chore(deps): update bats testing framework

Co-authored-by: CSRBot <csrbot@cryptic.systems>
Co-committed-by: CSRBot <csrbot@cryptic.systems>

.gitea/scripts/add-annotations.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+
+set -e
+
+CHART_FILE="Chart.yaml"
+if [ ! -f "${CHART_FILE}" ]; then
+  echo "ERROR: ${CHART_FILE} not found!" 1>&2
+  exit 1
+fi
+
+DEFAULT_NEW_TAG="$(git tag --sort=-version:refname | head -n 1)"
+DEFAULT_OLD_TAG="$(git tag --sort=-version:refname | head -n 2 | tail -n 1)"
+
+if [ -z "${1}" ]; then
+  read -p "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
+  if [ -z "${OLD_TAG}" ]; then
+    OLD_TAG="${DEFAULT_OLD_TAG}"
+  fi
+
+  while [ -z "$(git tag --list "${OLD_TAG}")" ]; do
+    echo "ERROR: Tag '${OLD_TAG}' not found!" 1>&2
+    read -p "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
+    if [ -z "${OLD_TAG}" ]; then
+      OLD_TAG="${DEFAULT_OLD_TAG}"
+    fi
+  done
+else
+  OLD_TAG=${1}
+  if [ -z "$(git tag --list "${OLD_TAG}")" ]; then
+    echo "ERROR: Tag '${OLD_TAG}' not found!" 1>&2
+    exit 1
+  fi
+fi
+
+if [ -z "${2}" ]; then
+  read -p "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
+  if [ -z "${NEW_TAG}" ]; then
+    NEW_TAG="${DEFAULT_NEW_TAG}"
+  fi
+
+  while [ -z "$(git tag --list "${NEW_TAG}")" ]; do
+    echo "ERROR: Tag '${NEW_TAG}' not found!" 1>&2
+    read -p "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
+    if [ -z "${NEW_TAG}" ]; then
+      NEW_TAG="${DEFAULT_NEW_TAG}"
+    fi
+  done
+else
+  NEW_TAG=${2}
+
+  if [ -z "$(git tag --list "${NEW_TAG}")" ]; then
+    echo "ERROR: Tag '${NEW_TAG}' not found!" 1>&2
+    exit 1
+  fi
+fi
+
+CHANGE_LOG_YAML=$(mktemp)
+echo "[]" > "${CHANGE_LOG_YAML}"
+
+function map_type_to_kind() {
+  case "${1}" in
+    feat)
+      echo "added"
+    ;;
+    fix)
+      echo "fixed"
+    ;;
+    chore|style|test|ci|docs|refac)
+      echo "changed"
+    ;;
+    revert)
+      echo "removed"
+    ;;
+    sec)
+      echo "security"
+    ;;
+    *)
+      echo "skip"
+    ;;
+  esac
+}
+
+COMMIT_TITLES="$(git log --pretty=format:"%s" "${OLD_TAG}..${NEW_TAG}")"
+
+echo "INFO: Generate change log entries from ${OLD_TAG} until ${NEW_TAG}"
+
+while IFS= read -r line; do
+  if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
+    TYPE="${BASH_REMATCH[1]}"
+    KIND=$(map_type_to_kind "${TYPE}")
+
+    if [ "${KIND}" == "skip" ]; then
+      continue
+    fi
+
+    DESC="${BASH_REMATCH[3]}"
+
+    echo "- ${KIND}: ${DESC}"
+
+    jq --arg kind "${KIND}" --arg description "${DESC}" '. += [ $ARGS.named ]' < "${CHANGE_LOG_YAML}" > "${CHANGE_LOG_YAML}.new"
+    mv "${CHANGE_LOG_YAML}.new" "${CHANGE_LOG_YAML}"
+
+  fi
+done <<< "${COMMIT_TITLES}"
+
+if [ -s "${CHANGE_LOG_YAML}" ]; then
+  yq --inplace --input-format json --output-format yml "${CHANGE_LOG_YAML}"
+  yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${CHANGE_LOG_YAML}\") | sort_keys(.)" "${CHART_FILE}"
+else
+  echo "ERROR: Changelog file is empty: ${CHANGE_LOG_YAML}" 1>&2
+  exit 1
+fi
+
+rm "${CHANGE_LOG_YAML}"

.gitea/workflows/bash.yaml

@@ -1,29 +0,0 @@
-name: Bash
-
-on:
-  pull_request:
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches:
-    - '**'
-    tags-ignore:
-    - '**'
-  workflow_dispatch: {}
-
-jobs:
-  bash-unittest:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      with:
-        submodules: true
-    - env:
-          TERM: xterm
-      name: Run bash unittests
-      run: make bash/unittest
-
-  shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0

.gitea/workflows/changelog.yml

@@ -8,12 +8,12 @@ on:
 jobs:
   changelog:
     runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:2.1.3
+    container: docker.io/thegeeklab/git-sv:2.0.11
     steps:
       - name: install tools
         run: |
           apk add -q --update --no-cache nodejs curl jq sed
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Generate upcoming changelog

.gitea/workflows/commit-lints.yml

@@ -1,16 +0,0 @@
-name: Commit Linter
-
-on:
-  pull_request:
-    branches: [ "*" ]
-    types: [ "opened", "edited" ]
-
-jobs:
-  check-and-test:
-    runs-on: ubuntu-latest
-    container: docker.io/commitlint/commitlint:21.2.1
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - name: Verify PR title
-        run: |
-          echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json

.gitea/workflows/commitlint.yml

@@ -0,0 +1,19 @@
+name: commitlint
+
+on:
+  pull_request:
+    branches:
+      - "*"
+    types:
+      - opened
+      - edited
+
+jobs:
+  check-and-test:
+    runs-on: ubuntu-latest
+    container: commitlint/commitlint:20.5.1
+    steps:
+      - uses: actions/checkout@v6
+      - name: check PR title
+        run: |
+          echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json

.gitea/workflows/helm.yaml

@@ -1,41 +0,0 @@
-name: Helm
-
-on:
-  pull_request:
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches:
-    - '**'
-    tags-ignore:
-    - '**'
-  workflow_dispatch: {}
-
-jobs:
-  helm-lint:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
-      with:
-        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
-    - name: Update helm dependencies
-      run: helm dependency update
-    - name: Lint helm files
-      run: |
-        helm lint --values values.yaml .
-
-  helm-unittest:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
-      with:
-        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
-    - env:
-        HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
-      name: Install helm-unittest
-      run: helm plugin install --verify=false --version "${HELM_UNITTEST_VERSION}" https://github.com/helm-unittest/helm-unittest
-    - name: Update helm dependencies
-      run: helm dependency update
-    - name: Execute helm unittests
-      run: helm unittest --strict --file 'unittests/**/*.yaml' .

.gitea/workflows/markdown-linters.yaml

@@ -1,44 +0,0 @@
-name: Markdown linter
-
-on:
-  pull_request:
-    paths: [ "**/*.md" ]
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches:
-    - '**'
-    paths: [ "**/*.md" ]
-    tags-ignore:
-    - '**'
-  workflow_dispatch: {}
-
-jobs:
-  markdown-link-checker:
-    container:
-      image: docker.io/library/node:26.8.2-alpine
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install tooling
-      run: |
-        apk update
-        apk add git npm
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - name: Verify links in markdown files
-      run: |
-        npm install
-        npm run readme:link
-
-  markdown-lint:
-    container:
-      image: docker.io/library/node:26.8.2-alpine
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install tooling
-      run: |
-        apk update
-        apk add git
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - name: Lint markdown files
-      run: |
-        npm install
-        npm run readme:lint

.gitea/workflows/release-version.yml

@@ -9,7 +9,7 @@ jobs:
   generate-chart-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -21,13 +21,22 @@ jobs:
       - name: Install helm
         env:
           # renovate: datasource=docker depName=alpine/helm
-          HELM_VERSION: "3.21.3"
+          HELM_VERSION: "3.20.2"
         run: |
           curl --fail --location --output /dev/stdout --silent --show-error https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
           mv linux-$(dpkg --print-architecture)/helm /usr/local/bin/
           rm --force --recursive linux-$(dpkg --print-architecture) helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz
           helm version
 
+      - name: Install yq
+        env:
+          YQ_VERSION: v4.45.4 # renovate: datasource=github-releases depName=mikefarah/yq
+        run: |
+          curl --fail --location --output /dev/stdout --silent --show-error https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
+          mv yq_linux_$(dpkg --print-architecture) /usr/local/bin
+          rm --force --recursive yq_linux_$(dpkg --print-architecture) yq_linux_$(dpkg --print-architecture).tar.gz
+          yq --version
+
       - name: Install docker-ce via apt
         run: |
           install -m 0755 -d /etc/apt/keyrings
@@ -44,14 +53,20 @@ jobs:
 
       - name: Import GPG key
         id: import_gpg
-        uses: https://github.com/crazy-max/ghaction-import-gpg@v7
+        uses: https://github.com/crazy-max/ghaction-import-gpg@v6
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
 
       - name: Add Artifacthub.io annotations
-        uses: volker-raschek/ah-annotations@v0.2.0
+        run: |
+          NEW_TAG="$(git tag --sort=-version:refname | head --lines 1)"
+          OLD_TAG="$(git tag --sort=-version:refname | head --lines 2 | tail --lines 1)"
+          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
+
+      - name: Print Chart.yaml
+        run: cat Chart.yaml
 
       # Using helm gpg plugin as 'helm package --sign' has issues with gpg2: https://github.com/helm/helm/issues/2843
       - name: package chart
@@ -70,25 +85,26 @@ jobs:
           helm push gitea/gitea-${GITHUB_REF#refs/tags/v}.tgz oci://registry-1.docker.io/giteacharts
           helm registry logout registry-1.docker.io
 
-      - name: Copy files to Cloudflare R2
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: auto
-          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
-          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
+      - name: aws credential configure
+        uses: https://github.com/aws-actions/configure-aws-credentials@v5
+        with:
+          aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Copy files to S3 and clear cache
         run: |
-          aws s3 sync gitea/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com
+          aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET}}/charts/
 
   release-gitea:
     needs: generate-chart-publish
     runs-on: ubuntu-latest
-    container: docker.io/thegeeklab/git-sv:2.1.3
+    container: docker.io/thegeeklab/git-sv:2.0.11
     steps:
       - name: install tools
         run: |
           apk add -q --update --no-cache nodejs
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@v6
         with:
           fetch-tags: true
           fetch-depth: 0

.gitea/workflows/test-pr.yml

@@ -0,0 +1,45 @@
+name: check-and-test
+
+on:
+  pull_request:
+    branches:
+      - "*"
+  push:
+    branches:
+      - main
+
+env:
+  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
+  HELM_UNITTEST_VERSION: "v1.0.3"
+
+jobs:
+  check-and-test:
+    runs-on: ubuntu-latest
+    container: alpine/helm:3.20.2
+    steps:
+      - name: install tools
+        run: |
+          apk update
+          apk add --update bash make nodejs npm yamllint ncurses
+      - uses: actions/checkout@v6
+      - name: install chart dependencies
+        run: helm dependency build
+      - name: lint
+        run: helm lint
+      - name: template
+        run: helm template --debug gitea-helm .
+      - name: prepare unit test environment
+        run: |
+          helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
+          git submodule update --init --recursive
+      - name: unit tests
+        env:
+          TERM: xterm
+        run: |
+          make unittests
+      - name: verify readme
+        run: |
+          make readme
+          git diff --exit-code --name-only README.md
+      - name: yaml lint
+        uses: https://github.com/ibiqlik/action-yamllint@v3

.github/copilot-instructions.md

@@ -1,75 +0,0 @@
-# Gitea Helm Chart — Copilot Instructions
-
-## Project Overview
-
-Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes a sub-chart for Valkey. The database is provisioned as a CloudNativePG `Cluster` resource, the operator itself is not part of the chart.
-
-## Build & Test
-
-```bash
-make missing-dot       # Check if the @param annotations are missing a trailing dot.
-make readme            # Regenerate README.md parameter table + lint + link checker
-make helm/unittest     # Run Helm unit tests (helm-unittest plugin required)
-make bash/unittest     # Run bash/bats script tests (requires git submodule init)
-```
-
-Always run `make readme` after changing `values.yaml` `@param` annotations.
-Always run `make helm/unittest` after changing templates or unit tests.
-
-## Conventions
-
-### values.yaml
-
-- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
-- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
-- Top-level keys are sorted alphabetically within their section group.
-- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
-
-```yaml
-image:
-  registry: docker.io
-  repository: library/busybox
-  tag: 0.1.0
-```
-
-### Templates
-
-- Helm templates live in `templates/`. Helpers live in `templates/_helpers.tpl`.
-- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
-- Use `include "gitea.fullname"` for naming resources.
-- Use `fail` for required-value validation with clear error messages referencing the full values path.
-- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
-- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
-- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
-- Use as prefix of YAML files the resource kind (e.g., `deployment.yaml` for `Deployment` resources). If there are multiple resources of the same kind, use a descriptive suffix (e.g., `deployment_metrics.yaml` for a `Deployment` related to metrics).
-- Short names like `pvc` for Persistent Volume Claims or `svc` for Services are not allowed in file names or key names.
-- Render `Secret` payloads as base64 `data` and never as `stringData`. The API server drops `stringData` and persists everything under `data`, so Helm's three-way merge cannot prune a key that was removed from the values — the stale key survives every upgrade. For example:
-
-```yaml
-data:
-  app.ini: {{ $config | b64enc }}
-```
-
-### Unit Tests
-
-- Helm unit tests live in `unittests/helm/` mirroring the template structure. A suite belongs into the directory of the template it asserts on, never into the directory of a template it only renders as a side effect.
-- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
-- Name test files in camelCase after the scenario they cover (e.g. `signingEnabled.yaml`), use `basics.yaml` for the default scenario and do not repeat the directory name in the file name. The `make helm/unittest` glob only matches one directory level, so every suite must live in a subdirectory.
-- Each test must set all required values explicitly — do not rely on cross-test state.
-- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint.yaml`. Use `make yamllint` to run the linter.
-- The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
-- The `suite` title follows the pattern `Test <subject> <scenario>` (e.g. `Test deployment probes`). It must be unique across all suites, because `helm unittest` identifies a failing suite by this title.
-- Each unit test must explicitly set a custom namespace and release name, rather than relying on defaults.
-- Assert `Secret` content via `data.*` with `decodeBase64: true` and add a `notExists` assertion for `stringData`.
-
-### Commits & PRs
-
-- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
-- See `CONTRIBUTING.md` for full PR requirements.
-- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
-- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
-
-### Documentation
-
-- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
-- `README.md` parameter tables are auto-generated — never edit them manually.

.helmignore

@@ -36,6 +36,6 @@ unittests/
 .prettierignore
 .yamllint
 CODEOWNERS
-renovate.json
+renovate.json5
 .commitlintrc.json
 .gitsv/

.vscode/settings.json

@@ -1,10 +1,7 @@
 {
     "yaml.schemas": {
-        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
+        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.3/schema/helm-testsuite.json": [
             "/unittests/**/*.yaml"
-        ],
-        "https://docs.renovatebot.com/renovate-schema.json":[
-          "renovate.json"
         ]
     },
     "yaml.schemaStore.enable": true,

.yamllint

@@ -1,21 +1,20 @@
 ---
 extends: default
+
 ignore: |
-  charts
   .yamllint
   node_modules
   templates
   unittests/bash
 
 rules:
-  braces:
-    max-spaces-inside: 2
-  comments:
-    min-spaces-from-content: 1
-  comments-indentation: disable
-  document-start: disable
-  line-length: disable
   truthy:
     allowed-values: ['true', 'false']
-    check-keys: false
+    check-keys: False
     level: error
+  line-length: disable
+  document-start: disable
+  comments:
+    min-spaces-from-content: 1
+  braces:
+    max-spaces-inside: 2

CODEOWNERS

@@ -1 +1 @@
-* @volker.raschek @ChristopherHX
+* @rossigee @volker.raschek @ChristopherHX

CONTRIBUTING.md

@@ -37,14 +37,15 @@ For local development and testing of pull requests, the following workflow can
 be used:
 
 1. Install `minikube` and `helm`.
-2. Start a `minikube` cluster via `minikube start`.
-3. From the `gitea/helm-gitea` directory execute the following command.
+1. Start a `minikube` cluster via `minikube start`.
+1. From the `gitea/helm-gitea` directory execute the following command.
    This will install the dependencies listed in `Chart.yml` and deploy the current state of the helm chart found locally.
    If you want to test a branch, make sure to switch to the respective branch first.
    `helm install --dependency-update gitea . -f values.yaml`.
-4. Gitea is now deployed in `minikube`. To access it, it's port needs to be forwarded first from `minikube` to localhost
-   first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at
-   `localhost:3000`.
+1. Gitea is now deployed in `minikube`.
+   To access it, it's port needs to be forwarded first from `minikube` to localhost first via `kubectl --namespace
+default port-forward svc/gitea-http 3000:3000`.
+   Now Gitea is accessible at [http://localhost:3000](http://localhost:3000).
 
 ### Unit tests
 

Chart.lock

@@ -1,6 +1,15 @@
 dependencies:
+- name: postgresql
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 16.7.27
+- name: postgresql-ha
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 16.3.2
+- name: valkey-cluster
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 3.0.24
 - name: valkey
-  repository: https://valkey.io/valkey-helm
-  version: 0.10.0
-digest: sha256:c3deb43d02228f143e1c9525f5ce06dc6a78646e763c7a73c5ec8ea0101ed2f5
-generated: "2026-10-04T00:24:11.331968211+02:00"
+  repository: oci://registry-1.docker.io/bitnamicharts
+  version: 3.0.31
+digest: sha256:ceb6a1890cfdc2627abb85d3e2a4baa64d30afd21dcfabce978a824a67f0a2bb
+generated: "2025-08-30T00:03:04.59764502Z"

Chart.yaml

@@ -3,7 +3,8 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-appVersion: 28.0.0
+# renovate datasource=github-releases depName=go-gitea/gitea extractVersion=^v(?<version>.*)$
+appVersion: 1.26.1
 icon: https://gitea.com/assets/img/logo.svg
 
 annotations:
@@ -25,6 +26,9 @@ sources:
   - https://docker.gitea.com/gitea
 
 maintainers:
+  # https://gitea.com/rossigee
+  - name: Ross Golder
+    email: ross@golder.org
   # https://gitea.com/volker.raschek
   - name: Markus Pesch
     email: markus.pesch+apps@cryptic.systems
@@ -36,8 +40,23 @@ maintainers:
     email: christopher.homberger@web.de
 
 dependencies:
+  # https://github.com/bitnami/charts/blob/main/bitnami/postgresql
+  - name: postgresql
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 16.7.27
+    condition: postgresql.enabled
+  # https://github.com/bitnami/charts/blob/main/bitnami/postgresql-ha/Chart.yaml
+  - name: postgresql-ha
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 16.3.2
+    condition: postgresql-ha.enabled
+  # https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml
+  - name: valkey-cluster
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 3.0.24
+    condition: valkey-cluster.enabled
   # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
   - name: valkey
-    repository: https://valkey.io/valkey-helm
-    version: 0.10.0
+    repository: oci://registry-1.docker.io/bitnamicharts
+    version: 3.0.31
     condition: valkey.enabled

Makefile

@@ -1,67 +1,29 @@
 SHELL := /usr/bin/env bash -O globstar
 
-# CLEAN
-# ==============================================================================
-PHONY+=clean
-clean:
-	-rm -rf charts *.tar.gz *.tar.gz.sig node_modules
+.PHONY: prepare-environment
+prepare-environment:
+	npm install
 
-# MISSING DOT
-# ==============================================================================
-PHONY+=missing-dot
-missing-dot:
-	grep --perl-regexp '## @(param|skip).*[^.]$$' values.yaml
+.PHONY: readme
+readme: prepare-environment
+	npm run readme:parameters
+	npm run readme:lint
 
-# README
-# ==============================================================================
-PHONY+=readme
-readme: readme/link readme/lint readme/parameters
+.PHONY: unittests
+unittests: unittests-helm unittests-bash
 
-PHONY+=readme/link
-readme/link:
-	npm install && npm run readme:link
+.PHONY: unittests-helm
+unittests-helm:
+	helm unittest --strict -f 'unittests/helm/**/*.yaml' -f 'unittests/helm/values-conflicting-checks.yaml' ./
 
-PHONY+=readme/lint
-readme/lint:
-	npm install && npm run readme:lint
-
-PHONY+=readme/parameters
-readme/parameters:
-	npm install && npm run readme:parameters
-
-# HELM DEPENDENCIES
-# ==============================================================================
-PHONY+=helm/dependency-update
-helm/dependency-update:
-	helm dependency update
-
-# HELM UNITTESTS
-# ==============================================================================
-PHONY+=helm/unittest
-helm/unittest:
-	helm unittest --strict --file 'unittests/helm/**/*.yaml' ./
-
-# BASH PREPARE
-# ==============================================================================
-PHONY+=bash/prepare
-bash/prepare:
-	git submodule init
-	git submodule update
-
-# BASH UNITTESTS
-# ==============================================================================
-PHONY+=bash/unittest
-bash/unittest:
+.PHONY: unittests-bash
+unittests-bash:
 	./unittests/bash/bats/bin/bats --pretty ./unittests/bash/tests/**/*.bats
 
-# YAML LINT
-# ==============================================================================
-PHONY+=yamllint
-yamllint:
-	yamllint -c .yamllint.yaml .
+.PHONY: update-helm-dependencies
+update-helm-dependencies:
+	helm dependency update
 
-# PHONY
-# ==============================================================================
-# Declare the contents of the PHONY variable as phony. We keep that information
-# in a variable so we can use it in if_changed.
-.PHONY: ${PHONY}
+.PHONY: yamllint
+yamllint:
+	yamllint -c .yamllint .

docs/gateway-api.md

@@ -1,269 +0,0 @@
-# Gateway API
-
-This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
-alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
-are rendered:
-
-- `HTTPRoute` — required for HTTP traffic
-- `TCPRoute` — optional, typically for SSH (port 22)
-- `BackendTLSPolicy` — optional, for encrypted backend traffic
-- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
-
-All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
-
-The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
-
-## Prerequisites
-
-| Resource               | API version                          | Status (as of writing) |
-| ---------------------- | ------------------------------------ | ---------------------- |
-| `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
-| `TCPRoute`             | `gateway.networking.k8s.io/v1`       | GA (v1.4+)             |
-| `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
-| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
-
-## Common topology
-
-Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
-
-```yaml
-gatewayAPI:
-  core:
-    httpRoute:
-      enabled: true
-      tls: true            # the shared Gateway terminates TLS
-      hostnames:
-        - git.example.com
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: shared-gateway
-          namespace: gateway-system
-          sectionName: https-gitea   # pin to a specific listener (see below)
-    tcpRoute:
-      enabled: true
-      parentRefs:
-        - group: gateway.networking.k8s.io
-          kind: Gateway
-          name: shared-gateway
-          namespace: gateway-system
-          sectionName: ssh
-```
-
-With this configuration:
-
-- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
-- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
-- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
-- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
-
-### Why `sectionName` matters
-
-Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
-that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
-to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
-(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
-side typically looks like:
-
-```yaml
-listeners:
-  - name: https-gitea
-    port: 443
-    protocol: HTTPS
-    hostname: git.example.com
-    tls:
-      certificateRefs:
-        - name: git-example-com-tls
-    allowedRoutes:
-      kinds:
-        - kind: HTTPRoute
-      namespaces:
-        from: Selector
-        selector:
-          matchLabels:
-            kubernetes.io/metadata.name: gitea
-  - name: ssh
-    port: 22
-    protocol: TCP
-    allowedRoutes:
-      kinds:
-        - kind: TCPRoute
-      namespaces:
-        from: Selector
-        selector:
-          matchLabels:
-            kubernetes.io/metadata.name: gitea
-```
-
-### Sharing a hostname between HTTP and SSH
-
-HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
-clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
-and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
-extra configuration.
-
-If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
-cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
-
-```yaml
-gitea:
-  config:
-    server:
-      SSH_DOMAIN: gitea-ssh.example.com
-```
-
-## BackendTLSPolicy
-
-Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
-`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
-verify the backend certificate before forwarding the request.
-
-### Configuring Gitea to serve HTTPS directly
-
-Gitea serves HTTPS via three `[server]` app.ini options
-([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
-cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths:
-
-```yaml
-gitea:
-  config:
-    server:
-      PROTOCOL: https
-      CERT_FILE: /etc/gitea-tls/tls.crt
-      KEY_FILE: /etc/gitea-tls/tls.key
-
-deployment:
-  gitea:
-    volumeMounts:
-      - name: gitea-tls
-        mountPath: /etc/gitea-tls
-        readOnly: true
-  volumes:
-    - name: gitea-tls
-      secret:
-        secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
-```
-
-- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
-  official image); absolute paths are clearer.
-- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
-- For chained certs, the server cert comes first, intermediates after.
-- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
-  (3000 by default) is now speaking HTTPS instead of HTTP.
-
-### BackendTLSPolicy example
-
-Verify the backend with a CA bundle stored in a `ConfigMap`:
-
-```yaml
-gatewayAPI:
-  core:
-    backendTLSPolicy:
-      enabled: true
-      validation:
-        hostname: gitea.svc.cluster.local
-        caCertificateRefs:
-          - name: gitea-backend-ca
-            group: ""
-            kind: ConfigMap
-```
-
-This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
-(`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
-API; the template fails fast if omitted.
-
-### System CA trust and explicit targetRefs
-
-To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
-and `targetRefs`:
-
-```yaml
-gatewayAPI:
-  core:
-    backendTLSPolicy:
-      enabled: true
-      targetRefs:
-        - group: ""
-          kind: Service
-          name: gitea-sidecar
-      validation:
-        hostname: sidecar.gitea.svc.cluster.local
-        wellKnownCACertificates: System
-```
-
-Notes:
-
-- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
-- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
-  (otherwise stick with `caCertificateRefs`).
-- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
-  `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
-
-## Raising the request body size limit (NGINX Gateway Fabric)
-
-NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
-Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
-images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
-`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
-API. NGINX Gateway Fabric instead reads the limit from a
-[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
-
-This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
-**not** impose a default request body size limit, so large uploads work without any extra configuration —
-leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
-
-```yaml
-gatewayAPI:
-  enabled: true
-  nginx:
-    clientSettingsPolicies:
-      enabled: true
-      body:
-        maxSize: 100m   # bytes, or with a k / m / g suffix; 0 disables the limit
-```
-
-This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
-(`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
-template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
-are supported too.
-
-To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
-override `targetRef`:
-
-```yaml
-gatewayAPI:
-  nginx:
-    clientSettingsPolicies:
-      enabled: true
-      targetRef:
-        group: gateway.networking.k8s.io
-        kind: Gateway
-        name: shared-gateway
-      body:
-        maxSize: 100m
-```
-
-Notes:
-
-- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
-  attaching it to an `HTTPRoute` scopes it to that route only.
-- The policy must live in the same namespace as its `targetRef`.
-- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
-  `[packages]` sections) — raising the proxy limit alone is not always sufficient.
-
-## Interaction with `ingress` and `route`
-
-The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
-
-1. `route.host` (when `route.enabled`)
-2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
-3. First `ingress.hosts[0].host`
-4. The in-cluster Service DNS name
-
-Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
-
-## SSH considerations
-
-- `TCPRoute` is GA since Gateway API v1.4. Older CRD bundles only ship the `v1alpha2` version, so make sure the installed CRDs are at least v1.4.
-- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
-- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.

docs/ha-setup.md

@@ -14,7 +14,7 @@ They might cost a bit more than using a self-hosted k8s variant but are usually
 Also they can be centrally managed and are not linked to the Gitea helm chart or namespace.
 Please consider using external services before you start with your Gitea HA setup, it will make your life (and the life of the Gitea maintainers) easier.
 
-This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `deployment.replicas` is set to a value > 1.
+This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `replicaCount` is set to a value > 1.
 Nevertheless, we cannot guarantee for every possible combination of Gitea settings to work together perfectly in a HA setup.
 As a general advice, we recommend to have a test environment aside on which to test possible changes/upgrades before applying these to a production installation.
 
@@ -28,8 +28,8 @@ In addition, the following components are required for full HA-readiness:
 - A HA-ready cache (`valkey-cluster`)
 - A HA-ready DB
 
-`cloudnativePG.enabled`, which defaults to `false`, must be enabled for a HA setup.
-It requires the CloudNativePG operator to be installed cluster-wide beforehand.
+`postgres.enabled`, which default to `true`, must be set to `false` for a HA setup.
+The default `postgres` chart dependency is not HA-ready (there's a dedicated `postgres-ha` chart).
 
 The following sections discuss each of the components in more detail.
 Note that for each component discussed, the shown configurations only provides a (working) starting point, not necessarily the most optimal setup.
@@ -153,31 +153,15 @@ persistence:
 
 ## Database
 
-By enabling `cloudnativePG`, the chart renders a [CloudNativePG](https://cloudnative-pg.io/) `Cluster`, which provides a HA-ready PostgreSQL via streaming replication.
-The CloudNativePG operator itself is not part of this chart and has to be [installed cluster-wide](https://cloudnative-pg.io/documentation/current/installation_upgrade/) beforehand.
-For that reason the option is disabled by default.
+If you do not have an HA-ready DB, using a managed database service in the cloud might be the easiest and most robust solution.
+Remember: disable the built-in `postgres` dependency and configure the database connection manually via `gitea.config.database`:
 
 ```yml
-cloudnativePG:
-  enabled: true
-  instances: 3
-  storage:
-    size: 10Gi
-    storageClass: <storage class>
-  walStorage:
-    enabled: true
-    size: 2Gi
-    storageClass: <storage class>
-```
-
-If you do not want to run the operator, using a managed database service in the cloud might be the easiest and most robust solution.
-Remember: keep `cloudnativePG` disabled and configure the database connection manually via `gitea.config.database`:
-
-```yml
-cloudnativePG:
-  enabled: false
-
 gitea:
+  database:
+    builtIn:
+      postgresql:
+        enabled: false
   config:
     database:
       DB_TYPE: postgres
@@ -191,4 +175,4 @@ gitea:
 - Currently Cron jobs are run on all replicas as no leader election is implemented.
   See [https://github.com/go-gitea/gitea/issues/13791](https://github.com/go-gitea/gitea/issues/13791) for a discussion and possible solution.
 
-- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases.
+- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases. 

package.json

@@ -9,13 +9,11 @@
     "npm": ">=8.0.0"
   },
   "scripts": {
-    "readme:link": "markdown-link-check *.md",
     "readme:lint": "markdownlint *.md -f",
     "readme:parameters": "readme-generator -v values.yaml -r README.md"
   },
   "devDependencies": {
     "@bitnami/readme-generator-for-helm": "^2.5.0",
-    "markdown-link-check": "^3.13.6",
-    "markdownlint-cli": "^0.49.0"
+    "markdownlint-cli": "^0.48.0"
   }
 }

renovate.json

@@ -1,136 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "gitea>gitea/renovate-config",
-    "helpers:pinGitHubActionDigests",
-    ":automergeMinor",
-    "schedule:automergeDaily",
-    "schedule:weekends"
-  ],
-  "labels": [
-    "kind/dependency"
-  ],
-  "digest": {
-    "automerge": true
-  },
-  "automergeStrategy": "squash",
-  "git-submodules": {
-    "enabled": true
-  },
-  "customManagers": [
-    {
-      "description": "Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions",
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/.gitea/workflows/.+\\.ya?ml$/"
-      ],
-      "matchStrings": [
-        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s"
-      ]
-    },
-    {
-      "description": "Detect helm-unittest yaml schema file",
-      "customType": "regex",
-      "managerFilePatterns": [
-        "/.vscode/settings\\.json$/"
-      ],
-      "matchStrings": [
-        "https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json"
-      ],
-      "datasourceTemplate": "github-releases"
-    },
-    {
-      "description": "Automatically detect new Gitea releases",
-      "customType": "regex",
-      "datasourceTemplate": "github-releases",
-      "depNameTemplate": "gitea/gitea",
-      "extractVersionTemplate": "^v(?<version>.*)$",
-      "managerFilePatterns": [
-        "/(^|/)Chart\\.ya?ml$/"
-      ],
-      "matchStrings": [
-        "^appVersion:\\s+[\"']?(?<currentVersion>\\S+)[\"']?$"
-      ]
-    }
-  ],
-  "lockFileMaintenance": {
-    "enabled": true,
-    "commitMessageAction": "update",
-    "commitMessageTopic": "lockfiles",
-    "schedule": [
-      "at any time"
-    ]
-  },
-  "packageRules": [
-    {
-      "groupName": "subcharts (minor & patch)",
-      "matchManagers": [
-        "helmv3"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest"
-      ]
-    },
-    {
-      "groupName": "bats testing framework",
-      "matchManagers": [
-        "git-submodules"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest"
-      ]
-    },
-    {
-      "groupName": "workflow dependencies (minor & patch)",
-      "matchManagers": [
-        "github-actions",
-        "npm",
-        "custom.regex"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest"
-      ],
-      "matchFileNames": [
-        "!Chart.yaml"
-      ]
-    },
-    {
-      "description": "Update README.md on changes in values.yaml",
-      "matchManagers": [
-        "helm-values"
-      ],
-      "postUpgradeTasks": {
-        "commands": [
-          "install-tool node",
-          "make readme"
-        ],
-        "fileFilters": [
-          "README.md"
-        ],
-        "executionMode": "update"
-      }
-    },
-    {
-      "description": "Override changelog url for Helm image, to have release notes in our PRs",
-      "matchDepNames": [
-        "alpine/helm"
-      ],
-      "changelogUrl": "https://github.com/helm/helm"
-    },
-    {
-      "description": "Bump Gitea as fast as possible - not only on weekends",
-      "matchDepNames": [
-        "go-gitea/gitea"
-      ],
-      "schedule": [
-        "at any time"
-      ]
-    }
-  ]
-}

renovate.json5

@@ -0,0 +1,132 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'gitea>gitea/renovate-config',
+    ':automergeMinor',
+    'schedule:automergeDaily',
+    'schedule:weekends',
+  ],
+  labels: [
+    'kind/dependency',
+  ],
+  digest: {
+    automerge: true,
+  },
+  automergeStrategy: 'squash',
+  'git-submodules': {
+    enabled: true,
+  },
+  customManagers: [
+    {
+      description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
+      customType: 'regex',
+      managerFilePatterns: [
+        '/.gitea/workflows/.+\\.ya?ml$/',
+      ],
+      matchStrings: [
+        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
+      ],
+    },
+    {
+      description: 'Detect helm-unittest yaml schema file',
+      customType: 'regex',
+      managerFilePatterns: [
+        '/.vscode/settings\\.json$/',
+      ],
+      matchStrings: [
+        'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
+      ],
+      datasourceTemplate: 'github-releases',
+    },
+    {
+      description: 'Automatically detect new Gitea releases',
+      customType: 'regex',
+      managerFilePatterns: [
+        '/(^|/)Chart\\.yaml$/',
+      ],
+      matchStrings: [
+        '# renovate datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) extractVersion=(?<extractVersion>\\S+)\\nappVersion:\\s?(?<currentValue>\\S+)\\n',
+      ],
+    },
+  ],
+  lockFileMaintenance: {
+    "enabled": true,
+    "commitMessageAction": "update",
+    "commitMessageTopic": "lockfiles",
+    schedule: [
+      'at any time',
+    ]
+  },
+  packageRules: [
+    {
+      groupName: 'subcharts (minor & patch)',
+      matchManagers: [
+        'helmv3',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+    },
+    {
+      groupName: 'bats testing framework',
+      matchManagers: [
+        'git-submodules',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+    },
+    {
+      groupName: 'workflow dependencies (minor & patch)',
+      matchManagers: [
+        'github-actions',
+        'npm',
+        'custom.regex',
+      ],
+      matchUpdateTypes: [
+        'minor',
+        'patch',
+        'digest',
+      ],
+      matchFileNames: [
+        '!Chart.yaml',
+      ],
+    },
+    {
+      description: 'Update README.md on changes in values.yaml',
+      matchManagers: [
+        'helm-values',
+      ],
+      postUpgradeTasks: {
+        commands: [
+          'install-tool node',
+          'make readme',
+        ],
+        fileFilters: [
+          'README.md',
+        ],
+        executionMode: 'update',
+      },
+    },
+    {
+      description: 'Override changelog url for Helm image, to have release notes in our PRs',
+      matchDepNames: [
+        'alpine/helm',
+      ],
+      changelogUrl: 'https://github.com/helm/helm',
+    },
+    {
+      description: 'Bump Gitea as fast as possible - not only on weekends',
+      matchDepNames: [
+        'go-gitea/gitea',
+      ],
+      schedule: [
+        'at any time',
+      ],
+    },
+  ],
+}

scripts/act_runner/token.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+set -eu
+
+timeout_delay=15
+
+check_token() {
+  set +e
+
+  echo "Checking for existing token..."
+  token="$(kubectl get secret "$SECRET_NAME" -o jsonpath="{.data['token']}" 2> /dev/null)"
+  [ $? -ne 0 ] && return 1
+  [ -z "$token" ] && return 2
+  return 0
+}
+
+create_token() {
+  echo "Waiting for new token to be generated..."
+  begin=$(date +%s)
+  end=$((begin + timeout_delay))
+  while true; do
+    [ -f /data/actions/token ] && return 0
+    [ "$(date +%s)" -gt $end ] && return 1
+    sleep 5
+  done
+}
+
+store_token() {
+  echo "Storing the token in Kubernetes secret..."
+  kubectl patch secret "$SECRET_NAME" -p "{\"data\":{\"token\":\"$(base64 /data/actions/token | tr -d '\n')\"}}"
+}
+
+if check_token; then
+  echo "Key already in place, exiting."
+  exit
+fi
+
+if ! create_token; then
+  echo "Checking for an existing act runner token in secret $SECRET_NAME timed out after $timeout_delay"
+  exit 1
+fi
+
+store_token

scripts/init-containers/config/config_environment.sh

@@ -2,8 +2,7 @@
 set -euo pipefail
 
 function env2ini::log() {
-  # '%b' expands the \n escapes of the callers without treating the message itself as a format string
-  printf '%b\n' "${1}"
+  printf "${1}\n"
 }
 
 function env2ini::read_config_to_env() {
@@ -16,8 +15,7 @@ function env2ini::read_config_to_env() {
   fi
 
   # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-  local setting
-  setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
+  local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
 
   if [[ -z "${setting}" ]]; then
     env2ini::log '  ! invalid setting'
@@ -56,8 +54,7 @@ function env2ini::reload_preset_envs() {
     fi
 
     # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-    local setting
-    setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
+    local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
 
     if [[ -z "${setting}" ]]; then
       env2ini::log '  ! invalid setting'
@@ -78,13 +75,13 @@ function env2ini::reload_preset_envs() {
     export "${setting^^}=${value}"                           # '^^' makes the variable content uppercase
   done < "$TMP_EXISTING_ENVS_FILE"
 
-  rm "$TMP_EXISTING_ENVS_FILE"
+  rm $TMP_EXISTING_ENVS_FILE
 }
 
+
 function env2ini::process_config_file() {
   local config_file="${1}"
-  local section
-  section="$(basename "${config_file}")"
+  local section="$(basename "${config_file}")"
 
   if [[ $section == '_generals_' ]]; then
     env2ini::log "  [ini root]"
@@ -104,7 +101,7 @@ function env2ini::load_config_sources() {
   if [[ -d "${path}" ]]; then
     env2ini::log "Processing $(basename "${path}")..."
 
-    while read -r -d '' configFile; do
+    while read -d '' configFile; do
       env2ini::process_config_file "${configFile}"
     done < <(find "${path}" -type l -not -name '..data' -print0)
 
@@ -118,20 +115,16 @@ function env2ini::generate_initial_secrets() {
   #   - initially used to set up Gitea
   # Anyway, they won't harm existing app.ini files
 
-  GITEA__SECURITY__INTERNAL_TOKEN="$(gitea generate secret INTERNAL_TOKEN)"
-  GITEA__SECURITY__SECRET_KEY="$(gitea generate secret SECRET_KEY)"
-  GITEA__OAUTH2__JWT_SECRET="$(gitea generate secret JWT_SECRET)"
-  GITEA__SERVER__LFS_JWT_SECRET="$(gitea generate secret LFS_JWT_SECRET)"
-  export GITEA__SECURITY__INTERNAL_TOKEN \
-         GITEA__SECURITY__SECRET_KEY \
-         GITEA__OAUTH2__JWT_SECRET \
-         GITEA__SERVER__LFS_JWT_SECRET
+  export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
+  export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
+  export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
+  export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
 
   env2ini::log "...Initial secrets generated\n"
 }
 
 # save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
-env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > "$TMP_EXISTING_ENVS_FILE"
+env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > $TMP_EXISTING_ENVS_FILE
 
 # MUST BE CALLED BEFORE OTHER CONFIGURATION
 env2ini::generate_initial_secrets
@@ -145,7 +138,7 @@ env2ini::reload_preset_envs
 env2ini::log "=== All configuration sources loaded ===\n"
 
 # safety to prevent rewrite of secret keys if an app.ini already exists
-if [ -f "${GITEA_APP_INI}" ]; then
+if [ -f ${GITEA_APP_INI} ]; then
   env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
   env2ini::log '  - security.INTERNAL_TOKEN'
   env2ini::log '  - security.SECRET_KEY'
@@ -158,4 +151,4 @@ if [ -f "${GITEA_APP_INI}" ]; then
   unset GITEA__SERVER__LFS_JWT_SECRET
 fi
 
-gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"
+environment-to-ini -o $GITEA_APP_INI

templates/NOTES.txt

@@ -1,12 +1,5 @@
 1. Get the application URL by running these commands:
-{{- if .Values.route.enabled }}
-  {{- if .Values.route.host }}
-  {{ include "gitea.public_protocol" . }}://{{ tpl .Values.route.host . }}{{ .Values.route.path }}
-  {{- else }}
-  export ROUTE_HOST=$(kubectl get route --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} -o jsonpath="{.spec.host}")
-  echo {{ include "gitea.public_protocol" . }}://$ROUTE_HOST{{ .Values.route.path }}
-  {{- end }}
-{{- else if .Values.ingress.enabled }}
+{{- if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
   {{- range .paths }}
   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}

templates/_backendTLSPolicies.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.backendTLSPolicy.annotations" -}}
-{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.backendTLSPolicy.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.core.backendTLSPolicy.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.backendTLSPolicy.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_clientSettingsPolicies.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.clientSettingsPolicies.annotations" -}}
-{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.clientSettingsPolicies.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.clientSettingsPolicies.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_clusters.tpl

@@ -1,24 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.cluster.cloudnativePG.annotations" -}}
-{{- with .Values.cloudnativePG.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.cluster.cloudnativePG.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.cloudnativePG.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* names */}}
-
-{{- define "gitea.cluster.cloudnativePG.name" -}}
-{{ include "gitea.fullname" . }}-postgresql
-{{- end }}

templates/_deployments.tpl

@@ -1,38 +0,0 @@
-{{/* annotations */}}
-
-{{- define "gitea.deployment.annotations" -}}
-{{- with .Values.deployment.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* initContainers */}}
-
-{{- define "gitea.deployment.initContainers" -}}
-{{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }}
-{{- range $index, $entry := .Values.deployment.initContainers }}
-{{- if and (hasKey $entry "container") (hasKey $entry "link") }}
-{{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }}
-{{- else if hasKey $entry "container" }}
-{{- list $entry.container | toYaml | nindent 0 }}
-{{- else if hasKey $entry "link" }}
-{{- if not (has $entry.link $links) }}
-{{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }}
-{{- end }}
-{{- with include (printf "gitea.initContainer.%s" $entry.link) $ }}
-{{- nindent 0 . }}
-{{- end }}
-{{- else }}
-{{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.deployment.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.deployment.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_helpers.tpl

@@ -43,25 +43,15 @@ Create chart name and version as used by the chart label.
 Create image name and tag used by the deployment.
 */}}
 {{- define "gitea.image" -}}
-{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}}
-{{- end -}}
-
-{{/*
-Create image name and tag from an arbitrary `image` dict.
-Arguments: (list $root $image)
-*/}}
-{{- define "gitea.image.name" -}}
-{{- $root := index . 0 -}}
-{{- $image := index . 1 -}}
-{{- $fullOverride := $image.fullOverride | default "" -}}
-{{- $registry := $root.Values.global.imageRegistry | default $image.registry -}}
-{{- $repository := $image.repository -}}
+{{- $fullOverride := .Values.image.fullOverride | default "" -}}
+{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
+{{- $repository := .Values.image.repository -}}
 {{- $separator := ":" -}}
-{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}}
-{{- $rootless := ternary "-rootless" "" ($image.rootless) -}}
+{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
+{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
 {{- $digest := "" -}}
-{{- if $image.digest }}
-    {{- $digest = (printf "@%s" ($image.digest | toString)) -}}
+{{- if .Values.image.digest }}
+    {{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
 {{- end -}}
 {{- if $fullOverride }}
     {{- printf "%s" $fullOverride -}}
@@ -86,72 +76,15 @@ imagePullSecrets:
 {{- end }}
 {{- end -}}
 
-{{/*
-Return true when OpenShift compatibility defaults should be rendered.
-If openshift.enabled is unset, auto-detect via the SCC API.
-*/}}
-{{- define "gitea.openshift.enabled" -}}
-{{- if kindIs "bool" .Values.openshift.enabled -}}
-{{ ternary "true" "false" .Values.openshift.enabled }}
-{{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" -}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end -}}
 
 {{/*
-Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean.
+Storage Class
 */}}
-{{- define "gitea.hostUsers" -}}
-{{- if kindIs "bool" .Values.deployment.hostUsers -}}
-{{ ternary "true" "false" .Values.deployment.hostUsers }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
-*/}}
-{{- define "gitea.deployment.securityContext" -}}
-{{- $securityContext := deepCopy .Values.deployment.securityContext -}}
-{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $securityContext "fsGroup")) -}}
-{{- $_ := set $securityContext "fsGroup" 1000 -}}
-{{- end -}}
-{{- if gt (len $securityContext) 0 -}}
-{{ toYaml $securityContext }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render container securityContext with OpenShift restricted SCC defaults when enabled.
-*/}}
-{{- define "gitea.containerSecurityContext" -}}
-{{- $root := index . 0 -}}
-{{- $containerSecurityContext := deepCopy (index . 1) -}}
-{{- if eq (include "gitea.openshift.enabled" $root | trim) "true" -}}
-{{- $containerSecurityContext = mergeOverwrite (dict
-  "allowPrivilegeEscalation" false
-  "capabilities" (dict "drop" (list "ALL"))
-  "runAsNonRoot" true
-  "seccompProfile" (dict "type" "RuntimeDefault")
-) $containerSecurityContext -}}
-{{- end -}}
-{{- if gt (len $containerSecurityContext) 0 -}}
-{{ toYaml $containerSecurityContext }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Render the securityContext for init containers that execute Gitea/GPG commands.
-These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
-*/}}
-{{- define "gitea.commandInitContainerSecurityContext" -}}
-{{- $root := index . 0 -}}
-{{- $containerSecurityContext := deepCopy (index . 1) -}}
-{{- if and (ne (include "gitea.openshift.enabled" $root | trim) "true") (not (hasKey $containerSecurityContext "runAsUser")) -}}
-{{- $_ := set $containerSecurityContext "runAsUser" 1000 -}}
-{{- end -}}
-{{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
+{{- define "gitea.persistence.storageClass" -}}
+{{- $storageClass :=  (tpl ( default "" .Values.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
+{{- if $storageClass }}
+storageClassName: {{ $storageClass | quote }}
+{{- end }}
 {{- end -}}
 
 {{/*
@@ -161,8 +94,17 @@ Common labels
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}
 {{ include "gitea.selectorLabels" . }}
-app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "gitea.labels.actRunner" -}}
+helm.sh/chart: {{ include "gitea.chart" . }}
+app: {{ include "gitea.name" . }}-act-runner
+{{ include "gitea.selectorLabels.actRunner" . }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
 
@@ -174,27 +116,46 @@ app.kubernetes.io/name: {{ include "gitea.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
-{{- define "cloudnativePG.dns" -}}
-{{- if .Values.cloudnativePG.enabled -}}
-{{- printf "%s-rw.%s.svc.%s:5432" (include "gitea.cluster.cloudnativePG.name" .) (.Values.namespace | default .Release.Namespace) .Values.clusterDomain -}}
+{{- define "gitea.selectorLabels.actRunner" -}}
+app.kubernetes.io/name: {{ include "gitea.name" . }}-act-runner
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "postgresql-ha.dns" -}}
+{{- if (index .Values "postgresql-ha").enabled -}}
+{{- printf "%s-postgresql-ha-pgpool.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "postgresql-ha" "service" "ports" "postgresql") -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "postgresql.dns" -}}
+{{- if (index .Values "postgresql").enabled -}}
+{{- printf "%s-postgresql.%s.svc.%s:%g" .Release.Name .Release.Namespace .Values.clusterDomain .Values.postgresql.global.postgresql.service.ports.postgresql -}}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.dns" -}}
-{{- if (index .Values "valkey").enabled -}}
-{{- printf "redis://:%s@%s-valkey.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index (index .Values "valkey").auth.aclUsers "default").password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").service.port -}}
+{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
+{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
+{{- else if (index .Values "valkey-cluster").enabled -}}
+{{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
+{{- else if (index .Values "valkey").enabled -}}
+{{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.port" -}}
-{{- if (index .Values "valkey").enabled -}}
-{{ (index .Values "valkey").service.port }}
+{{- if (index .Values "valkey-cluster").enabled -}}
+{{ (index .Values "valkey-cluster").service.ports.valkey }}
+{{- else if (index .Values "valkey").enabled -}}
+{{ (index .Values "valkey").master.service.ports.valkey }}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.servicename" -}}
-{{- if (index .Values "valkey").enabled -}}
-{{- printf "%s-valkey.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- if (index .Values "valkey-cluster").enabled -}}
+{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- else if (index .Values "valkey").enabled -}}
+{{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
 
@@ -202,18 +163,6 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 
-{{- define "gitea.public_hostname" -}}
-{{- if and .Values.route.enabled .Values.route.host -}}
-{{ tpl .Values.route.host . }}
-{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
-{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
-{{- else if gt (len .Values.ingress.hosts) 0 -}}
-{{ tpl (index .Values.ingress.hosts 0).host $ }}
-{{- else -}}
-{{ include "gitea.default_domain" . }}
-{{- end -}}
-{{- end -}}
-
 {{- define "gitea.ldap_settings" -}}
 {{- $idx := index . 0 }}
 {{- $values := index . 1 }}
@@ -264,11 +213,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "gitea.public_protocol" -}}
-{{- if and .Values.route.enabled .Values.route.tls.termination -}}
-https
-{{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
-https
-{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
+{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
 https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
@@ -282,7 +227,7 @@ https
   {{- $generals := list -}}
   {{- $inlines := dict -}}
 
-  {{- range $key, $value := .Values.gitea.config }}
+  {{- range $key, $value := .Values.gitea.config  }}
     {{- if kindIs "map" $value }}
       {{- if gt (len $value) 0 }}
         {{- $section := default list (get $inlines $key) -}}
@@ -361,7 +306,7 @@ https
     {{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
   {{- end -}}
   {{- /* valkey queue */ -}}
-  {{- if (index .Values "valkey").enabled -}}
+  {{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
     {{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
     {{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
     {{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
@@ -401,7 +346,11 @@ https
     {{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
   {{- end -}}
   {{- if not (.Values.gitea.config.server.DOMAIN) -}}
-    {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.public_hostname" .) -}}
+    {{- if gt (len .Values.ingress.hosts) 0 -}}
+      {{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
+    {{- else -}}
+      {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
+    {{- end -}}
   {{- end -}}
   {{- if not .Values.gitea.config.server.ROOT_URL -}}
     {{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}
@@ -413,7 +362,7 @@ https
     {{- $_ := set .Values.gitea.config.server "SSH_PORT" .Values.service.ssh.port -}}
   {{- end -}}
   {{- if not (hasKey .Values.gitea.config.server "START_SSH_SERVER") -}}
-    {{- if .Values.deployment.gitea.image.rootless -}}
+    {{- if .Values.image.rootless -}}
       {{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "true" -}}
       {{- if not (hasKey .Values.gitea.config.server "SSH_LISTEN_PORT") -}}
         {{- if not .Values.gitea.config.server.SSH_LISTEN_PORT -}}
@@ -435,23 +384,52 @@ https
 {{- end -}}
 
 {{- define "gitea.inline_configuration.defaults.database" -}}
-  {{- if .Values.cloudnativePG.enabled -}}
-    {{/* PASSWD is injected as an env-to-ini variable from the credentials Secret. */}}
+  {{- if (index .Values "postgresql-ha" "enabled") -}}
     {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}
     {{- if not (.Values.gitea.config.database.HOST) -}}
-      {{- $_ := set .Values.gitea.config.database "HOST"      (include "cloudnativePG.dns" .) -}}
+      {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql-ha.dns" .) -}}
     {{- end -}}
-    {{- $_ := set .Values.gitea.config.database "NAME"      .Values.cloudnativePG.credentials.database -}}
-    {{- $_ := set .Values.gitea.config.database "USER"      .Values.cloudnativePG.credentials.username -}}
+    {{- $_ := set .Values.gitea.config.database "NAME"      (index .Values "postgresql-ha" "global" "postgresql" "database") -}}
+    {{- $_ := set .Values.gitea.config.database "USER"      (index .Values "postgresql-ha" "global" "postgresql" "username") -}}
+    {{- $_ := set .Values.gitea.config.database "PASSWD"    (index .Values "postgresql-ha" "global" "postgresql" "password") -}}
+  {{- end -}}
+  {{- if (index .Values "postgresql" "enabled") -}}
+    {{- $_ := set .Values.gitea.config.database "DB_TYPE"   "postgres" -}}
+    {{- if not (.Values.gitea.config.database.HOST) -}}
+      {{- $_ := set .Values.gitea.config.database "HOST"      (include "postgresql.dns" .) -}}
+    {{- end -}}
+    {{- $_ := set .Values.gitea.config.database "NAME"      .Values.postgresql.global.postgresql.auth.database -}}
+    {{- $_ := set .Values.gitea.config.database "USER"      .Values.postgresql.global.postgresql.auth.username -}}
+    {{- $_ := set .Values.gitea.config.database "PASSWD"    .Values.postgresql.global.postgresql.auth.password -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "gitea.init-additional-mounts" -}}
+  {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
+  {{- if gt (len .Values.extraInitVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraInitVolumeMounts -}}
+  {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraVolumeMounts -}}
   {{- end -}}
 {{- end -}}
 
 {{- define "gitea.container-additional-mounts" -}}
-  {{- if gt (len .Values.deployment.gitea.volumeMounts) 0 -}}
-    {{- toYaml .Values.deployment.gitea.volumeMounts -}}
+  {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
+  {{- if gt (len .Values.extraContainerVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraContainerVolumeMounts -}}
+  {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
+    {{- toYaml .Values.extraVolumeMounts -}}
   {{- end -}}
 {{- end -}}
 
+{{- define "gitea.gpg-key-secret-name" -}}
+{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
+{{- end -}}
+
+{{- define "gitea.serviceAccountName" -}}
+{{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
+{{- end -}}
+
 {{- define "ingress.annotations" -}}
   {{- if .Values.ingress.annotations }}
   annotations:
@@ -464,6 +442,14 @@ https
   {{- end }}
 {{- end -}}
 
+{{- define "gitea.admin.passwordMode" -}}
+{{- if has .Values.gitea.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
+{{ .Values.gitea.admin.passwordMode }}
+{{- else -}}
+{{ printf "gitea.admin.passwordMode must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.gitea.admin.passwordMode | fail }}
+{{- end -}}
+{{- end -}}
+
 {{/* Create a functioning probe object for rendering. Given argument must be either a livenessProbe, readinessProbe, or startupProbe */}}
 {{- define "gitea.deployment.probe" -}}
   {{- $probe := unset . "enabled" -}}
@@ -481,3 +467,7 @@ https
   {{- end -}}
   {{- toYaml $probe -}}
 {{- end -}}
+
+{{- define "gitea.metrics-secret-name" -}}
+{{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
+{{- end -}}

templates/_httpRoutes.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.httpRoute.annotations" -}}
-{{- with .Values.gatewayAPI.core.httpRoute.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.httpRoute.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-          .Values.gatewayAPI.core.httpRoute.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.httpRoute.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.httpRoute.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/_ingresses.tpl

@@ -1,32 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.ingress.annotations" -}}
-{{- with .Values.ingress.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.ingress.enabled" -}}
-{{- if and .Values.ingress.enabled .Values.service.http.enabled -}}
-true
-{{- else -}}
-false
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.ingress.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.ingress.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* name */}}
-
-{{- define "gitea.ingress.name" -}}
-{{ include "gitea.fullname" . }}
-{{- end }}

templates/_initContainers.tpl

@@ -1,305 +0,0 @@
-{{/* initDirectories */}}
-
-{{- define "gitea.initContainer.initDirectories" -}}
-{{- $config := .Values.deployment.initDirectories -}}
-- name: init-directories
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  command:
-    - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
-  env:
-    - name: GITEA_APP_INI
-      value: /data/gitea/conf/app.ini
-    - name: GITEA_CUSTOM
-      value: /data/gitea
-    - name: GITEA_WORK_DIR
-      value: /data
-    - name: GITEA_TEMP
-      value: /tmp/gitea
-    {{- if .Values.deployment.gitea.env }}
-    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
-    {{- end }}
-    {{- if .Values.secrets.gpg.enabled }}
-    - name: GNUPGHOME
-      valueFrom:
-        secretKeyRef:
-          name: {{ include "gitea.secret.gpg.name" . }}
-          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
-    {{- end }}
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: init
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: temp
-      mountPath: /tmp
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}
-
-{{/* initAppIni */}}
-
-{{- define "gitea.initContainer.initAppIni" -}}
-{{- $config := .Values.deployment.initAppIni -}}
-- name: init-app-ini
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  {{- if .Values.gitea.extraEnvSourceFile }}
-  command:
-  - "/bin/bash"
-  - "-c"
-  args:
-  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-  {{- else }}
-  command:
-  - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-  {{- end }}
-  env:
-    - name: GITEA_APP_INI
-      value: /data/gitea/conf/app.ini
-    - name: GITEA_CUSTOM
-      value: /data/gitea
-    - name: GITEA_WORK_DIR
-      value: /data
-    - name: GITEA_TEMP
-      value: /tmp/gitea
-    - name: TMP_EXISTING_ENVS_FILE
-      value: /tmp/existing-envs
-    - name: ENV_TO_INI_MOUNT_POINT
-      value: /env-to-ini-mounts
-    {{- if .Values.cloudnativePG.enabled }}
-    - name: GITEA__database__PASSWD
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.cloudnativePG.passwordKey" . }}
-          name: {{ include "gitea.secret.cloudnativePG.name" . }}
-    {{- end }}
-    {{- if .Values.deployment.gitea.env }}
-    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
-    {{- end }}
-    {{- if .Values.gitea.additionalConfigFromEnvs }}
-    {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }}
-    {{- end }}
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: config
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: temp
-      mountPath: /tmp
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    - name: inline-config-sources
-      mountPath: /env-to-ini-mounts/inlines/
-    {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
-    - name: additional-config-sources-{{ $idx }}
-      mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
-    {{- end }}
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}
-
-{{/* initConfigureGPG */}}
-
-{{- define "gitea.initContainer.initConfigureGPG" -}}
-{{- $config := .Values.deployment.initConfigureGPG -}}
-{{- if .Values.secrets.gpg.enabled -}}
-- name: configure-gpg
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  {{- if .Values.gitea.extraEnvSourceFile }}
-  command:
-  - "/bin/bash"
-  - "-c"
-  args:
-  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-  {{- else }}
-  command:
-  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-  {{- end }}
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  env:
-    - name: GNUPGHOME
-      valueFrom:
-        secretKeyRef:
-          name: {{ include "gitea.secret.gpg.name" . }}
-          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
-    - name: TMP_RAW_GPG_KEY
-      value: /raw/private.asc
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: init
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    - name: gpg-private-key
-      mountPath: /raw
-      readOnly: true
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}
-{{- end }}
-
-{{/* initConfigureGitea */}}
-
-{{- define "gitea.initContainer.initConfigureGitea" -}}
-{{- $config := .Values.deployment.initConfigureGitea -}}
-- name: configure-gitea
-  image: "{{ include "gitea.image.name" (list . $config.image) }}"
-  {{- if .Values.gitea.extraEnvSourceFile }}
-  command:
-  - "/bin/bash"
-  - "-c"
-  args:
-  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-  {{- else }}
-  command:
-  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-  {{- end }}
-  imagePullPolicy: {{ $config.image.pullPolicy }}
-  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
-  securityContext:
-    {{- . | nindent 4 }}
-  {{- end }}
-  env:
-    - name: GITEA_APP_INI
-      value: /data/gitea/conf/app.ini
-    - name: GITEA_CUSTOM
-      value: /data/gitea
-    - name: GITEA_WORK_DIR
-      value: /data
-    - name: GITEA_TEMP
-      value: /tmp/gitea
-    {{- if $config.image.rootless }}
-    - name: HOME
-      value: /data/gitea/git
-    {{- end }}
-    {{- if .Values.gitea.ldap }}
-    {{- range $idx, $value := .Values.gitea.ldap }}
-    {{- if $value.existingSecret }}
-    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  bindDn
-          name: {{ $value.existingSecret }}
-    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  bindPassword
-          name: {{ $value.existingSecret }}
-    {{- else }}
-    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
-      value: {{ $value.bindDn | quote }}
-    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
-      value: {{ $value.bindPassword | quote }}
-    {{- end }}
-    {{- end }}
-    {{- end }}
-    {{- if .Values.gitea.oauth }}
-    {{- range $idx, $value := .Values.gitea.oauth }}
-    {{- if $value.existingSecret }}
-    - name: GITEA_OAUTH_KEY_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  key
-          name: {{ $value.existingSecret }}
-    - name: GITEA_OAUTH_SECRET_{{ $idx }}
-      valueFrom:
-        secretKeyRef:
-          key:  secret
-          name: {{ $value.existingSecret }}
-    {{- end }}
-    {{- end }}
-    {{- end }}
-    {{- if .Values.secrets.admin.enabled }}
-    - name: GITEA_ADMIN_USERNAME
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.admin.usernameKey" . }}
-          name: {{ include "gitea.secret.admin.name" . }}
-    - name: GITEA_ADMIN_PASSWORD
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.admin.passwordKey" . }}
-          name: {{ include "gitea.secret.admin.name" . }}
-    - name: GITEA_ADMIN_EMAIL
-      valueFrom:
-        secretKeyRef:
-          key: {{ include "gitea.secret.admin.emailKey" . }}
-          name: {{ include "gitea.secret.admin.name" . }}
-    - name: GITEA_ADMIN_PASSWORD_MODE
-      value: {{ include "gitea.secret.admin.passwordMode" $ }}
-    {{- end }}
-    {{- if .Values.deployment.gitea.env }}
-    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
-    {{- end }}
-    {{- with $config.env }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with $config.envFrom }}
-  envFrom:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  volumeMounts:
-    - name: init
-      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-    - name: temp
-      mountPath: /tmp
-    - name: data
-      mountPath: /data
-      {{- if .Values.persistence.new.subPath }}
-      subPath: {{ .Values.persistence.new.subPath }}
-      {{- end }}
-    {{- with $config.volumeMounts }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  resources:
-    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
-{{- end }}

templates/_persistentVolumeClaims.tpl

@@ -1,38 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.persistentVolumeClaim.annotations" -}}
-{{- with .Values.persistence.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.persistentVolumeClaim.enabled" -}}
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingPersistentVolumeClaim.enabled) -}}
-true
-{{- else -}}
-false
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.persistentVolumeClaim.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.persistence.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* name */}}
-
-{{- define "gitea.persistentVolumeClaim.name" -}}
-{{- if .Values.persistence.existingPersistentVolumeClaim.enabled -}}
-{{ required "persistence.existingPersistentVolumeClaim.persistentVolumeClaimName is required when persistence.existingPersistentVolumeClaim.enabled is true" .Values.persistence.existingPersistentVolumeClaim.persistentVolumeClaimName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}
-{{- end }}
-{{- end }}

templates/_pods.tpl

@@ -1,57 +0,0 @@
----
-
-{{/* annotations */}}
-
-{{- define "gitea.pod.annotations" -}}
-
-{{/* secret - admin */}}
-{{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }}
-checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
-{{- end }}
-
-{{/* secret - cloudnativePG */}}
-{{- if and .Values.cloudnativePG.enabled .Values.cloudnativePG.credentials.addSHASumAnnotation }}
-checksum/cloudnativePG: {{ include "gitea.secret.checksum" (list . "cloudnativePG") }}
-{{- end }}
-
-{{/* secret - config */}}
-{{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
-checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}
-{{- end }}
-
-{{/* secret - gpg */}}
-{{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }}
-checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }}
-{{- end }}
-
-{{/* secret - init */}}
-{{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }}
-checksum/init: {{ include "gitea.secret.checksum" (list . "init") }}
-{{- end }}
-
-{{/* secret - inlineConfig */}}
-{{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }}
-checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }}
-{{- end }}
-
-{{/* secret - metrics */}}
-{{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }}
-checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }}
-{{- end }}
-
-{{/* secret - ldap */}}
-{{- range $idx, $value := .Values.gitea.ldap }}
-checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
-{{- end }}
-
-{{/* secret - oauth */}}
-{{- range $idx, $value := .Values.gitea.oauth }}
-checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
-{{- end }}
-
-{{/* custom pod annotations */}}
-{{- with .Values.gitea.podAnnotations }}
-{{ toYaml . }}
-{{- end }}
-
-{{- end }}

templates/_secrets.tpl

@@ -1,239 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.secret.admin.annotations" -}}
-{{- with .Values.secrets.admin.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.annotations" -}}
-{{- with .Values.cloudnativePG.credentials.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.config.annotations" -}}
-{{- with .Values.secrets.config.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.gpg.annotations" -}}
-{{- with .Values.secrets.gpg.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.init.annotations" -}}
-{{- with .Values.secrets.init.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.inlineConfig.annotations" -}}
-{{- with .Values.secrets.inlineConfig.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.metrics.annotations" -}}
-{{- with .Values.secrets.metrics.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* checksums */}}
-
-{{/*
-SHA sum of a Secret, used to trigger a rollout whenever its content changes.
-User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
-cluster still holds their pre-upgrade state.
-Arguments: (list $root $key)
-*/}}
-{{- define "gitea.secret.checksum" -}}
-{{- $root := index . 0 -}}
-{{- $key := index . 1 -}}
-{{- $config := index $root.Values.secrets $key -}}
-{{- if eq $key "cloudnativePG" -}}
-{{- $config = $root.Values.cloudnativePG.credentials -}}
-{{- end -}}
-{{- if $config.existingSecret.enabled -}}
-{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
-{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
-{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
-{{- else -}}
-{{- include (printf "%s/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
-{{- end -}}
-{{- end }}
-
-
-{{/* labels */}}
-
-{{- define "gitea.secret.admin.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.admin.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.cloudnativePG.credentials.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.config.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.config.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.gpg.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.gpg.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.init.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.init.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.inlineConfig.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.inlineConfig.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.secret.metrics.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.secrets.metrics.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* names */}}
-
-{{- define "gitea.secret.admin.name" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ required "`secrets.admin.existingSecret.secretName` must be set when `secrets.admin.existingSecret.enabled` is enabled" .Values.secrets.admin.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-admin
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.name" -}}
-{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
-{{ required "`cloudnativePG.credentials.existingSecret.secretName` must be set when `cloudnativePG.credentials.existingSecret.enabled` is enabled" .Values.cloudnativePG.credentials.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.cluster.cloudnativePG.name" . }}-app
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.config.name" -}}
-{{- if .Values.secrets.config.existingSecret.enabled -}}
-{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-config
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.gpg.name" -}}
-{{- if .Values.secrets.gpg.existingSecret.enabled -}}
-{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-gpg-key
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.init.name" -}}
-{{- if .Values.secrets.init.existingSecret.enabled -}}
-{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-init
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.inlineConfig.name" -}}
-{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}}
-{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-inline-config
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.metrics.name" -}}
-{{- if .Values.secrets.metrics.existingSecret.enabled -}}
-{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}-metrics
-{{- end -}}
-{{- end }}
-
-{{/* keys */}}
-
-{{- define "gitea.secret.admin.emailKey" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ .Values.secrets.admin.existingSecret.emailKey }}
-{{- else -}}
-email
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.admin.passwordKey" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ .Values.secrets.admin.existingSecret.passwordKey }}
-{{- else -}}
-password
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.admin.usernameKey" -}}
-{{- if .Values.secrets.admin.existingSecret.enabled -}}
-{{ .Values.secrets.admin.existingSecret.usernameKey }}
-{{- else -}}
-username
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.cloudnativePG.passwordKey" -}}
-{{- if .Values.cloudnativePG.credentials.existingSecret.enabled -}}
-{{ .Values.cloudnativePG.credentials.existingSecret.passwordKey }}
-{{- else -}}
-password
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.gpg.gpgHomeKey" -}}
-{{- if .Values.secrets.gpg.existingSecret.enabled -}}
-{{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
-{{- else -}}
-gpgHome
-{{- end -}}
-{{- end }}
-
-{{- define "gitea.secret.gpg.privateKeyKey" -}}
-{{- if .Values.secrets.gpg.existingSecret.enabled -}}
-{{ .Values.secrets.gpg.existingSecret.privateKeyKey }}
-{{- else -}}
-privateKey
-{{- end -}}
-{{- end }}
-
-{{/* misc */}}
-
-{{- define "gitea.secret.admin.passwordMode" -}}
-{{- if has .Values.secrets.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
-{{ .Values.secrets.admin.passwordMode }}
-{{- else -}}
-{{ printf "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.secrets.admin.passwordMode | fail }}
-{{- end -}}
-{{- end }}

templates/_serviceAccounts.tpl

@@ -1,38 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.serviceAccount.annotations" -}}
-{{- with .Values.serviceAccount.new.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.serviceAccount.enabled" -}}
-{{- if and .Values.serviceAccount.enabled (not .Values.serviceAccount.existingServiceAccount.enabled) -}}
-true
-{{- else -}}
-false
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.serviceAccount.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.serviceAccount.new.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}
-
-{{/* name */}}
-
-{{- define "gitea.serviceAccount.name" -}}
-{{- if .Values.serviceAccount.existingServiceAccount.enabled -}}
-{{ required "serviceAccount.existingServiceAccount.existingServiceAccountName is required when serviceAccount.existingServiceAccount.enabled is true" .Values.serviceAccount.existingServiceAccount.existingServiceAccountName }}
-{{- else -}}
-{{ include "gitea.fullname" . }}
-{{- end }}
-{{- end }}

templates/_services.tpl

@@ -1,11 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* names */}}
-
-{{- define "gitea.service.http.name" -}}
-{{ include "gitea.fullname" . }}-http
-{{- end }}
-
-{{- define "gitea.service.ssh.name" -}}
-{{ include "gitea.fullname" . }}-ssh
-{{- end }}

templates/_tcpRoutes.tpl

@@ -1,30 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.tcpRoute.annotations" -}}
-{{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
-{{- toYaml . -}}
-{{- end }}
-{{- end }}
-
-{{/* enabled */}}
-
-{{- define "gitea.tcpRoute.enabled" -}}
-{{- if and .Values.gatewayAPI.enabled
-           .Values.gatewayAPI.core.tcpRoute.enabled
--}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.tcpRoute.labels" -}}
-{{ include "gitea.labels" . }}
-{{- with .Values.gatewayAPI.core.tcpRoute.labels }}
-{{ toYaml . }}
-{{- end }}
-{{- end }}

templates/backendTLSPolicy.yaml

@@ -1,30 +0,0 @@
-{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
-{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
-{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
-{{- end }}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: BackendTLSPolicy
-metadata:
-  {{- with (include "gitea.backendTLSPolicy.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.backendTLSPolicy.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  targetRefs:
-    {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
-    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
-    {{- else }}
-    - group: ""
-      kind: Service
-      name: {{ include "gitea.service.http.name" . }}
-    {{- end }}
-  validation:
-    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
-{{- end }}

templates/clientSettingsPolicy.yaml

@@ -1,30 +0,0 @@
-{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
-{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
-{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
-{{- end }}
----
-apiVersion: gateway.nginx.org/v1alpha1
-kind: ClientSettingsPolicy
-metadata:
-  {{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.clientSettingsPolicies.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  targetRef:
-    {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
-    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
-    {{- else }}
-    group: gateway.networking.k8s.io
-    kind: HTTPRoute
-    name: {{ include "gitea.fullname" . }}
-    {{- end }}
-  body:
-    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
-{{- end }}

templates/cluster.yaml

@@ -1,51 +0,0 @@
-{{- if .Values.cloudnativePG.enabled -}}
-{{- $registry := .Values.global.imageRegistry | default .Values.cloudnativePG.image.registry -}}
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  {{- with (include "gitea.cluster.cloudnativePG.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.cluster.cloudnativePG.labels" . | nindent 4 }}
-  name: {{ include "gitea.cluster.cloudnativePG.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  {{- with .Values.cloudnativePG.affinity }}
-  affinity:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  bootstrap:
-    initdb:
-      database: {{ .Values.cloudnativePG.credentials.database | quote }}
-      owner: {{ .Values.cloudnativePG.credentials.username | quote }}
-      secret:
-        name: {{ include "gitea.secret.cloudnativePG.name" . }}
-  imageName: {{ printf "%s/%s:%s" $registry .Values.cloudnativePG.image.repository (.Values.cloudnativePG.image.tag | toString) | quote }}
-  instances: {{ .Values.cloudnativePG.instances }}
-  monitoring:
-    enablePodMonitor: {{ .Values.cloudnativePG.monitoring.enablePodMonitor }}
-  postgresql:
-    parameters:
-      {{- toYaml .Values.cloudnativePG.postgresql.parameters | nindent 6 }}
-  priorityClassName: {{ .Values.cloudnativePG.priorityClassName | quote }}
-  resources:
-    {{- toYaml .Values.cloudnativePG.resources | nindent 4 }}
-  storage:
-    size: {{ .Values.cloudnativePG.storage.size | quote }}
-    {{- with .Values.cloudnativePG.storage.storageClass }}
-    storageClass: {{ . | quote }}
-    {{- end }}
-  {{- with .Values.cloudnativePG.topologySpreadConstraints }}
-  topologySpreadConstraints:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- if .Values.cloudnativePG.walStorage.enabled }}
-  walStorage:
-    size: {{ .Values.cloudnativePG.walStorage.size | quote }}
-    {{- with .Values.cloudnativePG.walStorage.storageClass }}
-    storageClass: {{ . | quote }}
-    {{- end }}
-  {{- end }}
-{{- end -}}

templates/deployment.yaml

@@ -1,221 +0,0 @@
-{{- if .Values.deployment.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  {{- with (include "gitea.deployment.annotations" . | fromYaml) }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.deployment.labels" . | fromYaml) }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  replicas: {{ .Values.deployment.replicas }}
-  strategy:
-    type: {{ .Values.deployment.strategy.type }}
-    {{- if eq .Values.deployment.strategy.type "RollingUpdate" }}
-    rollingUpdate:
-      maxUnavailable: {{ .Values.deployment.strategy.rollingUpdate.maxUnavailable }}
-      maxSurge: {{ .Values.deployment.strategy.rollingUpdate.maxSurge }}
-    {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gitea.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with (include "gitea.pod.annotations" . | fromYaml) }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "gitea.labels" . | nindent 8 }}
-        {{- if .Values.deployment.labels }}
-        {{- toYaml .Values.deployment.labels | nindent 8 }}
-        {{- end }}
-    spec:
-      {{- $hostUsers := include "gitea.hostUsers" . | trim }}
-      {{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
-      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
-      {{- if .Values.deployment.schedulerName }}
-      schedulerName: "{{ .Values.deployment.schedulerName }}"
-      {{- end }}
-      {{- if .Values.serviceAccount.enabled }}
-      serviceAccountName: {{ include "gitea.serviceAccount.name" . }}
-      {{- end }}
-      {{- if .Values.deployment.priorityClassName }}
-      priorityClassName: "{{ .Values.deployment.priorityClassName }}"
-      {{- end }}
-      {{- if $hostUsers }}
-      hostUsers: {{ $hostUsers }}
-      {{- end }}
-      {{- include "gitea.images.pullSecrets" . | nindent 6 }}
-      {{- if $securityContext }}
-      securityContext:
-        {{- $securityContext | nindent 8 }}
-      {{- end }}
-      initContainers:
-        {{- include "gitea.deployment.initContainers" . | trim | nindent 8 }}
-      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
-      containers:
-        - name: {{ .Chart.Name }}
-          image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
-          env:
-            # SSH Port values have to be set here as well for openssh configuration
-            - name: SSH_LISTEN_PORT
-              value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
-            - name: SSH_PORT
-              value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
-            {{- if not .Values.deployment.gitea.image.rootless }}
-            - name: SSH_LOG_LEVEL
-              value: {{ .Values.gitea.ssh.logLevel | quote }}
-            {{- end }}
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            {{- with .Values.deployment.gitea.resources }}
-            {{- if and (hasKey . "limits") (hasKey (.limits | default dict) "cpu") }}
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  divisor: "1"
-                  resource: limits.cpu
-            {{- end }}
-            {{- end }}
-            - name: TMPDIR
-              value: /tmp/gitea
-            {{- if .Values.deployment.gitea.image.rootless }}
-            - name: HOME
-              value: /data/gitea/git
-            {{- end }}
-            {{- if .Values.secrets.gpg.enabled }}
-            - name: GNUPGHOME
-              valueFrom:
-                secretKeyRef:
-                  name: {{ include "gitea.secret.gpg.name" . }}
-                  key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
-            {{- end }}
-            {{- if .Values.deployment.gitea.env }}
-            {{- toYaml .Values.deployment.gitea.env | nindent 12 }}
-            {{- end }}
-          {{- with .Values.deployment.gitea.envFrom }}
-          envFrom:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - name: ssh
-              containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
-            {{- if .Values.service.ssh.hostPort }}
-              hostPort: {{ .Values.service.ssh.hostPort }}
-            {{- end }}
-            - name: http
-              containerPort: {{ .Values.gitea.config.server.HTTP_PORT }}
-            {{- if .Values.gitea.config.server.ENABLE_PPROF }}
-            - name: profiler
-              containerPort: 6060
-            {{- end }}
-          {{- if .Values.gitea.livenessProbe.enabled }}
-          livenessProbe:
-            {{- include "gitea.deployment.probe" .Values.gitea.livenessProbe | nindent 12 }}
-          {{- end }}
-          {{- if .Values.gitea.readinessProbe.enabled }}
-          readinessProbe:
-            {{- include "gitea.deployment.probe" .Values.gitea.readinessProbe | nindent 12 }}
-          {{- end }}
-          {{- if .Values.gitea.startupProbe.enabled }}
-          startupProbe:
-            {{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
-          {{- end }}
-          resources:
-            {{- toYaml (.Values.deployment.gitea.resources | default dict) | nindent 12 }}
-          {{- if $containerSecurityContext }}
-          securityContext:
-            {{- $containerSecurityContext | nindent 12 }}
-          {{- end }}
-          volumeMounts:
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.new.subPath }}
-              subPath: {{ .Values.persistence.new.subPath }}
-              {{- end }}
-            {{- include "gitea.container-additional-mounts" . | nindent 12 }}
-        {{- if .Values.extraContainers }}
-        {{- toYaml .Values.extraContainers | nindent 8 }}
-        {{- end }}
-      {{- with .Values.global.hostAliases }}
-      hostAliases:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.deployment.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    {{- with .Values.deployment.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.deployment.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.deployment.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- if .Values.deployment.dnsConfig }}
-      dnsConfig:
-        {{- toYaml .Values.deployment.dnsConfig | nindent 8 }}
-    {{- end }}
-    {{- with .Values.deployment.resources }}
-      resources:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-      volumes:
-        - name: init
-          secret:
-            secretName: {{ include "gitea.secret.init.name" . }}
-            defaultMode: 110
-        - name: config
-          secret:
-            secretName: {{ include "gitea.secret.config.name" . }}
-            defaultMode: 110
-        {{- if gt (len .Values.deployment.volumes) 0 }}
-        {{- toYaml .Values.deployment.volumes | nindent 8 }}
-        {{- end }}
-        - name: inline-config-sources
-          secret:
-            secretName: {{ include "gitea.secret.inlineConfig.name" . }}
-        {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
-        - name: additional-config-sources-{{ $idx }}
-          {{- toYaml $value | nindent 10 }}
-        {{- end }}
-        - name: temp
-          emptyDir: {}
-        {{- if .Values.secrets.gpg.enabled }}
-        - name: gpg-private-key
-          secret:
-            secretName: {{ include "gitea.secret.gpg.name" . }}
-            items:
-              - key: {{ include "gitea.secret.gpg.privateKeyKey" . }}
-                path: private.asc
-            defaultMode: 0100
-        {{- end }}
-  {{- if .Values.persistence.enabled }}
-        - name: data
-          persistentVolumeClaim:
-            claimName: {{ include "gitea.persistentVolumeClaim.name" . }}
-  {{- else }}
-        - name: data
-          emptyDir: {}
-  {{- end }}
-{{- end }}

templates/deprecation.yaml

@@ -1,167 +0,0 @@
-{{- if .Values.checkDeprecation -}}
-  {{/* CUSTOM PROBES */}}
-  {{- if .Values.gitea.customLivenessProbe -}}
-    {{- fail "`gitea.customLivenessProbe` does no longer exist. Please refer to the changelog and configure `gitea.livenessProbe` instead." -}}
-  {{- end -}}
-  {{- if .Values.gitea.customReadinessProbe -}}
-    {{- fail "`gitea.customReadinessProbe` does no longer exist. Please refer to the changelog and configure `gitea.readinessProbe` instead." -}}
-  {{- end -}}
-  {{- if .Values.gitea.customStartupProbe -}}
-    {{- fail "`gitea.customStartupProbe` does no longer exist. Please refer to the changelog and configure `gitea.startupProbe` instead." -}}
-  {{- end -}}
-
-  {{/* LDAP SOURCES */}}
-  {{- if kindIs "map" .Values.gitea.ldap -}}
-    {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
-  {{- end -}}
-
-  {{/* OAUTH SOURCES */}}
-  {{- if kindIs "map" .Values.gitea.oauth -}}
-    {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
-  {{- end -}}
-
-  {{/* BUILTIN */}}
-  {{- if .Values.gitea.cache -}}
-    {{- if .Values.gitea.cache.builtIn -}}
-      {{- fail "`gitea.cache.builtIn` does no longer exist. Please use `memcached` at root level instead." -}}
-    {{- end -}}
-  {{- end -}}
-  {{- if .Values.gitea.database -}}
-    {{- if .Values.gitea.database.builtIn -}}
-      {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
-    {{- end -}}
-  {{- end -}}
-  {{- if .Values.gitea.admin -}}
-    {{- fail "`gitea.admin` does no longer exist. Please refer to the changelog and configure `secrets.admin` instead." -}}
-  {{- end -}}
-
-  {{/* SIGNING */}}
-  {{- if .Values.signing -}}
-    {{- fail "`signing` does no longer exist. Please refer to the changelog and configure `secrets.gpg` instead." -}}
-  {{- end -}}
-
-  {{/* AFFINITY */}}
-  {{- if .Values.affinity -}}
-    {{- fail "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead." -}}
-  {{- end -}}
-
-  {{/* CONTAINER SECURITY CONTEXT */}}
-  {{- if .Values.containerSecurityContext -}}
-    {{- fail "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead." -}}
-  {{- end -}}
-
-  {{/* DEPLOYMENT ENV */}}
-  {{- if .Values.deployment.env -}}
-    {{- fail "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead." -}}
-  {{- end -}}
-
-  {{/* DNS CONFIG */}}
-  {{- if .Values.dnsConfig -}}
-    {{- fail "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA CONTAINER VOLUME MOUNTS */}}
-  {{- if .Values.extraContainerVolumeMounts -}}
-    {{- fail "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA INIT VOLUME MOUNTS */}}
-  {{- if .Values.extraInitVolumeMounts -}}
-    {{- fail "`extraInitVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.<initContainer>.volumeMounts` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA VOLUME MOUNTS */}}
-  {{- if .Values.extraVolumeMounts -}}
-    {{- fail "`extraVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` and `deployment.<initContainer>.volumeMounts` instead." -}}
-  {{- end -}}
-
-  {{/* EXTRA VOLUMES */}}
-  {{- if .Values.extraVolumes -}}
-    {{- fail "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." -}}
-  {{- end -}}
-
-  {{/* INGRESS CLASS NAME */}}
-  {{- if hasKey .Values.ingress "className" -}}
-    {{- fail "`ingress.className` does no longer exist. Please refer to the changelog and configure `ingress.ingressClassName` instead." -}}
-  {{- end -}}
-
-  {{/* NODE SELECTOR */}}
-  {{- if .Values.nodeSelector -}}
-    {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}
-  {{- end -}}
-
-  {{/* OPENSHIFT HOST USERS */}}
-  {{- if hasKey .Values.openshift "hostUsers" -}}
-    {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
-  {{- end -}}
-
-  {{/* POSTGRESQL */}}
-  {{- if index .Values "postgresql" -}}
-    {{- fail "`postgresql` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}}
-  {{- end -}}
-
-  {{/* POSTGRESQL HA */}}
-  {{- if index .Values "postgresql-ha" -}}
-    {{- fail "`postgresql-ha` does no longer exist. Please refer to the changelog and configure `cloudnativePG` instead, which requires the CloudNativePG operator to be installed in the cluster." -}}
-  {{- end -}}
-
-  {{/* PRIORITY CLASS NAME */}}
-  {{- if .Values.priorityClassName -}}
-    {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}
-  {{- end -}}
-
-  {{/* POD SECURITY CONTEXT */}}
-  {{- if .Values.podSecurityContext -}}
-    {{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
-  {{- end -}}
-
-  {{/* POST EXTRA INIT CONTAINERS */}}
-  {{- if .Values.postExtraInitContainers -}}
-    {{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}}
-  {{- end -}}
-
-  {{/* PRE EXTRA INIT CONTAINERS */}}
-  {{- if .Values.preExtraInitContainers -}}
-    {{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}}
-  {{- end -}}
-
-  {{/* RESOURCES */}}
-  {{- if .Values.resources -}}
-    {{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}
-  {{- end -}}
-
-  {{/* REPLICA COUNT */}}
-  {{- if .Values.replicaCount -}}
-    {{- fail "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead." -}}
-  {{- end -}}
-
-  {{/* SCHEDULER NAME */}}
-  {{- if .Values.schedulerName -}}
-    {{- fail "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead." -}}
-  {{- end -}}
-
-  {{/* SECURITY CONTEXT */}}
-  {{- if .Values.securityContext -}}
-    {{- fail "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead." -}}
-  {{- end -}}
-
-  {{/* STRATEGY */}}
-  {{- if .Values.strategy -}}
-    {{- fail "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." -}}
-  {{- end -}}
-
-  {{/* TEST */}}
-  {{- if .Values.test -}}
-    {{- fail "`test` does no longer exist. Please refer to the changelog. The `helm test` connection Pod has been removed without replacement." -}}
-  {{- end -}}
-
-  {{/* TOLERATIONS */}}
-  {{- if .Values.tolerations -}}
-    {{- fail "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead." -}}
-  {{- end -}}
-
-  {{/* TOPOLOGY SPREAD CONSTRAINTS */}}
-  {{- if .Values.topologySpreadConstraints -}}
-    {{- fail "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead." -}}
-  {{- end -}}
-{{- end -}}

templates/gitea/check-actions-not-present.yaml

@@ -0,0 +1,3 @@
+{{- if .Values.actions -}}
+    {{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
+{{- end -}}

templates/gitea/config.yaml

@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}-inline-config
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{- include "gitea.inline_configuration" . | nindent 2 }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
+  assertions: |
+
+    {{- /*assert that only one PG dep is enabled */ -}}
+    {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
+      {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
+    {{- end }}
+    
+    {{- /* multiple replicas assertions */ -}}
+    {{- if gt (.Values.replicaCount | int) 1 -}}
+      {{- if .Values.gitea.config.cron -}}
+        {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
+          {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
+            {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    
+      {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}}
+        {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}}
+      {{- end }}
+      {{- if .Values.gitea.config.indexer -}}
+        {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
+          {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
+        {{- end }}
+        {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
+          {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
+            {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
+              {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
+                {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
+              {{- end }}
+            {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      
+    {{- end }}

templates/gitea/deployment.yaml

@@ -0,0 +1,429 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- if .Values.deployment.annotations }}
+    {{- toYaml .Values.deployment.annotations | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+    {{- if .Values.deployment.labels }}
+    {{- toYaml .Values.deployment.labels | nindent 4 }}
+    {{- end }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: {{ .Values.strategy.type }}
+    {{- if eq .Values.strategy.type "RollingUpdate" }}
+    rollingUpdate:
+      maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
+      maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
+    {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gitea.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/gitea/config.yaml") . | sha256sum }}
+        {{- range $idx, $value := .Values.gitea.ldap }}
+        checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
+        {{- end }}
+        {{- range $idx, $value := .Values.gitea.oauth }}
+        checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
+        {{- end }}
+        {{- with .Values.gitea.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "gitea.labels" . | nindent 8 }}
+        {{- if .Values.deployment.labels }}
+        {{- toYaml .Values.deployment.labels | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- if .Values.schedulerName }}
+      schedulerName: "{{ .Values.schedulerName }}"
+      {{- end }}
+      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
+      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
+      {{- end }}
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{ .Values.priorityClassName }}"
+      {{- end }}
+      {{- include "gitea.images.pullSecrets" . | nindent 6 }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+        {{- if .Values.preExtraInitContainers }}
+        {{- toYaml .Values.preExtraInitContainers | nindent 8 }}
+        {{- end }}
+        - name: init-directories
+          image: "{{ include "gitea.image" . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
+          env:
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+            {{- if .Values.signing.enabled }}
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+            {{- end }}
+          volumeMounts:
+            - name: init
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        - name: init-app-ini
+          image: "{{ include "gitea.image" . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+          - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
+          env:
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            - name: TMP_EXISTING_ENVS_FILE
+              value: /tmp/existing-envs
+            - name: ENV_TO_INI_MOUNT_POINT
+              value: /env-to-ini-mounts
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+            {{- if .Values.gitea.additionalConfigFromEnvs }}
+            {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: config
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            - name: inline-config-sources
+              mountPath: /env-to-ini-mounts/inlines/
+            {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
+            - name: additional-config-sources-{{ $idx }}
+              mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
+            {{- end }}
+            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        {{- if .Values.signing.enabled }}
+        - name: configure-gpg
+          image: "{{ include "gitea.image" . }}"
+          command:
+          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
+          env:
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+            - name: TMP_RAW_GPG_KEY
+              value: /raw/private.asc
+          volumeMounts:
+            - name: init
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            - name: gpg-private-key
+              mountPath: /raw
+              readOnly: true
+            {{- if .Values.extraVolumeMounts }}
+            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        {{- end }}
+        - name: configure-gitea
+          image: "{{ include "gitea.image" . }}"
+          command:
+          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
+            {{- $csc := deepCopy .Values.containerSecurityContext -}}
+            {{- if not (hasKey $csc "runAsUser") -}}
+            {{- $_ := set $csc "runAsUser" 1000 -}}
+            {{- end -}}
+            {{- toYaml $csc | nindent 12 }}
+          env:
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- if .Values.image.rootless }}
+            - name: HOME
+              value: /data/gitea/git
+            {{- end }}
+            {{- if .Values.gitea.ldap }}
+            {{- range $idx, $value := .Values.gitea.ldap }}
+            {{- if $value.existingSecret }}
+            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  bindDn
+                  name: {{ $value.existingSecret }}
+            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  bindPassword
+                  name: {{ $value.existingSecret }}
+            {{- else }}
+            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
+              value: {{ $value.bindDn | quote }}
+            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
+              value: {{ $value.bindPassword | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            {{- if .Values.gitea.oauth }}
+            {{- range $idx, $value := .Values.gitea.oauth }}
+            {{- if $value.existingSecret }}
+            - name: GITEA_OAUTH_KEY_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  key
+                  name: {{ $value.existingSecret }}
+            - name: GITEA_OAUTH_SECRET_{{ $idx }}
+              valueFrom:
+                secretKeyRef:
+                  key:  secret
+                  name: {{ $value.existingSecret }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
+            {{- if .Values.gitea.admin.existingSecret }}
+            - name: GITEA_ADMIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  key:  username
+                  name: {{ .Values.gitea.admin.existingSecret }}
+            - name: GITEA_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key:  password
+                  name: {{ .Values.gitea.admin.existingSecret }}
+            {{- else }}
+            - name: GITEA_ADMIN_USERNAME
+              value: {{ .Values.gitea.admin.username | quote }}
+            - name: GITEA_ADMIN_PASSWORD
+              value: {{ .Values.gitea.admin.password | quote }}
+            {{- end }}
+            - name: GITEA_ADMIN_PASSWORD_MODE
+              value: {{ include "gitea.admin.passwordMode" $ }}
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: init
+              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
+          resources:
+            {{- toYaml .Values.initContainers.resources | nindent 12 }}
+        {{- if .Values.postExtraInitContainers }}
+        {{- toYaml .Values.postExtraInitContainers | nindent 8 }}
+        {{- end }}
+      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ include "gitea.image" . }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            # SSH Port values have to be set here as well for openssh configuration
+            - name: SSH_LISTEN_PORT
+              value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
+            - name: SSH_PORT
+              value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
+            {{- if not .Values.image.rootless }}
+            - name: SSH_LOG_LEVEL
+              value: {{ .Values.gitea.ssh.logLevel | quote }}
+            {{- end }}
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- if and (hasKey .Values.resources "limits") (hasKey .Values.resources.limits "cpu") }}
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  divisor: "1"
+                  resource: limits.cpu
+            {{- end }}
+            - name: TMPDIR
+              value: /tmp/gitea
+            {{- if .Values.image.rootless }}
+            - name: HOME
+              value: /data/gitea/git
+            {{- end }}
+            {{- if .Values.signing.enabled }}
+            - name: GNUPGHOME
+              value: {{ .Values.signing.gpgHome }}
+            {{- end }}
+            {{- if .Values.deployment.env }}
+            {{- toYaml .Values.deployment.env | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: ssh
+              containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
+            {{- if .Values.service.ssh.hostPort }}
+              hostPort: {{ .Values.service.ssh.hostPort }}
+            {{- end }}
+            - name: http
+              containerPort: {{ .Values.gitea.config.server.HTTP_PORT }}
+            {{- if .Values.gitea.config.server.ENABLE_PPROF }}
+            - name: profiler
+              containerPort: 6060
+            {{- end }}
+          {{- if .Values.gitea.livenessProbe.enabled }}
+          livenessProbe:
+            {{- include "gitea.deployment.probe" .Values.gitea.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.gitea.readinessProbe.enabled }}
+          readinessProbe:
+            {{- include "gitea.deployment.probe" .Values.gitea.readinessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.gitea.startupProbe.enabled }}
+          startupProbe:
+            {{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            {{- /* Honor the deprecated securityContext variable when defined */ -}}
+            {{- if .Values.containerSecurityContext -}}
+            {{ toYaml .Values.containerSecurityContext | nindent 12 -}}
+            {{- else -}}
+            {{ toYaml .Values.securityContext | nindent 12 -}}
+            {{- end }}
+          volumeMounts:
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.subPath }}
+              subPath: {{ .Values.persistence.subPath }}
+              {{- end }}
+            {{- include "gitea.container-additional-mounts" . | nindent 12 }}
+        {{- if .Values.extraContainers }}
+        {{- toYaml .Values.extraContainers | nindent 8 }}
+        {{- end }}
+      {{- with .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- if .Values.dnsConfig }}
+      dnsConfig:
+        {{- toYaml .Values.dnsConfig | nindent 8 }}
+    {{- end }}
+      volumes:
+        - name: init
+          secret:
+            secretName: {{ include "gitea.fullname" . }}-init
+            defaultMode: 110
+        - name: config
+          secret:
+            secretName: {{ include "gitea.fullname" . }}
+            defaultMode: 110
+        {{- if gt (len .Values.extraVolumes) 0 }}
+        {{- toYaml .Values.extraVolumes | nindent 8 }}
+        {{- end }}
+        - name: inline-config-sources
+          secret:
+            secretName: {{ include "gitea.fullname" . }}-inline-config
+        {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
+        - name: additional-config-sources-{{ $idx }}
+          {{- toYaml $value | nindent 10 }}
+        {{- end }}
+        - name: temp
+          emptyDir: {}
+        {{- if .Values.signing.enabled }}
+        - name: gpg-private-key
+          secret:
+            secretName: {{ include "gitea.gpg-key-secret-name" . }}
+            items:
+              - key: privateKey
+                path: private.asc
+            defaultMode: 0100
+        {{- end }}
+  {{- if .Values.persistence.enabled }}
+    {{- if .Values.persistence.mount }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.claimName }}
+    {{- end }}
+  {{- else if not .Values.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+  {{- end }}

templates/gitea/deprecation.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.checkDeprecation -}}
+  {{/* CUSTOM PROBES */}}
+  {{- if .Values.gitea.customLivenessProbe -}}
+    {{- fail "`gitea.customLivenessProbe` does no longer exist. Please refer to the changelog and configure `gitea.livenessProbe` instead." -}}
+  {{- end -}}
+  {{- if .Values.gitea.customReadinessProbe -}}
+    {{- fail "`gitea.customReadinessProbe` does no longer exist. Please refer to the changelog and configure `gitea.readinessProbe` instead." -}}
+  {{- end -}}
+  {{- if .Values.gitea.customStartupProbe -}}
+    {{- fail "`gitea.customStartupProbe` does no longer exist. Please refer to the changelog and configure `gitea.startupProbe` instead." -}}
+  {{- end -}}
+
+  {{/* LDAP SOURCES */}}
+  {{- if kindIs "map" .Values.gitea.ldap -}}
+    {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
+  {{- end -}}
+  
+  {{/* OAUTH SOURCES */}}
+  {{- if kindIs "map" .Values.gitea.oauth -}}
+    {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
+  {{- end -}}
+  
+  {{/* BUILTIN */}}
+  {{- if .Values.gitea.cache -}}
+    {{- if .Values.gitea.cache.builtIn -}}
+      {{- fail "`gitea.cache.builtIn` does no longer exist. Please use `memcached` at root level instead." -}}
+    {{- end -}}
+  {{- end -}}
+  {{- if .Values.gitea.database -}}
+    {{- if .Values.gitea.database.builtIn -}}
+      {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}

templates/gitea/gpg-secret.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.signing.enabled -}}
+{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
+  {{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}}
+{{- end }}
+{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.gpg-key-secret-name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+data:
+  privateKey: {{ .Values.signing.privateKey | b64enc }}
+{{- end }}
+{{- end }}

templates/gitea/http-svc.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    {{- toYaml .Values.service.http.annotations | nindent 4 }}
+  name: {{ include "gitea.fullname" . }}-http
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.http.labels }}
     {{- toYaml .Values.service.http.labels  | nindent 4 }}
     {{- end }}
-  name: {{ include "gitea.service.http.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.http.annotations | nindent 4 }}
 spec:
   type: {{ .Values.service.http.type }}
   {{- if eq .Values.service.http.type "LoadBalancer" }}

templates/gitea/ingress.yaml

@@ -1,20 +1,29 @@
-{{- if eq (include "gitea.ingress.enabled" .) "true" -}}
----
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "gitea.fullname" . -}}
+{{- $httpPort := .Values.service.http.port -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  {{- with (include "gitea.ingress.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.ingress.labels" .) }}
+  name: {{ $fullName }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.ingress.name" . }}
-  namespace: {{ .Release.Namespace }}
+    {{- include "gitea.labels" . | nindent 4 }}
+  annotations:
+    {{- range $key, $value := .Values.ingress.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
-  ingressClassName: {{ tpl .Values.ingress.ingressClassName . }}
+  ingressClassName: {{ tpl .Values.ingress.className . }}
+{{- if .Values.ingress.tls }}
+  tls:
+  {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ tpl . $ | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+  {{- end }}
+{{- end }}
   rules:
     {{- range .Values.ingress.hosts }}
     - host: {{ tpl .host $ | quote }}
@@ -27,17 +36,17 @@ spec:
             pathType: {{ default "Prefix" $.Values.ingress.pathType }}
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
           {{- else }}
           - path: {{ .path | default "/" }}
             pathType: {{ .pathType | default "Prefix" }}
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
           {{- end }}
           {{- end }}
           {{- else }}
@@ -45,19 +54,9 @@ spec:
             pathType: "Prefix"
             backend:
               service:
-                name: {{ include "gitea.service.http.name" $ }}
+                name: {{ $fullName }}-http
                 port:
-                  number: {{ $.Values.service.http.port }}
+                  number: {{ $httpPort }}
           {{- end }}
     {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ tpl . $ | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
 {{- end }}

templates/gitea/init.yaml

@@ -0,0 +1,228 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.fullname" . }}-init
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
+  init_directory_structure.sh: |-
+    #!/usr/bin/env bash
+
+    set -euo pipefail
+
+    {{- if .Values.initPreScript }}
+    # BEGIN: initPreScript
+    {{- with .Values.initPreScript -}}
+    {{ . | nindent 4}}
+    {{- end -}}
+    # END: initPreScript
+    {{- end }}
+
+    {{- if not .Values.image.rootless }}
+    chown -v 1000:1000 /data
+    {{- end }}
+    mkdir -pv /data/git/.ssh
+    chmod -Rv 700 /data/git/.ssh
+    [ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
+
+    # prepare temp directory structure
+    mkdir -pv "${GITEA_TEMP}"
+    {{- if not .Values.image.rootless }}
+    chown -v 1000:1000 "${GITEA_TEMP}"
+    {{- end }}
+    chmod -v ug+rwx "${GITEA_TEMP}"
+
+    {{ if .Values.signing.enabled -}}
+    if [ ! -d "${GNUPGHOME}" ]; then
+      mkdir -pv "${GNUPGHOME}"
+      chmod -v 700 "${GNUPGHOME}"
+      chown -v 1000:1000 "${GNUPGHOME}"
+    fi
+    {{- end }}
+
+  configure_gitea.sh: |-
+    #!/usr/bin/env bash
+
+    set -euo pipefail
+
+    echo '==== BEGIN GITEA CONFIGURATION ===='
+
+    { # try
+      gitea migrate
+    } || { # catch
+      echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
+      exit 1
+    }
+
+    {{- if include "valkey.servicename" . }}
+    function test_valkey_connection() {
+      local RETRY=0
+      local MAX=30
+      
+      echo 'Wait for valkey to become avialable...'
+      until [ "${RETRY}" -ge "${MAX}" ]; do
+        RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
+        RETRY=$[${RETRY}+1]
+        echo "...not ready yet (${RETRY}/${MAX})"
+      done
+
+      if [ "${RETRY}" -ge "${MAX}" ]; then
+        echo "Valkey not reachable after '${MAX}' attempts!"
+        exit 1
+      fi
+    }
+
+    test_valkey_connection
+    {{- end }}
+    
+
+    {{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
+    function configure_admin_user() {
+      local full_admin_list=$(gitea admin user list --admin)
+      local actual_user_table=''
+
+      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+      local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
+      if [[ "${full_admin_list}" =~ $regex ]]; then
+        actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+      else
+        # This code block should never be reached, as long as the output table header remains the same.
+        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+        echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
+        echo "       Please review the output of 'gitea admin user list --admin' shown below."
+        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+        echo "DEBUG: Output of 'gitea admin user list --admin'"
+        echo "--"
+        echo "${full_admin_list}"
+        echo "--"
+        exit 1
+      fi
+
+      local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
+      if [[ -z "${ACCOUNT_ID}" ]]; then
+        local -a create_args
+        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
+        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
+          create_args+=(--must-change-password=true)
+        else
+          create_args+=(--must-change-password=false)
+        fi
+        echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
+        gitea admin user create "${create_args[@]}"
+        echo '...created.'
+      else
+        if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
+          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
+          # See https://gitea.com/gitea/helm-gitea/issues/673
+          # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
+          #   which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
+          #   should add it to prevent requiring frequent admin password resets.
+          local -a change_args
+          change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
+          if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
+            change_args+=(--must-change-password=false)
+          fi
+          gitea admin user change-password "${change_args[@]}"
+          echo '...password sync done.'
+        else
+          echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
+        fi
+      fi
+    }
+
+    configure_admin_user
+    {{- end }}
+
+    function configure_ldap() {
+      {{- if .Values.gitea.ldap }}
+      {{- range $idx, $value := .Values.gitea.ldap }}
+      local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
+      local full_auth_list=$(gitea admin auth list --vertical-bars)
+      local actual_auth_table=''
+
+      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+      local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
+      if [[ "${full_auth_list}" =~ $regex ]]; then
+        actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+      else
+        # This code block should never be reached, as long as the output table header remains the same.
+        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+        echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
+        echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
+        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+        echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
+        echo "--"
+        echo "${full_auth_list}"
+        echo "--"
+        exit 1
+      fi
+
+      local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " "  "{print \$1}")
+
+      if [[ -z "${GITEA_AUTH_ID}" ]]; then
+        echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
+        gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
+        echo '...installed.'
+      else
+        echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
+        gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
+        echo '...sync settings done.'
+      fi
+      {{- end }}
+      {{- else }}
+        echo 'no ldap configuration... skipping.'
+      {{- end }}
+    }
+
+    configure_ldap
+
+    function configure_oauth() {
+      {{- if .Values.gitea.oauth }}
+      {{- range $idx, $value := .Values.gitea.oauth }}
+      local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
+      local full_auth_list=$(gitea admin auth list --vertical-bars)
+      local actual_auth_table=''
+
+      # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
+      local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
+      if [[ "${full_auth_list}" =~ $regex ]]; then
+        actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
+      else
+        # This code block should never be reached, as long as the output table header remains the same.
+        # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
+
+        echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
+        echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
+        echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
+        echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
+        echo "--"
+        echo "${full_auth_list}"
+        echo "--"
+        exit 1
+      fi
+
+      local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " "  "{print \$1}")
+
+      if [[ -z "${AUTH_ID}" ]]; then
+        echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
+        gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
+        echo '...installed.'
+      else
+        echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
+        gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
+        echo '...sync settings done.'
+      fi
+      {{- end }}
+      {{- else }}
+        echo 'no oauth configuration... skipping.'
+      {{- end }}
+    }
+
+    configure_oauth
+
+    echo '==== END GITEA CONFIGURATION ===='

templates/gitea/metrics-secret.yaml

@@ -0,0 +1,12 @@
+{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "gitea.metrics-secret-name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+type: Opaque
+data:
+  token: {{ .Values.gitea.metrics.token  | b64enc }}
+{{- end }}

templates/gitea/pvc.yaml

@@ -0,0 +1,26 @@
+{{- if and .Values.persistence.enabled .Values.persistence.create }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ .Values.persistence.claimName }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+{{ .Values.persistence.annotations | toYaml | indent 4}}
+  labels:
+{{ .Values.persistence.labels | toYaml | indent 4}}
+spec:
+  accessModes:
+  {{- if gt (.Values.replicaCount | int) 1 }}
+      - ReadWriteMany
+  {{- else }}
+    {{- .Values.persistence.accessModes | toYaml | nindent 4 }}
+  {{- end }}
+  volumeMode: Filesystem
+  {{- include "gitea.persistence.storageClass" . | nindent 2 }}
+  {{- with .Values.persistence.volumeName }}
+  volumeName: {{ . }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}

templates/gitea/serviceaccount.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "gitea.serviceAccountName" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+    {{- with .Values.serviceAccount.labels }}
+    {{- . | toYaml | nindent 4 }}
+  {{- end }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- . | toYaml | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- with .Values.serviceAccount.imagePullSecrets }}
+imagePullSecrets:
+  {{- . | toYaml | nindent 2 }}
+{{- end }}
+{{- end }}

templates/gitea/servicemonitor.yaml

@@ -36,7 +36,7 @@ spec:
     authorization:
       type: Bearer
       credentials:
-        name: {{ include "gitea.secret.metrics.name" . }}
+        name: {{ include "gitea.metrics-secret-name" . }}
         key: token
         optional: false
     {{- end }}

templates/gitea/ssh-svc.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  annotations:
-    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
+  name: {{ include "gitea.fullname" . }}-ssh
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.ssh.labels }}
     {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
     {{- end }}
-  name: {{ include "gitea.service.ssh.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
 spec:
   type: {{ .Values.service.ssh.type }}
   {{- if eq .Values.service.ssh.type "LoadBalancer" }}

templates/httpRoute.yaml

@@ -1,42 +0,0 @@
-{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  {{- with (include "gitea.httpRoute.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.httpRoute.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  parentRefs:
-    {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
-    {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
-    {{- else }}
-    {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
-    {{- end }}
-  {{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
-  hostnames:
-    {{- tpl (toYaml .) $ | nindent 4 }}
-  {{- end }}
-  rules:
-    {{- if .Values.gatewayAPI.core.httpRoute.rules }}
-    {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
-    {{- else }}
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - group: ""
-          kind: Service
-          name: {{ include "gitea.service.http.name" . }}
-          port: {{ .Values.service.http.port }}
-          weight: 1
-    {{- end }}
-{{- end }}

templates/persistentVolumeClaim.yaml

@@ -1,33 +0,0 @@
-{{- if eq (include "gitea.persistentVolumeClaim.enabled" .) "true" }}
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  {{- with (include "gitea.persistentVolumeClaim.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.persistentVolumeClaim.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.persistentVolumeClaim.name" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  accessModes:
-  {{- if gt (.Values.deployment.replicas | int) 1 }}
-      - ReadWriteMany
-  {{- else }}
-    {{- .Values.persistence.new.accessModes | toYaml | nindent 4 }}
-  {{- end }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.new.size }}
-  {{- with .Values.persistence.new.storageClassName }}
-  storageClassName: {{ . }}
-  {{- end }}
-  volumeMode: Filesystem
-  {{- with .Values.persistence.new.persistentVolumeName }}
-  volumeName: {{ . }}
-  {{- end }}
-{{- end }}

templates/route.yaml

@@ -1,52 +0,0 @@
-{{- if .Values.route.enabled -}}
-{{- $fullName := include "gitea.fullname" . -}}
-apiVersion: route.openshift.io/v1
-kind: Route
-metadata:
-  name: {{ $fullName }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-  {{- with .Values.route.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if .Values.route.host }}
-  host: {{ tpl .Values.route.host . | quote }}
-  {{- end }}
-  {{- if .Values.route.path }}
-  path: {{ tpl .Values.route.path . | quote }}
-  {{- end }}
-  to:
-    kind: Service
-    name: {{ include "gitea.service.http.name" . }}
-  port:
-    targetPort: http
-  wildcardPolicy: {{ .Values.route.wildcardPolicy }}
-  {{- with .Values.route.tls }}
-  {{- if .termination }}
-  tls:
-    termination: {{ .termination }}
-    {{- if .insecureEdgeTerminationPolicy }}
-    insecureEdgeTerminationPolicy: {{ .insecureEdgeTerminationPolicy }}
-    {{- end }}
-    {{- if .key }}
-    key: |
-      {{- .key | nindent 6 }}
-    {{- end }}
-    {{- if .certificate }}
-    certificate: |
-      {{- .certificate | nindent 6 }}
-    {{- end }}
-    {{- if .caCertificate }}
-    caCertificate: |
-      {{- .caCertificate | nindent 6 }}
-    {{- end }}
-    {{- if .destinationCACertificate }}
-    destinationCACertificate: |
-      {{- .destinationCACertificate | nindent 6 }}
-    {{- end }}
-  {{- end }}
-  {{- end }}
-{{- end }}

templates/secret_admin.yaml

@@ -1,21 +0,0 @@
-{{- if and (.Values.secrets.admin.enabled) (not .Values.secrets.admin.existingSecret.enabled) -}}
-{{- if or (empty .Values.secrets.admin.new.username) (empty .Values.secrets.admin.new.password) -}}
-  {{- fail "Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`" -}}
-{{- end }}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.admin.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.admin.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.admin.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  email: {{ .Values.secrets.admin.new.email | b64enc }}
-  password: {{ .Values.secrets.admin.new.password | b64enc }}
-  username: {{ .Values.secrets.admin.new.username | b64enc }}
-{{- end }}

templates/secret_cloudnativePG.yaml

@@ -1,18 +0,0 @@
-{{- if and .Values.cloudnativePG.enabled (not .Values.cloudnativePG.credentials.existingSecret.enabled) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.cloudnativePG.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.cloudnativePG.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.cloudnativePG.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: kubernetes.io/basic-auth
-data:
-  password: {{ required "`cloudnativePG.credentials.new.password` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.new.password | b64enc | quote }}
-  {{- /* CloudNativePG requires the username of a basic-auth bootstrap Secret to match the owner of the Cluster. */}}
-  username: {{ required "`cloudnativePG.credentials.username` must be set when `cloudnativePG.enabled` is enabled" .Values.cloudnativePG.credentials.username | b64enc | quote }}
-{{- end -}}

templates/secret_config.yaml

@@ -1,53 +0,0 @@
-{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
-{{- $assertions := include "gitea.config.assertions" . -}}
-{{- if not .Values.secrets.config.existingSecret.enabled -}}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.config.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.config.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.config.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsSecrets | indent 2 }}
-  assertions: {{ $assertions | b64enc | quote }}
-{{- end }}
-
-{{- define "gitea.config.assertions" -}}
-
-  {{- /* multiple replicas assertions */ -}}
-  {{- if gt (.Values.deployment.replicas | int) 1 -}}
-    {{- if .Values.gitea.config.cron -}}
-      {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
-        {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
-          {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
-        {{- end }}
-      {{- end }}
-    {{- end }}
-
-    {{- if eq (first .Values.persistence.new.accessModes) "ReadWriteOnce" -}}
-      {{- fail "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany." -}}
-    {{- end }}
-    {{- if .Values.gitea.config.indexer -}}
-      {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
-        {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
-      {{- end }}
-      {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
-        {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
-          {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
-            {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
-              {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
-            {{- end }}
-          {{- end }}
-        {{- end }}
-      {{- end }}
-    {{- end }}
-
-  {{- end }}
-{{- end }}

templates/secret_gpg.yaml

@@ -1,20 +0,0 @@
-{{- if and (.Values.secrets.gpg.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
-{{- if empty .Values.secrets.gpg.new.privateKey -}}
-  {{- fail "Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`" -}}
-{{- end }}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.gpg.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.gpg.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.gpg.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  gpgHome: {{ .Values.secrets.gpg.new.gpgHome | b64enc }}
-  privateKey: {{ .Values.secrets.gpg.new.privateKey | b64enc }}
-{{- end }}

templates/secret_init.yaml

@@ -1,239 +0,0 @@
-{{- if not .Values.secrets.init.existingSecret.enabled -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.init.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.init.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.init.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-{{ (.Files.Glob "scripts/init-containers/init/*.sh").AsSecrets | indent 2 }}
-  configure_gitea.sh: {{ include "gitea.init.configureGitea" . | trimAll "\n" | b64enc | quote }}
-  init_directory_structure.sh: {{ include "gitea.init.initDirectoryStructure" . | trimAll "\n" | b64enc | quote }}
-{{- end }}
-
-{{- define "gitea.init.initDirectoryStructure" -}}
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-{{- if .Values.initPreScript }}
-# BEGIN: initPreScript
-{{- with .Values.initPreScript -}}
-{{ . | nindent 0 }}
-{{- end -}}
-# END: initPreScript
-{{- end }}
-
-{{- if not .Values.deployment.gitea.image.rootless }}
-chown -v 1000:1000 /data
-{{- end }}
-mkdir -pv /data/git/.ssh
-chmod -Rv 700 /data/git/.ssh
-[ ! -d /data/gitea/conf ] && mkdir -pv /data/gitea/conf
-
-# prepare temp directory structure
-mkdir -pv "${GITEA_TEMP}"
-{{- if not .Values.deployment.gitea.image.rootless }}
-chown -v 1000:1000 "${GITEA_TEMP}"
-{{- end }}
-chmod -v ug+rwx "${GITEA_TEMP}"
-
-{{ if .Values.secrets.gpg.enabled -}}
-if [ ! -d "${GNUPGHOME}" ]; then
-  mkdir -pv "${GNUPGHOME}"
-  chmod -v 700 "${GNUPGHOME}"
-  chown -v 1000:1000 "${GNUPGHOME}"
-fi
-{{- end }}
-{{- end }}
-
-{{- define "gitea.init.configureGitea" -}}
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-echo '==== BEGIN GITEA CONFIGURATION ===='
-
-{ # try
-  gitea migrate
-} || { # catch
-  echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
-  exit 1
-}
-
-{{- if include "valkey.servicename" . }}
-function test_valkey_connection() {
-  local RETRY=0
-  local MAX=30
-
-  echo 'Wait for valkey to become avialable...'
-  until [ "${RETRY}" -ge "${MAX}" ]; do
-    RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
-    RETRY=$[${RETRY}+1]
-    echo "...not ready yet (${RETRY}/${MAX})"
-  done
-
-  if [ "${RETRY}" -ge "${MAX}" ]; then
-    echo "Valkey not reachable after '${MAX}' attempts!"
-    exit 1
-  fi
-}
-
-test_valkey_connection
-{{- end }}
-
-
-{{- if .Values.secrets.admin.enabled }}
-function configure_admin_user() {
-  local full_admin_list=$(gitea admin user list --admin)
-  local actual_user_table=''
-
-  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-  local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
-  if [[ "${full_admin_list}" =~ $regex ]]; then
-    actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-  else
-    # This code block should never be reached, as long as the output table header remains the same.
-    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-    echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
-    echo "       Please review the output of 'gitea admin user list --admin' shown below."
-    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-    echo "DEBUG: Output of 'gitea admin user list --admin'"
-    echo "--"
-    echo "${full_admin_list}"
-    echo "--"
-    exit 1
-  fi
-
-  local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
-  if [[ -z "${ACCOUNT_ID}" ]]; then
-    local -a create_args
-    create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
-    if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
-      create_args+=(--must-change-password=true)
-    else
-      create_args+=(--must-change-password=false)
-    fi
-    echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
-    gitea admin user create "${create_args[@]}"
-    echo '...created.'
-  else
-    if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
-      echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
-      # See https://gitea.com/gitea/helm-gitea/issues/673
-      # --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
-      #   which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
-      #   should add it to prevent requiring frequent admin password resets.
-      local -a change_args
-      change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
-      if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
-        change_args+=(--must-change-password=false)
-      fi
-      gitea admin user change-password "${change_args[@]}"
-      echo '...password sync done.'
-    else
-      echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
-    fi
-  fi
-}
-
-configure_admin_user
-{{- end }}
-
-function configure_ldap() {
-  {{- if .Values.gitea.ldap }}
-  {{- range $idx, $value := .Values.gitea.ldap }}
-  local LDAP_NAME={{ (printf "%s" $value.name) | squote }}
-  local full_auth_list=$(gitea admin auth list --vertical-bars)
-  local actual_auth_table=''
-
-  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-  local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
-  if [[ "${full_auth_list}" =~ $regex ]]; then
-    actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-  else
-    # This code block should never be reached, as long as the output table header remains the same.
-    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-    echo "ERROR: 'configure_ldap' was not able to determine the current list of authentication sources."
-    echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
-    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-    echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
-    echo "--"
-    echo "${full_auth_list}"
-    echo "--"
-    exit 1
-  fi
-
-  local GITEA_AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " "  "{print \$1}")
-
-  if [[ -z "${GITEA_AUTH_ID}" ]]; then
-    echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
-    gitea admin auth add-ldap {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
-    echo '...installed.'
-  else
-    echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
-    gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" (list $idx $value) | indent 1 }}
-    echo '...sync settings done.'
-  fi
-  {{- end }}
-  {{- else }}
-    echo 'no ldap configuration... skipping.'
-  {{- end }}
-}
-
-configure_ldap
-
-function configure_oauth() {
-  {{- if .Values.gitea.oauth }}
-  {{- range $idx, $value := .Values.gitea.oauth }}
-  local OAUTH_NAME={{ (printf "%s" $value.name) | squote }}
-  local full_auth_list=$(gitea admin auth list --vertical-bars)
-  local actual_auth_table=''
-
-  # We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
-  local regex="(.*)(ID\s+\|Name\s+\|Type\s+\|Enabled.*)"
-  if [[ "${full_auth_list}" =~ $regex ]]; then
-    actual_auth_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
-  else
-    # This code block should never be reached, as long as the output table header remains the same.
-    # If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
-
-    echo "ERROR: 'configure_oauth' was not able to determine the current list of authentication sources."
-    echo "       Please review the output of 'gitea admin auth list --vertical-bars' shown below."
-    echo "       If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-gitea/issues."
-    echo "DEBUG: Output of 'gitea admin auth list --vertical-bars'"
-    echo "--"
-    echo "${full_auth_list}"
-    echo "--"
-    exit 1
-  fi
-
-  local AUTH_ID=$(echo "${actual_auth_table}" | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " "  "{print \$1}")
-
-  if [[ -z "${AUTH_ID}" ]]; then
-    echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
-    gitea admin auth add-oauth {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
-    echo '...installed.'
-  else
-    echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
-    gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" (list $idx $value) | indent 1 }}
-    echo '...sync settings done.'
-  fi
-  {{- end }}
-  {{- else }}
-    echo 'no oauth configuration... skipping.'
-  {{- end }}
-}
-
-configure_oauth
-
-echo '==== END GITEA CONFIGURATION ===='
-{{- end }}

templates/secret_inlineConfig.yaml

@@ -1,21 +0,0 @@
-{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}}
-{{- $inlineConfiguration := include "gitea.inline_configuration" . -}}
-{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.inlineConfig.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.inlineConfig.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  {{- range $key, $value := fromYaml $inlineConfiguration }}
-  {{ $key }}: {{ $value | b64enc | quote }}
-  {{- end }}
-{{- end }}

templates/secret_metrics.yaml

@@ -1,16 +0,0 @@
-{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  {{- with (include "gitea.secret.metrics.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  labels:
-    {{- include "gitea.secret.metrics.labels" . | nindent 4 }}
-  name: {{ include "gitea.secret.metrics.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-type: Opaque
-data:
-  token: {{ .Values.gitea.metrics.token  | b64enc }}
-{{- end }}

templates/serviceAccount.yaml

@@ -1,21 +0,0 @@
-{{- if eq (include "gitea.serviceAccount.enabled" .) "true" }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  {{- with (include "gitea.serviceAccount.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.serviceAccount.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.serviceAccount.name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-automountServiceAccountToken: {{ .Values.serviceAccount.new.automountServiceAccountToken }}
-{{- with .Values.serviceAccount.new.imagePullSecrets }}
-imagePullSecrets:
-  {{- . | toYaml | nindent 2 }}
-{{- end }}
-{{- end }}

templates/tcpRoute.yaml

@@ -1,34 +0,0 @@
-{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: TCPRoute
-metadata:
-  {{- with (include "gitea.tcpRoute.annotations" .) }}
-  annotations:
-    {{- . | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.tcpRoute.labels" .) }}
-  labels:
-    {{- . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-spec:
-  parentRefs:
-    {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
-    {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
-    {{- else }}
-    {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
-    {{- end }}
-  rules:
-    {{- if .Values.gatewayAPI.core.tcpRoute.rules }}
-    {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
-    {{- else }}
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: {{ include "gitea.service.ssh.name" . }}
-          port: {{ .Values.service.ssh.port }}
-          weight: 1
-    {{- end }}
-{{- end }}

templates/tests/test-http-connection.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.test.enabled }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "gitea.fullname" . }}-test-connection"
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+{{ include "gitea.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test-success
+spec:
+  containers:
+    - name: wget
+      image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
+      command: ['wget']
+      args:  ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
+  restartPolicy: Never
+{{- end }}

unittests/bash/tests/init-containers/config/config_environment.bats

@@ -9,51 +9,27 @@ function setup() {
   export GITEA_APP_INI="$BATS_TEST_TMPDIR/app.ini"
   export TMP_EXISTING_ENVS_FILE="$BATS_TEST_TMPDIR/existing-envs"
   export ENV_TO_INI_MOUNT_POINT="$BATS_TEST_TMPDIR/env-to-ini-mounts"
-  export GITEA_EDIT_INI_EXPECTED=0
-  export PATH="$BATS_TEST_TMPDIR/bin:$PATH"
 
-  mkdir -p "$BATS_TEST_TMPDIR/bin"
-  cat >"$BATS_TEST_TMPDIR/bin/gitea" <<'EOF'
-#!/usr/bin/env bash
-set -euo pipefail
-
-case "$*" in
-  'generate secret INTERNAL_TOKEN')
-    echo 'mocked-internal-token'
-    ;;
-  'generate secret SECRET_KEY')
-    echo 'mocked-secret-key'
-    ;;
-  'generate secret JWT_SECRET')
-    echo 'mocked-jwt-secret'
-    ;;
-  'generate secret LFS_JWT_SECRET')
-    echo 'mocked-lfs-jwt-secret'
-    ;;
-  "config edit-ini --apply-env --config $GITEA_APP_INI --out $GITEA_APP_INI")
-    if [ "$GITEA_EDIT_INI_EXPECTED" -eq 1 ]; then
-      echo 'Stubbed gitea config edit-ini was called!'
-      exit 0
-    fi
-
-    echo 'Unexpected gitea config edit-ini invocation' >&2
-    exit 127
-    ;;
-  *)
-    echo "Unexpected gitea invocation: $*" >&2
-    exit 127
-    ;;
-esac
-EOF
-  chmod +x "$BATS_TEST_TMPDIR/bin/gitea"
+  stub gitea \
+      "generate secret INTERNAL_TOKEN : echo 'mocked-internal-token'" \
+      "generate secret SECRET_KEY : echo 'mocked-secret-key'" \
+      "generate secret JWT_SECRET : echo 'mocked-jwt-secret'" \
+      "generate secret LFS_JWT_SECRET : echo 'mocked-lfs-jwt-secret'"
 }
 
 function teardown() {
-  :
+  unstub gitea
+  # This condition exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
+  if [ $ENV_TO_INI_EXPECTED -eq 1 ]; then
+    unstub environment-to-ini
+  fi
 }
 
-function expect_gitea_config_edit_ini_call() {
-  export GITEA_EDIT_INI_EXPECTED=1
+# This function exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
+function expect_environment_to_ini_call() {
+  export ENV_TO_INI_EXPECTED=1
+  stub environment-to-ini \
+    "-o $GITEA_APP_INI : echo 'Stubbed environment-to-ini was called!'"
 }
 
 function execute_test_script() {
@@ -80,18 +56,18 @@ function write_mounted_file() {
 }
 
 @test "works as expected when nothing is configured" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   run $PROJECT_ROOT/scripts/init-containers/config/config_environment.sh
 
   assert_success
   assert_line '...Initial secrets generated'
   assert_line 'Reloading preset envs...'
   assert_line '=== All configuration sources loaded ==='
-  assert_line 'Stubbed gitea config edit-ini was called!'
+  assert_line 'Stubbed environment-to-ini was called!'
 }
 
 @test "exports initial secrets" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   run execute_test_script
 
   assert_success
@@ -102,7 +78,7 @@ function write_mounted_file() {
 }
 
 @test "does NOT export initial secrets when app.ini already exists" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   touch $GITEA_APP_INI
 
   run execute_test_script
@@ -116,7 +92,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over auto-generated ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
 
   run execute_test_script
@@ -126,7 +102,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over mounted ones" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
@@ -141,7 +117,7 @@ EOF
 }
 
 @test "ensures that additionals take precedence over inlines" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
 EOF
@@ -160,7 +136,7 @@ EOF
 }
 
 @test "ensures that dotted/dashed sections are properly masked" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
 EOF
@@ -176,7 +152,7 @@ EOF
 ##### THIS IS A BUG, BUT I WANT IT TO BE COVERED BY TESTS #####
 ###############################################################
 @test "ensures uppercase section and setting names (🐞)" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   export GITEA__oauth2__JwT_Secret="pre-defined-jwt-secret"
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_progress_PREFIXES=WIP:,[WIP]
@@ -191,7 +167,7 @@ EOF
 }
 
 @test "treats top-level configuration as section-less" {
-  expect_gitea_config_edit_ini_call
+  expect_environment_to_ini_call
   write_mounted_file "inlines" "_generals_" "$(cat << EOF
 APP_NAME=Hello top-level configuration
 RUN_MODE=dev

unittests/helm/admin-secret/basics.yaml

@@ -1,64 +0,0 @@
-suite: Test admin secret
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/secret_admin.yaml
-tests:
-  - it: "Skip rendering when the admin user is disabled"
-    set:
-      secrets.admin.enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Skip rendering when an existing Secret is referenced"
-    set:
-      secrets.admin.enabled: true
-      secrets.admin.existingSecret.enabled: true
-      secrets.admin.existingSecret.secretName: "external-secret-reference"
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Fail when no credentials are configured"
-    set:
-      secrets.admin.new.password: ""
-    asserts:
-      - failedTemplate:
-          errorMessage: Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`
-
-  - it: "Render the Secret with the default credentials"
-    asserts:
-      - hasDocuments:
-          count: 1
-      - documentIndex: 0
-        containsDocument:
-          kind: Secret
-          apiVersion: v1
-          name: gitea-unittests-admin
-      - isNotNullOrEmpty:
-          path: metadata.labels
-      - equal:
-          path: data.email
-          value: "Z2l0ZWFAbG9jYWwuZG9tYWlu"
-      - equal:
-          path: data.password
-          value: "cjhzQThDUEhEOSFidDZk"
-      - equal:
-          path: data.username
-          value: "Z2l0ZWFfYWRtaW4="
-
-  - it: "Render custom annotations and labels"
-    set:
-      secrets.admin.new.annotations:
-        custom-annotation: annotation-value
-      secrets.admin.new.labels:
-        custom-label: label-value
-    asserts:
-      - equal:
-          path: metadata.annotations["custom-annotation"]
-          value: annotation-value
-      - equal:
-          path: metadata.labels["custom-label"]
-          value: label-value

unittests/helm/check-actions-not-present.yaml

@@ -0,0 +1,12 @@
+suite: Check if actions raises an error
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: fails when trying to configure actions due to removal
+    set:
+      actions:
+        enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9.

unittests/helm/cluster/basics.yaml

@@ -1,182 +0,0 @@
-suite: Test cluster basics
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Render nothing when cloudnativePG is disabled"
-    templates:
-      - templates/cluster.yaml
-      - templates/secret_cloudnativePG.yaml
-    set:
-      cloudnativePG:
-        enabled: false
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Render the Cluster with the default values"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - containsDocument:
-          kind: Cluster
-          apiVersion: postgresql.cnpg.io/v1
-          name: gitea-unittests-postgresql
-          namespace: testing
-      - equal:
-          path: spec.instances
-          value: 3
-      - equal:
-          path: spec.imageName
-          value: "ghcr.io/cloudnative-pg/postgresql:18.0"
-      - equal:
-          path: spec.bootstrap.initdb
-          value:
-            database: "gitea"
-            owner: "gitea"
-            secret:
-              name: gitea-unittests-postgresql-app
-      - equal:
-          path: spec.storage.size
-          value: "10Gi"
-      - notExists:
-          path: spec.storage.storageClass
-      - notExists:
-          path: spec.walStorage
-      - notExists:
-          path: spec.affinity
-      - notExists:
-          path: spec.topologySpreadConstraints
-
-  - it: "Render the credential Secret with the default values"
-    template: templates/secret_cloudnativePG.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - containsDocument:
-          kind: Secret
-          apiVersion: v1
-          name: gitea-unittests-postgresql-app
-          namespace: testing
-      - equal:
-          path: type
-          value: kubernetes.io/basic-auth
-      - equal:
-          path: data.password
-          decodeBase64: true
-          value: "gitea"
-      - equal:
-          path: data.username
-          decodeBase64: true
-          value: "gitea"
-      - notExists:
-          path: data.database
-      - notExists:
-          path: stringData
-
-  - it: "Render no credential Secret when an existing Secret is used"
-    template: templates/secret_cloudnativePG.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        credentials:
-          existingSecret:
-            enabled: true
-            secretName: my-credentials
-    asserts:
-      - hasDocuments:
-          count: 0
-
-  - it: "Reference the existing Secret in the Cluster"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        credentials:
-          existingSecret:
-            enabled: true
-            secretName: my-credentials
-          database: my-database
-          username: my-username
-    asserts:
-      - equal:
-          path: spec.bootstrap.initdb
-          value:
-            database: "my-database"
-            owner: "my-username"
-            secret:
-              name: my-credentials
-
-  - it: "Apply the storage and walStorage customizations"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        storage:
-          size: 1337Mi
-          storageClass: my-storage-class
-        walStorage:
-          enabled: true
-          size: 42Mi
-          storageClass: my-wal-storage-class
-    asserts:
-      - equal:
-          path: spec.storage
-          value:
-            size: "1337Mi"
-            storageClass: "my-storage-class"
-      - equal:
-          path: spec.walStorage
-          value:
-            size: "42Mi"
-            storageClass: "my-wal-storage-class"
-
-  - it: "Apply the scheduling customizations"
-    template: templates/cluster.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        affinity:
-          nodeSelector:
-            disktype: ssd
-          podAntiAffinityType: required
-          tolerations:
-            - key: my-key
-              operator: Equal
-              value: my-value
-              effect: NoSchedule
-        priorityClassName: my-priority-class
-        topologySpreadConstraints:
-          - maxSkew: 1
-            topologyKey: topology.kubernetes.io/zone
-            whenUnsatisfiable: DoNotSchedule
-            labelSelector:
-              matchLabels:
-                app.kubernetes.io/name: gitea
-    asserts:
-      - equal:
-          path: spec.affinity
-          value:
-            nodeSelector:
-              disktype: ssd
-            podAntiAffinityType: required
-            tolerations:
-              - key: my-key
-                operator: Equal
-                value: my-value
-                effect: NoSchedule
-      - equal:
-          path: spec.priorityClassName
-          value: my-priority-class
-      - equal:
-          path: spec.topologySpreadConstraints
-          value:
-            - maxSkew: 1
-              topologyKey: topology.kubernetes.io/zone
-              whenUnsatisfiable: DoNotSchedule
-              labelSelector:
-                matchLabels:
-                  app.kubernetes.io/name: gitea

unittests/helm/config/actions-config.yaml

@@ -0,0 +1,24 @@
+suite: config template | actions config
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/config.yaml
+tests:
+  - it: "actions are enabled by default (based on vanilla Gitea behavior)"
+    template: templates/gitea/config.yaml
+    asserts:
+      - documentIndex: 0
+        notExists:
+          path: stringData.actions
+
+  - it: "actions can be disabled via inline config"
+    template: templates/gitea/config.yaml
+    set:
+      gitea.config.actions.ENABLED: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.actions
+          value: |-
+            ENABLED=false

unittests/helm/config/actions.yaml

@@ -1,25 +0,0 @@
-suite: Test config actions
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/secret_inlineConfig.yaml
-tests:
-  - it: "Enable actions by default to match vanilla Gitea"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        notExists:
-          path: data.actions
-
-  - it: "Disable actions via the inline config"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      gitea.config.actions.ENABLED: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.actions
-          decodeBase64: true
-          value: |-
-            ENABLED=false

unittests/helm/config/cache-config.yaml

@@ -0,0 +1,66 @@
+suite: config template | cache config
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "cache is configured correctly for valkey-cluster"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=redis
+            HOST=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "cache is configured correctly for valkey"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=redis
+            HOST=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "cache is configured correctly for 'memory' when valkey (or valkey-cluster) is disabled"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=memory
+            HOST=
+
+  - it: "cache can be customized when valkey (or valkey-cluster) is disabled"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+      gitea.config.cache.ADAPTER: custom-adapter
+      gitea.config.cache.HOST: custom-host
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.cache
+          value: |-
+            ADAPTER=custom-adapter
+            HOST=custom-host

unittests/helm/config/cache.yaml

@@ -1,48 +0,0 @@
-suite: Test config cache
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Configure the cache for valkey"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.cache
-          decodeBase64: true
-          value: |-
-            ADAPTER=redis
-            HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
-  - it: "Configure the cache for 'memory' when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.cache
-          decodeBase64: true
-          value: |-
-            ADAPTER=memory
-            HOST=
-
-  - it: "Customize the cache when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-      gitea.config.cache.ADAPTER: custom-adapter
-      gitea.config.cache.HOST: custom-host
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.cache
-          decodeBase64: true
-          value: |-
-            ADAPTER=custom-adapter
-            HOST=custom-host

unittests/helm/config/database.yaml

@@ -1,48 +0,0 @@
-suite: Test config database
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Connect to the read-write Service of the CloudNativePG Cluster"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
-
-  - it: "Connect to the read-write Service of the CloudNativePG Cluster with a custom cluster domain"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      clusterDomain: my-special-cluster.local
-      cloudnativePG:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.database
-          decodeBase64: true
-          pattern: HOST=gitea-unittests-postgresql-rw.testing.svc.my-special-cluster.local:5432
-
-  - it: "Connect to the configured CloudNativePG database"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      cloudnativePG:
-        enabled: true
-        credentials:
-          database: gitea-database
-          username: gitea-username
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.database
-          decodeBase64: true
-          value: |-
-            DB_TYPE=postgres
-            HOST=gitea-unittests-postgresql-rw.testing.svc.cluster.local:5432
-            NAME=gitea-database
-            USER=gitea-username

unittests/helm/config/environmentScript.yaml

@@ -1,25 +0,0 @@
-suite: Test config environment script
-release:
-  name: gitea-unittests
-  namespace: testing
-templates:
-  - templates/secret_admin.yaml
-  - templates/secret_config.yaml
-tests:
-  - it: "Write app.ini from the environment variables via `gitea config edit-ini`"
-    template: templates/secret_config.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data["config_environment.sh"]
-          decodeBase64: true
-          pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'
-  - it: "Render data instead of stringData so removed keys are pruned on upgrade"
-    template: templates/secret_config.yaml
-    asserts:
-      - documentIndex: 0
-        notExists:
-          path: stringData
-      - documentIndex: 0
-        exists:
-          path: data["config_environment.sh"]

unittests/helm/config/metrics-section_metrics-token.yaml

@@ -1,10 +1,10 @@
-suite: Test config metrics token
+suite: config template | metrics section (metrics token)
 release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "Configure the metrics token when it is set"
-    template: templates/secret_inlineConfig.yaml
+  - it: metrics token is set
+    template: templates/gitea/config.yaml
     set:
       gitea:
         metrics:
@@ -13,13 +13,12 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
-          decodeBase64: true
+          path: stringData.metrics
           value: |-
             ENABLED=true
             TOKEN=somepassword
-  - it: "Omit the metrics token when it is empty"
-    template: templates/secret_inlineConfig.yaml
+  - it: metrics token is empty
+    template: templates/gitea/config.yaml
     set:
       gitea:
         metrics:
@@ -28,12 +27,11 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
-          decodeBase64: true
+          path: stringData.metrics
           value: |-
             ENABLED=true
-  - it: "Omit the metrics token when it is nil"
-    template: templates/secret_inlineConfig.yaml
+  - it: metrics token is nil
+    template: templates/gitea/config.yaml
     set:
       gitea:
         metrics:
@@ -42,12 +40,11 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
-          decodeBase64: true
+          path: stringData.metrics
           value: |-
             ENABLED=true
-  - it: "Omit the metrics token when metrics are disabled"
-    template: templates/secret_inlineConfig.yaml
+  - it: does not configures a token if metrics are disabled
+    template: templates/gitea/config.yaml
     set:
       gitea:
         metrics:
@@ -56,7 +53,6 @@ tests:
     asserts:
       - documentIndex: 0
         equal:
-          path: data.metrics
-          decodeBase64: true
+          path: stringData.metrics
           value: |-
             ENABLED=false

unittests/helm/config/queue-config.yaml

@@ -0,0 +1,66 @@
+suite: config template | queue config
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "queue is configured correctly for valkey-cluster"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            TYPE=redis
+
+  - it: "queue is configured correctly for valkey"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            TYPE=redis
+
+  - it: "queue is configured correctly for 'levelDB' when valkey (and valkey-cluster) is disabled"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=
+            TYPE=level
+
+  - it: "queue can be customized when valkey (and valkey-cluster) are disabled"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+      gitea.config.queue.TYPE: custom-type
+      gitea.config.queue.CONN_STR: custom-connection-string
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.queue
+          value: |-
+            CONN_STR=custom-connection-string
+            TYPE=custom-type

unittests/helm/config/queue.yaml

@@ -1,48 +0,0 @@
-suite: Test config queue
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Configure the queue for valkey"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.queue
-          decodeBase64: true
-          value: |-
-            CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-            TYPE=redis
-
-  - it: "Configure the queue for 'levelDB' when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.queue
-          decodeBase64: true
-          value: |-
-            CONN_STR=
-            TYPE=level
-
-  - it: "Customize the queue when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-      gitea.config.queue.TYPE: custom-type
-      gitea.config.queue.CONN_STR: custom-connection-string
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.queue
-          decodeBase64: true
-          value: |-
-            CONN_STR=custom-connection-string
-            TYPE=custom-type

unittests/helm/config/server-section_domain.yaml

@@ -0,0 +1,67 @@
+suite: config template | server section (domain related)
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/gitea/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=git.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=git.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://git.example.com
+
+  ################################################
+
+  - it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/gitea/config.yaml
+    set:
+      ingress:
+        hosts: []
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
+
+  ################################################
+
+  - it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/gitea/config.yaml
+    set:
+      gitea.config.server.DOMAIN: provided.example.com
+      ingress:
+        hosts:
+          - host: non-used.example.com
+            paths:
+              - path: /
+                pathType: Prefix
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=provided.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=provided.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://provided.example.com

unittests/helm/config/serverDomain.yaml

@@ -1,175 +0,0 @@
-suite: Test config server domain
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "[default values] Use the ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=git.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=git.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://git.example.com
-
-  ################################################
-
-  - it: "[no ingress hosts] Use the HTTP Service for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      ingress:
-        hosts: []
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=gitea-unittests-http.testing.svc.cluster.local
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=gitea-unittests-http.testing.svc.cluster.local
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://gitea-unittests-http.testing.svc.cluster.local
-
-  ################################################
-
-  - it: "[provided via values] Use the configured values for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      gitea.config.server.DOMAIN: provided.example.com
-      ingress:
-        hosts:
-          - host: non-used.example.com
-            paths:
-              - path: /
-                pathType: Prefix
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=provided.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=provided.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://provided.example.com
-
-  ################################################
-
-  - it: "[route enabled] Use the Route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      route:
-        enabled: true
-        host: route.example.com
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=route.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=route.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://route.example.com
-
-  ################################################
-
-  - it: "[route tls termination] Use https for ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      route:
-        enabled: true
-        host: route.example.com
-        tls:
-          termination: edge
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=https://route.example.com
-
-  ################################################
-
-  - it: "[HTTPRoute enabled] Use the first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      ingress:
-        hosts: []
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            hostnames:
-              - gw.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nDOMAIN=gw.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nSSH_DOMAIN=gw.example.com
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=http://gw.example.com
-
-  ################################################
-
-  - it: "[HTTPRoute tls] Switch ROOT_URL to https"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      ingress:
-        hosts: []
-      gatewayAPI:
-        enabled: true
-        core:
-          httpRoute:
-            enabled: true
-            tls: true
-            hostnames:
-              - gw.example.com
-            parentRefs:
-              - name: shared-gateway
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data.server
-          decodeBase64: true
-          pattern: \nROOT_URL=https://gw.example.com

unittests/helm/config/session-config.yaml

@@ -0,0 +1,66 @@
+suite: config template | session config
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "session is configured correctly for valkey-cluster"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=redis
+            PROVIDER_CONFIG=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "session is configured correctly for valkey"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=redis
+            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+
+  - it: "session is configured correctly for 'memory' when valkey (and valkey-cluster) is disabled"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=memory
+            PROVIDER_CONFIG=
+
+  - it: "session can be customized when valkey (and valkey-cluster) is disabled"
+    template: templates/gitea/config.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: false
+      gitea.config.session.PROVIDER: custom-provider
+      gitea.config.session.PROVIDER_CONFIG: custom-provider-config
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: stringData.session
+          value: |-
+            PROVIDER=custom-provider
+            PROVIDER_CONFIG=custom-provider-config

unittests/helm/config/session.yaml

@@ -1,48 +0,0 @@
-suite: Test config session
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: "Configure the session for valkey"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: true
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.session
-          decodeBase64: true
-          value: |-
-            PROVIDER=redis
-            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
-  - it: "Configure the session for 'memory' when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.session
-          decodeBase64: true
-          value: |-
-            PROVIDER=memory
-            PROVIDER_CONFIG=
-
-  - it: "Customize the session when valkey is disabled"
-    template: templates/secret_inlineConfig.yaml
-    set:
-      valkey:
-        enabled: false
-      gitea.config.session.PROVIDER: custom-provider
-      gitea.config.session.PROVIDER_CONFIG: custom-provider-config
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.session
-          decodeBase64: true
-          value: |-
-            PROVIDER=custom-provider
-            PROVIDER_CONFIG=custom-provider-config

unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml

@@ -0,0 +1,129 @@
+suite: Dependency checks | Customization integrity | postgresql-ha
+release:
+  name: gitea-unittests
+  namespace: testing
+set:
+  postgresql:
+    enabled: false
+  postgresql-ha:
+    enabled: true
+    global:
+      postgresql:
+        database: gitea-database
+        password: gitea-password
+        username: gitea-username
+    postgresql:
+      repmgrPassword: custom-password-repmgr
+      postgresPassword: custom-password-postgres
+      password: custom-password-overwritten-by-global-postgresql-password
+    pgpool:
+      adminPassword: custom-password-pgpool
+      srCheckPassword: custom-password-sr-check
+    service:
+      ports:
+        postgresql: 1234
+    persistence:
+      size: 1337Mi
+tests:
+  - it: "[postgresql-ha] DB settings are applied as expected"
+    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_DB
+            value: "gitea-database"
+      - documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_USER
+            value: "gitea-username"
+  - it: "[postgresql-ha] DB passwords are applied as expected"
+    template: charts/postgresql-ha/templates/postgresql/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["repmgr-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXJlcG1ncg=="
+      - documentIndex: 0
+        equal:
+          path: data["postgres-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBvc3RncmVz"
+      - documentIndex: 0
+        equal:
+          path: data["password"]
+          value: "Z2l0ZWEtcGFzc3dvcmQ=" # postgresql-ha.postgresql.password is overwritten by postgresql-ha.global.postgresql.password and should not be referenced here
+  - it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["admin-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
+  - it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["admin-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
+  - it: "[postgresql-ha] pgpool.adminPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["admin-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXBncG9vbA=="
+  - it: "[postgresql-ha] pgpool.srCheckPassword is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["sr-check-password"]
+          value: "Y3VzdG9tLXBhc3N3b3JkLXNyLWNoZWNr"
+  - it: "[postgresql-ha] persistence.size is applied as expected"
+    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
+          value: "1337Mi"
+  - it: "[postgresql-ha] service.ports.postgresql is applied as expected"
+    template: charts/postgresql-ha/templates/pgpool/service.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.ports[0].port
+          value: 1234
+  - it: "[postgresql-ha] renders the referenced service"
+    template: charts/postgresql-ha/templates/pgpool/service.yaml
+    asserts:
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: gitea-unittests-postgresql-ha-pgpool
+          namespace: testing
+  - it: "[gitea] connects to pgpool service"
+    template: templates/gitea/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
+  - it: "[gitea] connects to configured database"
+    template: templates/gitea/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: NAME=gitea-database
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: USER=gitea-username
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: PASSWD=gitea-password

unittests/helm/dependency-checks/customization-integrity-postgresql.yaml

@@ -0,0 +1,88 @@
+suite: Dependency checks | Customization integrity | postgresql
+release:
+  name: gitea-unittests
+  namespace: testing
+set:
+  postgresql-ha:
+    enabled: false
+  postgresql:
+    enabled: true
+    global:
+      postgresql:
+        auth:
+          password: gitea-password
+          database: gitea-database
+          username: gitea-username
+        service:
+          ports:
+            postgresql: 1234
+    primary:
+      persistence:
+        size: 1337Mi
+tests:
+  - it: "[postgresql] DB settings are applied as expected"
+    template: charts/postgresql/templates/primary/statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_DATABASE
+            value: "gitea-database"
+      - documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: POSTGRES_USER
+            value: "gitea-username"
+  - it: "[postgresql] DB password is applied as expected"
+    template: charts/postgresql/templates/secrets.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["password"]
+          value: "Z2l0ZWEtcGFzc3dvcmQ="
+  - it: "[postgresql] primary.persistence.size is applied as expected"
+    template: charts/postgresql/templates/primary/statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.volumeClaimTemplates[0].spec.resources.requests.storage
+          value: "1337Mi"
+  - it: "[postgresql] global.postgresql.service.ports.postgresql is applied as expected"
+    template: charts/postgresql/templates/primary/svc.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.ports[0].port
+          value: 1234
+  - it: "[postgresql] renders the referenced service"
+    template: charts/postgresql/templates/primary/svc.yaml
+    asserts:
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: gitea-unittests-postgresql
+          namespace: testing
+  - it: "[gitea] connects to postgresql service"
+    template: templates/gitea/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
+  - it: "[gitea] connects to configured database"
+    template: templates/gitea/config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: NAME=gitea-database
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: USER=gitea-username
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: PASSWD=gitea-password

unittests/helm/dependency-checks/customization-integrity-valkey-cluster.yaml

@@ -0,0 +1,90 @@
+suite: Dependency checks | Customization integrity | valkey-cluster
+release:
+  name: gitea-unittests
+  namespace: testing
+set:
+  valkey:
+    enabled: false
+  valkey-cluster:
+    enabled: true
+    usePassword: false
+    cluster:
+      nodes: 5
+      replicas: 2
+tests:
+  - it: "[valkey-cluster] configures correct nodes/replicas"
+    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.replicas
+          value: 5
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].args[0]
+          pattern: VALKEY_CLUSTER_REPLICAS="2"
+  - it: "[valkey-cluster] support auth-less connections"
+    asserts:
+      - template: charts/valkey-cluster/templates/secret.yaml
+        hasDocuments:
+          count: 0
+      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+        documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: ALLOW_EMPTY_PASSWORD
+            value: "yes"
+  - it: "[valkey-cluster] support auth-full connections"
+    set:
+      valkey-cluster:
+        usePassword: true
+    asserts:
+      - template: charts/valkey-cluster/templates/secret.yaml
+        containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-valkey-cluster
+          namespace: testing
+      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+        documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDISCLI_AUTH
+            valueFrom:
+              secretKeyRef:
+                name: gitea-unittests-valkey-cluster
+                key: valkey-password
+      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+        documentIndex: 0
+        contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDISCLI_AUTH
+            valueFrom:
+              secretKeyRef:
+                name: gitea-unittests-valkey-cluster
+                key: valkey-password
+  - it: "[valkey-cluster] renders the referenced service"
+    template: charts/valkey-cluster/templates/headless-svc.yaml
+    asserts:
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: gitea-unittests-valkey-cluster-headless
+          namespace: testing
+      - documentIndex: 0
+        contains:
+          path: spec.ports
+          content:
+            name: tcp-redis
+            port: 6379
+            targetPort: tcp-redis
+  - it: "[gitea] waits for valkey-cluster to be up and running"
+    template: templates/gitea/init.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData["configure_gitea.sh"]
+          pattern: nc -vz -w2 gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local 6379

unittests/helm/dependency-checks/customization-integrity-valkey.yaml

@@ -0,0 +1,52 @@
+suite: Dependency checks | Customization integrity | valkey
+release:
+  name: gitea-unittests
+  namespace: testing
+set:
+  valkey-cluster:
+    enabled: false
+  valkey:
+    enabled: true
+    architecture: standalone
+    global:
+      valkey:
+        password: gitea-password
+    master:
+      count: 2
+tests:
+  - it: "[valkey] configures correct 'master' nodes"
+    template: charts/valkey/templates/primary/application.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.replicas
+          value: 1
+  - it: "[valkey] valkey.global.valkey.password is applied as expected"
+    template: charts/valkey/templates/secret.yaml
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: data["valkey-password"]
+          value: "Z2l0ZWEtcGFzc3dvcmQ="
+  - it: "[valkey] renders the referenced service"
+    template: charts/valkey/templates/headless-svc.yaml
+    asserts:
+      - containsDocument:
+          kind: Service
+          apiVersion: v1
+          name: gitea-unittests-valkey-headless
+          namespace: testing
+      - documentIndex: 0
+        contains:
+          path: spec.ports
+          content:
+            name: tcp-redis
+            port: 6379
+            targetPort: redis
+  - it: "[gitea] waits for valkey to be up and running"
+    template: templates/gitea/init.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData["configure_gitea.sh"]
+          pattern: nc -vz -w2 gitea-unittests-valkey-headless.testing.svc.cluster.local 6379

unittests/helm/dependency-checks/customizationIntegrityValkey.yaml

@@ -1,54 +0,0 @@
-suite: Test dependency customization integrity of valkey
-release:
-  name: gitea-unittests
-  namespace: testing
-set:
-  valkey:
-    enabled: true
-    auth:
-      enabled: true
-      aclUsers:
-        default:
-          permissions: "~* &* +@all"
-          password: gitea-password
-tests:
-  - it: "[valkey] Apply valkey.auth.aclUsers.default.password"
-    template: charts/valkey/templates/secret.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: data.default-password
-          value: "Z2l0ZWEtcGFzc3dvcmQ="
-  - it: "[valkey] Render the referenced Service"
-    template: charts/valkey/templates/service.yaml
-    asserts:
-      - containsDocument:
-          kind: Service
-          apiVersion: v1
-          name: gitea-unittests-valkey
-      - documentIndex: 0
-        contains:
-          path: spec.ports
-          content:
-            name: tcp
-            port: 6379
-            targetPort: tcp
-            protocol: TCP
-  - it: "[gitea] Wait for valkey to be up and running"
-    template: templates/secret_init.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data["configure_gitea.sh"]
-          decodeBase64: true
-          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
-  - it: "[gitea] Wait for valkey to be up and running with a custom cluster domain"
-    set:
-      clusterDomain: my-special-cluster.local
-    template: templates/secret_init.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: data["configure_gitea.sh"]
-          decodeBase64: true
-          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379

unittests/helm/dependency-checks/major-image-bump.yaml

@@ -0,0 +1,57 @@
+suite: Dependency checks | Major image bumps
+release:
+  name: gitea-unittests
+  namespace: testing
+tests:
+  - it: "[postgresql-ha] ensures we detect major image version upgrades"
+    template: charts/postgresql-ha/templates/postgresql/statefulset.yaml
+    set:
+      postgresql:
+        enabled: false
+      postgresql-ha:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].image
+          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
+          pattern: bitnamilegacy/postgresql-repmgr:17.+$
+  - it: "[postgresql] ensures we detect major image version upgrades"
+    template: charts/postgresql/templates/primary/statefulset.yaml
+    set:
+      postgresql:
+        enabled: true
+      postgresql-ha:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].image
+          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
+          pattern: bitnamilegacy/postgresql:17.+$
+  - it: "[valkey-cluster] ensures we detect major image version upgrades"
+    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
+    set:
+      valkey-cluster:
+        enabled: true
+      valkey:
+        enabled: false
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].image
+          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
+          pattern: bitnamilegacy/valkey-cluster:8.+$
+  - it: "[valkey] ensures we detect major image version upgrades"
+    template: charts/valkey/templates/primary/application.yaml
+    set:
+      valkey-cluster:
+        enabled: false
+      valkey:
+        enabled: true
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: spec.template.spec.containers[0].image
+          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
+          pattern: bitnamilegacy/valkey:8.+$