                |
-| `gitea.podAnnotations`                       | Annotations for the Gitea pod                                                                                                                                                   | `{}`                 |
-| `gitea.ssh.logLevel`                         | Configure OpenSSH's log level. Only available for root-based Gitea image.                                                                                                       | `INFO`               |
+| Name                                         | Description                                                                                                                    | Value                |
+| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | -------------------- |
+| `gitea.admin.username`                       | Username for the Gitea admin user                                                                                              | `gitea_admin`        |
+| `gitea.admin.existingSecret`                 | Use an existing secret to store admin user credentials                                                                         | `nil`                |
+| `gitea.admin.password`                       | Password for the Gitea admin user                                                                                              | `r8sA8CPHD9!bt6d`    |
+| `gitea.admin.email`                          | Email for the Gitea admin user                                                                                                 | `gitea@local.domain` |
+| `gitea.admin.passwordMode`                   | Mode for how to set/update the admin user password. Options are: initialOnlyNoReset, initialOnlyRequireReset, and keepUpdated  | `keepUpdated`        |
+| `gitea.metrics.enabled`                      | Enable Gitea metrics                                                                                                           | `false`              |
+| `gitea.metrics.token`                        | used for `bearer` token authentication on metrics endpoint. If not specified or empty metrics endpoint is public.              | `nil`                |
+| `gitea.metrics.serviceMonitor.enabled`       | Enable Gitea metrics service monitor. Requires, that `gitea.metrics.enabled` is also set to true, to enable metrics generally. | `false`              |
+| `gitea.metrics.serviceMonitor.interval`      | Interval at which metrics should be scraped. If not specified Prometheus' global scrape interval is used.                      | `""`                 |
+| `gitea.metrics.serviceMonitor.relabelings`   | RelabelConfigs to apply to samples before scraping.                                                                            | `[]`                 |
+| `gitea.metrics.serviceMonitor.scheme`        | HTTP scheme to use for scraping. For example `http` or `https`. Default is http.                                               | `""`                 |
+| `gitea.metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended. If not specified, global Prometheus scrape timeout is used.                           | `""`                 |
+| `gitea.metrics.serviceMonitor.tlsConfig`     | TLS configuration to use when scraping the metric endpoint by Prometheus.                                                      | `{}`                 |
+| `gitea.ldap`                                 | LDAP configuration                                                                                                             | `[]`                 |
+| `gitea.oauth`                                | OAuth configuration                                                                                                            | `[]`                 |
+| `gitea.config.server.SSH_PORT`               | SSH port for rootlful Gitea image                                                                                              | `22`                 |
+| `gitea.config.server.SSH_LISTEN_PORT`        | SSH port for rootless Gitea image                                                                                              | `2222`               |
+| `gitea.additionalConfigSources`              | Additional configuration from secret or configmap                                                                              | `[]`                 |
+| `gitea.additionalConfigFromEnvs`             | Additional configuration sources from environment variables                                                                    | `[]`                 |
+| `gitea.podAnnotations`                       | Annotations for the Gitea pod                                                                                                  | `{}`                 |
+| `gitea.ssh.logLevel`                         | Configure OpenSSH's log level. Only available for root-based Gitea image.                                                      | `INFO`               |
 
 ### LivenessProbe
 
@@ -1232,70 +1158,68 @@ To comply with the Gitea helm chart definition of the digest parameter, a "custo
 | `gitea.startupProbe.successThreshold`    | Success threshold for startup probe             | `1`     |
 | `gitea.startupProbe.failureThreshold`    | Failure threshold for startup probe             | `10`    |
 
+### Network Policy
+
+| Name                        | Description                                                               | Value   |
+| --------------------------- | ------------------------------------------------------------------------- | ------- |
+| `networkPolicy.enabled`     | Enable network policies in general.                                       | `false` |
+| `networkPolicy.annotations` | Additional network policy annotations.                                    | `{}`    |
+| `networkPolicy.labels`      | Additional network policy labels.                                         | `{}`    |
+| `networkPolicy.policyTypes` | List of policy types. Supported is ingress, egress or ingress and egress. | `[]`    |
+| `networkPolicy.egress`      | Concrete egress network policy implementation.                            | `[]`    |
+| `networkPolicy.ingress`     | Concrete ingress network policy implementation.                           | `[]`    |
+
+### valkey-cluster
+
+Valkey cluster and [Valkey](#valkey) cannot be enabled at the same time.
+
+| Name                                  | Description                                                          | Value   |
+| ------------------------------------- | -------------------------------------------------------------------- | ------- |
+| `valkey-cluster.enabled`              | Enable valkey cluster                                                | `true`  |
+| `valkey-cluster.usePassword`          | Whether to use password authentication                               | `false` |
+| `valkey-cluster.usePasswordFiles`     | Whether to mount passwords as files instead of environment variables | `false` |
+| `valkey-cluster.cluster.nodes`        | Number of valkey cluster master nodes                                | `3`     |
+| `valkey-cluster.cluster.replicas`     | Number of valkey cluster master node replicas                        | `0`     |
+| `valkey-cluster.service.ports.valkey` | Port of Valkey service                                               | `6379`  |
+
 ### valkey
 
-| Name                                       | Description                                        | Value                      |
-| ------------------------------------------ | -------------------------------------------------- | -------------------------- |
-| `valkey.enabled`                           | Enable valkey standalone or replicated             | `false`                    |
-| `valkey.image.registry`                    | Image registry                                     | `docker.io`                |
-| `valkey.image.repository`                  | Image repository                                   | `valkey/valkey`            |
-| `valkey.image.tag`                         | Image tag                                          | `""`                       |
-| `valkey.auth.enabled`                      | Enable ACL-based authentication                    | `true`                     |
-| `valkey.auth.aclUsers.default.permissions` | ACL permissions for the default user               | `~* &* +@all`              |
-| `valkey.auth.aclUsers.default.password`    | Password for the default user                      | `changeme`                 |
-| `valkey.service.port`                      | Port of Valkey service                             | `6379`                     |
-| `valkey.dataStorage.enabled`               | Enable persistence using Persistent Volume Claims. | `false`                    |
-| `valkey.dataStorage.className`             | Persistent Volume storage class.                   | `""`                       |
-| `valkey.dataStorage.requestedSize`         | Persistent Volume size.                            | `8Gi`                      |
-| `valkey.replica.enabled`                   | Enable replication                                 | `false`                    |
-| `valkey.replica.replicas`                  | Number of Valkey replica instances to deploy       | `3`                        |
-| `valkey.replica.persistence.size`          | Persistent Volume size for replicas.               | `8Gi`                      |
-| `valkey.replica.persistence.storageClass`  | Persistent Volume storage class for replicas.      | `""`                       |
-| `valkey.metrics.enabled`                   | Enable Prometheus exporter sidecar                 | `false`                    |
-| `valkey.metrics.exporter.image.registry`   | Image registry                                     | `ghcr.io`                  |
-| `valkey.metrics.exporter.image.repository` | Image repository                                   | `oliver006/redis_exporter` |
-| `valkey.metrics.exporter.image.tag`        | Image tag                                          | `""`                       |
+Valkey and [Valkey cluster](#valkey-cluster) cannot be enabled at the same time.
+
+| Name                                 | Description                                 | Value        |
+| ------------------------------------ | ------------------------------------------- | ------------ |
+| `valkey.enabled`                     | Enable valkey standalone or replicated      | `false`      |
+| `valkey.architecture`                | Whether to use standalone or replication    | `standalone` |
+| `valkey.global.valkey.password`      | Required password                           | `changeme`   |
+| `valkey.master.count`                | Number of Valkey master instances to deploy | `1`          |
+| `valkey.master.service.ports.valkey` | Port of Valkey service                      | `6379`       |
 
 ### PostgreSQL HA
 
-| Name                                               | Description                                                      | Value                             |
-| -------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------- |
-| `postgresql-ha.enabled`                            | Enable PostgreSQL HA                                             | `true`                            |
-| `postgresql-ha.global.postgresql.database`         | Name for a custom database to create (overrides `auth.database`) | `gitea`                           |
-| `postgresql-ha.global.postgresql.username`         | Name for a custom user to create (overrides `auth.username`)     | `gitea`                           |
-| `postgresql-ha.global.postgresql.password`         | Name for a custom password to create (overrides `auth.password`) | `gitea`                           |
-| `postgresql-ha.metrics.image.repository`           | Image repository, eg. `bitnamilegacy/postgres-exporter`.         | `bitnamilegacy/postgres-exporter` |
-| `postgresql-ha.postgresql.image.repository`        | Image repository, eg. `bitnamilegacy/postgresql-repmgr`.         | `bitnamilegacy/postgresql-repmgr` |
-| `postgresql-ha.postgresql.repmgrPassword`          | Repmgr Password                                                  | `changeme2`                       |
-| `postgresql-ha.postgresql.postgresPassword`        | postgres Password                                                | `changeme1`                       |
-| `postgresql-ha.postgresql.password`                | Password for the `gitea` user (overrides `auth.password`)        | `changeme4`                       |
-| `postgresql-ha.pgpool.adminPassword`               | pgpool adminPassword                                             | `changeme3`                       |
-| `postgresql-ha.pgpool.image.repository`            | Image repository, eg. `bitnamilegacy/pgpool`.                    | `bitnamilegacy/pgpool`            |
-| `postgresql-ha.pgpool.srCheckPassword`             | pgpool srCheckPassword                                           | `changeme4`                       |
-| `postgresql-ha.service.ports.postgresql`           | PostgreSQL service port (overrides `service.ports.postgresql`)   | `5432`                            |
-| `postgresql-ha.persistence.enabled`                | Enable persistence.                                              | `true`                            |
-| `postgresql-ha.persistence.storageClass`           | Persistent Volume Storage Class.                                 | `""`                              |
-| `postgresql-ha.persistence.size`                   | PVC Storage Request for PostgreSQL HA volume                     | `10Gi`                            |
-| `postgresql-ha.volumePermissions.image.repository` | Image repository, eg. `bitnamilegacy/os-shell`.                  | `bitnamilegacy/os-shell`          |
+| Name                                        | Description                                                      | Value       |
+| ------------------------------------------- | ---------------------------------------------------------------- | ----------- |
+| `postgresql-ha.enabled`                     | Enable PostgreSQL HA                                             | `true`      |
+| `postgresql-ha.postgresql.password`         | Password for the `gitea` user (overrides `auth.password`)        | `changeme4` |
+| `postgresql-ha.global.postgresql.database`  | Name for a custom database to create (overrides `auth.database`) | `gitea`     |
+| `postgresql-ha.global.postgresql.username`  | Name for a custom user to create (overrides `auth.username`)     | `gitea`     |
+| `postgresql-ha.global.postgresql.password`  | Name for a custom password to create (overrides `auth.password`) | `gitea`     |
+| `postgresql-ha.postgresql.repmgrPassword`   | Repmgr Password                                                  | `changeme2` |
+| `postgresql-ha.postgresql.postgresPassword` | postgres Password                                                | `changeme1` |
+| `postgresql-ha.pgpool.adminPassword`        | pgpool adminPassword                                             | `changeme3` |
+| `postgresql-ha.pgpool.srCheckPassword`      | pgpool srCheckPassword                                           | `changeme4` |
+| `postgresql-ha.service.ports.postgresql`    | PostgreSQL service port (overrides `service.ports.postgresql`)   | `5432`      |
+| `postgresql-ha.persistence.size`            | PVC Storage Request for PostgreSQL HA volume                     | `10Gi`      |
 
 ### PostgreSQL
 
-| Name                                                    | Description                                                      | Value                             |
-| ------------------------------------------------------- | ---------------------------------------------------------------- | --------------------------------- |
-| `postgresql.enabled`                                    | Enable PostgreSQL                                                | `false`                           |
-| `postgresql.global.postgresql.auth.password`            | Password for the `gitea` user (overrides `auth.password`)        | `gitea`                           |
-| `postgresql.global.postgresql.auth.database`            | Name for a custom database to create (overrides `auth.database`) | `gitea`                           |
-| `postgresql.global.postgresql.auth.username`            | Name for a custom user to create (overrides `auth.username`)     | `gitea`                           |
-| `postgresql.global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`)   | `5432`                            |
-| `postgresql.image.repository`                           | Image repository, eg. `bitnamilegacy/postgresql`.                | `bitnamilegacy/postgresql`        |
-| `postgresql.primary.persistence.enabled`                | Enable persistence.                                              | `true`                            |
-| `postgresql.primary.persistence.storageClass`           | Persistent Volume storage class.                                 | `""`                              |
-| `postgresql.primary.persistence.size`                   | PVC Storage Request for PostgreSQL volume.                       | `10Gi`                            |
-| `postgresql.readReplicas.persistence.enabled`           | Enable PostgreSQL read only data persistence using PVC.          | `true`                            |
-| `postgresql.readReplicas.persistence.storageClass`      | Persistent Volume storage class.                                 | `""`                              |
-| `postgresql.readReplicas.persistence.size`              | PVC Storage Request for PostgreSQL volume.                       | `""`                              |
-| `postgresql.metrics.image.repository`                   | Image repository, eg. `bitnamilegacy/postgres-exporter`.         | `bitnamilegacy/postgres-exporter` |
-| `postgresql.volumePermissions.image.repository`         | Image repository, eg. `bitnamilegacy/os-shell`.                  | `bitnamilegacy/os-shell`          |
+| Name                                                    | Description                                                      | Value   |
+| ------------------------------------------------------- | ---------------------------------------------------------------- | ------- |
+| `postgresql.enabled`                                    | Enable PostgreSQL                                                | `false` |
+| `postgresql.global.postgresql.auth.password`            | Password for the `gitea` user (overrides `auth.password`)        | `gitea` |
+| `postgresql.global.postgresql.auth.database`            | Name for a custom database to create (overrides `auth.database`) | `gitea` |
+| `postgresql.global.postgresql.auth.username`            | Name for a custom user to create (overrides `auth.username`)     | `gitea` |
+| `postgresql.global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`)   | `5432`  |
+| `postgresql.primary.persistence.size`                   | PVC Storage Request for PostgreSQL volume                        | `10Gi`  |
 
 ### Advanced
 
@@ -1582,7 +1506,7 @@ mariadb:
 
 ### App.ini generation <!-- omit from toc -->
 
-The app.ini generation has changed and now uses the `gitea config edit-ini` subcommand introduced in Gitea 1.26.
+The app.ini generation has changed and now utilizes the environment-to-ini script provided by newer Gitea versions.
 This change ensures, that the app.ini is now persistent.
 
 ### Secret Key generation <!-- omit from toc -->

docs/gateway-api.md

@@ -1,267 +0,0 @@
-# Gateway API
-
-This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
-alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
-are rendered:
-
-- `HTTPRoute` — required for HTTP traffic
-- `TCPRoute` — optional, typically for SSH (port 22)
-- `BackendTLSPolicy` — optional, for encrypted backend traffic
-- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
-
-All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
-
-The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
-
-## Prerequisites
-
-| Resource               | API version                          | Status (as of writing) |
-| ---------------------- | ------------------------------------ | ---------------------- |
-| `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
-| `TCPRoute`             | `gateway.networking.k8s.io/v1alpha2` | Experimental           |
-| `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
-| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
-
-## Common topology
-
-Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
-
-```yaml
-gatewayAPI:
-  core:
-    httpRoute:
-      enabled: true
-      tls: true            # the shared Gateway terminates TLS
-      hostnames:
-        - git.example.com
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: shared-gateway
-          namespace: gateway-system
-          sectionName: https-gitea   # pin to a specific listener (see below)
-    tcpRoute:
-      enabled: true
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: shared-gateway
-          namespace: gateway-system
-          sectionName: ssh
-```
-
-With this configuration:
-
-- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
-- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
-- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
-- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
-
-### Why `sectionName` matters
-
-Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
-that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
-to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
-(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
-side typically looks like:
-
-```yaml
-listeners:
-  - name: https-gitea
-    port: 443
-    protocol: HTTPS
-    hostname: git.example.com
-    tls:
-      certificateRefs:
-        - name: git-example-com-tls
-    allowedRoutes:
-      kinds:
-        - kind: HTTPRoute
-      namespaces:
-        from: Selector
-        selector:
-          matchLabels:
-            kubernetes.io/metadata.name: gitea
-  - name: ssh
-    port: 22
-    protocol: TCP
-    allowedRoutes:
-      kinds:
-        - kind: TCPRoute
-      namespaces:
-        from: Selector
-        selector:
-          matchLabels:
-            kubernetes.io/metadata.name: gitea
-```
-
-### Sharing a hostname between HTTP and SSH
-
-HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
-clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
-and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
-extra configuration.
-
-If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
-cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
-
-```yaml
-gitea:
-  config:
-    server:
-      SSH_DOMAIN: gitea-ssh.example.com
-```
-
-## BackendTLSPolicy
-
-Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
-`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
-verify the backend certificate before forwarding the request.
-
-### Configuring Gitea to serve HTTPS directly
-
-Gitea serves HTTPS via three `[server]` app.ini options
-([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
-cert/key with `extraVolumes` + `extraContainerVolumeMounts` and point Gitea at them with absolute paths:
-
-```yaml
-gitea:
-  config:
-    server:
-      PROTOCOL: https
-      CERT_FILE: /etc/gitea-tls/tls.crt
-      KEY_FILE: /etc/gitea-tls/tls.key
-
-extraVolumes:
-  - name: gitea-tls
-    secret:
-      secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
-extraContainerVolumeMounts:
-  - name: gitea-tls
-    mountPath: /etc/gitea-tls
-    readOnly: true
-```
-
-- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
-  official image); absolute paths are clearer.
-- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
-- For chained certs, the server cert comes first, intermediates after.
-- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
-  (3000 by default) is now speaking HTTPS instead of HTTP.
-
-### BackendTLSPolicy example
-
-Verify the backend with a CA bundle stored in a `ConfigMap`:
-
-```yaml
-gatewayAPI:
-  core:
-    backendTLSPolicy:
-      enabled: true
-      validation:
-        hostname: gitea.svc.cluster.local
-        caCertificateRefs:
-          - name: gitea-backend-ca
-            group: ""
-            kind: ConfigMap
-```
-
-This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
-(`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
-API; the template fails fast if omitted.
-
-### System CA trust and explicit targetRefs
-
-To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
-and `targetRefs`:
-
-```yaml
-gatewayAPI:
-  core:
-    backendTLSPolicy:
-      enabled: true
-      targetRefs:
-        - group: ""
-          kind: Service
-          name: gitea-sidecar
-      validation:
-        hostname: sidecar.gitea.svc.cluster.local
-        wellKnownCACertificates: System
-```
-
-Notes:
-
-- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
-- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
-  (otherwise stick with `caCertificateRefs`).
-- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
-  `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
-
-## Raising the request body size limit (NGINX Gateway Fabric)
-
-NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
-Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
-images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
-`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
-API. NGINX Gateway Fabric instead reads the limit from a
-[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
-
-This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
-**not** impose a default request body size limit, so large uploads work without any extra configuration —
-leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
-
-```yaml
-gatewayAPI:
-  enabled: true
-  nginx:
-    clientSettingsPolicies:
-      enabled: true
-      body:
-        maxSize: 100m   # bytes, or with a k / m / g suffix; 0 disables the limit
-```
-
-This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
-(`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
-template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
-are supported too.
-
-To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
-override `targetRef`:
-
-```yaml
-gatewayAPI:
-  nginx:
-    clientSettingsPolicies:
-      enabled: true
-      targetRef:
-        group: gateway.networking.k8s.io
-        kind: Gateway
-        name: shared-gateway
-      body:
-        maxSize: 100m
-```
-
-Notes:
-
-- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
-  attaching it to an `HTTPRoute` scopes it to that route only.
-- The policy must live in the same namespace as its `targetRef`.
-- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
-  `[packages]` sections) — raising the proxy limit alone is not always sufficient.
-
-## Interaction with `ingress` and `route`
-
-The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
-
-1. `route.host` (when `route.enabled`)
-2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
-3. First `ingress.hosts[0].host`
-4. The in-cluster Service DNS name
-
-Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
-
-## SSH considerations
-
-- `TCPRoute` is still experimental. Many production-grade implementations support it (Envoy Gateway, Istio, Kgateway, NGINX Gateway Fabric), but you should verify before relying on it.
-- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
-- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.

package.json

@@ -9,11 +9,13 @@
     "npm": ">=8.0.0"
   },
   "scripts": {
+    "readme:link": "markdown-link-check --config .markdownlink.json *.md",
     "readme:lint": "markdownlint *.md -f",
     "readme:parameters": "readme-generator -v values.yaml -r README.md"
   },
   "devDependencies": {
     "@bitnami/readme-generator-for-helm": "^2.5.0",
-    "markdownlint-cli": "^0.49.0"
+    "markdown-link-check": "^3.13.6",
+    "markdownlint-cli": "^0.45.0"
   }
 }

renovate.json5

@@ -1,55 +1,51 @@
 {
-  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
   extends: [
-    "gitea>gitea/renovate-config",
-    "helpers:pinGitHubActionDigests",
-    ":automergeMinor",
-    "schedule:automergeDaily",
-    "schedule:weekends",
+    'gitea>gitea/renovate-config',
+    ':automergeMinor',
+    'schedule:automergeDaily',
+    'schedule:weekends',
   ],
   labels: [
-    "kind/dependency",
+    'kind/dependency',
   ],
   digest: {
     automerge: true,
   },
-  automergeStrategy: "squash",
-  "git-submodules": {
+  automergeStrategy: 'squash',
+  'git-submodules': {
     enabled: true,
   },
   customManagers: [
     {
-      description: "Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions",
-      customType: "regex",
+      description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
+      customType: 'regex',
       managerFilePatterns: [
-        "/.gitea/workflows/.+\\.ya?ml$/",
+        '/.gitea/workflows/.+\\.ya?ml$/',
       ],
       matchStrings: [
-        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s",
+        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
       ],
     },
     {
-      description: "Detect helm-unittest yaml schema file",
-      customType: "regex",
+      description: 'Detect helm-unittest yaml schema file',
+      customType: 'regex',
       managerFilePatterns: [
-        "/.vscode/settings\\.json$/",
+        '/.vscode/settings\\.json$/',
       ],
       matchStrings: [
-        "https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json",
+        'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
       ],
-      datasourceTemplate: "github-releases",
+      datasourceTemplate: 'github-releases',
     },
     {
-      description: "Automatically detect new Gitea releases",
-      customType: "regex",
-      datasourceTemplate: "github-releases",
-      depNameTemplate: "gitea/gitea",
-      extractVersionTemplate: "^v(?<version>.*)$",
+      description: 'Automatically detect new Gitea releases',
+      customType: 'regex',
       managerFilePatterns: [
-        "/(^|/)Chart\\.ya?ml$/",
+        '/(^|/)Chart\\.yaml$/',
       ],
       matchStrings: [
-        "^appVersion:\\s+[\"']?(?<currentVersion>\\S+)[\"']?$",
+        '# renovate datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) extractVersion=(?<extractVersion>\\S+)\\nappVersion:\\s?(?<currentValue>\\S+)\\n',
       ],
     },
   ],
@@ -58,78 +54,78 @@
     "commitMessageAction": "update",
     "commitMessageTopic": "lockfiles",
     schedule: [
-      "at any time",
+      'at any time',
     ]
   },
   packageRules: [
     {
-      groupName: "subcharts (minor & patch)",
+      groupName: 'subcharts (minor & patch)',
       matchManagers: [
-        "helmv3",
+        'helmv3',
       ],
       matchUpdateTypes: [
-        "minor",
-        "patch",
-        "digest",
+        'minor',
+        'patch',
+        'digest',
       ],
     },
     {
-      groupName: "bats testing framework",
+      groupName: 'bats testing framework',
       matchManagers: [
-        "git-submodules",
+        'git-submodules',
       ],
       matchUpdateTypes: [
-        "minor",
-        "patch",
-        "digest",
+        'minor',
+        'patch',
+        'digest',
       ],
     },
     {
-      groupName: "workflow dependencies (minor & patch)",
+      groupName: 'workflow dependencies (minor & patch)',
       matchManagers: [
-        "github-actions",
-        "npm",
-        "custom.regex",
+        'github-actions',
+        'npm',
+        'custom.regex',
       ],
       matchUpdateTypes: [
-        "minor",
-        "patch",
-        "digest",
+        'minor',
+        'patch',
+        'digest',
       ],
       matchFileNames: [
-        "!Chart.yaml",
+        '!Chart.yaml',
       ],
     },
     {
-      description: "Update README.md on changes in values.yaml",
+      description: 'Update README.md on changes in values.yaml',
       matchManagers: [
-        "helm-values",
+        'helm-values',
       ],
       postUpgradeTasks: {
         commands: [
-          "install-tool node",
-          "make readme",
+          'install-tool node',
+          'make readme',
         ],
         fileFilters: [
-          "README.md",
+          'README.md',
         ],
-        executionMode: "update",
+        executionMode: 'update',
       },
     },
     {
-      description: "Override changelog url for Helm image, to have release notes in our PRs",
+      description: 'Override changelog url for Helm image, to have release notes in our PRs',
       matchDepNames: [
-        "alpine/helm",
+        'alpine/helm',
       ],
-      changelogUrl: "https://github.com/helm/helm",
+      changelogUrl: 'https://github.com/helm/helm',
     },
     {
-      description: "Bump Gitea as fast as possible - not only on weekends",
+      description: 'Bump Gitea as fast as possible - not only on weekends',
       matchDepNames: [
-        "go-gitea/gitea",
+        'go-gitea/gitea',
       ],
       schedule: [
-        "at any time",
+        'at any time',
       ],
     },
   ],

scripts/init-containers/config/config_environment.sh

@@ -78,6 +78,7 @@ function env2ini::reload_preset_envs() {
   rm $TMP_EXISTING_ENVS_FILE
 }
 
+
 function env2ini::process_config_file() {
   local config_file="${1}"
   local section="$(basename "${config_file}")"
@@ -150,4 +151,4 @@ if [ -f ${GITEA_APP_INI} ]; then
   unset GITEA__SERVER__LFS_JWT_SECRET
 fi
 
-gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
+environment-to-ini -o $GITEA_APP_INI

templates/NOTES.txt

@@ -1,12 +1,5 @@
 1. Get the application URL by running these commands:
-{{- if .Values.route.enabled }}
-  {{- if .Values.route.host }}
-  {{ include "gitea.public_protocol" . }}://{{ tpl .Values.route.host . }}{{ .Values.route.path }}
-  {{- else }}
-  export ROUTE_HOST=$(kubectl get route --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} -o jsonpath="{.spec.host}")
-  echo {{ include "gitea.public_protocol" . }}://$ROUTE_HOST{{ .Values.route.path }}
-  {{- end }}
-{{- else if .Values.ingress.enabled }}
+{{- if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
   {{- range .paths }}
   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}

templates/_helpers.tpl

@@ -76,87 +76,6 @@ imagePullSecrets:
 {{- end }}
 {{- end -}}
 
-{{/*
-Return true when OpenShift compatibility defaults should be rendered.
-If openshift.enabled is unset, auto-detect via the SCC API.
-*/}}
-{{- define "gitea.openshift.enabled" -}}
-{{- if kindIs "bool" .Values.openshift.enabled -}}
-{{ ternary "true" "false" .Values.openshift.enabled }}
-{{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" -}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the pod's hostUsers setting when OpenShift compatibility is enabled.
-*/}}
-{{- define "gitea.hostUsers" -}}
-{{- if eq (include "gitea.openshift.enabled" . | trim) "true" -}}
-{{- if kindIs "bool" .Values.openshift.hostUsers -}}
-{{ ternary "true" "false" .Values.openshift.hostUsers }}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
-*/}}
-{{- define "gitea.podSecurityContext" -}}
-{{- $podSecurityContext := deepCopy .Values.podSecurityContext -}}
-{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $podSecurityContext "fsGroup")) -}}
-{{- $_ := set $podSecurityContext "fsGroup" 1000 -}}
-{{- end -}}
-{{- if gt (len $podSecurityContext) 0 -}}
-{{ toYaml $podSecurityContext }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render container securityContext with OpenShift restricted SCC defaults when enabled.
-*/}}
-{{- define "gitea.containerSecurityContext" -}}
-{{- $root := index . 0 -}}
-{{- $containerSecurityContext := deepCopy (index . 1) -}}
-{{- if eq (include "gitea.openshift.enabled" $root | trim) "true" -}}
-{{- $containerSecurityContext = mergeOverwrite (dict
-  "allowPrivilegeEscalation" false
-  "capabilities" (dict "drop" (list "ALL"))
-  "runAsNonRoot" true
-  "seccompProfile" (dict "type" "RuntimeDefault")
-) $containerSecurityContext -}}
-{{- end -}}
-{{- if gt (len $containerSecurityContext) 0 -}}
-{{ toYaml $containerSecurityContext }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render the securityContext for init containers that execute Gitea/GPG commands.
-These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
-*/}}
-{{- define "gitea.commandInitContainerSecurityContext" -}}
-{{- $root := index . 0 -}}
-{{- $containerSecurityContext := deepCopy (index . 1) -}}
-{{- if and (ne (include "gitea.openshift.enabled" $root | trim) "true") (not (hasKey $containerSecurityContext "runAsUser")) -}}
-{{- $_ := set $containerSecurityContext "runAsUser" 1000 -}}
-{{- end -}}
-{{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
-{{- end -}}
-
-{{/*
-Render the runtime container securityContext while honoring the deprecated securityContext value.
-*/}}
-{{- define "gitea.runtimeContainerSecurityContext" -}}
-{{- $containerSecurityContext := deepCopy .Values.containerSecurityContext -}}
-{{- if and (eq (len $containerSecurityContext) 0) .Values.securityContext -}}
-{{- $containerSecurityContext = deepCopy .Values.securityContext -}}
-{{- end -}}
-{{- include "gitea.containerSecurityContext" (list . $containerSecurityContext) -}}
-{{- end -}}
-
 
 {{/*
 Storage Class
@@ -168,6 +87,12 @@ storageClassName: {{ $storageClass | quote }}
 {{- end }}
 {{- end -}}
 
+{{/*
+Common annotations
+*/}}
+{{- define "gitea.annotations" -}}
+{{- end }}
+
 {{/*
 Common labels
 */}}
@@ -215,20 +140,28 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "valkey.dns" -}}
-{{- if (index .Values "valkey").enabled -}}
-{{- printf "redis://:%s@%s-valkey.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index (index .Values "valkey").auth.aclUsers "default").password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").service.port -}}
+{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
+{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
+{{- else if (index .Values "valkey-cluster").enabled -}}
+{{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
+{{- else if (index .Values "valkey").enabled -}}
+{{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.port" -}}
-{{- if (index .Values "valkey").enabled -}}
-{{ (index .Values "valkey").service.port }}
+{{- if (index .Values "valkey-cluster").enabled -}}
+{{ (index .Values "valkey-cluster").service.ports.valkey }}
+{{- else if (index .Values "valkey").enabled -}}
+{{ (index .Values "valkey").master.service.ports.valkey }}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.servicename" -}}
-{{- if (index .Values "valkey").enabled -}}
-{{- printf "%s-valkey.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- if (index .Values "valkey-cluster").enabled -}}
+{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- else if (index .Values "valkey").enabled -}}
+{{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
 
@@ -236,18 +169,6 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 
-{{- define "gitea.public_hostname" -}}
-{{- if and .Values.route.enabled .Values.route.host -}}
-{{ tpl .Values.route.host . }}
-{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
-{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
-{{- else if gt (len .Values.ingress.hosts) 0 -}}
-{{ tpl (index .Values.ingress.hosts 0).host $ }}
-{{- else -}}
-{{ include "gitea.default_domain" . }}
-{{- end -}}
-{{- end -}}
-
 {{- define "gitea.ldap_settings" -}}
 {{- $idx := index . 0 }}
 {{- $values := index . 1 }}
@@ -298,11 +219,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "gitea.public_protocol" -}}
-{{- if and .Values.route.enabled .Values.route.tls.termination -}}
-https
-{{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
-https
-{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
+{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
 https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
@@ -395,7 +312,7 @@ https
     {{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
   {{- end -}}
   {{- /* valkey queue */ -}}
-  {{- if (index .Values "valkey").enabled -}}
+  {{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
     {{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
     {{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
     {{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
@@ -435,7 +352,11 @@ https
     {{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
   {{- end -}}
   {{- if not (.Values.gitea.config.server.DOMAIN) -}}
-    {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.public_hostname" .) -}}
+    {{- if gt (len .Values.ingress.hosts) 0 -}}
+      {{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
+    {{- else -}}
+      {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
+    {{- end -}}
   {{- end -}}
   {{- if not .Values.gitea.config.server.ROOT_URL -}}
     {{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}

templates/_networkPolicy.tpl

@@ -0,0 +1,19 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.networkPolicy.annotations" -}}
+{{ include "gitea.annotations" . }}
+{{- if .Values.networkPolicy.annotations }}
+{{ toYaml .Values.networkPolicy.annotations }}
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.networkPolicy.labels" -}}
+{{ include "gitea.labels" . }}
+{{- if .Values.networkPolicy.labels }}
+{{ toYaml .Values.networkPolicy.labels }}
+{{- end }}
+{{- end }}

templates/_pod.tpl

@@ -0,0 +1,17 @@
+---
+
+{{/* labels */}}
+
+{{- define "gitea.pod.labels" -}}
+{{- include "gitea.labels" . }}
+{{- if .Values.deployment.labels }}
+{{ toYaml .Values.deployment.labels }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.pod.selectorLabels" -}}
+{{- include "gitea.selectorLabels" . }}
+{{- if .Values.deployment.labels }}
+{{ toYaml .Values.deployment.labels }}
+{{- end }}
+{{- end }}

templates/check-actions-not-present.yaml

@@ -0,0 +1,3 @@
+{{- if .Values.actions -}}
+    {{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
+{{- end -}}

templates/deployment.yaml

@@ -23,11 +23,11 @@ spec:
     {{- end }}
   selector:
     matchLabels:
-      {{- include "gitea.selectorLabels" . | nindent 6 }}
+      {{- include "gitea.pod.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/gitea/config.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
         {{- range $idx, $value := .Values.gitea.ldap }}
         checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
         {{- end }}
@@ -38,16 +38,8 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
-        {{- include "gitea.labels" . | nindent 8 }}
-        {{- if .Values.deployment.labels }}
-        {{- toYaml .Values.deployment.labels | nindent 8 }}
-        {{- end }}
+        {{- include "gitea.pod.labels" . | nindent 8 }}
     spec:
-      {{- $hostUsers := include "gitea.hostUsers" . | trim }}
-      {{- $podSecurityContext := include "gitea.podSecurityContext" . | trim }}
-      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.containerSecurityContext)) | trim }}
-      {{- $commandInitContainerSecurityContext := include "gitea.commandInitContainerSecurityContext" (list . (deepCopy .Values.containerSecurityContext)) | trim }}
-      {{- $runtimeContainerSecurityContext := include "gitea.runtimeContainerSecurityContext" . | trim }}
       {{- if .Values.schedulerName }}
       schedulerName: "{{ .Values.schedulerName }}"
       {{- end }}
@@ -57,14 +49,9 @@ spec:
       {{- if .Values.priorityClassName }}
       priorityClassName: "{{ .Values.priorityClassName }}"
       {{- end }}
-      {{- if $hostUsers }}
-      hostUsers: {{ $hostUsers }}
-      {{- end }}
       {{- include "gitea.images.pullSecrets" . | nindent 6 }}
-      {{- if $podSecurityContext }}
       securityContext:
-        {{- $podSecurityContext | nindent 8 }}
-      {{- end }}
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       initContainers:
         {{- if .Values.preExtraInitContainers }}
         {{- toYaml .Values.preExtraInitContainers | nindent 8 }}
@@ -101,25 +88,15 @@ spec:
               subPath: {{ .Values.persistence.subPath }}
               {{- end }}
             {{- include "gitea.init-additional-mounts" . | nindent 12 }}
-          {{- if $containerSecurityContext }}
           securityContext:
-            {{- $containerSecurityContext | nindent 12 }}
-          {{- end }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           resources:
             {{- toYaml .Values.initContainers.resources | nindent 12 }}
         - name: init-app-ini
           image: "{{ include "gitea.image" . }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if .Values.gitea.extraEnvSourceFile }}
-          command:
-          - "/bin/bash"
-          - "-c"
-          args:
-          - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-          {{- else }}
           command:
           - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-          {{- end }}
           env:
             - name: GITEA_APP_INI
               value: /data/gitea/conf/app.ini
@@ -156,30 +133,23 @@ spec:
               mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
             {{- end }}
             {{- include "gitea.init-additional-mounts" . | nindent 12 }}
-          {{- if $containerSecurityContext }}
           securityContext:
-            {{- $containerSecurityContext | nindent 12 }}
-          {{- end }}
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
           resources:
             {{- toYaml .Values.initContainers.resources | nindent 12 }}
         {{- if .Values.signing.enabled }}
         - name: configure-gpg
           image: "{{ include "gitea.image" . }}"
-          {{- if .Values.gitea.extraEnvSourceFile }}
-          command:
-          - "/bin/bash"
-          - "-c"
-          args:
-          - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-          {{- else }}
           command:
           - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-          {{- end }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if $commandInitContainerSecurityContext }}
           securityContext:
-            {{- $commandInitContainerSecurityContext | nindent 12 }}
-          {{- end }}
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
           env:
             - name: GNUPGHOME
               value: {{ .Values.signing.gpgHome }}
@@ -204,21 +174,16 @@ spec:
         {{- end }}
         - name: configure-gitea
           image: "{{ include "gitea.image" . }}"
-          {{- if .Values.gitea.extraEnvSourceFile }}
-          command:
-          - "/bin/bash"
-          - "-c"
-          args:
-          - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-          {{- else }}
           command:
           - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-          {{- end }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          {{- if $commandInitContainerSecurityContext }}
           securityContext:
-            {{- $commandInitContainerSecurityContext | nindent 12 }}
-          {{- end }}
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
           env:
             - name: GITEA_APP_INI
               value: /data/gitea/conf/app.ini
@@ -376,10 +341,13 @@ spec:
           {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
-          {{- if $runtimeContainerSecurityContext }}
           securityContext:
-            {{- $runtimeContainerSecurityContext | nindent 12 }}
-          {{- end }}
+            {{- /* Honor the deprecated securityContext variable when defined */ -}}
+            {{- if .Values.containerSecurityContext -}}
+            {{ toYaml .Values.containerSecurityContext | nindent 12 -}}
+            {{- else -}}
+            {{ toYaml .Values.securityContext | nindent 12 -}}
+            {{- end }}
           volumeMounts:
             - name: temp
               mountPath: /tmp
@@ -396,9 +364,9 @@ spec:
       hostAliases:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.nodeSelector }}
+      {{- range $key, $value := .Values.nodeSelector }}
       nodeSelector:
-        {{- toYaml . | nindent 8 }}
+        {{ $key }}: {{ $value | quote }}
       {{- end }}
     {{- with .Values.affinity }}
       affinity:

templates/extra-list.yaml

@@ -1,8 +1,8 @@
 {{- range .Values.extraDeploy }}
 ---
 {{- if typeIs "string" . }}
-    {{ tpl . $ }}
+    {{- tpl . $ }}
 {{- else }}
-    {{ tpl (. | toYaml) $ }}
+    {{- tpl (. | toYaml) $ }}
 {{- end }}
 {{- end }}

templates/gitea/_backendTLSPolicies.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.backendTLSPolicy.annotations" -}}
-{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.backendTLSPolicy.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.core.backendTLSPolicy.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.backendTLSPolicy.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/gitea/_clientSettingsPolicies.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.clientSettingsPolicies.annotations" -}}
-{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.clientSettingsPolicies.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.clientSettingsPolicies.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/gitea/_httpRoutes.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.httpRoute.annotations" -}}
-{{- with .Values.gatewayAPI.core.httpRoute.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.httpRoute.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.core.httpRoute.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.httpRoute.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.httpRoute.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/gitea/_services.tpl

@@ -1,11 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* names */}}
-
-{{- define "gitea.service.http.name" -}}
-{{ include "gitea.fullname" . }}-http
-{{- end }}
-
-{{- define "gitea.service.ssh.name" -}}
-{{ include "gitea.fullname" . }}-ssh
-{{- end }}

templates/gitea/_tcpRoutes.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.tcpRoute.annotations" -}}
-{{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.tcpRoute.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-           .Values.gatewayAPI.core.tcpRoute.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.tcpRoute.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.tcpRoute.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/gitea/backendTLSPolicy.yaml

@@ -1,30 +0,0 @@
-{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
-{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
-{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
-{{- end }}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: BackendTLSPolicy
-metadata:
-  {{- with (include "gitea.backendTLSPolicy.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.backendTLSPolicy.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  targetRefs:
-    {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
-    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
-    {{- else }}
-    - group: ""
-      kind: Service
-      name: {{ include "gitea.service.http.name" . }}
-    {{- end }}
-  validation:
-    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
-{{- end }}

templates/gitea/clientSettingsPolicy.yaml

@@ -1,30 +0,0 @@
-{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
-{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
-{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
-{{- end }}
----
-apiVersion: gateway.nginx.org/v1alpha1
-kind: ClientSettingsPolicy
-metadata:
-  {{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.clientSettingsPolicies.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  targetRef:
-    {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
-    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
-    {{- else }}
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: {{ include "gitea.fullname" . }}
-    {{- end }}
-  body:
-    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
-{{- end }}

templates/gitea/httpRoute.yaml

@@ -1,42 +0,0 @@
-{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  {{- with (include "gitea.httpRoute.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.httpRoute.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  parentRefs:
-    {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
-    {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
-    {{- else }}
-    {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
-    {{- end }}
-  {{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
-  hostnames:
-    {{- tpl (toYaml .) $ | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- if .Values.gatewayAPI.core.httpRoute.rules }}
-    {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
-    {{- else }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - group: ""
-          kind: Service
-          name: {{ include "gitea.service.http.name" . }}
-          port: {{ .Values.service.http.port }}
-          weight: 1
-    {{- end }}
-{{- end }}

templates/gitea/route.yaml

@@ -1,52 +0,0 @@
-{{- if .Values.route.enabled -}}
-{{- $fullName := include "gitea.fullname" . -}}
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  name: {{ $fullName }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-  {{- with .Values.route.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.route.host }}
-  host: {{ tpl .Values.route.host . | quote }}
-  {{- end }}
-  {{- if .Values.route.path }}
-  path: {{ tpl .Values.route.path . | quote }}
-  {{- end }}
-  to:
-    kind: Service
-    name: {{ include "gitea.service.http.name" . }}
-  port:
-    targetPort: http
-  wildcardPolicy: {{ .Values.route.wildcardPolicy }}
-  {{- with .Values.route.tls }}
-  {{- if .termination }}
-  tls:
-    termination: {{ .termination }}
-    {{- if .insecureEdgeTerminationPolicy }}
-    insecureEdgeTerminationPolicy: {{ .insecureEdgeTerminationPolicy }}
-    {{- end }}
-    {{- if .key }}
-    key: |
-      {{- .key | nindent 6 }}
-    {{- end }}
-    {{- if .certificate }}
-    certificate: |
-      {{- .certificate | nindent 6 }}
-    {{- end }}
-    {{- if .caCertificate }}
-    caCertificate: |
-      {{- .caCertificate | nindent 6 }}
-    {{- end }}
-    {{- if .destinationCACertificate }}
-    destinationCACertificate: |
-      {{- .destinationCACertificate | nindent 6 }}
-    {{- end }}
-  {{- end }}
-  {{- end }}
-{{- end }}

templates/gitea/tcpRoute.yaml

@@ -1,34 +0,0 @@
-{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
----
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TCPRoute
-metadata:
-  {{- with (include "gitea.tcpRoute.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.tcpRoute.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  parentRefs:
-    {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
-    {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
-    {{- else }}
-    {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
-    {{- end }}
-  rules:
-    {{- if .Values.gatewayAPI.core.tcpRoute.rules }}
-    {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
-    {{- else }}
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: {{ include "gitea.service.ssh.name" . }}
-          port: {{ .Values.service.ssh.port }}
-          weight: 1
-    {{- end }}
-{{- end }}

templates/http-svc.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    {{- toYaml .Values.service.http.annotations | nindent 4 }}
+  name: {{ include "gitea.fullname" . }}-http
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.http.labels }}
     {{- toYaml .Values.service.http.labels  | nindent 4 }}
     {{- end }}
-  name: {{ include "gitea.service.http.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.http.annotations | nindent 4 }}
 spec:
   type: {{ .Values.service.http.type }}
   {{- if eq .Values.service.http.type "LoadBalancer" }}

templates/ingress.yaml

@@ -36,7 +36,7 @@ spec:
             pathType: {{ default "Prefix" $.Values.ingress.pathType }}
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
                   number: {{ $httpPort }}
           {{- else }}
@@ -44,7 +44,7 @@ spec:
             pathType: {{ .pathType | default "Prefix" }}
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
                   number: {{ $httpPort }}
           {{- end }}
@@ -54,7 +54,7 @@ spec:
             pathType: "Prefix"
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
                   number: {{ $httpPort }}
           {{- end }}

templates/init.yaml

@@ -64,7 +64,7 @@ stringData:
       
       echo 'Wait for valkey to become avialable...'
       until [ "${RETRY}" -ge "${MAX}" ]; do
-        RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
+        nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
         RETRY=$[${RETRY}+1]
         echo "...not ready yet (${RETRY}/${MAX})"
       done
@@ -123,7 +123,7 @@ stringData:
           #   should add it to prevent requiring frequent admin password resets.
           local -a change_args
           change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
-          if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
+          if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
             change_args+=(--must-change-password=false)
           fi
           gitea admin user change-password "${change_args[@]}"
@@ -225,4 +225,4 @@ stringData:
 
     configure_oauth
 
-    echo '==== END GITEA CONFIGURATION ===='
+    echo '==== END GITEA CONFIGURATION ===='

templates/networkPolicy.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.networkPolicy.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  {{- with (include "gitea.networkPolicy.annotations" . | fromYaml) }}
+  annotations:
+    {{- tpl (toYaml .) $ | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.networkPolicy.labels" . | fromYaml) }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "gitea.pod.selectorLabels" $ | nindent 6 }}
+  {{- with .Values.networkPolicy.policyTypes }}
+  policyTypes:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+  {{- with .Values.networkPolicy.egress }}
+  egress:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+  {{- with .Values.networkPolicy.ingress }}
+  ingress:
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+{{- end }}

templates/ssh-svc.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
+  name: {{ include "gitea.fullname" . }}-ssh
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.ssh.labels }}
     {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
     {{- end }}
-  name: {{ include "gitea.service.ssh.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
 spec:
   type: {{ .Values.service.ssh.type }}
   {{- if eq .Values.service.ssh.type "LoadBalancer" }}

templates/tests/test-http-connection.yaml

@@ -9,19 +9,10 @@ metadata:
   annotations:
     "helm.sh/hook": test-success
 spec:
-  {{- $hostUsers := include "gitea.hostUsers" . | trim }}
-  {{- $testContainerSecurityContext := include "gitea.containerSecurityContext" (list . (dict)) | trim }}
-  {{- if $hostUsers }}
-  hostUsers: {{ $hostUsers }}
-  {{- end }}
   containers:
     - name: wget
       image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
-      {{- if $testContainerSecurityContext }}
-      securityContext:
-        {{- $testContainerSecurityContext | nindent 8 }}
-      {{- end }}
       command: ['wget']
-      args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}']
+      args:  ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
   restartPolicy: Never
 {{- end }}

unittests/bash/tests/init-containers/config/config_environment.bats

@@ -9,51 +9,27 @@ function setup() {
   export GITEA_APP_INI="$BATS_TEST_TMPDIR/app.ini"
   export TMP_EXISTING_ENVS_FILE="$BATS_TEST_TMPDIR/existing-envs"
   export ENV_TO_INI_MOUNT_POINT="$BATS_TEST_TMPDIR/env-to-ini-mounts"
-  export GITEA_EDIT_INI_EXPECTED=0
-  export PATH="$BATS_TEST_TMPDIR/bin:$PATH"
 
-  mkdir -p "$BATS_TEST_TMPDIR/bin"
-  cat >"$BATS_TEST_TMPDIR/bin/gitea" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-case "$*" in
-  'generate secret INTERNAL_TOKEN')
-    echo 'mocked-internal-token'
-    ;;
-  'generate secret SECRET_KEY')
-    echo 'mocked-secret-key'
-    ;;
-  'generate secret JWT_SECRET')
-    echo 'mocked-jwt-secret'
-    ;;
-  'generate secret LFS_JWT_SECRET')
-    echo 'mocked-lfs-jwt-secret'
-    ;;
-  "config edit-ini --apply-env --config $GITEA_APP_INI --out $GITEA_APP_INI")
-    if [ "$GITEA_EDIT_INI_EXPECTED" -eq 1 ]; then
-      echo 'Stubbed gitea config edit-ini was called!'
-      exit 0
-    fi
-
-    echo 'Unexpected gitea config edit-ini invocation' >&2
-    exit 127
-    ;;
-  *)
-    echo "Unexpected gitea invocation: $*" >&2
-    exit 127
-    ;;
-esac
-EOF
-  chmod +x "$BATS_TEST_TMPDIR/bin/gitea"
+  stub gitea \
+      "generate secret INTERNAL_TOKEN : echo 'mocked-internal-token'" \
+      "generate secret SECRET_KEY : echo 'mocked-secret-key'" \
+      "generate secret JWT_SECRET : echo 'mocked-jwt-secret'" \
+      "generate secret LFS_JWT_SECRET : echo 'mocked-lfs-jwt-secret'"
 }
 
 function teardown() {
-  :
+  unstub gitea
+  # This condition exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
+  if [ $ENV_TO_INI_EXPECTED -eq 1 ]; then
+    unstub environment-to-ini
+  fi
 }
 
-function expect_gitea_config_edit_ini_call() {
-  export GITEA_EDIT_INI_EXPECTED=1
+# This function exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
+function expect_environment_to_ini_call() {
+  export ENV_TO_INI_EXPECTED=1
+  stub environment-to-ini \
+    "-o $GITEA_APP_INI : echo 'Stubbed environment-to-ini was called!'"
 }
 
 function execute_test_script() {
@@ -80,18 +56,18 @@ function write_mounted_file() {
 }
 
 @test "works as expected when nothing is configured" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   run $PROJECT_ROOT/scripts/init-containers/config/config_environment.sh
 
   assert_success
   assert_line '...Initial secrets generated'
   assert_line 'Reloading preset envs...'
   assert_line '=== All configuration sources loaded ==='
-  assert_line 'Stubbed gitea config edit-ini was called!'
+  assert_line 'Stubbed environment-to-ini was called!'
 }
 
 @test "exports initial secrets" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   run execute_test_script
 
   assert_success
@@ -102,7 +78,7 @@ function write_mounted_file() {
 }
 
 @test "does NOT export initial secrets when app.ini already exists" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   touch $GITEA_APP_INI
 
   run execute_test_script
@@ -116,7 +92,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over auto-generated ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
 
   run execute_test_script
@@ -126,7 +102,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over mounted ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
@@ -141,7 +117,7 @@ EOF
 }
 
 @test "ensures that additionals take precedence over inlines" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
 EOF
@@ -160,7 +136,7 @@ EOF
 }
 
 @test "ensures that dotted/dashed sections are properly masked" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
 EOF
@@ -176,7 +152,7 @@ EOF
 ##### THIS IS A BUG, BUT I WANT IT TO BE COVERED BY TESTS #####
 ###############################################################
 @test "ensures uppercase section and setting names (🐞)" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__oauth2__JwT_Secret="pre-defined-jwt-secret"
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_progress_PREFIXES=WIP:,[WIP]
@@ -191,7 +167,7 @@ EOF
 }
 
 @test "treats top-level configuration as section-less" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "_generals_" "$(cat << EOF
 APP_NAME=Hello top-level configuration
 RUN_MODE=dev

unittests/helm/check-actions-not-present.yaml

@@ -0,0 +1,12 @@
+suite: Check if actions raises an error
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: fails when trying to configure actions due to removal
+    set:
+      actions:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9.

unittests/helm/config/actions-config.yaml

@@ -3,17 +3,17 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/config.yaml
+  - templates/config.yaml
 tests:
   - it: "actions are enabled by default (based on vanilla Gitea behavior)"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     asserts:
       - documentIndex: 0
         notExists:
           path: stringData.actions
 
   - it: "actions can be disabled via inline config"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       gitea.config.actions.ENABLED: false
     asserts:

unittests/helm/config/cache-config.yaml

@@ -3,9 +3,26 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "cache is configured correctly for valkey"
-    template: templates/gitea/config.yaml
+  - it: "cache is configured correctly for valkey-cluster"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=redis
+            HOST=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "cache is configured correctly for valkey"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -14,11 +31,13 @@ tests:
           path: stringData.cache
           value: |-
             ADAPTER=redis
-            HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            HOST=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
 
-  - it: "cache is configured correctly for 'memory' when valkey is disabled"
-    template: templates/gitea/config.yaml
+  - it: "cache is configured correctly for 'memory' when valkey (or valkey-cluster) is disabled"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: false
     asserts:
@@ -29,9 +48,11 @@ tests:
             ADAPTER=memory
             HOST=
 
-  - it: "cache can be customized when valkey is disabled"
-    template: templates/gitea/config.yaml
+  - it: "cache can be customized when valkey (or valkey-cluster) is disabled"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: false
       gitea.config.cache.ADAPTER: custom-adapter

unittests/helm/config/config-environment-script.yaml

@@ -1,14 +0,0 @@
-suite: config template | config_environment.sh
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/config.yaml
-tests:
-  - it: uses `gitea config edit-ini` to write app.ini from environment variables
-    template: templates/gitea/config.yaml
-    asserts:
-      - documentIndex: 1
-        matchRegex:
-          path: stringData["config_environment.sh"]
-          pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'

unittests/helm/config/metrics-section_metrics-token.yaml

@@ -4,7 +4,7 @@ release:
   namespace: testing
 tests:
   - it: metrics token is set
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -18,7 +18,7 @@ tests:
             ENABLED=true
             TOKEN=somepassword
   - it: metrics token is empty
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -31,7 +31,7 @@ tests:
           value: |-
             ENABLED=true
   - it: metrics token is nil
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:
@@ -44,7 +44,7 @@ tests:
           value: |-
             ENABLED=true
   - it: does not configures a token if metrics are disabled
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       gitea:
         metrics:

unittests/helm/config/queue-config.yaml

@@ -3,9 +3,26 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "queue is configured correctly for valkey"
-    template: templates/gitea/config.yaml
+  - it: "queue is configured correctly for valkey-cluster"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            TYPE=redis
+
+  - it: "queue is configured correctly for valkey"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -13,12 +30,14 @@ tests:
         equal:
           path: stringData.queue
           value: |-
-            CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            CONN_STR=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
             TYPE=redis
 
-  - it: "queue is configured correctly for 'levelDB' when valkey is disabled"
-    template: templates/gitea/config.yaml
+  - it: "queue is configured correctly for 'levelDB' when valkey (and valkey-cluster) is disabled"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: false
     asserts:
@@ -29,9 +48,11 @@ tests:
             CONN_STR=
             TYPE=level
 
-  - it: "queue can be customized when valkey is disabled"
-    template: templates/gitea/config.yaml
+  - it: "queue can be customized when valkey (and valkey-cluster) are disabled"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: false
       gitea.config.queue.TYPE: custom-type

unittests/helm/config/server-section_domain.yaml

@@ -4,7 +4,7 @@ release:
   namespace: testing
 tests:
   - it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
@@ -22,7 +22,7 @@ tests:
   ################################################
 
   - it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       ingress:
         hosts: []
@@ -43,7 +43,7 @@ tests:
   ################################################
 
   - it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     set:
       gitea.config.server.DOMAIN: provided.example.com
       ingress:
@@ -65,94 +65,3 @@ tests:
         matchRegex:
           path: stringData.server
           pattern: \nROOT_URL=http://provided.example.com
-
-  ################################################
-
-  - it: "[route enabled] uses route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/gitea/config.yaml
-    set:
-      route:
-        enabled: true
-        host: route.example.com
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nDOMAIN=route.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nSSH_DOMAIN=route.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nROOT_URL=http://route.example.com
-
-  ################################################
-
-  - it: "[route tls termination] uses https for ROOT_URL"
-    template: templates/gitea/config.yaml
-    set:
-      route:
-        enabled: true
-        host: route.example.com
-        tls:
-          termination: edge
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nROOT_URL=https://route.example.com
-
-  ################################################
-
-  - it: "[HTTPRoute enabled] uses first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/gitea/config.yaml
-    set:
-      ingress:
-        hosts: []
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            hostnames:
-              - gw.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nDOMAIN=gw.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nSSH_DOMAIN=gw.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nROOT_URL=http://gw.example.com
-
-  ################################################
-
-  - it: "[HTTPRoute tls] switches ROOT_URL to https"
-    template: templates/gitea/config.yaml
-    set:
-      ingress:
-        hosts: []
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            tls: true
-            hostnames:
-              - gw.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.server
-          pattern: \nROOT_URL=https://gw.example.com

unittests/helm/config/session-config.yaml

@@ -3,9 +3,26 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "session is configured correctly for valkey"
-    template: templates/gitea/config.yaml
+  - it: "session is configured correctly for valkey-cluster"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=redis
+            PROVIDER_CONFIG=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "session is configured correctly for valkey"
+    template: templates/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -14,11 +31,13 @@ tests:
           path: stringData.session
           value: |-
             PROVIDER=redis
-            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
 
-  - it: "session is configured correctly for 'memory' when valkey is disabled"
-    template: templates/gitea/config.yaml
+  - it: "session is configured correctly for 'memory' when valkey (and valkey-cluster) is disabled"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: false
     asserts:
@@ -29,9 +48,11 @@ tests:
             PROVIDER=memory
             PROVIDER_CONFIG=
 
-  - it: "session can be customized when valkey is disabled"
-    template: templates/gitea/config.yaml
+  - it: "session can be customized when valkey (and valkey-cluster) is disabled"
+    template: templates/config.yaml
     set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: false
       gitea.config.session.PROVIDER: custom-provider

unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml

@@ -106,23 +106,14 @@ tests:
           name: gitea-unittests-postgresql-ha-pgpool
           namespace: testing
   - it: "[gitea] connects to pgpool service"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
           path: stringData.database
           pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
-  - it: "[gitea] connects to pgpool service with custom cluster domain"
-    set:
-      clusterDomain: my-special-cluster.local
-    template: templates/gitea/config.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.database
-          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
   - it: "[gitea] connects to configured database"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     asserts:
       - documentIndex: 0
         matchRegex:

unittests/helm/dependency-checks/customization-integrity-postgresql.yaml

@@ -65,23 +65,14 @@ tests:
           name: gitea-unittests-postgresql
           namespace: testing
   - it: "[gitea] connects to postgresql service"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
           path: stringData.database
           pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
-  - it: "[gitea] connects to postgresql service with custom cluster domain"
-    set:
-      clusterDomain: my-special-cluster.local
-    template: templates/gitea/config.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData.database
-          pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234
   - it: "[gitea] connects to configured database"
-    template: templates/gitea/config.yaml
+    template: templates/config.yaml
     asserts:
       - documentIndex: 0
         matchRegex:

unittests/helm/dependency-checks/customization-integrity-valkey-cluster.yaml

@@ -0,0 +1,90 @@
+suite: Dependency checks | Customization integrity | valkey-cluster
+release:
+  name: gitea-unittests
+  namespace: testing
+set:
+  valkey:
+    enabled: false
+  valkey-cluster:
+    enabled: true
+    usePassword: false
+    cluster:
+      nodes: 5
+      replicas: 2
+tests:
+  - it: "[valkey-cluster] configures correct nodes/replicas"
+    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.replicas
+          value: 5
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].args[0]
+          pattern: VALKEY_CLUSTER_REPLICAS="2"
+  - it: "[valkey-cluster] support auth-less connections"
+    asserts:
+      - template: charts/valkey-cluster/templates/secret.yaml
+        hasDocuments:
+          count: 0
+      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+        documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: ALLOW_EMPTY_PASSWORD
+            value: "yes"
+  - it: "[valkey-cluster] support auth-full connections"
+    set:
+      valkey-cluster:
+        usePassword: true
+    asserts:
+      - template: charts/valkey-cluster/templates/secret.yaml
+        containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-valkey-cluster
+          namespace: testing
+      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+        documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDISCLI_AUTH
+            valueFrom:
+              secretKeyRef:
+                name: gitea-unittests-valkey-cluster
+                key: valkey-password
+      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+        documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDISCLI_AUTH
+            valueFrom:
+              secretKeyRef:
+                name: gitea-unittests-valkey-cluster
+                key: valkey-password
+  - it: "[valkey-cluster] renders the referenced service"
+    template: charts/valkey-cluster/templates/headless-svc.yaml
+    asserts:
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: gitea-unittests-valkey-cluster-headless
+          namespace: testing
+      - documentIndex: 0
+        contains:
+          path: spec.ports
+          content:
+            name: tcp-redis
+            port: 6379
+            targetPort: tcp-redis
+  - it: "[gitea] waits for valkey-cluster to be up and running"
+    template: templates/init.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData["configure_gitea.sh"]
+          pattern: nc -vz -w2 gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local 6379

unittests/helm/dependency-checks/customization-integrity-valkey.yaml

@@ -3,50 +3,50 @@ release:
   name: gitea-unittests
   namespace: testing
 set:
+  valkey-cluster:
+    enabled: false
   valkey:
     enabled: true
-    auth:
-      enabled: true
-      aclUsers:
-        default:
-          permissions: "~* &* +@all"
-          password: gitea-password
+    architecture: standalone
+    global:
+      valkey:
+        password: gitea-password
+    master:
+      count: 2
 tests:
-  - it: "[valkey] valkey.auth.aclUsers.default.password is applied as expected"
+  - it: "[valkey] configures correct 'master' nodes"
+    template: charts/valkey/templates/primary/application.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.replicas
+          value: 1
+  - it: "[valkey] valkey.global.valkey.password is applied as expected"
     template: charts/valkey/templates/secret.yaml
     asserts:
       - documentIndex: 0
         equal:
-          path: data.default-password
+          path: data["valkey-password"]
           value: "Z2l0ZWEtcGFzc3dvcmQ="
   - it: "[valkey] renders the referenced service"
-    template: charts/valkey/templates/service.yaml
+    template: charts/valkey/templates/headless-svc.yaml
     asserts:
       - containsDocument:
           kind: Service
           apiVersion: v1
-          name: gitea-unittests-valkey
+          name: gitea-unittests-valkey-headless
+          namespace: testing
       - documentIndex: 0
         contains:
           path: spec.ports
           content:
-            name: tcp
+            name: tcp-redis
             port: 6379
-            targetPort: tcp
-            protocol: TCP
+            targetPort: redis
   - it: "[gitea] waits for valkey to be up and running"
-    template: templates/gitea/init.yaml
+    template: templates/init.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
           path: stringData["configure_gitea.sh"]
-          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
-  - it: "[gitea] waits for valkey to be up and running with custom cluster domain"
-    set:
-      clusterDomain: my-special-cluster.local
-    template: templates/gitea/init.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData["configure_gitea.sh"]
-          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379
+          pattern: nc -vz -w2 gitea-unittests-valkey-headless.testing.svc.cluster.local 6379

unittests/helm/dependency-checks/major-image-bump.yaml

@@ -15,7 +15,7 @@ tests:
         matchRegex:
           path: spec.template.spec.containers[0].image
           # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnamilegacy/postgresql-repmgr:17.+$
+          pattern: bitnami/postgresql-repmgr:17.+$
   - it: "[postgresql] ensures we detect major image version upgrades"
     template: charts/postgresql/templates/primary/statefulset.yaml
     set:
@@ -28,10 +28,25 @@ tests:
         matchRegex:
           path: spec.template.spec.containers[0].image
           # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnamilegacy/postgresql:17.+$
-  - it: "[valkey] ensures we detect major image version upgrades"
-    template: charts/valkey/templates/deploy_valkey.yaml
+          pattern: bitnami/postgresql:17.+$
+  - it: "[valkey-cluster] ensures we detect major image version upgrades"
+    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
     set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].image
+          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
+          pattern: bitnami/valkey-cluster:8.+$
+  - it: "[valkey] ensures we detect major image version upgrades"
+    template: charts/valkey/templates/primary/application.yaml
+    set:
+      valkey-cluster:
+        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -39,4 +54,4 @@ tests:
         matchRegex:
           path: spec.template.spec.containers[0].image
           # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: valkey/valkey:9.+$
+          pattern: bitnami/valkey:8.+$

unittests/helm/deployment/HA.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: fails with multiple replicas and "GIT_GC_REPOS" enabled
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       replicaCount: 2
       persistence:
@@ -22,14 +22,14 @@ tests:
       - failedTemplate:
           errorMessage: "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'."
   - it: fails with multiple replicas and RWX file system not set
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       replicaCount: 2
     asserts:
       - failedTemplate:
           errorMessage: "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany."
   - it: fails with multiple replicas and bleve issue indexer
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       replicaCount: 2
       persistence:
@@ -43,7 +43,7 @@ tests:
       - failedTemplate:
           errorMessage: "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)."
   - it: fails with multiple replicas and bleve repo indexer
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       replicaCount: 2
       persistence:

unittests/helm/deployment/basic.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: renders a deployment
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - hasDocuments:
           count: 1
@@ -16,7 +16,7 @@ tests:
           apiVersion: apps/v1
           name: gitea-unittests
   - it: deployment labels are set
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       deployment.labels:
         hello: world
@@ -29,42 +29,8 @@ tests:
           path: spec.template.metadata.labels
           content:
             hello: world
-      - isNotSubset:
-          path: spec.selector.matchLabels
-          content:
-            hello: world
-  - it: deployment labels are not in selector matchLabels
-    template: templates/gitea/deployment.yaml
-    set:
-      deployment.labels:
-        custom-label: custom-value
-        another-label: another-value
-    asserts:
-      - equal:
-          path: spec.selector.matchLabels
-          value:
-            app.kubernetes.io/name: gitea
-            app.kubernetes.io/instance: gitea-unittests
-  - it: nodeSelector is undefined
-    asserts:
-      - notExists:
-          path: spec.template.spec.nodeSelector
-        template: templates/gitea/deployment.yaml
-  - it: nodeSelector is defined
-    set:
-      nodeSelector:
-        foo: bar
-        bar: foo
-    asserts:
-      - isSubset:
-          path: spec.template.spec.nodeSelector
-          content:
-            foo: bar
-            bar: foo
-        template: templates/gitea/deployment.yaml
-
   - it: "injects TMP_EXISTING_ENVS_FILE as environment variable to 'init-app-ini' init container"
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - contains:
           path: spec.template.spec.initContainers[1].env
@@ -72,7 +38,7 @@ tests:
             name: TMP_EXISTING_ENVS_FILE
             value: /tmp/existing-envs
   - it: "injects ENV_TO_INI_MOUNT_POINT as environment variable to 'init-app-ini' init container"
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - contains:
           path: spec.template.spec.initContainers[1].env
@@ -80,7 +46,7 @@ tests:
             name: ENV_TO_INI_MOUNT_POINT
             value: /env-to-ini-mounts
   - it: CPU resources are defined as well as GOMAXPROCS
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       resources:
         limits:
@@ -108,7 +74,7 @@ tests:
               cpu: 100ms
               memory: 100Mi
   - it: Init containers have correct volumeMount path
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       initContainersScriptsVolumeMountPath: "/custom/init/path"
     asserts:
@@ -119,7 +85,7 @@ tests:
           path: spec.template.spec.initContainers[*].volumeMounts[?(@.name=="config")].mountPath
           value: "/custom/init/path"
   - it: Init containers have correct volumeMount path if there is no override
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - equal:
           path: spec.template.spec.initContainers[*].volumeMounts[?(@.name=="init")].mountPath

unittests/helm/deployment/deployment-additional-config.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: Renders a deployment
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - hasDocuments:
           count: 1
@@ -16,7 +16,7 @@ tests:
           apiVersion: apps/v1
           name: gitea-unittests
   - it: Deployment with empty additionalConfigFromEnvs
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea.additionalConfigFromEnvs: []
     asserts:
@@ -44,7 +44,7 @@ tests:
               - name: ENV_TO_INI_MOUNT_POINT
                 value: /env-to-ini-mounts
   - it: Deployment with standard additionalConfigFromEnvs
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea.additionalConfigFromEnvs: [{name: GITEA_database_HOST, value: my-db:123}, {name: GITEA_database_USER, value: my-user}]
     asserts:
@@ -76,7 +76,7 @@ tests:
               - name: GITEA_database_USER
                 value: my-user
   - it: Deployment with templated additionalConfigFromEnvs
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea.misc.host: my-db-host:321
       gitea.misc.user: my-db-user
@@ -110,7 +110,7 @@ tests:
               - name: GITEA_database_USER
                 value: my-db-user
   - it: Deployment with additionalConfigFromEnvs templated secret name
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea.misc.existingSecret: my-db-secret
       gitea.additionalConfigFromEnvs[0]:

unittests/helm/deployment/extraEnvSourceFile.yaml

@@ -1,82 +0,0 @@
-suite: deployment template (extraEnvSourceFile)
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
-tests:
-  - it: uses direct execution when extraEnvSourceFile is not set
-    template: templates/gitea/deployment.yaml
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[1].command
-          value: ["/usr/sbinx/config_environment.sh"]
-      - notExists:
-          path: spec.template.spec.initContainers[1].args
-      - equal:
-          path: spec.template.spec.initContainers[2].command
-          value: ["/usr/sbinx/configure_gitea.sh"]
-      - notExists:
-          path: spec.template.spec.initContainers[2].args
-
-  - it: sources env file in init-app-ini when extraEnvSourceFile is set
-    template: templates/gitea/deployment.yaml
-    set:
-      gitea:
-        extraEnvSourceFile: /vault/secrets/gitea
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[1].command
-          value: ["/bin/bash", "-c"]
-      - matchRegex:
-          path: spec.template.spec.initContainers[1].args[0]
-          pattern: source /vault/secrets/gitea
-      - matchRegex:
-          path: spec.template.spec.initContainers[1].args[0]
-          pattern: config_environment\.sh
-
-  - it: sources env file in configure-gitea when extraEnvSourceFile is set
-    template: templates/gitea/deployment.yaml
-    set:
-      gitea:
-        extraEnvSourceFile: /vault/secrets/gitea
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[2].command
-          value: ["/bin/bash", "-c"]
-      - matchRegex:
-          path: spec.template.spec.initContainers[2].args[0]
-          pattern: source /vault/secrets/gitea
-      - matchRegex:
-          path: spec.template.spec.initContainers[2].args[0]
-          pattern: configure_gitea\.sh
-
-  - it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
-    template: templates/gitea/deployment.yaml
-    set:
-      signing:
-        enabled: true
-        existingSecret: "custom-gpg-secret"
-      gitea:
-        extraEnvSourceFile: /vault/secrets/gitea
-    asserts:
-      - equal:
-          path: spec.template.spec.initContainers[2].command
-          value: ["/bin/bash", "-c"]
-      - matchRegex:
-          path: spec.template.spec.initContainers[2].args[0]
-          pattern: source /vault/secrets/gitea
-      - matchRegex:
-          path: spec.template.spec.initContainers[2].args[0]
-          pattern: configure_gpg_environment\.sh
-
-  - it: includes file existence check in source command
-    template: templates/gitea/deployment.yaml
-    set:
-      gitea:
-        extraEnvSourceFile: /vault/secrets/gitea
-    asserts:
-      - matchRegex:
-          path: spec.template.spec.initContainers[1].args[0]
-          pattern: "test -f /vault/secrets/gitea"

unittests/helm/deployment/extraInitContainers.yaml

@@ -3,18 +3,18 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: Render the deployment (default)
     asserts:
       - hasDocuments:
           count: 1
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
       - lengthEqual:
           path: spec.template.spec.initContainers
           count: 3
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
 
   - it: Render the deployment (signing)
     set:
@@ -22,11 +22,11 @@ tests:
     asserts:
       - hasDocuments:
           count: 1
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
       - lengthEqual:
           path: spec.template.spec.initContainers
           count: 4
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
 
   - it: Render the deployment (extraInitContainers)
     set:
@@ -40,20 +40,20 @@ tests:
     asserts:
       - hasDocuments:
           count: 1
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
       - lengthEqual:
           path: spec.template.spec.initContainers
           count: 6
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
       - contains:
           path: spec.template.spec.initContainers
           content:
             name: foo
             image: docker.io/library/busybox:latest
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml
       - contains:
           path: spec.template.spec.initContainers
           content:
             name: bar
             image: docker.io/library/busybox:latest
-        template: templates/gitea/deployment.yaml
+        template: templates/deployment.yaml

unittests/helm/deployment/image-configuration.yaml

@@ -6,17 +6,17 @@ chart:
   # Override appVersion to be consistent with used digest :)
   appVersion: 1.19.3
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: default values
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3-rootless"
   - it: tag override
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.tag: "1.19.4"
     asserts:
@@ -24,7 +24,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.4-rootless"
   - it: root-based image
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.rootless: false
     asserts:
@@ -32,7 +32,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3"
   - it: scoped registry
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.registry: "example.com"
     asserts:
@@ -40,7 +40,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "example.com/gitea:1.19.3-rootless"
   - it: global registry
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       global.imageRegistry: "global.example.com"
     asserts:
@@ -48,7 +48,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "global.example.com/gitea:1.19.3-rootless"
   - it: digest for rootless image
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image:
         rootless: true
@@ -58,7 +58,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3-rootless@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
   - it: image fullOverride (does not append rootless)
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image:
         fullOverride: docker.gitea.com/gitea:1.19.3
@@ -73,7 +73,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3"
   - it: digest for root-based image
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image:
         rootless: false
@@ -83,7 +83,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
   - it: digest and global registry
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       global.imageRegistry: "global.example.com"
       image.digest: "sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
@@ -92,7 +92,7 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "global.example.com/gitea:1.19.3-rootless@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
   - it: correctly renders floating tag references
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
     asserts:

unittests/helm/deployment/ingress-configuration.yaml

@@ -1,6 +1,6 @@
 suite: Test ingress tpl use
 templates:
-  - templates/gitea/ingress.yaml
+  - templates/ingress.yaml
 tests:
   - it: Ingress Class using TPL
     set:

unittests/helm/deployment/inline-config.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/config.yaml
+  - templates/config.yaml
 tests:
   - it: inline config stringData.server using TPL
     set:

unittests/helm/deployment/openshift.yaml

@@ -1,106 +0,0 @@
-suite: deployment template (openshift)
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
-tests:
-  - it: renders openshift-compatible defaults for chart-managed containers
-    template: templates/gitea/deployment.yaml
-    set:
-      openshift.enabled: true
-    asserts:
-      - notExists:
-          path: spec.template.spec.hostUsers
-      - notExists:
-          path: spec.template.spec.securityContext
-      - equal:
-          path: spec.template.spec.initContainers[0].securityContext
-          value:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
-      - equal:
-          path: spec.template.spec.initContainers[1].securityContext
-          value:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
-      - equal:
-          path: spec.template.spec.initContainers[2].securityContext
-          value:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
-      - equal:
-          path: spec.template.spec.containers[0].securityContext
-          value:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
-
-  - it: does not force runAsUser 1000 for command init containers on OpenShift
-    template: templates/gitea/deployment.yaml
-    set:
-      openshift.enabled: true
-      signing.enabled: true
-      signing.existingSecret: custom-gpg-secret
-    asserts:
-      - notExists:
-          path: spec.template.spec.initContainers[2].securityContext.runAsUser
-      - notExists:
-          path: spec.template.spec.initContainers[3].securityContext.runAsUser
-
-  - it: preserves explicit pod and container security context overrides on OpenShift
-    template: templates/gitea/deployment.yaml
-    set:
-      openshift:
-        enabled: true
-        hostUsers: true
-      podSecurityContext:
-        fsGroup: 1000620000
-      containerSecurityContext:
-        runAsUser: 1000620000
-        runAsGroup: 1000620000
-    asserts:
-      - equal:
-          path: spec.template.spec.hostUsers
-          value: true
-      - equal:
-          path: spec.template.spec.securityContext
-          value:
-            fsGroup: 1000620000
-      - equal:
-          path: spec.template.spec.initContainers[2].securityContext.runAsUser
-          value: 1000620000
-      - equal:
-          path: spec.template.spec.containers[0].securityContext.runAsGroup
-          value: 1000620000
-
-  - it: renders an explicit hostUsers=false override on OpenShift
-    template: templates/gitea/deployment.yaml
-    set:
-      openshift:
-        enabled: true
-        hostUsers: false
-    asserts:
-      - equal:
-          path: spec.template.spec.hostUsers
-          value: false

unittests/helm/deployment/probes.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: renders default liveness probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - notExists:
           path: spec.template.spec.containers[0].livenessProbe.enabled
@@ -22,7 +22,7 @@ tests:
               port: http
             timeoutSeconds: 1
   - it: renders default readiness probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - notExists:
           path: spec.template.spec.containers[0].readinessProbe.enabled
@@ -37,12 +37,12 @@ tests:
               port: http
             timeoutSeconds: 1
   - it: does not render a default startup probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - notExists:
           path: spec.template.spec.containers[0].startupProbe
   - it: allows enabling a startup probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea.startupProbe.enabled: true
     asserts:
@@ -60,7 +60,7 @@ tests:
             timeoutSeconds: 1
 
   - it: allows overwriting the default port of the liveness probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea:
         livenessProbe:
@@ -74,7 +74,7 @@ tests:
               port: my-port
 
   - it: allows overwriting the default port of the readiness probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea:
         readinessProbe:
@@ -88,7 +88,7 @@ tests:
               port: my-port
 
   - it: allows overwriting the default port of the startup probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea:
         startupProbe:
@@ -103,7 +103,7 @@ tests:
               port: my-port
 
   - it: allows using a non-default method as liveness probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea:
         livenessProbe:
@@ -131,7 +131,7 @@ tests:
             timeoutSeconds: 13372
 
   - it: allows using a non-default method as readiness probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea:
         readinessProbe:
@@ -159,7 +159,7 @@ tests:
             timeoutSeconds: 13372
 
   - it: allows using a non-default method as startup probe
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       gitea:
         startupProbe:

unittests/helm/deployment/sidecar-container.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: supports adding a sidecar container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       extraContainers:
         - name: sidecar-bob

unittests/helm/deployment/signing-disabled.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: skips gpg init container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - notContains:
           path: spec.template.spec.initContainers
@@ -15,7 +15,7 @@ tests:
           content:
             name: configure-gpg
   - it: skips gpg env in `init-directories` init container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       signing.enabled: false
     asserts:
@@ -25,14 +25,14 @@ tests:
             name: GNUPGHOME
             value: /data/git/.gnupg
   - it: skips gpg env in runtime container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - notContains:
           path: spec.template.spec.containers[0].env
           content:
             name: GNUPGHOME
   - it: skips gpg volume spec
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     asserts:
       - notContains:
           path: spec.template.spec.volumes

unittests/helm/deployment/signing-enabled.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: adds gpg init container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       signing:
         enabled: true
@@ -41,7 +41,7 @@ tests:
               mountPath: /raw
               readOnly: true
   - it: adds gpg env in `init-directories` init container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       signing.enabled: true
       signing.existingSecret: "custom-gpg-secret"
@@ -52,7 +52,7 @@ tests:
             name: GNUPGHOME
             value: /data/git/.gnupg
   - it: adds gpg env in runtime container
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       signing.enabled: true
       signing.existingSecret: "custom-gpg-secret"
@@ -63,7 +63,7 @@ tests:
             name: GNUPGHOME
             value: /data/git/.gnupg
   - it: adds gpg volume spec
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       signing:
         enabled: true
@@ -80,7 +80,7 @@ tests:
                   path: private.asc
               defaultMode: 0100
   - it: supports gpg volume spec with external reference
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       signing:
         enabled: true

unittests/helm/deployment/ssh-configuration.yaml

@@ -3,11 +3,11 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/deployment.yaml
-  - templates/gitea/config.yaml
+  - templates/deployment.yaml
+  - templates/config.yaml
 tests:
   - it: supports defining SSH log level for root based image
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.rootless: false
     asserts:
@@ -17,7 +17,7 @@ tests:
             name: SSH_LOG_LEVEL
             value: "INFO"
   - it: supports overriding SSH log level
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.rootless: false
       gitea.ssh.logLevel: "DEBUG"
@@ -28,7 +28,7 @@ tests:
             name: SSH_LOG_LEVEL
             value: "DEBUG"
   - it: supports overriding SSH log level (even when image.fullOverride set)
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.fullOverride: docker.gitea.com/gitea:1.19.3
       image.rootless: false
@@ -40,7 +40,7 @@ tests:
             name: SSH_LOG_LEVEL
             value: "DEBUG"
   - it: skips SSH_LOG_LEVEL for rootless image
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.rootless: true
       gitea.ssh.logLevel: "DEBUG" # explicitly defining a non-standard level here
@@ -51,7 +51,7 @@ tests:
           content:
             name: SSH_LOG_LEVEL
   - it: skips SSH_LOG_LEVEL for rootless image (even when image.fullOverride set)
-    template: templates/gitea/deployment.yaml
+    template: templates/deployment.yaml
     set:
       image.fullOverride: docker.gitea.com/gitea:1.19.3
       image.rootless: true

unittests/helm/deployment/storage-class-configuration.yaml

@@ -7,11 +7,11 @@ release:
   namespace: testing
 
 templates:
-  - templates/gitea/pvc.yaml
+  - templates/pvc.yaml
 
 tests:
   - it: should set storageClassName when persistence.storageClass is defined
-    template: templates/gitea/pvc.yaml
+    template: templates/pvc.yaml
     set:
       persistence.storageClass: "my-storage-class"
     asserts:
@@ -20,7 +20,7 @@ tests:
           value: "my-storage-class"
 
   - it: should set global.storageClass when persistence.storageClass is not defined
-    template: templates/gitea/pvc.yaml
+    template: templates/pvc.yaml
     set:
       global.storageClass: "default-storage-class"
     asserts:
@@ -29,7 +29,7 @@ tests:
           value: "default-storage-class"
 
   - it: should set storageClassName when persistence.storageClass is defined and global.storageClass is defined
-    template: templates/gitea/pvc.yaml
+    template: templates/pvc.yaml
     set:
       global.storageClass: "default-storage-class"
       persistence.storageClass: "my-storage-class"

unittests/helm/deployment/svc-configuration.yaml

@@ -1,13 +1,13 @@
-suite: sshService / httpService template (Services configuration)
+suite: ssh-svc / http-svc template (Services configuration)
 release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/sshService.yaml
-  - templates/gitea/httpService.yaml
+  - templates/ssh-svc.yaml
+  - templates/http-svc.yaml
 tests:
-  - it: supports adding custom labels to sshService
-    template: templates/gitea/sshService.yaml
+  - it: supports adding custom labels to ssh-svc
+    template: templates/ssh-svc.yaml
     set:
       service:
         ssh:
@@ -19,7 +19,7 @@ tests:
           value: "testvalue"
 
   - it: keeps existing labels (ssh)
-    template: templates/gitea/sshService.yaml
+    template: templates/ssh-svc.yaml
     set:
       service:
         ssh:
@@ -28,8 +28,8 @@ tests:
       - exists:
           path: metadata.labels["app"]
 
-  - it: supports adding custom labels to httpService
-    template: templates/gitea/httpService.yaml
+  - it: supports adding custom labels to http-svc
+    template: templates/http-svc.yaml
     set:
       service:
         http:
@@ -41,7 +41,7 @@ tests:
           value: "testvalue"
 
   - it: keeps existing labels (http)
-    template: templates/gitea/httpService.yaml
+    template: templates/http-svc.yaml
     set:
       service:
         http:
@@ -51,7 +51,7 @@ tests:
           path: metadata.labels["app"]
 
   - it: render service.ssh.loadBalancerClass if set and type is LoadBalancer
-    template: templates/gitea/sshService.yaml
+    template: templates/ssh-svc.yaml
     set:
       service:
         ssh:
@@ -73,7 +73,7 @@ tests:
           value: ["1.2.3.4/32", "5.6.7.8/32"]
 
   - it: does not render when loadbalancer properties are set but type is not loadBalancerClass
-    template: templates/gitea/httpService.yaml
+    template: templates/http-svc.yaml
     set:
       service:
         http:
@@ -92,7 +92,7 @@ tests:
           path: spec.loadBalancerSourceRanges
 
   - it: does not render loadBalancerClass by default even when type is LoadBalancer
-    template: templates/gitea/httpService.yaml
+    template: templates/http-svc.yaml
     set:
       service:
         http:
@@ -107,8 +107,8 @@ tests:
 
   - it: both ssh and http services exist
     templates:
-      - templates/gitea/sshService.yaml
-      - templates/gitea/httpService.yaml
+      - templates/ssh-svc.yaml
+      - templates/http-svc.yaml
     asserts:
       - matchRegex:
           path: metadata.name

unittests/helm/gatewayAPI/backendTLSPolicy.yaml

@@ -1,89 +0,0 @@
-suite: Test Gateway API backendTLSPolicy.yaml
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/backendTLSPolicy.yaml
-tests:
-  - it: should not render when gatewayAPI.enabled is false
-    set:
-      gatewayAPI:
-        enabled: false
-        core:
-          backendTLSPolicy:
-            enabled: true
-            validation:
-              hostname: git.internal
-              caCertificateRefs:
-                - name: gitea-ca
-                  group: ""
-                  kind: ConfigMap
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should not render when backendTLSPolicy.enabled is false
-    set:
-      gatewayAPI:
-        enabled: true
-      gatewayAPI.core.backendTLSPolicy.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should render a BackendTLSPolicy targeting the http Service by default
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          backendTLSPolicy:
-            enabled: true
-            validation:
-              hostname: git.internal
-              caCertificateRefs:
-                - name: gitea-ca
-                  group: ""
-                  kind: ConfigMap
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: BackendTLSPolicy
-      - equal:
-          path: apiVersion
-          value: gateway.networking.k8s.io/v1
-      - equal:
-          path: metadata.name
-          value: gitea-unittests
-      - equal:
-          path: spec.targetRefs[0].name
-          value: gitea-unittests-http
-      - equal:
-          path: spec.targetRefs[0].kind
-          value: Service
-      - equal:
-          path: spec.validation.hostname
-          value: git.internal
-
-  - it: should fail when validation is missing
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          backendTLSPolicy:
-            enabled: true
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.core.backendTLSPolicy.validation is required
-
-  - it: should fail when validation is an empty dict
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          backendTLSPolicy:
-            enabled: true
-            validation: {}
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.core.backendTLSPolicy.validation is required

unittests/helm/gatewayAPI/clientSettingsPolicy.yaml

@@ -1,105 +0,0 @@
-suite: Test Gateway API clientSettingsPolicy.yaml
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/clientSettingsPolicy.yaml
-tests:
-  - it: should not render when gatewayAPI.enabled is false
-    set:
-      gatewayAPI:
-        enabled: false
-        nginx:
-          clientSettingsPolicies:
-            enabled: true
-            body:
-              maxSize: 100m
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should not render when clientSettingsPolicies.enabled is false
-    set:
-      gatewayAPI:
-        enabled: true
-      gatewayAPI.nginx.clientSettingsPolicies.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should render a ClientSettingsPolicy targeting the HTTPRoute by default
-    set:
-      gatewayAPI:
-        enabled: true
-        nginx:
-          clientSettingsPolicies:
-            enabled: true
-            body:
-              maxSize: 100m
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: ClientSettingsPolicy
-      - equal:
-          path: apiVersion
-          value: gateway.nginx.org/v1alpha1
-      - equal:
-          path: metadata.name
-          value: gitea-unittests
-      - equal:
-          path: spec.targetRef.group
-          value: gateway.networking.k8s.io
-      - equal:
-          path: spec.targetRef.kind
-          value: HTTPRoute
-      - equal:
-          path: spec.targetRef.name
-          value: gitea-unittests
-      - equal:
-          path: spec.body.maxSize
-          value: 100m
-
-  - it: should honor a custom targetRef
-    set:
-      gatewayAPI:
-        enabled: true
-        nginx:
-          clientSettingsPolicies:
-            enabled: true
-            targetRef:
-              group: gateway.networking.k8s.io
-              kind: Gateway
-              name: shared-gateway
-            body:
-              maxSize: 100m
-    asserts:
-      - equal:
-          path: spec.targetRef.kind
-          value: Gateway
-      - equal:
-          path: spec.targetRef.name
-          value: shared-gateway
-
-  - it: should fail when body is missing
-    set:
-      gatewayAPI:
-        enabled: true
-        nginx:
-          clientSettingsPolicies:
-            enabled: true
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.nginx.clientSettingsPolicies.body is required
-
-  - it: should fail when body is an empty dict
-    set:
-      gatewayAPI:
-        enabled: true
-        nginx:
-          clientSettingsPolicies:
-            enabled: true
-            body: {}
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.nginx.clientSettingsPolicies.body is required

unittests/helm/gatewayAPI/httpRoute.yaml

@@ -1,117 +0,0 @@
-suite: Test Gateway API httpRoute.yaml
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/httpRoute.yaml
-tests:
-  - it: should not render when gatewayAPI.enabled is false
-    set:
-      gatewayAPI:
-        enabled: false
-        core:
-          httpRoute:
-            enabled: true
-            hostnames:
-              - git.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should not render when httpRoute.enabled is false
-    set:
-      gatewayAPI:
-        enabled: true
-      gatewayAPI.core.httpRoute.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should render a single HTTPRoute with default rule
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            annotations:
-              example.io/owner: gitea
-            hostnames:
-              - git.example.com
-            parentRefs:
-              - name: shared-gateway
-                namespace: gateway-system
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: HTTPRoute
-      - equal:
-          path: apiVersion
-          value: gateway.networking.k8s.io/v1
-      - equal:
-          path: metadata.name
-          value: gitea-unittests
-      - equal:
-          path: metadata.annotations["example.io/owner"]
-          value: gitea
-      - equal:
-          path: spec.parentRefs[0].name
-          value: shared-gateway
-      - equal:
-          path: spec.parentRefs[0].namespace
-          value: gateway-system
-      - equal:
-          path: spec.hostnames[0]
-          value: git.example.com
-      - equal:
-          path: spec.rules[0].matches[0].path.value
-          value: /
-      - equal:
-          path: spec.rules[0].backendRefs[0].group
-          value: ""
-      - equal:
-          path: spec.rules[0].backendRefs[0].kind
-          value: Service
-      - equal:
-          path: spec.rules[0].backendRefs[0].name
-          value: gitea-unittests-http
-      - equal:
-          path: spec.rules[0].backendRefs[0].port
-          value: 3000
-      - equal:
-          path: spec.rules[0].backendRefs[0].weight
-          value: 1
-
-  - it: should fail when parentRefs missing
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            hostnames:
-              - git.example.com
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.core.httpRoute.parentRefs is required
-
-  - it: hostname tpl rendering
-    set:
-      global:
-        giteaHostName: gitea.tpl.example.com
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            hostnames:
-              - "{{ .Values.global.giteaHostName }}"
-            parentRefs:
-              - name: gw
-    asserts:
-      - equal:
-          path: spec.hostnames[0]
-          value: gitea.tpl.example.com

unittests/helm/gatewayAPI/tcpRoute.yaml

@@ -1,79 +0,0 @@
-suite: Test Gateway API tcpRoute.yaml
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/gitea/tcpRoute.yaml
-tests:
-  - it: should not render when gatewayAPI.enabled is false
-    set:
-      gatewayAPI:
-        enabled: false
-        core:
-          tcpRoute:
-            enabled: true
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should not render when tcpRoute.enabled is false
-    set:
-      gatewayAPI:
-        enabled: true
-      gatewayAPI.core.tcpRoute.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: should render a TCPRoute defaulting to the SSH service
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          tcpRoute:
-            enabled: true
-            parentRefs:
-              - name: shared-gateway
-                sectionName: ssh
-    asserts:
-      - hasDocuments:
-          count: 1
-      - isKind:
-          of: TCPRoute
-      - equal:
-          path: apiVersion
-          value: gateway.networking.k8s.io/v1alpha2
-      - equal:
-          path: metadata.name
-          value: gitea-unittests
-      - equal:
-          path: spec.parentRefs[0].sectionName
-          value: ssh
-      - equal:
-          path: spec.rules[0].backendRefs[0].group
-          value: ""
-      - equal:
-          path: spec.rules[0].backendRefs[0].kind
-          value: Service
-      - equal:
-          path: spec.rules[0].backendRefs[0].name
-          value: gitea-unittests-ssh
-      - equal:
-          path: spec.rules[0].backendRefs[0].port
-          value: 22
-      - equal:
-          path: spec.rules[0].backendRefs[0].weight
-          value: 1
-
-  - it: should fail when parentRefs missing
-    set:
-      gatewayAPI:
-        enabled: true
-        core:
-          tcpRoute:
-            enabled: true
-    asserts:
-      - failedTemplate:
-          errorMessage: gatewayAPI.core.tcpRoute.parentRefs is required

unittests/helm/gpg-secret/signing-disabled.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/gpg-secret.yaml
+  - templates/gpg-secret.yaml
 tests:
   - it: renders nothing
     set:

unittests/helm/gpg-secret/signing-enabled.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/gpg-secret.yaml
+  - templates/gpg-secret.yaml
 tests:
   - it: fails rendering when nothing is configured
     set:

unittests/helm/ingress/basic.yaml

@@ -1,6 +1,6 @@
 suite: Test ingress.yaml
 templates:
-  - templates/gitea/ingress.yaml
+  - templates/ingress.yaml
 tests:
   - it: should enable ingress when ingress.enabled is true
     set:

unittests/helm/ingress/implicit-defaults.yaml

@@ -1,6 +1,6 @@
 suite: Test ingress with implicit path defaults
 templates:
-  - templates/gitea/ingress.yaml
+  - templates/ingress.yaml
 tests:
   - it: should use default path and pathType when no paths are specified
     set:

unittests/helm/ingress/ingress.tpl.yaml

@@ -1,6 +1,6 @@
 suite: Test ingress tpl use
 templates:
-  - templates/gitea/ingress.yaml
+  - templates/ingress.yaml
 tests:
   - it: Ingress Class using TPL
     set:

unittests/helm/ingress/structured-paths.yaml

@@ -1,6 +1,6 @@
 suite: Test ingress with structured paths
 templates:
-  - templates/gitea/ingress.yaml
+  - templates/ingress.yaml
 tests:
   - it: should work with structured path definitions
     set:

unittests/helm/init/basic.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/init.yaml
+  - templates/init.yaml
 tests:
   - it: renders a secret
     asserts:

unittests/helm/init/init_directory_structure.sh-rootless.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/init.yaml
+  - templates/init.yaml
 tests:
   - it: runs gpg in batch mode
     set:
@@ -63,7 +63,7 @@ tests:
               chown -v 1000:1000 "${GNUPGHOME}"
             fi
   - it: it does not chown /data even when image.fullOverride is set
-    template: templates/gitea/init.yaml
+    template: templates/init.yaml
     set:
       image.fullOverride: docker.gitea.com/gitea:1.20.5
     asserts:

unittests/helm/init/init_directory_structure.sh.yaml

@@ -3,7 +3,7 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/gitea/init.yaml
+  - templates/init.yaml
 tests:
   - it: runs gpg in batch mode
     set: