refactor(persistence)!: group the values into existingPersistentVolumeClaim and new

The flat `persistence` dict mixed three concerns: whether persistence is used at all, whether the chart creates the
PersistentVolumeClaim, and how that claim is shaped. The pairs `create`/`claimName` and `enabled`/`mount` were only
meaningful in certain combinations, so an invalid configuration such as `create=true` together with a foreign
`claimName` was silently accepted. The same split into an `existingX`/`new` pair is already used for the Secrets, so
this aligns persistence with the rest of the chart.

`persistence.enabled` now only decides whether a volume is used at all. `persistence.existingPersistentVolumeClaim`
points at a claim managed outside of the chart, and everything under `persistence.new` describes the claim the chart
creates itself. Rendering and naming move into `templates/gitea/_persistentVolumeClaims.tpl` so the Deployment and the
PersistentVolumeClaim derive the claim name from a single helper instead of repeating the value lookups.

Support for `global.storageClass` is dropped. It was a chart-wide override that silently applied to the Gitea claim and
was evaluated through `tpl`, which made the effective storage class hard to predict. The storage class is now set
explicitly via `persistence.new.storageClassName`, which also matches the field name in the PersistentVolumeClaim spec.

BREAKING CHANGE: The `persistence` values were restructured and `global.storageClass` was removed.

- `persistence.create` and `persistence.mount` are gone. Set `persistence.enabled` to use a volume and
  `persistence.existingPersistentVolumeClaim.enabled` to reuse a claim that is not managed by the chart.
- `persistence.claimName` moves to `persistence.existingPersistentVolumeClaim.persistentVolumeClaimName`. A claim
  created by the chart is now named after `gitea.fullname` instead of the default `gitea-shared-storage`.
- `persistence.accessModes`, `annotations`, `labels`, `size` and `subPath` move into `persistence.new`.
- `persistence.volumeName` becomes `persistence.new.persistentVolumeName`.
- `persistence.storageClass` and `global.storageClass` become `persistence.new.storageClassName`.
- `persistence.enabled` now defaults to `false`.

Co-authored-by: Copilot <copilot@github.com>

.editorconfig

@@ -9,4 +9,7 @@ indent_size = 2
 end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = false
-insert_final_newline = false
+insert_final_newline = false
+
+[Makefile]
+indent_style = tab

.gitea/scripts/add-annotations.sh

@@ -1,114 +0,0 @@
-#!/bin/bash
-
-set -e
-
-CHART_FILE="Chart.yaml"
-if [ ! -f "${CHART_FILE}" ]; then
-  echo "ERROR: ${CHART_FILE} not found!" 1>&2
-  exit 1
-fi
-
-DEFAULT_NEW_TAG="$(git tag --sort=-version:refname | head -n 1)"
-DEFAULT_OLD_TAG="$(git tag --sort=-version:refname | head -n 2 | tail -n 1)"
-
-if [ -z "${1}" ]; then
-  read -p "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
-  if [ -z "${OLD_TAG}" ]; then
-    OLD_TAG="${DEFAULT_OLD_TAG}"
-  fi
-
-  while [ -z "$(git tag --list "${OLD_TAG}")" ]; do
-    echo "ERROR: Tag '${OLD_TAG}' not found!" 1>&2
-    read -p "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
-    if [ -z "${OLD_TAG}" ]; then
-      OLD_TAG="${DEFAULT_OLD_TAG}"
-    fi
-  done
-else
-  OLD_TAG=${1}
-  if [ -z "$(git tag --list "${OLD_TAG}")" ]; then
-    echo "ERROR: Tag '${OLD_TAG}' not found!" 1>&2
-    exit 1
-  fi
-fi
-
-if [ -z "${2}" ]; then
-  read -p "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
-  if [ -z "${NEW_TAG}" ]; then
-    NEW_TAG="${DEFAULT_NEW_TAG}"
-  fi
-
-  while [ -z "$(git tag --list "${NEW_TAG}")" ]; do
-    echo "ERROR: Tag '${NEW_TAG}' not found!" 1>&2
-    read -p "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
-    if [ -z "${NEW_TAG}" ]; then
-      NEW_TAG="${DEFAULT_NEW_TAG}"
-    fi
-  done
-else
-  NEW_TAG=${2}
-
-  if [ -z "$(git tag --list "${NEW_TAG}")" ]; then
-    echo "ERROR: Tag '${NEW_TAG}' not found!" 1>&2
-    exit 1
-  fi
-fi
-
-CHANGE_LOG_YAML=$(mktemp)
-echo "[]" > "${CHANGE_LOG_YAML}"
-
-function map_type_to_kind() {
-  case "${1}" in
-    feat)
-      echo "added"
-    ;;
-    fix)
-      echo "fixed"
-    ;;
-    chore|style|test|ci|docs|refac)
-      echo "changed"
-    ;;
-    revert)
-      echo "removed"
-    ;;
-    sec)
-      echo "security"
-    ;;
-    *)
-      echo "skip"
-    ;;
-  esac
-}
-
-COMMIT_TITLES="$(git log --pretty=format:"%s" "${OLD_TAG}..${NEW_TAG}")"
-
-echo "INFO: Generate change log entries from ${OLD_TAG} until ${NEW_TAG}"
-
-while IFS= read -r line; do
-  if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
-    TYPE="${BASH_REMATCH[1]}"
-    KIND=$(map_type_to_kind "${TYPE}")
-
-    if [ "${KIND}" == "skip" ]; then
-      continue
-    fi
-
-    DESC="${BASH_REMATCH[3]}"
-
-    echo "- ${KIND}: ${DESC}"
-
-    jq --arg kind "${KIND}" --arg description "${DESC}" '. += [ $ARGS.named ]' < "${CHANGE_LOG_YAML}" > "${CHANGE_LOG_YAML}.new"
-    mv "${CHANGE_LOG_YAML}.new" "${CHANGE_LOG_YAML}"
-
-  fi
-done <<< "${COMMIT_TITLES}"
-
-if [ -s "${CHANGE_LOG_YAML}" ]; then
-  yq --inplace --input-format json --output-format yml "${CHANGE_LOG_YAML}"
-  yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${CHANGE_LOG_YAML}\") | sort_keys(.)" "${CHART_FILE}"
-else
-  echo "ERROR: Changelog file is empty: ${CHANGE_LOG_YAML}" 1>&2
-  exit 1
-fi
-
-rm "${CHANGE_LOG_YAML}"

.gitea/scripts/update-changelog.sh

@@ -1,86 +0,0 @@
-#!/bin/bash
-
-DEFAULT_GITEA_SERVER_URL="${GITHUB_SERVER_URL:-"https://gitea.com"}"
-DEFAULT_GITEA_REPOSITORY="${GITHUB_REPOSITORY:-"gitea/helm-gitea"}"
-DEFAULT_GITEA_TOKEN="${ISSUE_RW_TOKEN:-""}"
-
-if [ -z "${1}" ]; then
-  read -p "Enter hostname of the Gitea instance [${DEFAULT_GITEA_SERVER_URL}]: " CURRENT_GITEA_SERVER_URL
-  if [ -z "${CURRENT_GITEA_SERVER_URL}" ]; then
-    CURRENT_GITEA_SERVER_URL="${DEFAULT_GITEA_SERVER_URL}"
-  fi
-else
-  CURRENT_GITEA_SERVER_URL=$1
-fi
-
-if [ -z "${2}" ]; then
-  read -p "Enter name of the git repository [${DEFAULT_GITEA_REPOSITORY}]: " CURRENT_GITEA_REPOSITORY
-  if [ -z "${CURRENT_GITEA_REPOSITORY}" ]; then
-    CURRENT_GITEA_REPOSITORY="${DEFAULT_GITEA_REPOSITORY}"
-  fi
-else
-  CURRENT_GITEA_REPOSITORY=$2
-fi
-
-if [ -z "${3}" ]; then
-  read -p "Enter token to access the Gitea instance [${DEFAULT_GITEA_TOKEN}]: " CURRENT_GITEA_TOKEN
-  if [ -z "${CURRENT_GITEA_TOKEN}" ]; then
-    CURRENT_GITEA_TOKEN="${DEFAULT_GITEA_TOKEN}"
-  fi
-else
-  CURRENT_GITEA_TOKEN=$3
-fi
-
-if ! git sv rn -o /tmp/changelog.md; then
-  echo "ERROR: Failed to generate /tmp/changelog.md" 1>&2
-  exit 1
-fi
-
-CURL_ARGS=(
-  "--data-urlencode" "q=Changelog for upcoming version"
-  # "--data-urlencode=\"q=Changelog for upcoming version\""
-  "--data-urlencode" "state=open"
-  "--fail"
-  "--header" "Accept: application/json"
-  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
-  "--request" "GET"
-  "--silent"
-)
-
-if ! ISSUE_NUMBER="$(curl "${CURL_ARGS[@]}" "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues" | jq '.[].number')"; then
-  echo "ERROR: Failed query issue number" 1>&2
-  exit 1
-fi
-export ISSUE_NUMBER
-
-if ! echo "" | jq --raw-input --slurp --arg title "Changelog for upcoming version" --arg body "$(cat /tmp/changelog.md)" '{title: $title, body: $body}' 1> /tmp/payload.json; then
-  echo "ERROR: Failed to create JSON payload file" 1>&2
-  exit 1
-fi
-
-CURL_ARGS=(
-  "--data" "@/tmp/payload.json"
-  "--fail"
-  "--header" "Authorization: token ${CURRENT_GITEA_TOKEN}"
-  "--header" "Content-Type: application/json"
-  "--location"
-  "--silent"
-  "--output" "/dev/null"
-)
-
-if [ -z "${ISSUE_NUMBER}" ]; then
-  if ! curl "${CURL_ARGS[@]}" --request POST "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues"; then
-    echo "ERROR: Failed to create new issue!" 1>&2
-    exit 1
-  else
-    echo "INFO: Successfully created new issue!"
-  fi
-else
-  if ! curl "${CURL_ARGS[@]}" --request PATCH "${CURRENT_GITEA_SERVER_URL}/api/v1/repos/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"; then
-    echo "ERROR: Failed to update issue with ID ${ISSUE_NUMBER}!" 1>&2
-    exit 1
-  else
-    echo "INFO: Successfully updated existing issue with ID ${ISSUE_NUMBER}!"
-    echo "INFO: ${CURRENT_GITEA_SERVER_URL}/${CURRENT_GITEA_REPOSITORY}/issues/${ISSUE_NUMBER}"
-  fi
-fi

.gitea/workflows/changelog.yml

@@ -0,0 +1,32 @@
+name: changelog
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    container: docker.io/thegeeklab/git-sv:2.1.3
+    steps:
+      - name: install tools
+        run: |
+          apk add -q --update --no-cache nodejs curl jq sed
+      - uses: actions/checkout@v7.0.0
+        with:
+          fetch-depth: 0
+      - name: Generate upcoming changelog
+        run: |
+          git sv rn -o changelog.md
+          export RELEASE_NOTES=$(cat changelog.md)
+          export ISSUE_NUMBER=$(curl -s "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues?state=open&q=Changelog%20for%20upcoming%20version" | jq '.[].number')
+
+          echo $RELEASE_NOTES
+          JSON_DATA=$(echo "" | jq -Rs --arg title 'Changelog for upcoming version' --arg body "$(cat changelog.md)" '{title: $title, body: $body}')
+
+          if [ -z "$ISSUE_NUMBER" ]; then
+            curl -s -X POST "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
+          else
+            curl -s -X PATCH "https://gitea.com/api/v1/repos/gitea/helm-gitea/issues/$ISSUE_NUMBER" -H "Authorization: token ${{ secrets.ISSUE_RW_TOKEN }}" -H "Content-Type: application/json" -d "$JSON_DATA"
+          fi

.gitea/workflows/commit-lints.yml

@@ -1,17 +1,16 @@
-name: Rum commitlint
+name: Commit Linter
 
 on:
   pull_request:
-    branches: [ '**' ]
+    branches: [ "*" ]
     types: [ "opened", "edited" ]
 
 jobs:
   check-and-test:
-    container: docker.io/commitlint/commitlint:19.9.1
-    name: Execute commitlint
     runs-on: ubuntu-latest
+    container: docker.io/commitlint/commitlint:21.2.1
     steps:
-      - uses: actions/checkout@v5.0.0
-      - name: Check PR title
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Verify PR title
         run: |
           echo "${{ gitea.event.pull_request.title }}" | commitlint --config .commitlintrc.json

.gitea/workflows/helm.yaml

@@ -0,0 +1,37 @@
+name: Helm
+
+on:
+  pull_request:
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches:
+    - '**'
+    tags-ignore:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  helm-lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      with:
+        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
+    - name: Lint helm files
+      run: |
+        helm lint --values values.yaml .
+
+  helm-unittest:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      with:
+        version: v4.3.0 # renovate: datasource=github-releases depName=helm/helm
+    - env:
+        HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
+      name: Install helm-unittest
+      run: helm plugin install --verify=false --version "${HELM_UNITTEST_VERSION}" https://github.com/helm-unittest/helm-unittest
+    - name: Execute helm unittests
+      run: helm unittest --strict --file 'unittests/**/*.yaml' .

.gitea/workflows/helm.yml

@@ -1,75 +0,0 @@
-name: Run Helm tests
-
-on:
-  pull_request:
-    branches: [ '**' ]
-  push:
-    branches: [ '**' ]
-    tags-ignore: [ '**' ]
-  workflow_call: {}
-
-env:
-  # renovate: datasource=github-releases depName=helm-unittest/helm-unittest
-  HELM_UNITTEST_VERSION: "v1.0.1"
-
-jobs:
-  helm-lint:
-    container: docker.io/alpine/helm:3.18.6
-    name: Execute helm lint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install additional tools
-        run: |
-          apk update
-          apk add --update bash make nodejs
-      - uses: actions/checkout@v5.0.0
-      - name: Install helm chart dependencies
-        run: helm dependency build
-      - name: Execute helm lint
-        run: helm lint
-
-  helm-template:
-    container: docker.io/alpine/helm:3.18.6
-    name: Execute helm template
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install additional tools
-        run: |
-          apk update
-          apk add --update bash make nodejs
-      - uses: actions/checkout@v5.0.0
-      - name: Install helm chart dependencies
-        run: helm dependency build
-      - name: Execute helm template
-        run: helm template --debug gitea-helm .
-
-  helm-unittest:
-    container: docker.io/alpine/helm:3.18.6
-    name: Execute helm unittest
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install additional tools
-        run: |
-          apk update
-          apk add --update bash make nodejs npm yamllint ncurses
-      - uses: actions/checkout@v5.0.0
-      - name: Install helm chart dependencies
-        run: helm dependency build
-      - name: Install helm plugin 'unittest'
-        run: |
-          helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest
-          git submodule update --init --recursive
-      - name: Execute helm unittest
-        env:
-          TERM: xterm
-        run: make unittests
-
-
-
-
-      # - name: verify readme
-      #   run: |
-      #     make readme
-      #     git diff --exit-code --name-only README.md
-      # - name: yaml lint
-      #   uses: https://github.com/ibiqlik/action-yamllint@v3

.gitea/workflows/markdown-linters.yaml

@@ -0,0 +1,44 @@
+name: Markdown linter
+
+on:
+  pull_request:
+    paths: [ "**/*.md" ]
+    types: [ "opened", "reopened", "synchronize" ]
+  push:
+    branches:
+    - '**'
+    paths: [ "**/*.md" ]
+    tags-ignore:
+    - '**'
+  workflow_dispatch: {}
+
+jobs:
+  markdown-link-checker:
+    container:
+      image: docker.io/library/node:26.8.2-alpine
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install tooling
+      run: |
+        apk update
+        apk add git npm
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - name: Verify links in markdown files
+      run: |
+        npm install
+        npm run readme:link
+
+  markdown-lint:
+    container:
+      image: docker.io/library/node:26.8.2-alpine
+    runs-on: ubuntu-latest
+    steps:
+    - name: Install tooling
+      run: |
+        apk update
+        apk add git
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - name: Lint markdown files
+      run: |
+        npm install
+        npm run readme:lint

.gitea/workflows/markdown-linters.yml

@@ -1,52 +0,0 @@
-name: Markdown linter
-
-on:
-  pull_request:
-    types: [ "opened", "reopened", "synchronize" ]
-  push:
-    branches: [ '**' ]
-    tags-ignore: [ '**' ]
-  workflow_dispatch: {}
-
-jobs:
-  readme-link:
-    container:
-      image: docker.io/library/node:24.9.0-alpine
-    name: Execute npm run readme:link
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v5.0.0
-    - name: Execute npm run readme:link
-      run: |
-        npm install
-        npm run readme:link
-
-  readme-lint:
-    container:
-      image: docker.io/library/node:24.9.0-alpine
-    name: Execute npm run readme:lint
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v5.0.0
-    - name: Execute npm run readme:lint
-      run: |
-        npm install
-        npm run readme:lint
-
-  readme-parameters:
-    container:
-      image: docker.io/library/node:24.9.0-alpine
-    name: Execute npm run readme:parameters
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install tooling
-      run: |
-        apk update
-        apk add git
-    - uses: actions/checkout@v5.0.0
-    - name: Execute npm run readme:parameters
-      run: |
-        npm install
-        npm run readme:parameters
-    - name: Compare diff
-      run: git diff --exit-code --name-only README.md

.gitea/workflows/release-version.yml

@@ -2,13 +2,14 @@ name: generate-chart
 
 on:
   push:
-    tags: [ '**' ]
+    tags:
+      - "*"
 
 jobs:
   generate-chart-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0
 
@@ -20,22 +21,13 @@ jobs:
       - name: Install helm
         env:
           # renovate: datasource=docker depName=alpine/helm
-          HELM_VERSION: "3.18.6"
+          HELM_VERSION: "3.21.3"
         run: |
           curl --fail --location --output /dev/stdout --silent --show-error https://get.helm.sh/helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
           mv linux-$(dpkg --print-architecture)/helm /usr/local/bin/
           rm --force --recursive linux-$(dpkg --print-architecture) helm-v${HELM_VERSION}-linux-$(dpkg --print-architecture).tar.gz
           helm version
 
-      - name: Install yq
-        env:
-          YQ_VERSION: v4.45.4 # renovate: datasource=github-releases depName=mikefarah/yq
-        run: |
-          curl --fail --location --output /dev/stdout --silent --show-error https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_$(dpkg --print-architecture).tar.gz | tar --extract --gzip --file /dev/stdin
-          mv yq_linux_$(dpkg --print-architecture) /usr/local/bin
-          rm --force --recursive yq_linux_$(dpkg --print-architecture) yq_linux_$(dpkg --print-architecture).tar.gz
-          yq --version
-
       - name: Install docker-ce via apt
         run: |
           install -m 0755 -d /etc/apt/keyrings
@@ -52,23 +44,17 @@ jobs:
 
       - name: Import GPG key
         id: import_gpg
-        uses: https://github.com/crazy-max/ghaction-import-gpg@v6
+        uses: https://github.com/crazy-max/ghaction-import-gpg@v7
         with:
           gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
           passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
           fingerprint: CC64B1DB67ABBEECAB24B6455FC346329753F4B0
 
       - name: Add Artifacthub.io annotations
-        run: |
-          NEW_TAG="$(git tag --sort=-version:refname | head --lines 1)"
-          OLD_TAG="$(git tag --sort=-version:refname | head --lines 2 | tail --lines 1)"
-          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
-
-      - name: Print Chart.yaml on stdout
-        run: cat Chart.yaml
+        uses: volker-raschek/ah-annotations@v0.2.0
 
       # Using helm gpg plugin as 'helm package --sign' has issues with gpg2: https://github.com/helm/helm/issues/2843
-      - name: Package Helm chart
+      - name: package chart
         run: |
           echo ${{ secrets.DOCKER_CHARTS_PASSWORD }} | docker login -u ${{ secrets.DOCKER_CHARTS_USERNAME }} --password-stdin
           # FIXME: use upstream after https://github.com/technosophos/helm-gpg/issues/1 is solved
@@ -84,26 +70,25 @@ jobs:
           helm push gitea/gitea-${GITHUB_REF#refs/tags/v}.tgz oci://registry-1.docker.io/giteacharts
           helm registry logout registry-1.docker.io
 
-      - name: Configure AWS credentials
-        uses: https://github.com/aws-actions/configure-aws-credentials@v5
-        with:
-          aws-access-key-id: ${{ secrets.AWS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
-
-      - name: Copy files to S3 and clear cache
+      - name: Copy files to Cloudflare R2
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: auto
+          CLOUDFLARE_R2_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_R2_ACCOUNT_ID }}
+          CLOUDFLARE_R2_BUCKET: ${{ secrets.CLOUDFLARE_R2_BUCKET }}
         run: |
-          aws s3 sync gitea/ s3://${{ secrets.AWS_S3_BUCKET}}/charts/
+          aws s3 sync gitea/ s3://${CLOUDFLARE_R2_BUCKET}/charts/ --endpoint-url https://${CLOUDFLARE_R2_ACCOUNT_ID}.r2.cloudflarestorage.com
 
   release-gitea:
-    container: docker.io/thegeeklab/git-sv:2.0.5
     needs: generate-chart-publish
     runs-on: ubuntu-latest
+    container: docker.io/thegeeklab/git-sv:2.1.3
     steps:
-      - name: Install packages via apt
+      - name: install tools
         run: |
           apk add -q --update --no-cache nodejs
-      - uses: actions/checkout@v5.0.0
+      - uses: actions/checkout@v7.0.0
         with:
           fetch-tags: true
           fetch-depth: 0

.gitea/workflows/update-changelog.yml

@@ -1,29 +0,0 @@
-name: Update changelog
-
-on:
-  push:
-    branches: [ "main" ]
-  workflow_dispatch: {}
-
-jobs:
-  changelog:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Install packages via apt-get
-        run: |
-          apt-get update &&
-          apt-get install --yes curl jq
-      - uses: actions/checkout@v5.0.0
-        with:
-          fetch-depth: 0
-      - name: Install git-sv
-        env:
-          GIT_SV_VERSION: v2.0.4 # renovate: datasource=github-releases depName=thegeeklab/git-sv
-        run: |
-          curl --fail --location --output /usr/local/bin/git-sv --silent --show-error https://github.com/thegeeklab/git-sv/releases/download/${GIT_SV_VERSION}/git-sv-linux-$(dpkg --print-architecture)
-          chmod +x /usr/local/bin/git-sv
-          git-sv --version
-      - name: Update changelog issue
-        env:
-          ISSUE_RW_TOKEN: ${{ secrets.ISSUE_RW_TOKEN }}
-        run: .gitea/scripts/update-changelog.sh

.github/copilot-instructions.md

@@ -0,0 +1,66 @@
+# Gitea Helm Chart — Copilot Instructions
+
+## Project Overview
+
+Kubernetes Helm chart for deploying [Gitea](https://gitea.com). Uses Go/Helm templating (`templates/`), YAML values (`values.yaml`), and includes sub-charts for PostgreSQL, PostgreSQL-HA, Valkey, and Valkey-cluster.
+
+## Build & Test
+
+```bash
+make missing-dot       # Check if the @param annotations are missing a trailing dot.
+make readme            # Regenerate README.md parameter table + lint + link checker
+make helm/unittest     # Run Helm unit tests (helm-unittest plugin required)
+make bash/unittest     # Run bash/bats script tests (requires git submodule init)
+```
+
+Always run `make readme` after changing `values.yaml` `@param` annotations.
+Always run `make helm/unittest` after changing templates or unit tests.
+
+## Conventions
+
+### values.yaml
+
+- Use `## @param path.to.key Description` annotations for every user-facing value. These drive the auto-generated README parameter table.
+- Property ordering within a resource block: `enabled`, `annotations`, `labels` first, then type-specific fields.
+- Top-level keys are sorted alphabetically within their section group.
+- Use [Helm Values](https://docs.renovatebot.com/modules/manager/helm-values/#additional-information) pattern from renovatebot. Ensure that the attributes `registry`, `repository` and `tag` are available as part of the dict `image`. For example:
+
+```yaml
+image:
+  registry: docker.io
+  repository: library/busybox
+  tag: 0.1.0
+```
+
+### Templates
+
+- Helm templates live in `templates/gitea/`. Helpers live in `templates/_helpers.tpl`.
+- Use camelCase for all files and variables (e.g `httpRoute`, `backendTLSPolicy`, `gatewayAPI`, `statefulSet`).
+- Use `include "gitea.fullname"` for naming resources.
+- Use `fail` for required-value validation with clear error messages referencing the full values path.
+- Ensure, that the attributes `annotations`, `labels`, `name` and `namespace` are alphabetically sorted.
+- Render all attributes, even if they are empty, to prevent drift in Argo CD. For example, `labels` must be rendered, while `annotations` are defined as `yaml:"annotations,omitempty"`.
+- Use plural for `*.tpl` files, because they may contain functions for multiple resources of the same kind (e.g. `_services.tpl` for `httpService.yaml` or `sshService.yaml`, `_backendTLSPolicies.tpl` for `backendTLSPolicy.yaml`).
+- Use as prefix of YAML files the resource kind (e.g., `deployment.yaml` for `Deployment` resources). If there are multiple resources of the same kind, use a descriptive suffix (e.g., `deployment_metrics.yaml` for a `Deployment` related to metrics).
+- Short names like `pvc` for Persistent Volume Claims or `svc` for Services are not allowed in file names or key names.
+
+### Unit Tests
+
+- Helm unit tests live in `unittests/helm/` mirroring the template structure.
+- Test files are YAML using the [helm-unittest](https://github.com/helm-unittest/helm-unittest) format.
+- Each test must set all required values explicitly — do not rely on cross-test state.
+- The `values.yaml` file must pass `yamllint`. The configuration is in `.yamllint.yaml`. Use `make yamllint` to run the linter.
+- The title of the unit test should clearly describe the scenario being tested. As title must be use a short sentence starting with a capital letter and ending without a period.
+- Each unit test must explicitly set a custom namespace and release name, rather than relying on defaults.
+
+### Commits & PRs
+
+- Follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) for PR titles and commit messages (e.g. `feat:`, `fix:`, `refactor:`, `docs:`, `style:`).
+- See `CONTRIBUTING.md` for full PR requirements.
+- Explain in detail why a change is needed, not just what the change is. Include links to relevant issues, PRs, or external references.
+- Add co-authors for any contributions that are not your own. Use the `Co-authored-by:` trailer in the commit message.
+
+### Documentation
+
+- `docs/` contains topic-specific guides (e.g. `gateway-api.md`, `ha-setup.md`).
+- `README.md` parameter tables are auto-generated — never edit them manually.

.markdownlink.json

@@ -1,8 +0,0 @@
-{
-  "projectBaseUrl":"${workspaceFolder}",
-  "ignorePatterns": [
-    {
-      "pattern": "^http://localhost"
-    }
-  ]
-}

.vscode/settings.json

@@ -1,7 +1,11 @@
 {
     "yaml.schemas": {
-        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.1/schema/helm-testsuite.json": [
+        "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.1/schema/helm-testsuite.json": [
             "/unittests/**/*.yaml"
+        ],
+        "https://docs.renovatebot.com/renovate-schema.json":[
+          "renovate.json",
+          "renovate.json5"
         ]
     },
     "yaml.schemaStore.enable": true,

.yamllint.yaml

@@ -1,20 +1,21 @@
 ---
 extends: default
-
 ignore: |
+  charts
   .yamllint
   node_modules
   templates
   unittests/bash
 
 rules:
-  truthy:
-    allowed-values: ['true', 'false']
-    check-keys: False
-    level: error
-  line-length: disable
-  document-start: disable
-  comments:
-    min-spaces-from-content: 1
   braces:
     max-spaces-inside: 2
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: disable
+  document-start: disable
+  line-length: disable
+  truthy:
+    allowed-values: ['true', 'false']
+    check-keys: false
+    level: error

CODEOWNERS

@@ -1 +1 @@
-* @rossigee @volker.raschek @ChristopherHX
+* @volker.raschek @ChristopherHX

CONTRIBUTING.md

@@ -37,14 +37,14 @@ For local development and testing of pull requests, the following workflow can
 be used:
 
 1. Install `minikube` and `helm`.
-1. Start a `minikube` cluster via `minikube start`.
-1. From the `gitea/helm-gitea` directory execute the following command.
+2. Start a `minikube` cluster via `minikube start`.
+3. From the `gitea/helm-gitea` directory execute the following command.
    This will install the dependencies listed in `Chart.yml` and deploy the current state of the helm chart found locally.
    If you want to test a branch, make sure to switch to the respective branch first.
    `helm install --dependency-update gitea . -f values.yaml`.
-1. Gitea is now deployed in `minikube`.
-   To access it, it's port needs to be forwarded first from `minikube` to localhost first via `kubectl --namespace
-default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at [http://localhost:3000](http://localhost:3000).
+4. Gitea is now deployed in `minikube`. To access it, it's port needs to be forwarded first from `minikube` to localhost
+   first via `kubectl --namespace default port-forward svc/gitea-http 3000:3000`. Now Gitea is accessible at
+   `localhost:3000`.
 
 ### Unit tests
 

Chart.lock

@@ -5,11 +5,8 @@ dependencies:
 - name: postgresql-ha
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 16.3.2
-- name: valkey-cluster
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 3.0.24
 - name: valkey
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 3.0.31
-digest: sha256:ceb6a1890cfdc2627abb85d3e2a4baa64d30afd21dcfabce978a824a67f0a2bb
-generated: "2025-08-30T00:03:04.59764502Z"
+  repository: https://valkey.io/valkey-helm
+  version: 0.10.0
+digest: sha256:1afecbf0d4fc9f48e31417573d4bed7e0ac7848040b9e0c5f3989ada9d1f944f
+generated: "2026-07-20T19:52:11.548874634+02:00"

Chart.yaml

@@ -3,10 +3,14 @@ name: gitea
 description: Gitea Helm chart for Kubernetes
 type: application
 version: 0.0.0
-# renovate datasource=github-releases depName=go-gitea/gitea extractVersion=^v(?<version>.*)$
-appVersion: 1.24.6
+appVersion: 1.27.3
 icon: https://gitea.com/assets/img/logo.svg
 
+annotations:
+  artifacthub.io/links: |
+    - name: support
+      url: https://gitea.com/gitea/helm-gitea/issues
+
 keywords:
   - git
   - issue tracker
@@ -14,23 +18,19 @@ keywords:
   - wiki
   - gitea
   - gogs
+
 sources:
   - https://gitea.com/gitea/helm-gitea
   - https://github.com/go-gitea/gitea
   - https://docker.gitea.com/gitea
-maintainers:
-  # https://gitea.com/rossigee
-  - name: Ross Golder
-    email: ross@golder.org
 
+maintainers:
   # https://gitea.com/volker.raschek
   - name: Markus Pesch
     email: markus.pesch+apps@cryptic.systems
-
   # https://gitea.com/DaanSelen
   - name: Daan Selen
     email: dselen@nerthus.nl
-
   # https://gitea.com/ChristopherHX
   - name: Christopher Homberger
     email: christopher.homberger@web.de
@@ -46,13 +46,8 @@ dependencies:
     repository: oci://registry-1.docker.io/bitnamicharts
     version: 16.3.2
     condition: postgresql-ha.enabled
-  # https://github.com/bitnami/charts/blob/main/bitnami/valkey-cluster/Chart.yaml
-  - name: valkey-cluster
-    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 3.0.24
-    condition: valkey-cluster.enabled
   # https://github.com/bitnami/charts/blob/main/bitnami/valkey/Chart.yaml
   - name: valkey
-    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 3.0.31
+    repository: https://valkey.io/valkey-helm
+    version: 0.10.0
     condition: valkey.enabled

Makefile

@@ -1,26 +1,54 @@
 SHELL := /usr/bin/env bash -O globstar
 
-.PHONY: prepare-environment
-prepare-environment:
-	npm install
+# MISSING DOT
+# ==============================================================================
+PHONY+=missing-dot
+missing-dot:
+	grep --perl-regexp '## @(param|skip).*[^.]$$' values.yaml
 
-.PHONY: readme
-readme: prepare-environment
-	npm run readme:parameters
-	npm run readme:lint
+# README
+# ==============================================================================
+PHONY+=readme
+readme: readme/link readme/lint readme/parameters
 
-.PHONY: unittests
-unittests: unittests-helm unittests-bash
+PHONY+=readme/link
+readme/link:
+	npm install && npm run readme:link
 
-.PHONY: unittests-helm
-unittests-helm:
-	helm unittest --strict -f 'unittests/helm/**/*.yaml' -f 'unittests/helm/values-conflicting-checks.yaml' ./
+PHONY+=readme/lint
+readme/lint:
+	npm install && npm run readme:lint
 
-.PHONY: unittests-bash
-unittests-bash:
+PHONY+=readme/parameters
+readme/parameters:
+	npm install && npm run readme:parameters
+
+# HELM DEPENDENCIES
+# ==============================================================================
+PHONY+=helm/dependency-update
+helm/dependency-update:
+	helm dependency update
+
+# HELM UNITTESTS
+# ==============================================================================
+PHONY+=helm/unittest
+helm/unittest:
+	helm unittest --strict --file 'unittests/helm/**/*.yaml' --file 'unittests/helm/values-conflicting-checks.yaml' ./
+
+# BASH UNITTESTS
+# ==============================================================================
+PHONY+=bash/unittest
+bash/unittest:
 	./unittests/bash/bats/bin/bats --pretty ./unittests/bash/tests/**/*.bats
 
-.PHONY: helm
-update-helm-dependencies:
-	helm dependency update
-  
+# YAML LINT
+# ==============================================================================
+PHONY+=yamllint
+yamllint:
+	yamllint -c .yamllint.yaml .
+
+# PHONY
+# ==============================================================================
+# Declare the contents of the PHONY variable as phony. We keep that information
+# in a variable so we can use it in if_changed.
+.PHONY: ${PHONY}

docs/gateway-api.md

@@ -0,0 +1,269 @@
+# Gateway API
+
+This chart can expose Gitea through [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) resources
+alongside (or instead of) the existing `Ingress` and OpenShift `Route` support. The following resources
+are rendered:
+
+- `HTTPRoute` — required for HTTP traffic
+- `TCPRoute` — optional, typically for SSH (port 22)
+- `BackendTLSPolicy` — optional, for encrypted backend traffic
+- `ClientSettingsPolicy` — optional, **NGINX Gateway Fabric only**, to raise the client request body size limit
+
+All resources are disabled by default. Enabling them requires Gateway API CRDs (and an implementation that supports them) to already be installed in the cluster.
+
+The chart does **not** render a `Gateway` resource — provisioning and managing the Gateway is the responsibility of the cluster / platform administrator.
+
+## Prerequisites
+
+| Resource               | API version                          | Status (as of writing) |
+| ---------------------- | ------------------------------------ | ---------------------- |
+| `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
+| `TCPRoute`             | `gateway.networking.k8s.io/v1`       | GA (v1.4+)             |
+| `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
+| `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
+
+## Common topology
+
+Most users should attach to a pre-existing, shared `Gateway` managed by the cluster administrator:
+
+```yaml
+gatewayAPI:
+  core:
+    httpRoute:
+      enabled: true
+      tls: true            # the shared Gateway terminates TLS
+      hostnames:
+        - git.example.com
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: shared-gateway
+          namespace: gateway-system
+          sectionName: https-gitea   # pin to a specific listener (see below)
+    tcpRoute:
+      enabled: true
+      parentRefs:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          name: shared-gateway
+          namespace: gateway-system
+          sectionName: ssh
+```
+
+With this configuration:
+
+- `ROOT_URL`, `DOMAIN`, and `SSH_DOMAIN` resolve to the first HTTPRoute hostname.
+- Setting `gatewayAPI.core.httpRoute.tls: true` switches `ROOT_URL` to `https://`.
+- The default HTTPRoute rule forwards `/` to the Gitea HTTP `Service`. The default TCPRoute rule forwards to the SSH `Service`.
+- Custom `rules` and `hostnames` are rendered through `tpl`, so Helm template expressions work inside them.
+
+### Why `sectionName` matters
+
+Omitting `sectionName` attaches the route to **every** matching listener on the Gateway. On implementations
+that use per-host HTTPS listeners (Envoy Gateway, Cilium Gateway), that means Gitea's HTTPRoute will try
+to bind to every HTTPS listener — usually not what you want. Always pin to a named listener
+(e.g. `https-gitea`, `ssh`) when the Gateway has more than one. The corresponding listener on the Gateway
+side typically looks like:
+
+```yaml
+listeners:
+  - name: https-gitea
+    port: 443
+    protocol: HTTPS
+    hostname: git.example.com
+    tls:
+      certificateRefs:
+        - name: git-example-com-tls
+    allowedRoutes:
+      kinds:
+        - kind: HTTPRoute
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+  - name: ssh
+    port: 22
+    protocol: TCP
+    allowedRoutes:
+      kinds:
+        - kind: TCPRoute
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gitea
+```
+
+### Sharing a hostname between HTTP and SSH
+
+HTTP (443) and SSH (22) are different ports, so a single hostname like `git.example.com` can serve both —
+clients disambiguate by port. This is the recommended pattern: one DNS record, `ssh git@git.example.com`
+and `https://git.example.com` both work, and `SSH_DOMAIN` / `DOMAIN` resolve to the same value with no
+extra configuration.
+
+If you want SSH on a **different** hostname (e.g. `gitea-ssh.example.com`), set it explicitly — the chart
+cannot infer it from TCPRoute config because TCPRoutes don't carry hostnames:
+
+```yaml
+gitea:
+  config:
+    server:
+      SSH_DOMAIN: gitea-ssh.example.com
+```
+
+## BackendTLSPolicy
+
+Use this when the Gitea HTTP backend is terminating TLS itself (for example, when running Gitea with
+`PROTOCOL=https`, or when fronting another HTTPS service from the same chart) and the Gateway needs to
+verify the backend certificate before forwarding the request.
+
+### Configuring Gitea to serve HTTPS directly
+
+Gitea serves HTTPS via three `[server]` app.ini options
+([cheat sheet](https://docs.gitea.com/administration/config-cheat-sheet#server-server)). Mount the
+cert/key with `deployment.volumes` + `deployment.gitea.volumeMounts` and point Gitea at them with absolute paths:
+
+```yaml
+gitea:
+  config:
+    server:
+      PROTOCOL: https
+      CERT_FILE: /etc/gitea-tls/tls.crt
+      KEY_FILE: /etc/gitea-tls/tls.key
+
+deployment:
+  gitea:
+    volumeMounts:
+      - name: gitea-tls
+        mountPath: /etc/gitea-tls
+        readOnly: true
+  volumes:
+    - name: gitea-tls
+      secret:
+        secretName: gitea-backend-tls   # cert-manager-issued Secret, etc.
+```
+
+- Relative `CERT_FILE`/`KEY_FILE` values resolve against Gitea's `CustomPath` (`/data/gitea` in the
+  official image); absolute paths are clearer.
+- Both options are ignored when `gitea.config.server.ENABLE_ACME` is `true`.
+- For chained certs, the server cert comes first, intermediates after.
+- The Service still forwards raw TCP — no `service.http.*` changes needed. The pod's container port
+  (3000 by default) is now speaking HTTPS instead of HTTP.
+
+### BackendTLSPolicy example
+
+Verify the backend with a CA bundle stored in a `ConfigMap`:
+
+```yaml
+gatewayAPI:
+  core:
+    backendTLSPolicy:
+      enabled: true
+      validation:
+        hostname: gitea.svc.cluster.local
+        caCertificateRefs:
+          - name: gitea-backend-ca
+            group: ""
+            kind: ConfigMap
+```
+
+This renders a single `BackendTLSPolicy` whose `targetRefs` defaults to the chart's HTTP `Service`
+(`<fullname>-http`), and whose `validation` is passed through verbatim. `validation` is required by the
+API; the template fails fast if omitted.
+
+### System CA trust and explicit targetRefs
+
+To trust the system CA store (Gateway API v1.1+) or target a different Service, use `wellKnownCACertificates`
+and `targetRefs`:
+
+```yaml
+gatewayAPI:
+  core:
+    backendTLSPolicy:
+      enabled: true
+      targetRefs:
+        - group: ""
+          kind: Service
+          name: gitea-sidecar
+      validation:
+        hostname: sidecar.gitea.svc.cluster.local
+        wellKnownCACertificates: System
+```
+
+Notes:
+
+- `targetRefs[].kind` is almost always `Service`; `group: ""` is the core API group.
+- `wellKnownCACertificates: System` requires Gateway API v1.1 and an implementation that supports it
+  (otherwise stick with `caCertificateRefs`).
+- The corresponding HTTPRoute must reference the backend by the same `Service` (and, if used,
+  `sectionName`/`port`) — `BackendTLSPolicy` attaches to the Service-side reference, not to the route.
+
+## Raising the request body size limit (NGINX Gateway Fabric)
+
+NGINX defaults `client_max_body_size` to `1m`. Requests exceeding it are rejected with `413 Request
+Entity Too Large`. This blocks uploading larger artifacts to Gitea's package/container registry (container
+images, DEB/RPM packages, etc.). With the NGINX **Ingress** controller you raised this via the
+`nginx.ingress.kubernetes.io/proxy-body-size` annotation — that annotation does **not** apply to Gateway
+API. NGINX Gateway Fabric instead reads the limit from a
+[`ClientSettingsPolicy`](https://docs.nginx.com/nginx-gateway-fabric/reference/api/) (`spec.body.maxSize`).
+
+This is specific to **NGINX Gateway Fabric**. Other implementations (Envoy Gateway, Cilium, Istio, …) do
+**not** impose a default request body size limit, so large uploads work without any extra configuration —
+leave `gatewayAPI.nginx.clientSettingsPolicies` disabled.
+
+```yaml
+gatewayAPI:
+  enabled: true
+  nginx:
+    clientSettingsPolicies:
+      enabled: true
+      body:
+        maxSize: 100m   # bytes, or with a k / m / g suffix; 0 disables the limit
+```
+
+This renders a single `ClientSettingsPolicy` whose `targetRef` defaults to the chart's `HTTPRoute`
+(`<fullname>`), so the limit applies to all traffic routed to Gitea. `body` is required when enabled; the
+template fails fast if omitted. `spec.body` is passed through verbatim, so other fields (e.g. `timeout`)
+are supported too.
+
+To attach the policy elsewhere — for example the whole `Gateway` so the limit is inherited by every route —
+override `targetRef`:
+
+```yaml
+gatewayAPI:
+  nginx:
+    clientSettingsPolicies:
+      enabled: true
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: shared-gateway
+      body:
+        maxSize: 100m
+```
+
+Notes:
+
+- `ClientSettingsPolicy` is an inherited policy: attaching it to a `Gateway` cascades to its routes, while
+  attaching it to an `HTTPRoute` scopes it to that route only.
+- The policy must live in the same namespace as its `targetRef`.
+- Gitea also enforces its own upload limits independently (`gitea.config` `[repository.upload]` and
+  `[packages]` sections) — raising the proxy limit alone is not always sufficient.
+
+## Interaction with `ingress` and `route`
+
+The three exposure mechanisms are independent and can coexist, but `ROOT_URL` / `DOMAIN` / `SSH_DOMAIN` resolution uses the first defined source in this order:
+
+1. `route.host` (when `route.enabled`)
+2. `httpRoute.hostnames[0]` (when `gatewayAPI.core.httpRoute.enabled`)
+3. First `ingress.hosts[0].host`
+4. The in-cluster Service DNS name
+
+Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tls.termination`, `ingress.tls`, or `gatewayAPI.core.httpRoute.tls`.
+
+## SSH considerations
+
+- `TCPRoute` is GA since Gateway API v1.4. Older CRD bundles only ship the `v1alpha2` version, so make sure the installed CRDs are at least v1.4.
+- If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
+- The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.

docs/ha-setup.md

@@ -14,7 +14,7 @@ They might cost a bit more than using a self-hosted k8s variant but are usually
 Also they can be centrally managed and are not linked to the Gitea helm chart or namespace.
 Please consider using external services before you start with your Gitea HA setup, it will make your life (and the life of the Gitea maintainers) easier.
 
-This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `replicaCount` is set to a value > 1.
+This helm chart tries to help as much as possible to simplify and assert the provisioning of a HA-ready Gitea instance by implementing smart conditionals if `deployment.replicas` is set to a value > 1.
 Nevertheless, we cannot guarantee for every possible combination of Gitea settings to work together perfectly in a HA setup.
 As a general advice, we recommend to have a test environment aside on which to test possible changes/upgrades before applying these to a production installation.
 
@@ -175,4 +175,4 @@ gitea:
 - Currently Cron jobs are run on all replicas as no leader election is implemented.
   See [https://github.com/go-gitea/gitea/issues/13791](https://github.com/go-gitea/gitea/issues/13791) for a discussion and possible solution.
 
-- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases. 
+- Running with multiple replicas slows down Gitea a bit, i.e. page loading time increases.

package.json

@@ -9,13 +9,13 @@
     "npm": ">=8.0.0"
   },
   "scripts": {
-    "readme:link": "markdown-link-check --config .markdownlink.json *.md",
+    "readme:link": "markdown-link-check *.md",
     "readme:lint": "markdownlint *.md -f",
     "readme:parameters": "readme-generator -v values.yaml -r README.md"
   },
   "devDependencies": {
     "@bitnami/readme-generator-for-helm": "^2.5.0",
     "markdown-link-check": "^3.13.6",
-    "markdownlint-cli": "^0.45.0"
+    "markdownlint-cli": "^0.49.0"
   }
 }

renovate.json5

@@ -1,51 +1,55 @@
 {
-  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
   extends: [
-    'gitea>gitea/renovate-config',
-    ':automergeMinor',
-    'schedule:automergeDaily',
-    'schedule:weekends',
+    "gitea>gitea/renovate-config",
+    "helpers:pinGitHubActionDigests",
+    ":automergeMinor",
+    "schedule:automergeDaily",
+    "schedule:weekends",
   ],
   labels: [
-    'kind/dependency',
+    "kind/dependency",
   ],
   digest: {
     automerge: true,
   },
-  automergeStrategy: 'squash',
-  'git-submodules': {
+  automergeStrategy: "squash",
+  "git-submodules": {
     enabled: true,
   },
   customManagers: [
     {
-      description: 'Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions',
-      customType: 'regex',
+      description: "Gitea-version of https://docs.renovatebot.com/presets-regexManagers/#regexmanagersgithubactionsversions",
+      customType: "regex",
       managerFilePatterns: [
-        '/.gitea/workflows/.+\\.ya?ml$/',
+        "/.gitea/workflows/.+\\.ya?ml$/",
       ],
       matchStrings: [
-        '# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*["\']?(?<currentValue>.+?)["\']?\\s',
+        "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)(?: (?:lookupName|packageName)=(?<packageName>[^\\s]+?))?(?: versioning=(?<versioning>[a-z-0-9]+?))?\\s+[A-Za-z0-9_]+?_VERSION\\s*:\\s*[\"']?(?<currentValue>.+?)[\"']?\\s",
       ],
     },
     {
-      description: 'Detect helm-unittest yaml schema file',
-      customType: 'regex',
+      description: "Detect helm-unittest yaml schema file",
+      customType: "regex",
       managerFilePatterns: [
-        '/.vscode/settings\\.json$/',
+        "/.vscode/settings\\.json$/",
       ],
       matchStrings: [
-        'https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json',
+        "https:\\/\\/raw\\.githubusercontent\\.com\\/(?<depName>[^\\s]+?)\\/(?<currentValue>v[0-9.]+?)\\/schema\\/helm-testsuite\\.json",
       ],
-      datasourceTemplate: 'github-releases',
+      datasourceTemplate: "github-releases",
     },
     {
-      description: 'Automatically detect new Gitea releases',
-      customType: 'regex',
+      description: "Automatically detect new Gitea releases",
+      customType: "regex",
+      datasourceTemplate: "github-releases",
+      depNameTemplate: "gitea/gitea",
+      extractVersionTemplate: "^v(?<version>.*)$",
       managerFilePatterns: [
-        '/(^|/)Chart\\.yaml$/',
+        "/(^|/)Chart\\.ya?ml$/",
       ],
       matchStrings: [
-        '# renovate datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) extractVersion=(?<extractVersion>\\S+)\\nappVersion:\\s?(?<currentValue>\\S+)\\n',
+        "^appVersion:\\s+[\"']?(?<currentVersion>\\S+)[\"']?$",
       ],
     },
   ],
@@ -54,78 +58,78 @@
     "commitMessageAction": "update",
     "commitMessageTopic": "lockfiles",
     schedule: [
-      'at any time',
+      "at any time",
     ]
   },
   packageRules: [
     {
-      groupName: 'subcharts (minor & patch)',
+      groupName: "subcharts (minor & patch)",
       matchManagers: [
-        'helmv3',
+        "helmv3",
       ],
       matchUpdateTypes: [
-        'minor',
-        'patch',
-        'digest',
+        "minor",
+        "patch",
+        "digest",
       ],
     },
     {
-      groupName: 'bats testing framework',
+      groupName: "bats testing framework",
       matchManagers: [
-        'git-submodules',
+        "git-submodules",
       ],
       matchUpdateTypes: [
-        'minor',
-        'patch',
-        'digest',
+        "minor",
+        "patch",
+        "digest",
       ],
     },
     {
-      groupName: 'workflow dependencies (minor & patch)',
+      groupName: "workflow dependencies (minor & patch)",
       matchManagers: [
-        'github-actions',
-        'npm',
-        'custom.regex',
+        "github-actions",
+        "npm",
+        "custom.regex",
       ],
       matchUpdateTypes: [
-        'minor',
-        'patch',
-        'digest',
+        "minor",
+        "patch",
+        "digest",
       ],
       matchFileNames: [
-        '!Chart.yaml',
+        "!Chart.yaml",
       ],
     },
     {
-      description: 'Update README.md on changes in values.yaml',
+      description: "Update README.md on changes in values.yaml",
       matchManagers: [
-        'helm-values',
+        "helm-values",
       ],
       postUpgradeTasks: {
         commands: [
-          'install-tool node',
-          'make readme',
+          "install-tool node",
+          "make readme",
         ],
         fileFilters: [
-          'README.md',
+          "README.md",
         ],
-        executionMode: 'update',
+        executionMode: "update",
       },
     },
     {
-      description: 'Override changelog url for Helm image, to have release notes in our PRs',
+      description: "Override changelog url for Helm image, to have release notes in our PRs",
       matchDepNames: [
-        'alpine/helm',
+        "alpine/helm",
       ],
-      changelogUrl: 'https://github.com/helm/helm',
+      changelogUrl: "https://github.com/helm/helm",
     },
     {
-      description: 'Bump Gitea as fast as possible - not only on weekends',
+      description: "Bump Gitea as fast as possible - not only on weekends",
       matchDepNames: [
-        'go-gitea/gitea',
+        "go-gitea/gitea",
       ],
       schedule: [
-        'at any time',
+        "at any time",
       ],
     },
   ],

scripts/init-containers/config/config_environment.sh

@@ -78,7 +78,6 @@ function env2ini::reload_preset_envs() {
   rm $TMP_EXISTING_ENVS_FILE
 }
 
-
 function env2ini::process_config_file() {
   local config_file="${1}"
   local section="$(basename "${config_file}")"
@@ -151,4 +150,4 @@ if [ -f ${GITEA_APP_INI} ]; then
   unset GITEA__SERVER__LFS_JWT_SECRET
 fi
 
-environment-to-ini -o $GITEA_APP_INI
+gitea config edit-ini --apply-env --config "$GITEA_APP_INI" --out "$GITEA_APP_INI"

templates/NOTES.txt

@@ -1,5 +1,12 @@
 1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
+{{- if .Values.route.enabled }}
+  {{- if .Values.route.host }}
+  {{ include "gitea.public_protocol" . }}://{{ tpl .Values.route.host . }}{{ .Values.route.path }}
+  {{- else }}
+  export ROUTE_HOST=$(kubectl get route --namespace {{ .Release.Namespace }} {{ include "gitea.fullname" . }} -o jsonpath="{.spec.host}")
+  echo {{ include "gitea.public_protocol" . }}://$ROUTE_HOST{{ .Values.route.path }}
+  {{- end }}
+{{- else if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
   {{- range .paths }}
   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}

templates/_helpers.tpl

@@ -43,15 +43,25 @@ Create chart name and version as used by the chart label.
 Create image name and tag used by the deployment.
 */}}
 {{- define "gitea.image" -}}
-{{- $fullOverride := .Values.image.fullOverride | default "" -}}
-{{- $registry := .Values.global.imageRegistry | default .Values.image.registry -}}
-{{- $repository := .Values.image.repository -}}
+{{- include "gitea.image.name" (list . .Values.deployment.gitea.image) -}}
+{{- end -}}
+
+{{/*
+Create image name and tag from an arbitrary `image` dict.
+Arguments: (list $root $image)
+*/}}
+{{- define "gitea.image.name" -}}
+{{- $root := index . 0 -}}
+{{- $image := index . 1 -}}
+{{- $fullOverride := $image.fullOverride | default "" -}}
+{{- $registry := $root.Values.global.imageRegistry | default $image.registry -}}
+{{- $repository := $image.repository -}}
 {{- $separator := ":" -}}
-{{- $tag := .Values.image.tag | default .Chart.AppVersion | toString -}}
-{{- $rootless := ternary "-rootless" "" (.Values.image.rootless) -}}
+{{- $tag := $image.tag | default $root.Chart.AppVersion | toString -}}
+{{- $rootless := ternary "-rootless" "" ($image.rootless) -}}
 {{- $digest := "" -}}
-{{- if .Values.image.digest }}
-    {{- $digest = (printf "@%s" (.Values.image.digest | toString)) -}}
+{{- if $image.digest }}
+    {{- $digest = (printf "@%s" ($image.digest | toString)) -}}
 {{- end -}}
 {{- if $fullOverride }}
     {{- printf "%s" $fullOverride -}}
@@ -76,22 +86,73 @@ imagePullSecrets:
 {{- end }}
 {{- end -}}
 
-
 {{/*
-Storage Class
+Return true when OpenShift compatibility defaults should be rendered.
+If openshift.enabled is unset, auto-detect via the SCC API.
 */}}
-{{- define "gitea.persistence.storageClass" -}}
-{{- $storageClass :=  (tpl ( default "" .Values.persistence.storageClass) .) | default (tpl ( default "" .Values.global.storageClass) .) }}
-{{- if $storageClass }}
-storageClassName: {{ $storageClass | quote }}
-{{- end }}
+{{- define "gitea.openshift.enabled" -}}
+{{- if kindIs "bool" .Values.openshift.enabled -}}
+{{ ternary "true" "false" .Values.openshift.enabled }}
+{{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1/SecurityContextConstraints" -}}
+true
+{{- else -}}
+false
+{{- end -}}
 {{- end -}}
 
 {{/*
-Common annotations
+Return the pod's hostUsers setting. Renders nothing unless explicitly set to a boolean.
 */}}
-{{- define "gitea.annotations" -}}
-{{- end }}
+{{- define "gitea.hostUsers" -}}
+{{- if kindIs "bool" .Values.deployment.hostUsers -}}
+{{ ternary "true" "false" .Values.deployment.hostUsers }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Render pod securityContext. On non-OpenShift clusters an empty map defaults fsGroup to 1000.
+*/}}
+{{- define "gitea.deployment.securityContext" -}}
+{{- $securityContext := deepCopy .Values.deployment.securityContext -}}
+{{- if and (ne (include "gitea.openshift.enabled" . | trim) "true") (not (hasKey $securityContext "fsGroup")) -}}
+{{- $_ := set $securityContext "fsGroup" 1000 -}}
+{{- end -}}
+{{- if gt (len $securityContext) 0 -}}
+{{ toYaml $securityContext }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Render container securityContext with OpenShift restricted SCC defaults when enabled.
+*/}}
+{{- define "gitea.containerSecurityContext" -}}
+{{- $root := index . 0 -}}
+{{- $containerSecurityContext := deepCopy (index . 1) -}}
+{{- if eq (include "gitea.openshift.enabled" $root | trim) "true" -}}
+{{- $containerSecurityContext = mergeOverwrite (dict
+  "allowPrivilegeEscalation" false
+  "capabilities" (dict "drop" (list "ALL"))
+  "runAsNonRoot" true
+  "seccompProfile" (dict "type" "RuntimeDefault")
+) $containerSecurityContext -}}
+{{- end -}}
+{{- if gt (len $containerSecurityContext) 0 -}}
+{{ toYaml $containerSecurityContext }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Render the securityContext for init containers that execute Gitea/GPG commands.
+These default to runAsUser 1000 outside OpenShift to preserve existing behavior.
+*/}}
+{{- define "gitea.commandInitContainerSecurityContext" -}}
+{{- $root := index . 0 -}}
+{{- $containerSecurityContext := deepCopy (index . 1) -}}
+{{- if and (ne (include "gitea.openshift.enabled" $root | trim) "true") (not (hasKey $containerSecurityContext "runAsUser")) -}}
+{{- $_ := set $containerSecurityContext "runAsUser" 1000 -}}
+{{- end -}}
+{{- include "gitea.containerSecurityContext" (list $root $containerSecurityContext) -}}
+{{- end -}}
 
 {{/*
 Common labels
@@ -100,8 +161,8 @@ Common labels
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}
 {{ include "gitea.selectorLabels" . }}
-app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
 
@@ -109,8 +170,8 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 helm.sh/chart: {{ include "gitea.chart" . }}
 app: {{ include "gitea.name" . }}-act-runner
 {{ include "gitea.selectorLabels.actRunner" . }}
-app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
-version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+app.kubernetes.io/version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
+version: {{ .Values.deployment.gitea.image.tag | default .Chart.AppVersion | quote }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end -}}
 
@@ -140,28 +201,20 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "valkey.dns" -}}
-{{- if and ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
-{{- fail "valkey and valkey-cluster cannot be enabled at the same time. Please only choose one." -}}
-{{- else if (index .Values "valkey-cluster").enabled -}}
-{{- printf "redis+cluster://:%s@%s-valkey-cluster-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey-cluster").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey-cluster").service.ports.valkey -}}
-{{- else if (index .Values "valkey").enabled -}}
-{{- printf "redis://:%s@%s-valkey-headless.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index .Values "valkey").global.valkey.password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").master.service.ports.valkey -}}
+{{- if (index .Values "valkey").enabled -}}
+{{- printf "redis://:%s@%s-valkey.%s.svc.%s:%g/0?pool_size=100&idle_timeout=180s&" (index (index .Values "valkey").auth.aclUsers "default").password .Release.Name .Release.Namespace .Values.clusterDomain (index .Values "valkey").service.port -}}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.port" -}}
-{{- if (index .Values "valkey-cluster").enabled -}}
-{{ (index .Values "valkey-cluster").service.ports.valkey }}
-{{- else if (index .Values "valkey").enabled -}}
-{{ (index .Values "valkey").master.service.ports.valkey }}
+{{- if (index .Values "valkey").enabled -}}
+{{ (index .Values "valkey").service.port }}
 {{- end -}}
 {{- end -}}
 
 {{- define "valkey.servicename" -}}
-{{- if (index .Values "valkey-cluster").enabled -}}
-{{- printf "%s-valkey-cluster-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
-{{- else if (index .Values "valkey").enabled -}}
-{{- printf "%s-valkey-headless.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
+{{- if (index .Values "valkey").enabled -}}
+{{- printf "%s-valkey.%s.svc.%s" .Release.Name .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 {{- end -}}
 
@@ -169,6 +222,18 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- printf "%s-http.%s.svc.%s" (include "gitea.fullname" .) .Release.Namespace .Values.clusterDomain -}}
 {{- end -}}
 
+{{- define "gitea.public_hostname" -}}
+{{- if and .Values.route.enabled .Values.route.host -}}
+{{ tpl .Values.route.host . }}
+{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled (gt (len .Values.gatewayAPI.core.httpRoute.hostnames) 0) -}}
+{{ tpl (index .Values.gatewayAPI.core.httpRoute.hostnames 0) $ }}
+{{- else if gt (len .Values.ingress.hosts) 0 -}}
+{{ tpl (index .Values.ingress.hosts 0).host $ }}
+{{- else -}}
+{{ include "gitea.default_domain" . }}
+{{- end -}}
+{{- end -}}
+
 {{- define "gitea.ldap_settings" -}}
 {{- $idx := index . 0 }}
 {{- $values := index . 1 }}
@@ -219,7 +284,11 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
 
 {{- define "gitea.public_protocol" -}}
-{{- if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
+{{- if and .Values.route.enabled .Values.route.tls.termination -}}
+https
+{{- else if and .Values.ingress.enabled (gt (len .Values.ingress.tls) 0) -}}
+https
+{{- else if and .Values.gatewayAPI.enabled .Values.gatewayAPI.core.httpRoute.enabled .Values.gatewayAPI.core.httpRoute.tls -}}
 https
 {{- else -}}
 {{ .Values.gitea.config.server.PROTOCOL }}
@@ -233,7 +302,7 @@ https
   {{- $generals := list -}}
   {{- $inlines := dict -}}
 
-  {{- range $key, $value := .Values.gitea.config  }}
+  {{- range $key, $value := .Values.gitea.config }}
     {{- if kindIs "map" $value }}
       {{- if gt (len $value) 0 }}
         {{- $section := default list (get $inlines $key) -}}
@@ -312,7 +381,7 @@ https
     {{- $_ := set .Values.gitea.config.metrics "TOKEN" .Values.gitea.metrics.token -}}
   {{- end -}}
   {{- /* valkey queue */ -}}
-  {{- if or ((index .Values "valkey-cluster").enabled) ((index .Values "valkey").enabled) -}}
+  {{- if (index .Values "valkey").enabled -}}
     {{- $_ := set .Values.gitea.config.queue "TYPE" "redis" -}}
     {{- $_ := set .Values.gitea.config.queue "CONN_STR" (include "valkey.dns" .) -}}
     {{- $_ := set .Values.gitea.config.session "PROVIDER" "redis" -}}
@@ -352,11 +421,7 @@ https
     {{- $_ := set .Values.gitea.config.server "PROTOCOL" "http" -}}
   {{- end -}}
   {{- if not (.Values.gitea.config.server.DOMAIN) -}}
-    {{- if gt (len .Values.ingress.hosts) 0 -}}
-      {{- $_ := set .Values.gitea.config.server "DOMAIN" ( tpl (index .Values.ingress.hosts 0).host $) -}}
-    {{- else -}}
-      {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.default_domain" .) -}}
-    {{- end -}}
+    {{- $_ := set .Values.gitea.config.server "DOMAIN" (include "gitea.public_hostname" .) -}}
   {{- end -}}
   {{- if not .Values.gitea.config.server.ROOT_URL -}}
     {{- $_ := set .Values.gitea.config.server "ROOT_URL" (printf "%s://%s" (include "gitea.public_protocol" .) .Values.gitea.config.server.DOMAIN) -}}
@@ -368,7 +433,7 @@ https
     {{- $_ := set .Values.gitea.config.server "SSH_PORT" .Values.service.ssh.port -}}
   {{- end -}}
   {{- if not (hasKey .Values.gitea.config.server "START_SSH_SERVER") -}}
-    {{- if .Values.image.rootless -}}
+    {{- if .Values.deployment.gitea.image.rootless -}}
       {{- $_ := set .Values.gitea.config.server "START_SSH_SERVER" "true" -}}
       {{- if not (hasKey .Values.gitea.config.server "SSH_LISTEN_PORT") -}}
         {{- if not .Values.gitea.config.server.SSH_LISTEN_PORT -}}
@@ -421,17 +486,13 @@ https
 
 {{- define "gitea.container-additional-mounts" -}}
   {{- /* Honor the deprecated extraVolumeMounts variable when defined */ -}}
-  {{- if gt (len .Values.extraContainerVolumeMounts) 0 -}}
-    {{- toYaml .Values.extraContainerVolumeMounts -}}
+  {{- if gt (len .Values.deployment.gitea.volumeMounts) 0 -}}
+    {{- toYaml .Values.deployment.gitea.volumeMounts -}}
   {{- else if gt (len .Values.extraVolumeMounts) 0 -}}
     {{- toYaml .Values.extraVolumeMounts -}}
   {{- end -}}
 {{- end -}}
 
-{{- define "gitea.gpg-key-secret-name" -}}
-{{ default (printf "%s-gpg-key" (include "gitea.fullname" .)) .Values.signing.existingSecret }}
-{{- end -}}
-
 {{- define "gitea.serviceAccountName" -}}
 {{ .Values.serviceAccount.name | default (include "gitea.fullname" .) }}
 {{- end -}}
@@ -448,14 +509,6 @@ https
   {{- end }}
 {{- end -}}
 
-{{- define "gitea.admin.passwordMode" -}}
-{{- if has .Values.gitea.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
-{{ .Values.gitea.admin.passwordMode }}
-{{- else -}}
-{{ printf "gitea.admin.passwordMode must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.gitea.admin.passwordMode | fail }}
-{{- end -}}
-{{- end -}}
-
 {{/* Create a functioning probe object for rendering. Given argument must be either a livenessProbe, readinessProbe, or startupProbe */}}
 {{- define "gitea.deployment.probe" -}}
   {{- $probe := unset . "enabled" -}}
@@ -473,7 +526,3 @@ https
   {{- end -}}
   {{- toYaml $probe -}}
 {{- end -}}
-
-{{- define "gitea.metrics-secret-name" -}}
-{{ default (printf "%s-metrics-secret" (include "gitea.fullname" .)) }}
-{{- end -}}

templates/_networkPolicy.tpl

@@ -1,19 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-
-{{/* annotations */}}
-
-{{- define "gitea.networkPolicy.annotations" -}}
-{{ include "gitea.annotations" . }}
-{{- if .Values.networkPolicy.annotations }}
-{{ toYaml .Values.networkPolicy.annotations }}
-{{- end }}
-{{- end }}
-
-{{/* labels */}}
-
-{{- define "gitea.networkPolicy.labels" -}}
-{{ include "gitea.labels" . }}
-{{- if .Values.networkPolicy.labels }}
-{{ toYaml .Values.networkPolicy.labels }}
-{{- end }}
-{{- end }}

templates/_pod.tpl

@@ -1,17 +0,0 @@
----
-
-{{/* labels */}}
-
-{{- define "gitea.pod.labels" -}}
-{{- include "gitea.labels" . }}
-{{- if .Values.deployment.labels }}
-{{ toYaml .Values.deployment.labels }}
-{{- end }}
-{{- end }}
-
-{{- define "gitea.pod.selectorLabels" -}}
-{{- include "gitea.selectorLabels" . }}
-{{- if .Values.deployment.labels }}
-{{ toYaml .Values.deployment.labels }}
-{{- end }}
-{{- end }}

templates/check-actions-not-present.yaml

@@ -1,3 +0,0 @@
-{{- if .Values.actions -}}
-    {{- fail "The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9." -}}
-{{- end -}}

templates/config.yaml

@@ -1,57 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "gitea.fullname" . }}-inline-config
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-type: Opaque
-stringData:
-  {{- include "gitea.inline_configuration" . | nindent 2 }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-type: Opaque
-stringData:
-{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
-  assertions: |
-
-    {{- /*assert that only one PG dep is enabled */ -}}
-    {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
-      {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
-    {{- end }}
-    
-    {{- /* multiple replicas assertions */ -}}
-    {{- if gt (.Values.replicaCount | int) 1 -}}
-      {{- if .Values.gitea.config.cron -}}
-        {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
-          {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
-            {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
-          {{- end }}
-        {{- end }}
-      {{- end }}
-    
-      {{- if eq (first .Values.persistence.accessModes) "ReadWriteOnce" -}}
-        {{- fail "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany." -}}
-      {{- end }}
-      {{- if .Values.gitea.config.indexer -}}
-        {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
-          {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
-        {{- end }}
-        {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
-          {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
-            {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
-              {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
-                {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
-              {{- end }}
-            {{- end }}
-          {{- end }}
-        {{- end }}
-      {{- end }}
-      
-    {{- end }}

templates/deployment.yaml

@@ -1,426 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  annotations:
-    {{- if .Values.deployment.annotations }}
-    {{- toYaml .Values.deployment.annotations | nindent 4 }}
-    {{- end }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-    {{- if .Values.deployment.labels }}
-    {{- toYaml .Values.deployment.labels | nindent 4 }}
-    {{- end }}
-spec:
-  replicas: {{ .Values.replicaCount }}
-  strategy:
-    type: {{ .Values.strategy.type }}
-    {{- if eq .Values.strategy.type "RollingUpdate" }}
-    rollingUpdate:
-      maxUnavailable: {{ .Values.strategy.rollingUpdate.maxUnavailable }}
-      maxSurge: {{ .Values.strategy.rollingUpdate.maxSurge }}
-    {{- end }}
-  selector:
-    matchLabels:
-      {{- include "gitea.pod.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
-        {{- range $idx, $value := .Values.gitea.ldap }}
-        checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
-        {{- end }}
-        {{- range $idx, $value := .Values.gitea.oauth }}
-        checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
-        {{- end }}
-        {{- with .Values.gitea.podAnnotations }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-      labels:
-        {{- include "gitea.pod.labels" . | nindent 8 }}
-    spec:
-      {{- if .Values.schedulerName }}
-      schedulerName: "{{ .Values.schedulerName }}"
-      {{- end }}
-      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
-      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
-      {{- end }}
-      {{- if .Values.priorityClassName }}
-      priorityClassName: "{{ .Values.priorityClassName }}"
-      {{- end }}
-      {{- include "gitea.images.pullSecrets" . | nindent 6 }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      initContainers:
-        {{- if .Values.preExtraInitContainers }}
-        {{- toYaml .Values.preExtraInitContainers | nindent 8 }}
-        {{- end }}
-        - name: init-directories
-          image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command:
-            - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            {{- if .Values.deployment.env }}
-            {{- toYaml .Values.deployment.env | nindent 12 }}
-            {{- end }}
-            {{- if .Values.signing.enabled }}
-            - name: GNUPGHOME
-              value: {{ .Values.signing.gpgHome }}
-            {{- end }}
-          volumeMounts:
-            - name: init
-              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
-          securityContext:
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          resources:
-            {{- toYaml .Values.initContainers.resources | nindent 12 }}
-        - name: init-app-ini
-          image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command:
-          - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            - name: TMP_EXISTING_ENVS_FILE
-              value: /tmp/existing-envs
-            - name: ENV_TO_INI_MOUNT_POINT
-              value: /env-to-ini-mounts
-            {{- if .Values.deployment.env }}
-            {{- toYaml .Values.deployment.env | nindent 12 }}
-            {{- end }}
-            {{- if .Values.gitea.additionalConfigFromEnvs }}
-            {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 12 }}
-            {{- end }}
-          volumeMounts:
-            - name: config
-              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-            - name: inline-config-sources
-              mountPath: /env-to-ini-mounts/inlines/
-            {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
-            - name: additional-config-sources-{{ $idx }}
-              mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
-            {{- end }}
-            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
-          securityContext:
-            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
-          resources:
-            {{- toYaml .Values.initContainers.resources | nindent 12 }}
-        {{- if .Values.signing.enabled }}
-        - name: configure-gpg
-          image: "{{ include "gitea.image" . }}"
-          command:
-          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          securityContext:
-            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
-            {{- $csc := deepCopy .Values.containerSecurityContext -}}
-            {{- if not (hasKey $csc "runAsUser") -}}
-            {{- $_ := set $csc "runAsUser" 1000 -}}
-            {{- end -}}
-            {{- toYaml $csc | nindent 12 }}
-          env:
-            - name: GNUPGHOME
-              value: {{ .Values.signing.gpgHome }}
-            - name: TMP_RAW_GPG_KEY
-              value: /raw/private.asc
-          volumeMounts:
-            - name: init
-              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-            - name: gpg-private-key
-              mountPath: /raw
-              readOnly: true
-            {{- if .Values.extraVolumeMounts }}
-            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
-            {{- end }}
-          resources:
-            {{- toYaml .Values.initContainers.resources | nindent 12 }}
-        {{- end }}
-        - name: configure-gitea
-          image: "{{ include "gitea.image" . }}"
-          command:
-          - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          securityContext:
-            {{- /* By default this container runs as user 1000 unless otherwise stated */ -}}
-            {{- $csc := deepCopy .Values.containerSecurityContext -}}
-            {{- if not (hasKey $csc "runAsUser") -}}
-            {{- $_ := set $csc "runAsUser" 1000 -}}
-            {{- end -}}
-            {{- toYaml $csc | nindent 12 }}
-          env:
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            {{- if .Values.image.rootless }}
-            - name: HOME
-              value: /data/gitea/git
-            {{- end }}
-            {{- if .Values.gitea.ldap }}
-            {{- range $idx, $value := .Values.gitea.ldap }}
-            {{- if $value.existingSecret }}
-            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
-              valueFrom:
-                secretKeyRef:
-                  key:  bindDn
-                  name: {{ $value.existingSecret }}
-            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
-              valueFrom:
-                secretKeyRef:
-                  key:  bindPassword
-                  name: {{ $value.existingSecret }}
-            {{- else }}
-            - name: GITEA_LDAP_BIND_DN_{{ $idx }}
-              value: {{ $value.bindDn | quote }}
-            - name: GITEA_LDAP_PASSWORD_{{ $idx }}
-              value: {{ $value.bindPassword | quote }}
-            {{- end }}
-            {{- end }}
-            {{- end }}
-            {{- if .Values.gitea.oauth }}
-            {{- range $idx, $value := .Values.gitea.oauth }}
-            {{- if $value.existingSecret }}
-            - name: GITEA_OAUTH_KEY_{{ $idx }}
-              valueFrom:
-                secretKeyRef:
-                  key:  key
-                  name: {{ $value.existingSecret }}
-            - name: GITEA_OAUTH_SECRET_{{ $idx }}
-              valueFrom:
-                secretKeyRef:
-                  key:  secret
-                  name: {{ $value.existingSecret }}
-            {{- end }}
-            {{- end }}
-            {{- end }}
-            {{- if .Values.gitea.admin.existingSecret }}
-            - name: GITEA_ADMIN_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  key:  username
-                  name: {{ .Values.gitea.admin.existingSecret }}
-            - name: GITEA_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key:  password
-                  name: {{ .Values.gitea.admin.existingSecret }}
-            {{- else }}
-            - name: GITEA_ADMIN_USERNAME
-              value: {{ .Values.gitea.admin.username | quote }}
-            - name: GITEA_ADMIN_PASSWORD
-              value: {{ .Values.gitea.admin.password | quote }}
-            {{- end }}
-            - name: GITEA_ADMIN_PASSWORD_MODE
-              value: {{ include "gitea.admin.passwordMode" $ }}
-            {{- if .Values.deployment.env }}
-            {{- toYaml .Values.deployment.env | nindent 12 }}
-            {{- end }}
-          volumeMounts:
-            - name: init
-              mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-            {{- include "gitea.init-additional-mounts" . | nindent 12 }}
-          resources:
-            {{- toYaml .Values.initContainers.resources | nindent 12 }}
-        {{- if .Values.postExtraInitContainers }}
-        {{- toYaml .Values.postExtraInitContainers | nindent 8 }}
-        {{- end }}
-      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
-      containers:
-        - name: {{ .Chart.Name }}
-          image: "{{ include "gitea.image" . }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          env:
-            # SSH Port values have to be set here as well for openssh configuration
-            - name: SSH_LISTEN_PORT
-              value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
-            - name: SSH_PORT
-              value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
-            {{- if not .Values.image.rootless }}
-            - name: SSH_LOG_LEVEL
-              value: {{ .Values.gitea.ssh.logLevel | quote }}
-            {{- end }}
-            - name: GITEA_APP_INI
-              value: /data/gitea/conf/app.ini
-            - name: GITEA_CUSTOM
-              value: /data/gitea
-            - name: GITEA_WORK_DIR
-              value: /data
-            - name: GITEA_TEMP
-              value: /tmp/gitea
-            {{- if and (hasKey .Values.resources "limits") (hasKey .Values.resources.limits "cpu") }}
-            - name: GOMAXPROCS
-              valueFrom:
-                resourceFieldRef:
-                  divisor: "1"
-                  resource: limits.cpu
-            {{- end }}
-            - name: TMPDIR
-              value: /tmp/gitea
-            {{- if .Values.image.rootless }}
-            - name: HOME
-              value: /data/gitea/git
-            {{- end }}
-            {{- if .Values.signing.enabled }}
-            - name: GNUPGHOME
-              value: {{ .Values.signing.gpgHome }}
-            {{- end }}
-            {{- if .Values.deployment.env }}
-            {{- toYaml .Values.deployment.env | nindent 12 }}
-            {{- end }}
-          ports:
-            - name: ssh
-              containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
-            {{- if .Values.service.ssh.hostPort }}
-              hostPort: {{ .Values.service.ssh.hostPort }}
-            {{- end }}
-            - name: http
-              containerPort: {{ .Values.gitea.config.server.HTTP_PORT }}
-            {{- if .Values.gitea.config.server.ENABLE_PPROF }}
-            - name: profiler
-              containerPort: 6060
-            {{- end }}
-          {{- if .Values.gitea.livenessProbe.enabled }}
-          livenessProbe:
-            {{- include "gitea.deployment.probe" .Values.gitea.livenessProbe | nindent 12 }}
-          {{- end }}
-          {{- if .Values.gitea.readinessProbe.enabled }}
-          readinessProbe:
-            {{- include "gitea.deployment.probe" .Values.gitea.readinessProbe | nindent 12 }}
-          {{- end }}
-          {{- if .Values.gitea.startupProbe.enabled }}
-          startupProbe:
-            {{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
-          {{- end }}
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          securityContext:
-            {{- /* Honor the deprecated securityContext variable when defined */ -}}
-            {{- if .Values.containerSecurityContext -}}
-            {{ toYaml .Values.containerSecurityContext | nindent 12 -}}
-            {{- else -}}
-            {{ toYaml .Values.securityContext | nindent 12 -}}
-            {{- end }}
-          volumeMounts:
-            - name: temp
-              mountPath: /tmp
-            - name: data
-              mountPath: /data
-              {{- if .Values.persistence.subPath }}
-              subPath: {{ .Values.persistence.subPath }}
-              {{- end }}
-            {{- include "gitea.container-additional-mounts" . | nindent 12 }}
-        {{- if .Values.extraContainers }}
-        {{- toYaml .Values.extraContainers | nindent 8 }}
-        {{- end }}
-      {{- with .Values.global.hostAliases }}
-      hostAliases:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- range $key, $value := .Values.nodeSelector }}
-      nodeSelector:
-        {{ $key }}: {{ $value | quote }}
-      {{- end }}
-    {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-    {{- end }}
-    {{- if .Values.dnsConfig }}
-      dnsConfig:
-        {{- toYaml .Values.dnsConfig | nindent 8 }}
-    {{- end }}
-      volumes:
-        - name: init
-          secret:
-            secretName: {{ include "gitea.fullname" . }}-init
-            defaultMode: 110
-        - name: config
-          secret:
-            secretName: {{ include "gitea.fullname" . }}
-            defaultMode: 110
-        {{- if gt (len .Values.extraVolumes) 0 }}
-        {{- toYaml .Values.extraVolumes | nindent 8 }}
-        {{- end }}
-        - name: inline-config-sources
-          secret:
-            secretName: {{ include "gitea.fullname" . }}-inline-config
-        {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
-        - name: additional-config-sources-{{ $idx }}
-          {{- toYaml $value | nindent 10 }}
-        {{- end }}
-        - name: temp
-          emptyDir: {}
-        {{- if .Values.signing.enabled }}
-        - name: gpg-private-key
-          secret:
-            secretName: {{ include "gitea.gpg-key-secret-name" . }}
-            items:
-              - key: privateKey
-                path: private.asc
-            defaultMode: 0100
-        {{- end }}
-  {{- if .Values.persistence.enabled }}
-    {{- if .Values.persistence.mount }}
-        - name: data
-          persistentVolumeClaim:
-            claimName: {{ .Values.persistence.claimName }}
-    {{- end }}
-  {{- else if not .Values.persistence.enabled }}
-        - name: data
-          emptyDir: {}
-  {{- end }}

templates/deprecation.yaml

@@ -1,34 +0,0 @@
-{{- if .Values.checkDeprecation -}}
-  {{/* CUSTOM PROBES */}}
-  {{- if .Values.gitea.customLivenessProbe -}}
-    {{- fail "`gitea.customLivenessProbe` does no longer exist. Please refer to the changelog and configure `gitea.livenessProbe` instead." -}}
-  {{- end -}}
-  {{- if .Values.gitea.customReadinessProbe -}}
-    {{- fail "`gitea.customReadinessProbe` does no longer exist. Please refer to the changelog and configure `gitea.readinessProbe` instead." -}}
-  {{- end -}}
-  {{- if .Values.gitea.customStartupProbe -}}
-    {{- fail "`gitea.customStartupProbe` does no longer exist. Please refer to the changelog and configure `gitea.startupProbe` instead." -}}
-  {{- end -}}
-
-  {{/* LDAP SOURCES */}}
-  {{- if kindIs "map" .Values.gitea.ldap -}}
-    {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
-  {{- end -}}
-  
-  {{/* OAUTH SOURCES */}}
-  {{- if kindIs "map" .Values.gitea.oauth -}}
-    {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
-  {{- end -}}
-  
-  {{/* BUILTIN */}}
-  {{- if .Values.gitea.cache -}}
-    {{- if .Values.gitea.cache.builtIn -}}
-      {{- fail "`gitea.cache.builtIn` does no longer exist. Please use `memcached` at root level instead." -}}
-    {{- end -}}
-  {{- end -}}
-  {{- if .Values.gitea.database -}}
-    {{- if .Values.gitea.database.builtIn -}}
-      {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
-    {{- end -}}
-  {{- end -}}
-{{- end -}}

templates/gitea/_backendTLSPolicies.tpl

@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.backendTLSPolicy.annotations" -}}
+{{- with .Values.gatewayAPI.core.backendTLSPolicy.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.backendTLSPolicy.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+          .Values.gatewayAPI.core.backendTLSPolicy.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.backendTLSPolicy.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.core.backendTLSPolicy.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}

templates/gitea/_clientSettingsPolicies.tpl

@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.clientSettingsPolicies.annotations" -}}
+{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.clientSettingsPolicies.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+          .Values.gatewayAPI.nginx.clientSettingsPolicies.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.clientSettingsPolicies.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.nginx.clientSettingsPolicies.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}

templates/gitea/_deployments.tpl

@@ -0,0 +1,38 @@
+{{/* annotations */}}
+
+{{- define "gitea.deployment.annotations" -}}
+{{- with .Values.deployment.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* initContainers */}}
+
+{{- define "gitea.deployment.initContainers" -}}
+{{- $links := list "initAppIni" "initConfigureGPG" "initConfigureGitea" "initDirectories" }}
+{{- range $index, $entry := .Values.deployment.initContainers }}
+{{- if and (hasKey $entry "container") (hasKey $entry "link") }}
+{{- fail (printf "deployment.initContainers[%d]: `container` and `link` are mutually exclusive" $index) }}
+{{- else if hasKey $entry "container" }}
+{{- list $entry.container | toYaml | nindent 0 }}
+{{- else if hasKey $entry "link" }}
+{{- if not (has $entry.link $links) }}
+{{- fail (printf "deployment.initContainers[%d]: unknown link `%s`, expected one of: %s" $index $entry.link (join ", " $links)) }}
+{{- end }}
+{{- with include (printf "gitea.initContainer.%s" $entry.link) $ }}
+{{- nindent 0 . }}
+{{- end }}
+{{- else }}
+{{- fail (printf "deployment.initContainers[%d]: either `container` or `link` must be set" $index) }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.deployment.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.deployment.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}

templates/gitea/_httpRoutes.tpl

@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.httpRoute.annotations" -}}
+{{- with .Values.gatewayAPI.core.httpRoute.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.httpRoute.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+          .Values.gatewayAPI.core.httpRoute.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.httpRoute.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.core.httpRoute.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}

templates/gitea/_ingresses.tpl

@@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.ingress.annotations" -}}
+{{- with .Values.ingress.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.ingress.enabled" -}}
+{{- if and .Values.ingress.enabled .Values.service.http.enabled -}}
+true
+{{- else -}}
+false
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.ingress.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.ingress.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* name */}}
+
+{{- define "gitea.ingress.name" -}}
+{{ include "gitea.fullname" . }}
+{{- end }}

templates/gitea/_initContainers.tpl

@@ -0,0 +1,304 @@
+{{/* initDirectories */}}
+
+{{- define "gitea.initContainer.initDirectories" -}}
+{{- $config := .Values.deployment.initDirectories -}}
+- name: init-directories
+  image: "{{ include "gitea.image.name" (list . $config.image) }}"
+  imagePullPolicy: {{ $config.image.pullPolicy }}
+  command:
+    - "{{ .Values.initContainersScriptsVolumeMountPath }}/init_directory_structure.sh"
+  env:
+    - name: GITEA_APP_INI
+      value: /data/gitea/conf/app.ini
+    - name: GITEA_CUSTOM
+      value: /data/gitea
+    - name: GITEA_WORK_DIR
+      value: /data
+    - name: GITEA_TEMP
+      value: /tmp/gitea
+    {{- if .Values.deployment.gitea.env }}
+    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
+    {{- end }}
+    {{- if .Values.secrets.gpg.enabled }}
+    - name: GNUPGHOME
+      valueFrom:
+        secretKeyRef:
+          name: {{ include "gitea.secret.gpg.name" . }}
+          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
+    {{- end }}
+    {{- with $config.env }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with $config.envFrom }}
+  envFrom:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  volumeMounts:
+    - name: init
+      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+    - name: temp
+      mountPath: /tmp
+    - name: data
+      mountPath: /data
+      {{- if .Values.persistence.new.subPath }}
+      subPath: {{ .Values.persistence.new.subPath }}
+      {{- end }}
+    {{- include "gitea.init-additional-mounts" . | nindent 4 }}
+    {{- with $config.volumeMounts }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
+  securityContext:
+    {{- . | nindent 4 }}
+  {{- end }}
+  resources:
+    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
+{{- end }}
+
+{{/* initAppIni */}}
+
+{{- define "gitea.initContainer.initAppIni" -}}
+{{- $config := .Values.deployment.initAppIni -}}
+- name: init-app-ini
+  image: "{{ include "gitea.image.name" (list . $config.image) }}"
+  imagePullPolicy: {{ $config.image.pullPolicy }}
+  {{- if .Values.gitea.extraEnvSourceFile }}
+  command:
+  - "/bin/bash"
+  - "-c"
+  args:
+  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
+  {{- else }}
+  command:
+  - "{{ .Values.initContainersScriptsVolumeMountPath }}/config_environment.sh"
+  {{- end }}
+  env:
+    - name: GITEA_APP_INI
+      value: /data/gitea/conf/app.ini
+    - name: GITEA_CUSTOM
+      value: /data/gitea
+    - name: GITEA_WORK_DIR
+      value: /data
+    - name: GITEA_TEMP
+      value: /tmp/gitea
+    - name: TMP_EXISTING_ENVS_FILE
+      value: /tmp/existing-envs
+    - name: ENV_TO_INI_MOUNT_POINT
+      value: /env-to-ini-mounts
+    {{- if .Values.deployment.gitea.env }}
+    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
+    {{- end }}
+    {{- if .Values.gitea.additionalConfigFromEnvs }}
+    {{- tpl (toYaml .Values.gitea.additionalConfigFromEnvs) $ | nindent 4 }}
+    {{- end }}
+    {{- with $config.env }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with $config.envFrom }}
+  envFrom:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  volumeMounts:
+    - name: config
+      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+    - name: temp
+      mountPath: /tmp
+    - name: data
+      mountPath: /data
+      {{- if .Values.persistence.new.subPath }}
+      subPath: {{ .Values.persistence.new.subPath }}
+      {{- end }}
+    - name: inline-config-sources
+      mountPath: /env-to-ini-mounts/inlines/
+    {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
+    - name: additional-config-sources-{{ $idx }}
+      mountPath: "/env-to-ini-mounts/additionals/{{ $idx }}/"
+    {{- end }}
+    {{- include "gitea.init-additional-mounts" . | nindent 4 }}
+    {{- with $config.volumeMounts }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with (include "gitea.containerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
+  securityContext:
+    {{- . | nindent 4 }}
+  {{- end }}
+  resources:
+    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
+{{- end }}
+
+{{/* initConfigureGPG */}}
+
+{{- define "gitea.initContainer.initConfigureGPG" -}}
+{{- $config := .Values.deployment.initConfigureGPG -}}
+{{- if .Values.secrets.gpg.enabled -}}
+- name: configure-gpg
+  image: "{{ include "gitea.image.name" (list . $config.image) }}"
+  {{- if .Values.gitea.extraEnvSourceFile }}
+  command:
+  - "/bin/bash"
+  - "-c"
+  args:
+  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
+  {{- else }}
+  command:
+  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gpg_environment.sh"
+  {{- end }}
+  imagePullPolicy: {{ $config.image.pullPolicy }}
+  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
+  securityContext:
+    {{- . | nindent 4 }}
+  {{- end }}
+  env:
+    - name: GNUPGHOME
+      valueFrom:
+        secretKeyRef:
+          name: {{ include "gitea.secret.gpg.name" . }}
+          key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
+    - name: TMP_RAW_GPG_KEY
+      value: /raw/private.asc
+    {{- with $config.env }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with $config.envFrom }}
+  envFrom:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  volumeMounts:
+    - name: init
+      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+    - name: data
+      mountPath: /data
+      {{- if .Values.persistence.new.subPath }}
+      subPath: {{ .Values.persistence.new.subPath }}
+      {{- end }}
+    - name: gpg-private-key
+      mountPath: /raw
+      readOnly: true
+    {{- if .Values.extraVolumeMounts }}
+    {{- toYaml .Values.extraVolumeMounts | nindent 4 }}
+    {{- end }}
+    {{- with $config.volumeMounts }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  resources:
+    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
+{{- end }}
+{{- end }}
+
+{{/* initConfigureGitea */}}
+
+{{- define "gitea.initContainer.initConfigureGitea" -}}
+{{- $config := .Values.deployment.initConfigureGitea -}}
+- name: configure-gitea
+  image: "{{ include "gitea.image.name" (list . $config.image) }}"
+  {{- if .Values.gitea.extraEnvSourceFile }}
+  command:
+  - "/bin/bash"
+  - "-c"
+  args:
+  - "test -f {{ .Values.gitea.extraEnvSourceFile }} && source {{ .Values.gitea.extraEnvSourceFile }} || { echo 'ERROR: Failed to source {{ .Values.gitea.extraEnvSourceFile }}'; exit 1; } && {{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
+  {{- else }}
+  command:
+  - "{{ .Values.initContainersScriptsVolumeMountPath }}/configure_gitea.sh"
+  {{- end }}
+  imagePullPolicy: {{ $config.image.pullPolicy }}
+  {{- with (include "gitea.commandInitContainerSecurityContext" (list . (deepCopy ($config.securityContext | default .Values.deployment.gitea.securityContext))) | trim) }}
+  securityContext:
+    {{- . | nindent 4 }}
+  {{- end }}
+  env:
+    - name: GITEA_APP_INI
+      value: /data/gitea/conf/app.ini
+    - name: GITEA_CUSTOM
+      value: /data/gitea
+    - name: GITEA_WORK_DIR
+      value: /data
+    - name: GITEA_TEMP
+      value: /tmp/gitea
+    {{- if $config.image.rootless }}
+    - name: HOME
+      value: /data/gitea/git
+    {{- end }}
+    {{- if .Values.gitea.ldap }}
+    {{- range $idx, $value := .Values.gitea.ldap }}
+    {{- if $value.existingSecret }}
+    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
+      valueFrom:
+        secretKeyRef:
+          key:  bindDn
+          name: {{ $value.existingSecret }}
+    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
+      valueFrom:
+        secretKeyRef:
+          key:  bindPassword
+          name: {{ $value.existingSecret }}
+    {{- else }}
+    - name: GITEA_LDAP_BIND_DN_{{ $idx }}
+      value: {{ $value.bindDn | quote }}
+    - name: GITEA_LDAP_PASSWORD_{{ $idx }}
+      value: {{ $value.bindPassword | quote }}
+    {{- end }}
+    {{- end }}
+    {{- end }}
+    {{- if .Values.gitea.oauth }}
+    {{- range $idx, $value := .Values.gitea.oauth }}
+    {{- if $value.existingSecret }}
+    - name: GITEA_OAUTH_KEY_{{ $idx }}
+      valueFrom:
+        secretKeyRef:
+          key:  key
+          name: {{ $value.existingSecret }}
+    - name: GITEA_OAUTH_SECRET_{{ $idx }}
+      valueFrom:
+        secretKeyRef:
+          key:  secret
+          name: {{ $value.existingSecret }}
+    {{- end }}
+    {{- end }}
+    {{- end }}
+    {{- if .Values.secrets.admin.enabled }}
+    - name: GITEA_ADMIN_USERNAME
+      valueFrom:
+        secretKeyRef:
+          key: {{ include "gitea.secret.admin.usernameKey" . }}
+          name: {{ include "gitea.secret.admin.name" . }}
+    - name: GITEA_ADMIN_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          key: {{ include "gitea.secret.admin.passwordKey" . }}
+          name: {{ include "gitea.secret.admin.name" . }}
+    - name: GITEA_ADMIN_EMAIL
+      valueFrom:
+        secretKeyRef:
+          key: {{ include "gitea.secret.admin.emailKey" . }}
+          name: {{ include "gitea.secret.admin.name" . }}
+    - name: GITEA_ADMIN_PASSWORD_MODE
+      value: {{ include "gitea.secret.admin.passwordMode" $ }}
+    {{- end }}
+    {{- if .Values.deployment.gitea.env }}
+    {{- toYaml .Values.deployment.gitea.env | nindent 4 }}
+    {{- end }}
+    {{- with $config.env }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with $config.envFrom }}
+  envFrom:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  volumeMounts:
+    - name: init
+      mountPath: {{ .Values.initContainersScriptsVolumeMountPath }}
+    - name: temp
+      mountPath: /tmp
+    - name: data
+      mountPath: /data
+      {{- if .Values.persistence.new.subPath }}
+      subPath: {{ .Values.persistence.new.subPath }}
+      {{- end }}
+    {{- include "gitea.init-additional-mounts" . | nindent 4 }}
+    {{- with $config.volumeMounts }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  resources:
+    {{- toYaml ($config.resources | default .Values.initContainers.resources) | nindent 4 }}
+{{- end }}

templates/gitea/_persistentVolumeClaims.tpl

@@ -0,0 +1,38 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.persistentVolumeClaim.annotations" -}}
+{{- with .Values.persistence.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.persistentVolumeClaim.enabled" -}}
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingPersistentVolumeClaim.enabled) -}}
+true
+{{- else -}}
+false
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.persistentVolumeClaim.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.persistence.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* name */}}
+
+{{- define "gitea.persistentVolumeClaim.name" -}}
+{{- if .Values.persistence.existingPersistentVolumeClaim.enabled -}}
+{{ required "persistence.existingPersistentVolumeClaim.persistentVolumeClaimName is required when persistence.existingPersistentVolumeClaim.enabled is true" .Values.persistence.existingPersistentVolumeClaim.persistentVolumeClaimName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}
+{{- end }}
+{{- end }}

templates/gitea/_pods.tpl

@@ -0,0 +1,52 @@
+---
+
+{{/* annotations */}}
+
+{{- define "gitea.pod.annotations" -}}
+
+{{/* secret - admin */}}
+{{- if and .Values.secrets.admin.enabled .Values.secrets.admin.addSHASumAnnotation }}
+checksum/admin: {{ include "gitea.secret.checksum" (list . "admin") }}
+{{- end }}
+
+{{/* secret - config */}}
+{{- if and .Values.secrets.config.enabled .Values.secrets.config.addSHASumAnnotation }}
+checksum/config: {{ include "gitea.secret.checksum" (list . "config") }}
+{{- end }}
+
+{{/* secret - gpg */}}
+{{- if and .Values.secrets.gpg.enabled .Values.secrets.gpg.addSHASumAnnotation }}
+checksum/gpg: {{ include "gitea.secret.checksum" (list . "gpg") }}
+{{- end }}
+
+{{/* secret - init */}}
+{{- if and .Values.secrets.init.enabled .Values.secrets.init.addSHASumAnnotation }}
+checksum/init: {{ include "gitea.secret.checksum" (list . "init") }}
+{{- end }}
+
+{{/* secret - inlineConfig */}}
+{{- if and .Values.secrets.inlineConfig.enabled .Values.secrets.inlineConfig.addSHASumAnnotation }}
+checksum/inlineConfig: {{ include "gitea.secret.checksum" (list . "inlineConfig") }}
+{{- end }}
+
+{{/* secret - metrics */}}
+{{- if and .Values.secrets.metrics.enabled .Values.secrets.metrics.addSHASumAnnotation }}
+checksum/metrics: {{ include "gitea.secret.checksum" (list . "metrics") }}
+{{- end }}
+
+{{/* secret - ldap */}}
+{{- range $idx, $value := .Values.gitea.ldap }}
+checksum/ldap_{{ $idx }}: {{ include "gitea.ldap_settings" (list $idx $value) | sha256sum }}
+{{- end }}
+
+{{/* secret - oauth */}}
+{{- range $idx, $value := .Values.gitea.oauth }}
+checksum/oauth_{{ $idx }}: {{ include "gitea.oauth_settings" (list $idx $value) | sha256sum }}
+{{- end }}
+
+{{/* custom pod annotations */}}
+{{- with .Values.gitea.podAnnotations }}
+{{ toYaml . }}
+{{- end }}
+
+{{- end }}

templates/gitea/_secrets.tpl

@@ -0,0 +1,206 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.secret.admin.annotations" -}}
+{{- with .Values.secrets.admin.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.config.annotations" -}}
+{{- with .Values.secrets.config.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.gpg.annotations" -}}
+{{- with .Values.secrets.gpg.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.init.annotations" -}}
+{{- with .Values.secrets.init.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.inlineConfig.annotations" -}}
+{{- with .Values.secrets.inlineConfig.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.metrics.annotations" -}}
+{{- with .Values.secrets.metrics.new.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* checksums */}}
+
+{{/*
+SHA sum of a Secret, used to trigger a rollout whenever its content changes.
+User-provided Secrets are looked up in the cluster, chart-managed ones are rendered, because the
+cluster still holds their pre-upgrade state.
+Arguments: (list $root $key)
+*/}}
+{{- define "gitea.secret.checksum" -}}
+{{- $root := index . 0 -}}
+{{- $key := index . 1 -}}
+{{- if (index $root.Values.secrets $key).existingSecret.enabled -}}
+{{- $namespace := $root.Values.namespace | default $root.Release.Namespace -}}
+{{- $name := include (printf "gitea.secret.%s.name" $key) $root -}}
+{{- lookup "v1" "Secret" $namespace $name | toYaml | sha256sum -}}
+{{- else -}}
+{{- include (printf "%s/gitea/secret_%s.yaml" $root.Template.BasePath $key) $root | sha256sum -}}
+{{- end -}}
+{{- end }}
+
+
+{{/* labels */}}
+
+{{- define "gitea.secret.admin.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.admin.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.config.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.config.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.gpg.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.gpg.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.init.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.init.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.inlineConfig.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.inlineConfig.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "gitea.secret.metrics.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.secrets.metrics.new.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/* names */}}
+
+{{- define "gitea.secret.admin.name" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ required "`secrets.admin.existingSecret.secretName` must be set when `secrets.admin.existingSecret.enabled` is enabled" .Values.secrets.admin.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-admin
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.config.name" -}}
+{{- if .Values.secrets.config.existingSecret.enabled -}}
+{{ required "`secrets.config.existingSecret.secretName` must be set when `secrets.config.existingSecret.enabled` is enabled" .Values.secrets.config.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-config
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.gpg.name" -}}
+{{- if .Values.secrets.gpg.existingSecret.enabled -}}
+{{ required "`secrets.gpg.existingSecret.secretName` must be set when `secrets.gpg.existingSecret.enabled` is enabled" .Values.secrets.gpg.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-gpg-key
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.init.name" -}}
+{{- if .Values.secrets.init.existingSecret.enabled -}}
+{{ required "`secrets.init.existingSecret.secretName` must be set when `secrets.init.existingSecret.enabled` is enabled" .Values.secrets.init.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-init
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.inlineConfig.name" -}}
+{{- if .Values.secrets.inlineConfig.existingSecret.enabled -}}
+{{ required "`secrets.inlineConfig.existingSecret.secretName` must be set when `secrets.inlineConfig.existingSecret.enabled` is enabled" .Values.secrets.inlineConfig.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-inline-config
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.metrics.name" -}}
+{{- if .Values.secrets.metrics.existingSecret.enabled -}}
+{{ required "`secrets.metrics.existingSecret.secretName` must be set when `secrets.metrics.existingSecret.enabled` is enabled" .Values.secrets.metrics.existingSecret.secretName }}
+{{- else -}}
+{{ include "gitea.fullname" . }}-metrics
+{{- end -}}
+{{- end }}
+
+{{/* keys */}}
+
+{{- define "gitea.secret.admin.emailKey" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ .Values.secrets.admin.existingSecret.emailKey }}
+{{- else -}}
+email
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.admin.passwordKey" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ .Values.secrets.admin.existingSecret.passwordKey }}
+{{- else -}}
+password
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.admin.usernameKey" -}}
+{{- if .Values.secrets.admin.existingSecret.enabled -}}
+{{ .Values.secrets.admin.existingSecret.usernameKey }}
+{{- else -}}
+username
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.gpg.gpgHomeKey" -}}
+{{- if .Values.secrets.gpg.existingSecret.enabled -}}
+{{ .Values.secrets.gpg.existingSecret.gpgHomeKey }}
+{{- else -}}
+gpgHome
+{{- end -}}
+{{- end }}
+
+{{- define "gitea.secret.gpg.privateKeyKey" -}}
+{{- if .Values.secrets.gpg.existingSecret.enabled -}}
+{{ .Values.secrets.gpg.existingSecret.privateKeyKey }}
+{{- else -}}
+privateKey
+{{- end -}}
+{{- end }}
+
+{{/* misc */}}
+
+{{- define "gitea.secret.admin.passwordMode" -}}
+{{- if has .Values.secrets.admin.passwordMode (tuple "keepUpdated" "initialOnlyNoReset" "initialOnlyRequireReset") -}}
+{{ .Values.secrets.admin.passwordMode }}
+{{- else -}}
+{{ printf "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: '%s'" .Values.secrets.admin.passwordMode | fail }}
+{{- end -}}
+{{- end }}

templates/gitea/_services.tpl

@@ -0,0 +1,11 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* names */}}
+
+{{- define "gitea.service.http.name" -}}
+{{ include "gitea.fullname" . }}-http
+{{- end }}
+
+{{- define "gitea.service.ssh.name" -}}
+{{ include "gitea.fullname" . }}-ssh
+{{- end }}

templates/gitea/_tcpRoutes.tpl

@@ -0,0 +1,30 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "gitea.tcpRoute.annotations" -}}
+{{- with .Values.gatewayAPI.core.tcpRoute.annotations }}
+{{- toYaml . -}}
+{{- end }}
+{{- end }}
+
+{{/* enabled */}}
+
+{{- define "gitea.tcpRoute.enabled" -}}
+{{- if and .Values.gatewayAPI.enabled
+           .Values.gatewayAPI.core.tcpRoute.enabled
+-}}
+true
+{{- else -}}
+false
+{{- end -}}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "gitea.tcpRoute.labels" -}}
+{{ include "gitea.labels" . }}
+{{- with .Values.gatewayAPI.core.tcpRoute.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}

templates/gitea/backendTLSPolicy.yaml

@@ -0,0 +1,30 @@
+{{- if eq (include "gitea.backendTLSPolicy.enabled" .) "true" -}}
+{{- if not (keys .Values.gatewayAPI.core.backendTLSPolicy.validation) }}
+{{- fail "gatewayAPI.core.backendTLSPolicy.validation is required" }}
+{{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  {{- with (include "gitea.backendTLSPolicy.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.backendTLSPolicy.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  targetRefs:
+    {{- if .Values.gatewayAPI.core.backendTLSPolicy.targetRefs }}
+    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.targetRefs | nindent 4 }}
+    {{- else }}
+    - group: ""
+      kind: Service
+      name: {{ include "gitea.service.http.name" . }}
+    {{- end }}
+  validation:
+    {{- toYaml .Values.gatewayAPI.core.backendTLSPolicy.validation | nindent 4 }}
+{{- end }}

templates/gitea/clientSettingsPolicy.yaml

@@ -0,0 +1,30 @@
+{{- if eq (include "gitea.clientSettingsPolicies.enabled" .) "true" -}}
+{{- if not (keys .Values.gatewayAPI.nginx.clientSettingsPolicies.body) }}
+{{- fail "gatewayAPI.nginx.clientSettingsPolicies.body is required" }}
+{{- end }}
+---
+apiVersion: gateway.nginx.org/v1alpha1
+kind: ClientSettingsPolicy
+metadata:
+  {{- with (include "gitea.clientSettingsPolicies.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.clientSettingsPolicies.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  targetRef:
+    {{- if .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef }}
+    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.targetRef | nindent 4 }}
+    {{- else }}
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: {{ include "gitea.fullname" . }}
+    {{- end }}
+  body:
+    {{- toYaml .Values.gatewayAPI.nginx.clientSettingsPolicies.body | nindent 4 }}
+{{- end }}

templates/gitea/deployment.yaml

@@ -0,0 +1,221 @@
+{{- if .Values.deployment.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  {{- with (include "gitea.deployment.annotations" . | fromYaml) }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.deployment.labels" . | fromYaml) }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  replicas: {{ .Values.deployment.replicas }}
+  strategy:
+    type: {{ .Values.deployment.strategy.type }}
+    {{- if eq .Values.deployment.strategy.type "RollingUpdate" }}
+    rollingUpdate:
+      maxUnavailable: {{ .Values.deployment.strategy.rollingUpdate.maxUnavailable }}
+      maxSurge: {{ .Values.deployment.strategy.rollingUpdate.maxSurge }}
+    {{- end }}
+  selector:
+    matchLabels:
+      {{- include "gitea.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with (include "gitea.pod.annotations" . | fromYaml) }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "gitea.labels" . | nindent 8 }}
+        {{- if .Values.deployment.labels }}
+        {{- toYaml .Values.deployment.labels | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- $hostUsers := include "gitea.hostUsers" . | trim }}
+      {{- $securityContext := include "gitea.deployment.securityContext" . | trim }}
+      {{- $containerSecurityContext := include "gitea.containerSecurityContext" (list . (deepCopy .Values.deployment.gitea.securityContext)) | trim }}
+      {{- if .Values.deployment.schedulerName }}
+      schedulerName: "{{ .Values.deployment.schedulerName }}"
+      {{- end }}
+      {{- if (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
+      serviceAccountName: {{ include "gitea.serviceAccountName" . }}
+      {{- end }}
+      {{- if .Values.deployment.priorityClassName }}
+      priorityClassName: "{{ .Values.deployment.priorityClassName }}"
+      {{- end }}
+      {{- if $hostUsers }}
+      hostUsers: {{ $hostUsers }}
+      {{- end }}
+      {{- include "gitea.images.pullSecrets" . | nindent 6 }}
+      {{- if $securityContext }}
+      securityContext:
+        {{- $securityContext | nindent 8 }}
+      {{- end }}
+      initContainers:
+        {{- include "gitea.deployment.initContainers" . | trim | nindent 8 }}
+      terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ include "gitea.image" . }}"
+          imagePullPolicy: {{ .Values.deployment.gitea.image.pullPolicy }}
+          env:
+            # SSH Port values have to be set here as well for openssh configuration
+            - name: SSH_LISTEN_PORT
+              value: {{ .Values.gitea.config.server.SSH_LISTEN_PORT | quote }}
+            - name: SSH_PORT
+              value: {{ .Values.gitea.config.server.SSH_PORT | quote }}
+            {{- if not .Values.deployment.gitea.image.rootless }}
+            - name: SSH_LOG_LEVEL
+              value: {{ .Values.gitea.ssh.logLevel | quote }}
+            {{- end }}
+            - name: GITEA_APP_INI
+              value: /data/gitea/conf/app.ini
+            - name: GITEA_CUSTOM
+              value: /data/gitea
+            - name: GITEA_WORK_DIR
+              value: /data
+            - name: GITEA_TEMP
+              value: /tmp/gitea
+            {{- with .Values.deployment.gitea.resources }}
+            {{- if and (hasKey . "limits") (hasKey (.limits | default dict) "cpu") }}
+            - name: GOMAXPROCS
+              valueFrom:
+                resourceFieldRef:
+                  divisor: "1"
+                  resource: limits.cpu
+            {{- end }}
+            {{- end }}
+            - name: TMPDIR
+              value: /tmp/gitea
+            {{- if .Values.deployment.gitea.image.rootless }}
+            - name: HOME
+              value: /data/gitea/git
+            {{- end }}
+            {{- if .Values.secrets.gpg.enabled }}
+            - name: GNUPGHOME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "gitea.secret.gpg.name" . }}
+                  key: {{ include "gitea.secret.gpg.gpgHomeKey" . }}
+            {{- end }}
+            {{- if .Values.deployment.gitea.env }}
+            {{- toYaml .Values.deployment.gitea.env | nindent 12 }}
+            {{- end }}
+          {{- with .Values.deployment.gitea.envFrom }}
+          envFrom:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: ssh
+              containerPort: {{ .Values.gitea.config.server.SSH_LISTEN_PORT }}
+            {{- if .Values.service.ssh.hostPort }}
+              hostPort: {{ .Values.service.ssh.hostPort }}
+            {{- end }}
+            - name: http
+              containerPort: {{ .Values.gitea.config.server.HTTP_PORT }}
+            {{- if .Values.gitea.config.server.ENABLE_PPROF }}
+            - name: profiler
+              containerPort: 6060
+            {{- end }}
+          {{- if .Values.gitea.livenessProbe.enabled }}
+          livenessProbe:
+            {{- include "gitea.deployment.probe" .Values.gitea.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.gitea.readinessProbe.enabled }}
+          readinessProbe:
+            {{- include "gitea.deployment.probe" .Values.gitea.readinessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.gitea.startupProbe.enabled }}
+          startupProbe:
+            {{- include "gitea.deployment.probe" .Values.gitea.startupProbe | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml (.Values.deployment.gitea.resources | default dict) | nindent 12 }}
+          {{- if $containerSecurityContext }}
+          securityContext:
+            {{- $containerSecurityContext | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+              {{- if .Values.persistence.new.subPath }}
+              subPath: {{ .Values.persistence.new.subPath }}
+              {{- end }}
+            {{- include "gitea.container-additional-mounts" . | nindent 12 }}
+        {{- if .Values.extraContainers }}
+        {{- toYaml .Values.extraContainers | nindent 8 }}
+        {{- end }}
+      {{- with .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.deployment.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- with .Values.deployment.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.deployment.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.deployment.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- if .Values.deployment.dnsConfig }}
+      dnsConfig:
+        {{- toYaml .Values.deployment.dnsConfig | nindent 8 }}
+    {{- end }}
+    {{- with .Values.deployment.resources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+      volumes:
+        - name: init
+          secret:
+            secretName: {{ include "gitea.secret.init.name" . }}
+            defaultMode: 110
+        - name: config
+          secret:
+            secretName: {{ include "gitea.secret.config.name" . }}
+            defaultMode: 110
+        {{- if gt (len .Values.deployment.volumes) 0 }}
+        {{- toYaml .Values.deployment.volumes | nindent 8 }}
+        {{- end }}
+        - name: inline-config-sources
+          secret:
+            secretName: {{ include "gitea.secret.inlineConfig.name" . }}
+        {{- range $idx, $value := .Values.gitea.additionalConfigSources }}
+        - name: additional-config-sources-{{ $idx }}
+          {{- toYaml $value | nindent 10 }}
+        {{- end }}
+        - name: temp
+          emptyDir: {}
+        {{- if .Values.secrets.gpg.enabled }}
+        - name: gpg-private-key
+          secret:
+            secretName: {{ include "gitea.secret.gpg.name" . }}
+            items:
+              - key: {{ include "gitea.secret.gpg.privateKeyKey" . }}
+                path: private.asc
+            defaultMode: 0100
+        {{- end }}
+  {{- if .Values.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "gitea.persistentVolumeClaim.name" . }}
+  {{- else }}
+        - name: data
+          emptyDir: {}
+  {{- end }}
+{{- end }}

templates/gitea/deprecation.yaml

@@ -0,0 +1,137 @@
+{{- if .Values.checkDeprecation -}}
+  {{/* CUSTOM PROBES */}}
+  {{- if .Values.gitea.customLivenessProbe -}}
+    {{- fail "`gitea.customLivenessProbe` does no longer exist. Please refer to the changelog and configure `gitea.livenessProbe` instead." -}}
+  {{- end -}}
+  {{- if .Values.gitea.customReadinessProbe -}}
+    {{- fail "`gitea.customReadinessProbe` does no longer exist. Please refer to the changelog and configure `gitea.readinessProbe` instead." -}}
+  {{- end -}}
+  {{- if .Values.gitea.customStartupProbe -}}
+    {{- fail "`gitea.customStartupProbe` does no longer exist. Please refer to the changelog and configure `gitea.startupProbe` instead." -}}
+  {{- end -}}
+
+  {{/* LDAP SOURCES */}}
+  {{- if kindIs "map" .Values.gitea.ldap -}}
+    {{- fail "You can configure multiple LDAP sources. Please refer to the changelog and switch `gitea.ldap` from object to array notation." -}}
+  {{- end -}}
+
+  {{/* OAUTH SOURCES */}}
+  {{- if kindIs "map" .Values.gitea.oauth -}}
+    {{- fail "You can configure multiple OAuth sources. Please refer to the changelog and switch `gitea.oauth` from object to array notation." -}}
+  {{- end -}}
+
+  {{/* BUILTIN */}}
+  {{- if .Values.gitea.cache -}}
+    {{- if .Values.gitea.cache.builtIn -}}
+      {{- fail "`gitea.cache.builtIn` does no longer exist. Please use `memcached` at root level instead." -}}
+    {{- end -}}
+  {{- end -}}
+  {{- if .Values.gitea.database -}}
+    {{- if .Values.gitea.database.builtIn -}}
+      {{- fail "`gitea.database.builtIn` does no longer exist. Builtin databases can be configured inside the dependencies itself. Please refer to the changelog." -}}
+    {{- end -}}
+  {{- end -}}
+  {{- if .Values.gitea.admin -}}
+    {{- fail "`gitea.admin` does no longer exist. Please refer to the changelog and configure `secrets.admin` instead." -}}
+  {{- end -}}
+
+  {{/* SIGNING */}}
+  {{- if .Values.signing -}}
+    {{- fail "`signing` does no longer exist. Please refer to the changelog and configure `secrets.gpg` instead." -}}
+  {{- end -}}
+
+  {{/* AFFINITY */}}
+  {{- if .Values.affinity -}}
+    {{- fail "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead." -}}
+  {{- end -}}
+
+  {{/* CONTAINER SECURITY CONTEXT */}}
+  {{- if .Values.containerSecurityContext -}}
+    {{- fail "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead." -}}
+  {{- end -}}
+
+  {{/* DEPLOYMENT ENV */}}
+  {{- if .Values.deployment.env -}}
+    {{- fail "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead." -}}
+  {{- end -}}
+
+  {{/* DNS CONFIG */}}
+  {{- if .Values.dnsConfig -}}
+    {{- fail "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead." -}}
+  {{- end -}}
+
+  {{/* EXTRA CONTAINER VOLUME MOUNTS */}}
+  {{- if .Values.extraContainerVolumeMounts -}}
+    {{- fail "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead." -}}
+  {{- end -}}
+
+  {{/* EXTRA VOLUMES */}}
+  {{- if .Values.extraVolumes -}}
+    {{- fail "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead." -}}
+  {{- end -}}
+
+  {{/* NODE SELECTOR */}}
+  {{- if .Values.nodeSelector -}}
+    {{- fail "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead." -}}
+  {{- end -}}
+
+  {{/* OPENSHIFT HOST USERS */}}
+  {{- if hasKey .Values.openshift "hostUsers" -}}
+    {{- fail "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead." -}}
+  {{- end -}}
+
+  {{/* PRIORITY CLASS NAME */}}
+  {{- if .Values.priorityClassName -}}
+    {{- fail "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead." -}}
+  {{- end -}}
+
+  {{/* POD SECURITY CONTEXT */}}
+  {{- if .Values.podSecurityContext -}}
+    {{- fail "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead." -}}
+  {{- end -}}
+
+  {{/* POST EXTRA INIT CONTAINERS */}}
+  {{- if .Values.postExtraInitContainers -}}
+    {{- fail "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead." -}}
+  {{- end -}}
+
+  {{/* PRE EXTRA INIT CONTAINERS */}}
+  {{- if .Values.preExtraInitContainers -}}
+    {{- fail "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead." -}}
+  {{- end -}}
+
+  {{/* RESOURCES */}}
+  {{- if .Values.resources -}}
+    {{- fail "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead." -}}
+  {{- end -}}
+
+  {{/* REPLICA COUNT */}}
+  {{- if .Values.replicaCount -}}
+    {{- fail "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead." -}}
+  {{- end -}}
+
+  {{/* SCHEDULER NAME */}}
+  {{- if .Values.schedulerName -}}
+    {{- fail "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead." -}}
+  {{- end -}}
+
+  {{/* SECURITY CONTEXT */}}
+  {{- if .Values.securityContext -}}
+    {{- fail "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead." -}}
+  {{- end -}}
+
+  {{/* STRATEGY */}}
+  {{- if .Values.strategy -}}
+    {{- fail "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead." -}}
+  {{- end -}}
+
+  {{/* TOLERATIONS */}}
+  {{- if .Values.tolerations -}}
+    {{- fail "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead." -}}
+  {{- end -}}
+
+  {{/* TOPOLOGY SPREAD CONSTRAINTS */}}
+  {{- if .Values.topologySpreadConstraints -}}
+    {{- fail "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead." -}}
+  {{- end -}}
+{{- end -}}

templates/gitea/extra-list.yaml

@@ -1,8 +1,8 @@
 {{- range .Values.extraDeploy }}
 ---
 {{- if typeIs "string" . }}
-    {{- tpl . $ }}
+    {{ tpl . $ }}
 {{- else }}
-    {{- tpl (. | toYaml) $ }}
+    {{ tpl (. | toYaml) $ }}
 {{- end }}
 {{- end }}

templates/gitea/httpRoute.yaml

@@ -0,0 +1,42 @@
+{{- if eq (include "gitea.httpRoute.enabled" .) "true" -}}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  {{- with (include "gitea.httpRoute.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.httpRoute.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  parentRefs:
+    {{- if .Values.gatewayAPI.core.httpRoute.parentRefs }}
+    {{- toYaml .Values.gatewayAPI.core.httpRoute.parentRefs | nindent 4 }}
+    {{- else }}
+    {{- fail "gatewayAPI.core.httpRoute.parentRefs is required" }}
+    {{- end }}
+  {{- with .Values.gatewayAPI.core.httpRoute.hostnames }}
+  hostnames:
+    {{- tpl (toYaml .) $ | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- if .Values.gatewayAPI.core.httpRoute.rules }}
+    {{- tpl (toYaml .Values.gatewayAPI.core.httpRoute.rules) $ | nindent 4 }}
+    {{- else }}
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: {{ include "gitea.service.http.name" . }}
+          port: {{ .Values.service.http.port }}
+          weight: 1
+    {{- end }}
+{{- end }}

templates/gitea/ingress.yaml

@@ -1,29 +1,20 @@
-{{- if .Values.ingress.enabled -}}
-{{- $fullName := include "gitea.fullname" . -}}
-{{- $httpPort := .Values.service.http.port -}}
+{{- if eq (include "gitea.ingress.enabled" .) "true" -}}
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ $fullName }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
+  {{- with (include "gitea.ingress.annotations" .) }}
   annotations:
-    {{- range $key, $value := .Values.ingress.annotations }}
-      {{ $key }}: {{ $value | quote }}
-    {{- end }}
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.ingress.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.ingress.name" . }}
+  namespace: {{ .Release.Namespace }}
 spec:
   ingressClassName: {{ tpl .Values.ingress.className . }}
-{{- if .Values.ingress.tls }}
-  tls:
-  {{- range .Values.ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ tpl . $ | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-  {{- end }}
-{{- end }}
   rules:
     {{- range .Values.ingress.hosts }}
     - host: {{ tpl .host $ | quote }}
@@ -36,17 +27,17 @@ spec:
             pathType: {{ default "Prefix" $.Values.ingress.pathType }}
             backend:
               service:
-                name: {{ $fullName }}-http
+                name: {{ include "gitea.service.http.name" $ }}
                 port:
-                  number: {{ $httpPort }}
+                  number: {{ $.Values.service.http.port }}
           {{- else }}
           - path: {{ .path | default "/" }}
             pathType: {{ .pathType | default "Prefix" }}
             backend:
               service:
-                name: {{ $fullName }}-http
+                name: {{ include "gitea.service.http.name" $ }}
                 port:
-                  number: {{ $httpPort }}
+                  number: {{ $.Values.service.http.port }}
           {{- end }}
           {{- end }}
           {{- else }}
@@ -54,9 +45,19 @@ spec:
             pathType: "Prefix"
             backend:
               service:
-                name: {{ $fullName }}-http
+                name: {{ include "gitea.service.http.name" $ }}
                 port:
-                  number: {{ $httpPort }}
+                  number: {{ $.Values.service.http.port }}
           {{- end }}
     {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ tpl . $ | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
 {{- end }}

templates/gitea/persistentVolumeClaim.yaml

@@ -0,0 +1,33 @@
+{{- if eq (include "gitea.persistentVolumeClaim.enabled" .) "true" }}
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  {{- with (include "gitea.persistentVolumeClaim.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.persistentVolumeClaim.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.persistentVolumeClaim.name" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  accessModes:
+  {{- if gt (.Values.deployment.replicas | int) 1 }}
+      - ReadWriteMany
+  {{- else }}
+    {{- .Values.persistence.new.accessModes | toYaml | nindent 4 }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.new.size }}
+  {{- with .Values.persistence.new.storageClassName }}
+  storageClassName: {{ . }}
+  {{- end }}
+  volumeMode: Filesystem
+  {{- with .Values.persistence.new.persistentVolumeName }}
+  volumeName: {{ . }}
+  {{- end }}
+{{- end }}

templates/gitea/route.yaml

@@ -0,0 +1,52 @@
+{{- if .Values.route.enabled -}}
+{{- $fullName := include "gitea.fullname" . -}}
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "gitea.labels" . | nindent 4 }}
+  {{- with .Values.route.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.route.host }}
+  host: {{ tpl .Values.route.host . | quote }}
+  {{- end }}
+  {{- if .Values.route.path }}
+  path: {{ tpl .Values.route.path . | quote }}
+  {{- end }}
+  to:
+    kind: Service
+    name: {{ include "gitea.service.http.name" . }}
+  port:
+    targetPort: http
+  wildcardPolicy: {{ .Values.route.wildcardPolicy }}
+  {{- with .Values.route.tls }}
+  {{- if .termination }}
+  tls:
+    termination: {{ .termination }}
+    {{- if .insecureEdgeTerminationPolicy }}
+    insecureEdgeTerminationPolicy: {{ .insecureEdgeTerminationPolicy }}
+    {{- end }}
+    {{- if .key }}
+    key: |
+      {{- .key | nindent 6 }}
+    {{- end }}
+    {{- if .certificate }}
+    certificate: |
+      {{- .certificate | nindent 6 }}
+    {{- end }}
+    {{- if .caCertificate }}
+    caCertificate: |
+      {{- .caCertificate | nindent 6 }}
+    {{- end }}
+    {{- if .destinationCACertificate }}
+    destinationCACertificate: |
+      {{- .destinationCACertificate | nindent 6 }}
+    {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end }}

templates/gitea/secret_admin.yaml

@@ -0,0 +1,21 @@
+{{- if and (.Values.secrets.admin.enabled) (not .Values.secrets.admin.existingSecret.enabled) -}}
+{{- if or (empty .Values.secrets.admin.new.username) (empty .Values.secrets.admin.new.password) -}}
+  {{- fail "Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`" -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.admin.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.admin.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.admin.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: Opaque
+data:
+  email: {{ .Values.secrets.admin.new.email | b64enc }}
+  password: {{ .Values.secrets.admin.new.password | b64enc }}
+  username: {{ .Values.secrets.admin.new.username | b64enc }}
+{{- end }}

templates/gitea/secret_config.yaml

@@ -0,0 +1,59 @@
+{{- /* Evaluated outside of the Secret so the guards also run with an existing Secret. */ -}}
+{{- $assertions := include "gitea.config.assertions" . -}}
+{{- if not .Values.secrets.config.existingSecret.enabled -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.config.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.config.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.config.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: Opaque
+stringData:
+{{ (.Files.Glob "scripts/init-containers/config/*.sh").AsConfig | indent 2 }}
+  assertions: |
+    {{- $assertions | nindent 4 }}
+{{- end }}
+
+{{- define "gitea.config.assertions" -}}
+
+  {{- /*assert that only one PG dep is enabled */ -}}
+  {{- if and (.Values.postgresql.enabled) (index .Values "postgresql-ha" "enabled") -}}
+    {{- fail "Only one of postgresql or postgresql-ha can be enabled at the same time." -}}
+  {{- end }}
+
+  {{- /* multiple replicas assertions */ -}}
+  {{- if gt (.Values.deployment.replicas | int) 1 -}}
+    {{- if .Values.gitea.config.cron -}}
+      {{- if .Values.gitea.config.cron.GIT_GC_REPOS -}}
+        {{- if eq .Values.gitea.config.cron.GIT_GC_REPOS.ENABLED true -}}
+          {{ fail "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'." }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+
+    {{- if eq (first .Values.persistence.new.accessModes) "ReadWriteOnce" -}}
+      {{- fail "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany." -}}
+    {{- end }}
+    {{- if .Values.gitea.config.indexer -}}
+      {{- if eq .Values.gitea.config.indexer.ISSUE_INDEXER_TYPE "bleve" -}}
+        {{- fail "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)." -}}
+      {{- end }}
+      {{- if .Values.gitea.config.indexer.REPO_INDEXER_TYPE -}}
+        {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_TYPE "bleve" -}}
+          {{- if .Values.gitea.config.indexer.REPO_INDEXER_ENABLED -}}
+            {{- if eq .Values.gitea.config.indexer.REPO_INDEXER_ENABLED true -}}
+              {{- fail "When using multiple replicas, the repo indexer (gitea.config.indexer.REPO_INDEXER_TYPE) must be set to 'meilisearch' or 'elasticsearch' or disabled." -}}
+            {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
+
+  {{- end }}
+{{- end }}

templates/gitea/secret_gpg.yaml

@@ -0,0 +1,20 @@
+{{- if and (.Values.secrets.gpg.enabled) (not .Values.secrets.gpg.existingSecret.enabled) -}}
+{{- if empty .Values.secrets.gpg.new.privateKey -}}
+  {{- fail "Either specify `secrets.gpg.new.privateKey` or reference an existing Secret via `secrets.gpg.existingSecret`" -}}
+{{- end }}
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.gpg.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.gpg.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.gpg.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: Opaque
+data:
+  gpgHome: {{ .Values.secrets.gpg.new.gpgHome | b64enc }}
+  privateKey: {{ .Values.secrets.gpg.new.privateKey | b64enc }}
+{{- end }}

templates/gitea/secret_init.yaml

@@ -1,10 +1,15 @@
+{{- if not .Values.secrets.init.existingSecret.enabled -}}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "gitea.fullname" . }}-init
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  {{- with (include "gitea.secret.init.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   labels:
-    {{- include "gitea.labels" . | nindent 4 }}
+    {{- include "gitea.secret.init.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.init.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 type: Opaque
 stringData:
 {{ (.Files.Glob "scripts/init-containers/init/*.sh").AsConfig | indent 2 }}
@@ -21,7 +26,7 @@ stringData:
     # END: initPreScript
     {{- end }}
 
-    {{- if not .Values.image.rootless }}
+    {{- if not .Values.deployment.gitea.image.rootless }}
     chown -v 1000:1000 /data
     {{- end }}
     mkdir -pv /data/git/.ssh
@@ -30,12 +35,12 @@ stringData:
 
     # prepare temp directory structure
     mkdir -pv "${GITEA_TEMP}"
-    {{- if not .Values.image.rootless }}
+    {{- if not .Values.deployment.gitea.image.rootless }}
     chown -v 1000:1000 "${GITEA_TEMP}"
     {{- end }}
     chmod -v ug+rwx "${GITEA_TEMP}"
 
-    {{ if .Values.signing.enabled -}}
+    {{ if .Values.secrets.gpg.enabled -}}
     if [ ! -d "${GNUPGHOME}" ]; then
       mkdir -pv "${GNUPGHOME}"
       chmod -v 700 "${GNUPGHOME}"
@@ -61,10 +66,10 @@ stringData:
     function test_valkey_connection() {
       local RETRY=0
       local MAX=30
-      
+
       echo 'Wait for valkey to become avialable...'
       until [ "${RETRY}" -ge "${MAX}" ]; do
-        nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
+        RES_OPTIONS="ndots:0" nc -vz -w2 {{ include "valkey.servicename" . }} {{ include "valkey.port" . }} && break
         RETRY=$[${RETRY}+1]
         echo "...not ready yet (${RETRY}/${MAX})"
       done
@@ -77,9 +82,9 @@ stringData:
 
     test_valkey_connection
     {{- end }}
-    
 
-    {{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
+
+    {{- if .Values.secrets.admin.enabled }}
     function configure_admin_user() {
       local full_admin_list=$(gitea admin user list --admin)
       local actual_user_table=''
@@ -105,7 +110,7 @@ stringData:
       local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
       if [[ -z "${ACCOUNT_ID}" ]]; then
         local -a create_args
-        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }})
+        create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "${GITEA_ADMIN_EMAIL}")
         if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
           create_args+=(--must-change-password=true)
         else
@@ -123,7 +128,7 @@ stringData:
           #   should add it to prevent requiring frequent admin password resets.
           local -a change_args
           change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
-          if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
+          if gitea admin user change-password --help | grep -F -- '--must-change-password' >/dev/null; then
             change_args+=(--must-change-password=false)
           fi
           gitea admin user change-password "${change_args[@]}"
@@ -225,4 +230,5 @@ stringData:
 
     configure_oauth
 
-    echo '==== END GITEA CONFIGURATION ===='
+    echo '==== END GITEA CONFIGURATION ===='
+{{- end }}

templates/gitea/secret_inlineConfig.yaml

@@ -0,0 +1,19 @@
+{{- /* Evaluated outside of the Secret because it populates `.Values.gitea.config` for the other templates. */ -}}
+{{- $inlineConfiguration := include "gitea.inline_configuration" . -}}
+{{- if not .Values.secrets.inlineConfig.existingSecret.enabled -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.inlineConfig.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.inlineConfig.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.inlineConfig.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: Opaque
+stringData:
+  {{- $inlineConfiguration | nindent 2 }}
+{{- end }}

templates/gitea/secret_metrics.yaml

@@ -0,0 +1,16 @@
+{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) (not .Values.secrets.metrics.existingSecret.enabled) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  {{- with (include "gitea.secret.metrics.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "gitea.secret.metrics.labels" . | nindent 4 }}
+  name: {{ include "gitea.secret.metrics.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+type: Opaque
+data:
+  token: {{ .Values.gitea.metrics.token  | b64enc }}
+{{- end }}

templates/gitea/serviceMonitor.yaml

@@ -36,7 +36,7 @@ spec:
     authorization:
       type: Bearer
       credentials:
-        name: {{ include "gitea.metrics-secret-name" . }}
+        name: {{ include "gitea.secret.metrics.name" . }}
         key: token
         optional: false
     {{- end }}

templates/gitea/service_http.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "gitea.fullname" . }}-http
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.http.annotations | nindent 4 }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.http.labels }}
     {{- toYaml .Values.service.http.labels  | nindent 4 }}
     {{- end }}
-  annotations:
-    {{- toYaml .Values.service.http.annotations | nindent 4 }}
+  name: {{ include "gitea.service.http.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
   type: {{ .Values.service.http.type }}
   {{- if eq .Values.service.http.type "LoadBalancer" }}

templates/gitea/service_ssh.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "gitea.fullname" . }}-ssh
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
   labels:
     {{- include "gitea.labels" . | nindent 4 }}
     {{- if .Values.service.ssh.labels }}
     {{- toYaml .Values.service.ssh.labels  | nindent 4 }}
     {{- end }}
-  annotations:
-    {{- toYaml .Values.service.ssh.annotations | nindent 4 }}
+  name: {{ include "gitea.service.ssh.name" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
 spec:
   type: {{ .Values.service.ssh.type }}
   {{- if eq .Values.service.ssh.type "LoadBalancer" }}

templates/gitea/tcpRoute.yaml

@@ -0,0 +1,34 @@
+{{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: TCPRoute
+metadata:
+  {{- with (include "gitea.tcpRoute.annotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- with (include "gitea.tcpRoute.labels" .) }}
+  labels:
+    {{- . | nindent 4 }}
+  {{- end }}
+  name: {{ include "gitea.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+spec:
+  parentRefs:
+    {{- if .Values.gatewayAPI.core.tcpRoute.parentRefs }}
+    {{- toYaml .Values.gatewayAPI.core.tcpRoute.parentRefs | nindent 4 }}
+    {{- else }}
+    {{- fail "gatewayAPI.core.tcpRoute.parentRefs is required" }}
+    {{- end }}
+  rules:
+    {{- if .Values.gatewayAPI.core.tcpRoute.rules }}
+    {{- tpl (toYaml .Values.gatewayAPI.core.tcpRoute.rules) $ | nindent 4 }}
+    {{- else }}
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: {{ include "gitea.service.ssh.name" . }}
+          port: {{ .Values.service.ssh.port }}
+          weight: 1
+    {{- end }}
+{{- end }}

templates/gpg-secret.yaml

@@ -1,17 +0,0 @@
-{{- if .Values.signing.enabled -}}
-{{- if and (empty .Values.signing.privateKey) (empty .Values.signing.existingSecret) -}}
-  {{- fail "Either specify `signing.privateKey` or `signing.existingSecret`" -}}
-{{- end }}
-{{- if and (not (empty .Values.signing.privateKey)) (empty .Values.signing.existingSecret) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "gitea.gpg-key-secret-name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-type: Opaque
-data:
-  privateKey: {{ .Values.signing.privateKey | b64enc }}
-{{- end }}
-{{- end }}

templates/metrics-secret.yaml

@@ -1,12 +0,0 @@
-{{- if and (.Values.gitea.metrics.enabled) (.Values.gitea.metrics.serviceMonitor.enabled) (.Values.gitea.metrics.token) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "gitea.metrics-secret-name" . }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  labels:
-    {{- include "gitea.labels" . | nindent 4 }}
-type: Opaque
-data:
-  token: {{ .Values.gitea.metrics.token  | b64enc }}
-{{- end }}

templates/networkPolicy.yaml

@@ -1,32 +0,0 @@
-{{- if .Values.networkPolicy.enabled }}
----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  {{- with (include "gitea.networkPolicy.annotations" . | fromYaml) }}
-  annotations:
-    {{- tpl (toYaml .) $ | nindent 4 }}
-  {{- end }}
-  {{- with (include "gitea.networkPolicy.labels" . | fromYaml) }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  name: {{ include "gitea.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-spec:
-  podSelector:
-    matchLabels:
-      {{- include "gitea.pod.selectorLabels" $ | nindent 6 }}
-  {{- with .Values.networkPolicy.policyTypes }}
-  policyTypes:
-  {{- toYaml . | nindent 2 }}
-  {{- end }}
-  {{- with .Values.networkPolicy.egress }}
-  egress:
-  {{- toYaml . | nindent 2 }}
-  {{- end }}
-  {{- with .Values.networkPolicy.ingress }}
-  ingress:
-  {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}

templates/pvc.yaml

@@ -1,26 +0,0 @@
-{{- if and .Values.persistence.enabled .Values.persistence.create }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ .Values.persistence.claimName }}
-  namespace: {{ .Values.namespace | default .Release.Namespace }}
-  annotations:
-{{ .Values.persistence.annotations | toYaml | indent 4}}
-  labels:
-{{ .Values.persistence.labels | toYaml | indent 4}}
-spec:
-  accessModes:
-  {{- if gt (.Values.replicaCount | int) 1 }}
-      - ReadWriteMany
-  {{- else }}
-    {{- .Values.persistence.accessModes | toYaml | nindent 4 }}
-  {{- end }}
-  volumeMode: Filesystem
-  {{- include "gitea.persistence.storageClass" . | nindent 2 }}
-  {{- with .Values.persistence.volumeName }}
-  volumeName: {{ . }}
-  {{- end }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.size }}
-{{- end }}

templates/tests/test-http-connection.yaml

@@ -9,10 +9,19 @@ metadata:
   annotations:
     "helm.sh/hook": test-success
 spec:
+  {{- $hostUsers := include "gitea.hostUsers" . | trim }}
+  {{- $testContainerSecurityContext := include "gitea.containerSecurityContext" (list . (dict)) | trim }}
+  {{- if $hostUsers }}
+  hostUsers: {{ $hostUsers }}
+  {{- end }}
   containers:
     - name: wget
       image: "{{ .Values.test.image.name }}:{{ .Values.test.image.tag }}"
+      {{- if $testContainerSecurityContext }}
+      securityContext:
+        {{- $testContainerSecurityContext | nindent 8 }}
+      {{- end }}
       command: ['wget']
-      args:  ['{{ include "gitea.fullname" . }}-http:{{ .Values.service.http.port }}']
+      args: ['{{ include "gitea.service.http.name" . }}:{{ .Values.service.http.port }}']
   restartPolicy: Never
 {{- end }}

unittests/bash/tests/init-containers/config/config_environment.bats

@@ -9,27 +9,51 @@ function setup() {
   export GITEA_APP_INI="$BATS_TEST_TMPDIR/app.ini"
   export TMP_EXISTING_ENVS_FILE="$BATS_TEST_TMPDIR/existing-envs"
   export ENV_TO_INI_MOUNT_POINT="$BATS_TEST_TMPDIR/env-to-ini-mounts"
+  export GITEA_EDIT_INI_EXPECTED=0
+  export PATH="$BATS_TEST_TMPDIR/bin:$PATH"
 
-  stub gitea \
-      "generate secret INTERNAL_TOKEN : echo 'mocked-internal-token'" \
-      "generate secret SECRET_KEY : echo 'mocked-secret-key'" \
-      "generate secret JWT_SECRET : echo 'mocked-jwt-secret'" \
-      "generate secret LFS_JWT_SECRET : echo 'mocked-lfs-jwt-secret'"
+  mkdir -p "$BATS_TEST_TMPDIR/bin"
+  cat >"$BATS_TEST_TMPDIR/bin/gitea" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+case "$*" in
+  'generate secret INTERNAL_TOKEN')
+    echo 'mocked-internal-token'
+    ;;
+  'generate secret SECRET_KEY')
+    echo 'mocked-secret-key'
+    ;;
+  'generate secret JWT_SECRET')
+    echo 'mocked-jwt-secret'
+    ;;
+  'generate secret LFS_JWT_SECRET')
+    echo 'mocked-lfs-jwt-secret'
+    ;;
+  "config edit-ini --apply-env --config $GITEA_APP_INI --out $GITEA_APP_INI")
+    if [ "$GITEA_EDIT_INI_EXPECTED" -eq 1 ]; then
+      echo 'Stubbed gitea config edit-ini was called!'
+      exit 0
+    fi
+
+    echo 'Unexpected gitea config edit-ini invocation' >&2
+    exit 127
+    ;;
+  *)
+    echo "Unexpected gitea invocation: $*" >&2
+    exit 127
+    ;;
+esac
+EOF
+  chmod +x "$BATS_TEST_TMPDIR/bin/gitea"
 }
 
 function teardown() {
-  unstub gitea
-  # This condition exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
-  if [ $ENV_TO_INI_EXPECTED -eq 1 ]; then
-    unstub environment-to-ini
-  fi
+  :
 }
 
-# This function exists due to https://github.com/jasonkarns/bats-mock/pull/37 being still open
-function expect_environment_to_ini_call() {
-  export ENV_TO_INI_EXPECTED=1
-  stub environment-to-ini \
-    "-o $GITEA_APP_INI : echo 'Stubbed environment-to-ini was called!'"
+function expect_gitea_config_edit_ini_call() {
+  export GITEA_EDIT_INI_EXPECTED=1
 }
 
 function execute_test_script() {
@@ -56,18 +80,18 @@ function write_mounted_file() {
 }
 
 @test "works as expected when nothing is configured" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   run $PROJECT_ROOT/scripts/init-containers/config/config_environment.sh
 
   assert_success
   assert_line '...Initial secrets generated'
   assert_line 'Reloading preset envs...'
   assert_line '=== All configuration sources loaded ==='
-  assert_line 'Stubbed environment-to-ini was called!'
+  assert_line 'Stubbed gitea config edit-ini was called!'
 }
 
 @test "exports initial secrets" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   run execute_test_script
 
   assert_success
@@ -78,7 +102,7 @@ function write_mounted_file() {
 }
 
 @test "does NOT export initial secrets when app.ini already exists" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   touch $GITEA_APP_INI
 
   run execute_test_script
@@ -92,7 +116,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over auto-generated ones" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
 
   run execute_test_script
@@ -102,7 +126,7 @@ function write_mounted_file() {
 }
 
 @test "ensures that preset environment variables take precedence over mounted ones" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   export GITEA__OAUTH2__JWT_SECRET="pre-defined-jwt-secret"
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
@@ -117,7 +141,7 @@ EOF
 }
 
 @test "ensures that additionals take precedence over inlines" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   write_mounted_file "inlines" "oauth2" "$(cat << EOF
 JWT_SECRET=inline-jwt-secret
 EOF
@@ -136,7 +160,7 @@ EOF
 }
 
 @test "ensures that dotted/dashed sections are properly masked" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_PROGRESS_PREFIXES=WIP:,[WIP]
 EOF
@@ -152,7 +176,7 @@ EOF
 ##### THIS IS A BUG, BUT I WANT IT TO BE COVERED BY TESTS #####
 ###############################################################
 @test "ensures uppercase section and setting names (🐞)" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   export GITEA__oauth2__JwT_Secret="pre-defined-jwt-secret"
   write_mounted_file "inlines" "repository.pull-request" "$(cat << EOF
 WORK_IN_progress_PREFIXES=WIP:,[WIP]
@@ -167,7 +191,7 @@ EOF
 }
 
 @test "treats top-level configuration as section-less" {
-  expect_environment_to_ini_call
+  expect_gitea_config_edit_ini_call
   write_mounted_file "inlines" "_generals_" "$(cat << EOF
 APP_NAME=Hello top-level configuration
 RUN_MODE=dev

unittests/helm/admin-secret/admin.yaml

@@ -0,0 +1,64 @@
+suite: Admin secret template
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/secret_admin.yaml
+tests:
+  - it: skips rendering when the admin user is disabled
+    set:
+      secrets.admin.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: skips rendering using an existing secret reference
+    set:
+      secrets.admin.enabled: true
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: "external-secret-reference"
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: fails rendering without credentials
+    set:
+      secrets.admin.new.password: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: Either specify `secrets.admin.new.username` and `secrets.admin.new.password` or reference an existing Secret via `secrets.admin.existingSecret`
+
+  - it: renders the secret specification with the default credentials
+    asserts:
+      - hasDocuments:
+          count: 1
+      - documentIndex: 0
+        containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: gitea-unittests-admin
+      - isNotNullOrEmpty:
+          path: metadata.labels
+      - equal:
+          path: data.email
+          value: "Z2l0ZWFAbG9jYWwuZG9tYWlu"
+      - equal:
+          path: data.password
+          value: "cjhzQThDUEhEOSFidDZk"
+      - equal:
+          path: data.username
+          value: "Z2l0ZWFfYWRtaW4="
+
+  - it: supports custom annotations and labels
+    set:
+      secrets.admin.new.annotations:
+        custom-annotation: annotation-value
+      secrets.admin.new.labels:
+        custom-label: label-value
+    asserts:
+      - equal:
+          path: metadata.annotations["custom-annotation"]
+          value: annotation-value
+      - equal:
+          path: metadata.labels["custom-label"]
+          value: label-value

unittests/helm/check-actions-not-present.yaml

@@ -1,12 +0,0 @@
-suite: Check if actions raises an error
-release:
-  name: gitea-unittests
-  namespace: testing
-tests:
-  - it: fails when trying to configure actions due to removal
-    set:
-      actions:
-        enabled: true
-    asserts:
-      - failedTemplate:
-          errorMessage: The actions sub-chart has been outsourced to a dedicated chart available at https://gitea.com/gitea/helm-actions. For assistance with the migration process, check https://gitea.com/gitea/helm-actions/issues/9.

unittests/helm/config/actions-config.yaml

@@ -3,17 +3,17 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/config.yaml
+  - templates/gitea/secret_inlineConfig.yaml
 tests:
   - it: "actions are enabled by default (based on vanilla Gitea behavior)"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         notExists:
           path: stringData.actions
 
   - it: "actions can be disabled via inline config"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       gitea.config.actions.ENABLED: false
     asserts:

unittests/helm/config/cache-config.yaml

@@ -3,26 +3,9 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "cache is configured correctly for valkey-cluster"
-    template: templates/config.yaml
-    set:
-      valkey-cluster:
-        enabled: true
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: stringData.cache
-          value: |-
-            ADAPTER=redis
-            HOST=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
   - it: "cache is configured correctly for valkey"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -31,13 +14,11 @@ tests:
           path: stringData.cache
           value: |-
             ADAPTER=redis
-            HOST=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            HOST=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
 
-  - it: "cache is configured correctly for 'memory' when valkey (or valkey-cluster) is disabled"
-    template: templates/config.yaml
+  - it: "cache is configured correctly for 'memory' when valkey is disabled"
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: false
     asserts:
@@ -48,11 +29,9 @@ tests:
             ADAPTER=memory
             HOST=
 
-  - it: "cache can be customized when valkey (or valkey-cluster) is disabled"
-    template: templates/config.yaml
+  - it: "cache can be customized when valkey is disabled"
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: false
       gitea.config.cache.ADAPTER: custom-adapter

unittests/helm/config/config-environment-script.yaml

@@ -0,0 +1,15 @@
+suite: config template | config_environment.sh
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+tests:
+  - it: uses `gitea config edit-ini` to write app.ini from environment variables
+    template: templates/gitea/secret_config.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData["config_environment.sh"]
+          pattern: 'gitea config edit-ini --apply-env --config .+GITEA_APP_INI.+ --out .+GITEA_APP_INI'

unittests/helm/config/metrics-section_metrics-token.yaml

@@ -4,7 +4,7 @@ release:
   namespace: testing
 tests:
   - it: metrics token is set
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       gitea:
         metrics:
@@ -18,7 +18,7 @@ tests:
             ENABLED=true
             TOKEN=somepassword
   - it: metrics token is empty
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       gitea:
         metrics:
@@ -31,7 +31,7 @@ tests:
           value: |-
             ENABLED=true
   - it: metrics token is nil
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       gitea:
         metrics:
@@ -44,7 +44,7 @@ tests:
           value: |-
             ENABLED=true
   - it: does not configures a token if metrics are disabled
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       gitea:
         metrics:

unittests/helm/config/queue-config.yaml

@@ -3,26 +3,9 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "queue is configured correctly for valkey-cluster"
-    template: templates/config.yaml
-    set:
-      valkey-cluster:
-        enabled: true
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: stringData.queue
-          value: |-
-            CONN_STR=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-            TYPE=redis
-
   - it: "queue is configured correctly for valkey"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -30,14 +13,12 @@ tests:
         equal:
           path: stringData.queue
           value: |-
-            CONN_STR=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            CONN_STR=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
             TYPE=redis
 
-  - it: "queue is configured correctly for 'levelDB' when valkey (and valkey-cluster) is disabled"
-    template: templates/config.yaml
+  - it: "queue is configured correctly for 'levelDB' when valkey is disabled"
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: false
     asserts:
@@ -48,11 +29,9 @@ tests:
             CONN_STR=
             TYPE=level
 
-  - it: "queue can be customized when valkey (and valkey-cluster) are disabled"
-    template: templates/config.yaml
+  - it: "queue can be customized when valkey is disabled"
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: false
       gitea.config.queue.TYPE: custom-type

unittests/helm/config/server-section_domain.yaml

@@ -4,7 +4,7 @@ release:
   namespace: testing
 tests:
   - it: "[default values] uses ingress host for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
@@ -22,7 +22,7 @@ tests:
   ################################################
 
   - it: "[no ingress hosts] uses gitea http service for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       ingress:
         hosts: []
@@ -43,7 +43,7 @@ tests:
   ################################################
 
   - it: "[provided via values] uses that for DOMAIN|SSH_DOMAIN|ROOT_URL"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
       gitea.config.server.DOMAIN: provided.example.com
       ingress:
@@ -65,3 +65,94 @@ tests:
         matchRegex:
           path: stringData.server
           pattern: \nROOT_URL=http://provided.example.com
+
+  ################################################
+
+  - it: "[route enabled] uses route host for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/gitea/secret_inlineConfig.yaml
+    set:
+      route:
+        enabled: true
+        host: route.example.com
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=route.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=route.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://route.example.com
+
+  ################################################
+
+  - it: "[route tls termination] uses https for ROOT_URL"
+    template: templates/gitea/secret_inlineConfig.yaml
+    set:
+      route:
+        enabled: true
+        host: route.example.com
+        tls:
+          termination: edge
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=https://route.example.com
+
+  ################################################
+
+  - it: "[HTTPRoute enabled] uses first hostname for DOMAIN|SSH_DOMAIN|ROOT_URL"
+    template: templates/gitea/secret_inlineConfig.yaml
+    set:
+      ingress:
+        hosts: []
+      gatewayAPI:
+        enabled: true
+        core:
+          httpRoute:
+            enabled: true
+            hostnames:
+              - gw.example.com
+            parentRefs:
+              - name: shared-gateway
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nDOMAIN=gw.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nSSH_DOMAIN=gw.example.com
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=http://gw.example.com
+
+  ################################################
+
+  - it: "[HTTPRoute tls] switches ROOT_URL to https"
+    template: templates/gitea/secret_inlineConfig.yaml
+    set:
+      ingress:
+        hosts: []
+      gatewayAPI:
+        enabled: true
+        core:
+          httpRoute:
+            enabled: true
+            tls: true
+            hostnames:
+              - gw.example.com
+            parentRefs:
+              - name: shared-gateway
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.server
+          pattern: \nROOT_URL=https://gw.example.com

unittests/helm/config/session-config.yaml

@@ -3,26 +3,9 @@ release:
   name: gitea-unittests
   namespace: testing
 tests:
-  - it: "session is configured correctly for valkey-cluster"
-    template: templates/config.yaml
-    set:
-      valkey-cluster:
-        enabled: true
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: stringData.session
-          value: |-
-            PROVIDER=redis
-            PROVIDER_CONFIG=redis+cluster://:@gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
   - it: "session is configured correctly for valkey"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -31,13 +14,11 @@ tests:
           path: stringData.session
           value: |-
             PROVIDER=redis
-            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey-headless.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
+            PROVIDER_CONFIG=redis://:changeme@gitea-unittests-valkey.testing.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
 
-  - it: "session is configured correctly for 'memory' when valkey (and valkey-cluster) is disabled"
-    template: templates/config.yaml
+  - it: "session is configured correctly for 'memory' when valkey is disabled"
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: false
     asserts:
@@ -48,11 +29,9 @@ tests:
             PROVIDER=memory
             PROVIDER_CONFIG=
 
-  - it: "session can be customized when valkey (and valkey-cluster) is disabled"
-    template: templates/config.yaml
+  - it: "session can be customized when valkey is disabled"
+    template: templates/gitea/secret_inlineConfig.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: false
       gitea.config.session.PROVIDER: custom-provider

unittests/helm/dependency-checks/customization-integrity-postgresql-ha.yaml

@@ -106,14 +106,23 @@ tests:
           name: gitea-unittests-postgresql-ha-pgpool
           namespace: testing
   - it: "[gitea] connects to pgpool service"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
           path: stringData.database
           pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.cluster.local:1234
+  - it: "[gitea] connects to pgpool service with custom cluster domain"
+    set:
+      clusterDomain: my-special-cluster.local
+    template: templates/gitea/secret_inlineConfig.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: HOST=gitea-unittests-postgresql-ha-pgpool.testing.svc.my-special-cluster.local:1234
   - it: "[gitea] connects to configured database"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:

unittests/helm/dependency-checks/customization-integrity-postgresql.yaml

@@ -65,14 +65,23 @@ tests:
           name: gitea-unittests-postgresql
           namespace: testing
   - it: "[gitea] connects to postgresql service"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
           path: stringData.database
           pattern: HOST=gitea-unittests-postgresql.testing.svc.cluster.local:1234
+  - it: "[gitea] connects to postgresql service with custom cluster domain"
+    set:
+      clusterDomain: my-special-cluster.local
+    template: templates/gitea/secret_inlineConfig.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData.database
+          pattern: HOST=gitea-unittests-postgresql.testing.svc.my-special-cluster.local:1234
   - it: "[gitea] connects to configured database"
-    template: templates/config.yaml
+    template: templates/gitea/secret_inlineConfig.yaml
     asserts:
       - documentIndex: 0
         matchRegex:

unittests/helm/dependency-checks/customization-integrity-valkey-cluster.yaml

@@ -1,90 +0,0 @@
-suite: Dependency checks | Customization integrity | valkey-cluster
-release:
-  name: gitea-unittests
-  namespace: testing
-set:
-  valkey:
-    enabled: false
-  valkey-cluster:
-    enabled: true
-    usePassword: false
-    cluster:
-      nodes: 5
-      replicas: 2
-tests:
-  - it: "[valkey-cluster] configures correct nodes/replicas"
-    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: spec.replicas
-          value: 5
-      - documentIndex: 0
-        matchRegex:
-          path: spec.template.spec.containers[0].args[0]
-          pattern: VALKEY_CLUSTER_REPLICAS="2"
-  - it: "[valkey-cluster] support auth-less connections"
-    asserts:
-      - template: charts/valkey-cluster/templates/secret.yaml
-        hasDocuments:
-          count: 0
-      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
-        documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: ALLOW_EMPTY_PASSWORD
-            value: "yes"
-  - it: "[valkey-cluster] support auth-full connections"
-    set:
-      valkey-cluster:
-        usePassword: true
-    asserts:
-      - template: charts/valkey-cluster/templates/secret.yaml
-        containsDocument:
-          kind: Secret
-          apiVersion: v1
-          name: gitea-unittests-valkey-cluster
-          namespace: testing
-      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
-        documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: REDISCLI_AUTH
-            valueFrom:
-              secretKeyRef:
-                name: gitea-unittests-valkey-cluster
-                key: valkey-password
-      - template: charts/valkey-cluster/templates/valkey-statefulset.yaml
-        documentIndex: 0
-        contains:
-          path: spec.template.spec.containers[0].env
-          content:
-            name: REDISCLI_AUTH
-            valueFrom:
-              secretKeyRef:
-                name: gitea-unittests-valkey-cluster
-                key: valkey-password
-  - it: "[valkey-cluster] renders the referenced service"
-    template: charts/valkey-cluster/templates/headless-svc.yaml
-    asserts:
-      - containsDocument:
-          kind: Service
-          apiVersion: v1
-          name: gitea-unittests-valkey-cluster-headless
-          namespace: testing
-      - documentIndex: 0
-        contains:
-          path: spec.ports
-          content:
-            name: tcp-redis
-            port: 6379
-            targetPort: tcp-redis
-  - it: "[gitea] waits for valkey-cluster to be up and running"
-    template: templates/init.yaml
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: stringData["configure_gitea.sh"]
-          pattern: nc -vz -w2 gitea-unittests-valkey-cluster-headless.testing.svc.cluster.local 6379

unittests/helm/dependency-checks/customization-integrity-valkey.yaml

@@ -3,50 +3,50 @@ release:
   name: gitea-unittests
   namespace: testing
 set:
-  valkey-cluster:
-    enabled: false
   valkey:
     enabled: true
-    architecture: standalone
-    global:
-      valkey:
-        password: gitea-password
-    master:
-      count: 2
+    auth:
+      enabled: true
+      aclUsers:
+        default:
+          permissions: "~* &* +@all"
+          password: gitea-password
 tests:
-  - it: "[valkey] configures correct 'master' nodes"
-    template: charts/valkey/templates/primary/application.yaml
-    asserts:
-      - documentIndex: 0
-        equal:
-          path: spec.replicas
-          value: 1
-  - it: "[valkey] valkey.global.valkey.password is applied as expected"
+  - it: "[valkey] valkey.auth.aclUsers.default.password is applied as expected"
     template: charts/valkey/templates/secret.yaml
     asserts:
       - documentIndex: 0
         equal:
-          path: data["valkey-password"]
+          path: data.default-password
           value: "Z2l0ZWEtcGFzc3dvcmQ="
   - it: "[valkey] renders the referenced service"
-    template: charts/valkey/templates/headless-svc.yaml
+    template: charts/valkey/templates/service.yaml
     asserts:
       - containsDocument:
           kind: Service
           apiVersion: v1
-          name: gitea-unittests-valkey-headless
-          namespace: testing
+          name: gitea-unittests-valkey
       - documentIndex: 0
         contains:
           path: spec.ports
           content:
-            name: tcp-redis
+            name: tcp
             port: 6379
-            targetPort: redis
+            targetPort: tcp
+            protocol: TCP
   - it: "[gitea] waits for valkey to be up and running"
-    template: templates/init.yaml
+    template: templates/gitea/secret_init.yaml
     asserts:
       - documentIndex: 0
         matchRegex:
           path: stringData["configure_gitea.sh"]
-          pattern: nc -vz -w2 gitea-unittests-valkey-headless.testing.svc.cluster.local 6379
+          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.cluster.local 6379
+  - it: "[gitea] waits for valkey to be up and running with custom cluster domain"
+    set:
+      clusterDomain: my-special-cluster.local
+    template: templates/gitea/secret_init.yaml
+    asserts:
+      - documentIndex: 0
+        matchRegex:
+          path: stringData["configure_gitea.sh"]
+          pattern: nc -vz -w2 gitea-unittests-valkey.testing.svc.my-special-cluster.local 6379

unittests/helm/dependency-checks/major-image-bump.yaml

@@ -15,7 +15,7 @@ tests:
         matchRegex:
           path: spec.template.spec.containers[0].image
           # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnami/postgresql-repmgr:17.+$
+          pattern: bitnamilegacy/postgresql-repmgr:17.+$
   - it: "[postgresql] ensures we detect major image version upgrades"
     template: charts/postgresql/templates/primary/statefulset.yaml
     set:
@@ -28,25 +28,10 @@ tests:
         matchRegex:
           path: spec.template.spec.containers[0].image
           # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnami/postgresql:17.+$
-  - it: "[valkey-cluster] ensures we detect major image version upgrades"
-    template: charts/valkey-cluster/templates/valkey-statefulset.yaml
-    set:
-      valkey-cluster:
-        enabled: true
-      valkey:
-        enabled: false
-    asserts:
-      - documentIndex: 0
-        matchRegex:
-          path: spec.template.spec.containers[0].image
-          # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnami/valkey-cluster:8.+$
+          pattern: bitnamilegacy/postgresql:17.+$
   - it: "[valkey] ensures we detect major image version upgrades"
-    template: charts/valkey/templates/primary/application.yaml
+    template: charts/valkey/templates/deploy_valkey.yaml
     set:
-      valkey-cluster:
-        enabled: false
       valkey:
         enabled: true
     asserts:
@@ -54,4 +39,4 @@ tests:
         matchRegex:
           path: spec.template.spec.containers[0].image
           # IN CASE OF AN INTENTIONAL MAJOR BUMP, ADJUST THIS TEST
-          pattern: bitnami/valkey:8.+$
+          pattern: valkey/valkey:9.+$

unittests/helm/deployment/HA.yaml

@@ -3,16 +3,23 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/deployment.yaml
-  - templates/config.yaml
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
 tests:
   - it: fails with multiple replicas and "GIT_GC_REPOS" enabled
-    template: templates/deployment.yaml
+    template: templates/gitea/secret_config.yaml
     set:
-      replicaCount: 2
+      deployment:
+        replicas: 2
       persistence:
-        accessModes:
-          - ReadWriteMany
+        new:
+          accessModes:
+            - ReadWriteMany
       gitea:
         config:
           cron:
@@ -22,19 +29,22 @@ tests:
       - failedTemplate:
           errorMessage: "Invoking the garbage collector via CRON is not yet supported when running with multiple replicas. Please set 'gitea.config.cron.GIT_GC_REPOS.enabled = false'."
   - it: fails with multiple replicas and RWX file system not set
-    template: templates/deployment.yaml
+    template: templates/gitea/secret_config.yaml
     set:
-      replicaCount: 2
+      deployment:
+        replicas: 2
     asserts:
       - failedTemplate:
-          errorMessage: "When using multiple replicas, a RWX file system is required and persistence.accessModes[0] must be set to ReadWriteMany."
+          errorMessage: "When using multiple replicas, a RWX file system is required and persistence.new.accessModes[0] must be set to ReadWriteMany."
   - it: fails with multiple replicas and bleve issue indexer
-    template: templates/deployment.yaml
+    template: templates/gitea/secret_config.yaml
     set:
-      replicaCount: 2
+      deployment:
+        replicas: 2
       persistence:
-        accessModes:
-          - ReadWriteMany
+        new:
+          accessModes:
+            - ReadWriteMany
       gitea:
         config:
           indexer:
@@ -43,12 +53,14 @@ tests:
       - failedTemplate:
           errorMessage: "When using multiple replicas, the issue indexer (gitea.config.indexer.ISSUE_INDEXER_TYPE) must be set to a HA-ready provider such as 'meilisearch', 'elasticsearch' or 'db' (if the DB is HA-ready)."
   - it: fails with multiple replicas and bleve repo indexer
-    template: templates/deployment.yaml
+    template: templates/gitea/secret_config.yaml
     set:
-      replicaCount: 2
+      deployment:
+        replicas: 2
       persistence:
-        accessModes:
-          - ReadWriteMany
+        new:
+          accessModes:
+            - ReadWriteMany
       gitea:
         config:
           indexer:

unittests/helm/deployment/admin.yaml

@@ -0,0 +1,103 @@
+suite: deployment template (admin user)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
+tests:
+  - it: reads the admin credentials from the generated secret
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_USERNAME
+            valueFrom:
+              secretKeyRef:
+                key: username
+                name: gitea-unittests-admin
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: password
+                name: gitea-unittests-admin
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_EMAIL
+            valueFrom:
+              secretKeyRef:
+                key: email
+                name: gitea-unittests-admin
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD_MODE
+            value: keepUpdated
+
+  - it: reads the admin credentials from the configured keys of an existing secret
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: custom-admin-secret
+      secrets.admin.existingSecret.emailKey: custom-email
+      secrets.admin.existingSecret.passwordKey: custom-password
+      secrets.admin.existingSecret.usernameKey: custom-username
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_USERNAME
+            valueFrom:
+              secretKeyRef:
+                key: custom-username
+                name: custom-admin-secret
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                key: custom-password
+                name: custom-admin-secret
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_EMAIL
+            valueFrom:
+              secretKeyRef:
+                key: custom-email
+                name: custom-admin-secret
+
+  - it: omits the admin environment when the admin user is disabled
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_USERNAME
+          any: true
+      - notContains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: GITEA_ADMIN_PASSWORD_MODE
+          any: true
+
+  - it: fails on an unsupported password mode
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.passwordMode: unsupported
+    asserts:
+      - failedTemplate:
+          errorMessage: "`secrets.admin.passwordMode` must be set to one of 'keepUpdated', 'initialOnlyNoReset', or 'initialOnlyRequireReset'. Received: 'unsupported'"

unittests/helm/deployment/basic.yaml

@@ -3,11 +3,16 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/deployment.yaml
-  - templates/config.yaml
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
 tests:
   - it: renders a deployment
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     asserts:
       - hasDocuments:
           count: 1
@@ -15,8 +20,15 @@ tests:
           kind: Deployment
           apiVersion: apps/v1
           name: gitea-unittests
+  - it: renders no deployment when disabled
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
   - it: deployment labels are set
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       deployment.labels:
         hello: world
@@ -29,8 +41,210 @@ tests:
           path: spec.template.metadata.labels
           content:
             hello: world
+      - isNotSubset:
+          path: spec.selector.matchLabels
+          content:
+            hello: world
+  - it: deployment labels are not in selector matchLabels
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.labels:
+        custom-label: custom-value
+        another-label: another-value
+    asserts:
+      - equal:
+          path: spec.selector.matchLabels
+          value:
+            app.kubernetes.io/name: gitea
+            app.kubernetes.io/instance: gitea-unittests
+  - it: deployment labels are always rendered
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - isSubset:
+          path: metadata.labels
+          content:
+            app: gitea
+            app.kubernetes.io/name: gitea
+            app.kubernetes.io/instance: gitea-unittests
+            app.kubernetes.io/managed-by: Helm
+  - it: deployment annotations are undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: metadata.annotations
+  - it: deployment annotations are set
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.annotations:
+        hello: world
+    asserts:
+      - equal:
+          path: metadata.annotations
+          value:
+            hello: world
+  - it: nodeSelector is undefined
+    asserts:
+      - notExists:
+          path: spec.template.spec.nodeSelector
+        template: templates/gitea/deployment.yaml
+  - it: nodeSelector is defined
+    set:
+      deployment.nodeSelector:
+        foo: bar
+        bar: foo
+    asserts:
+      - isSubset:
+          path: spec.template.spec.nodeSelector
+          content:
+            foo: bar
+            bar: foo
+        template: templates/gitea/deployment.yaml
+  - it: affinity is undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.affinity
+  - it: affinity is defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+    asserts:
+      - equal:
+          path: spec.template.spec.affinity
+          value:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: kubernetes.io/os
+                        operator: In
+                        values:
+                          - linux
+  - it: dnsConfig is undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.dnsConfig
+  - it: dnsConfig is defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.dnsConfig:
+        nameservers:
+          - 192.0.2.1
+        options:
+          - name: ndots
+            value: "2"
+    asserts:
+      - equal:
+          path: spec.template.spec.dnsConfig
+          value:
+            nameservers:
+              - 192.0.2.1
+            options:
+              - name: ndots
+                value: "2"
+  - it: priorityClassName is undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.priorityClassName
+  - it: priorityClassName is defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.priorityClassName: high-priority
+    asserts:
+      - equal:
+          path: spec.template.spec.priorityClassName
+          value: high-priority
+  - it: schedulerName is undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.schedulerName
+  - it: schedulerName is defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.schedulerName: stork
+    asserts:
+      - equal:
+          path: spec.template.spec.schedulerName
+          value: stork
+  - it: strategy defaults to a rolling update
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - equal:
+          path: spec.strategy
+          value:
+            type: RollingUpdate
+            rollingUpdate:
+              maxUnavailable: 0
+              maxSurge: 100%
+  - it: strategy omits rollingUpdate for other strategy types
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.strategy.type: Recreate
+    asserts:
+      - equal:
+          path: spec.strategy
+          value:
+            type: Recreate
+  - it: tolerations are undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.tolerations
+  - it: tolerations are defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.tolerations:
+        - key: database/type
+          operator: Equal
+          value: postgres
+          effect: NoSchedule
+    asserts:
+      - equal:
+          path: spec.template.spec.tolerations
+          value:
+            - key: database/type
+              operator: Equal
+              value: postgres
+              effect: NoSchedule
+  - it: topologySpreadConstraints are undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.topologySpreadConstraints
+  - it: topologySpreadConstraints are defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.topologySpreadConstraints:
+        - topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          maxSkew: 1
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: gitea-unittests
+    asserts:
+      - equal:
+          path: spec.template.spec.topologySpreadConstraints
+          value:
+            - topologyKey: kubernetes.io/hostname
+              whenUnsatisfiable: DoNotSchedule
+              maxSkew: 1
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/instance: gitea-unittests
+
   - it: "injects TMP_EXISTING_ENVS_FILE as environment variable to 'init-app-ini' init container"
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     asserts:
       - contains:
           path: spec.template.spec.initContainers[1].env
@@ -38,17 +252,44 @@ tests:
             name: TMP_EXISTING_ENVS_FILE
             value: /tmp/existing-envs
   - it: "injects ENV_TO_INI_MOUNT_POINT as environment variable to 'init-app-ini' init container"
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     asserts:
       - contains:
           path: spec.template.spec.initContainers[1].env
           content:
             name: ENV_TO_INI_MOUNT_POINT
             value: /env-to-ini-mounts
-  - it: CPU resources are defined as well as GOMAXPROCS
-    template: templates/deployment.yaml
+  - it: "deployment.gitea.env is injected into all init containers and the gitea container"
+    template: templates/gitea/deployment.yaml
     set:
-      resources:
+      deployment.gitea.env:
+        - name: VARIABLE
+          value: my-value
+    asserts:
+      - contains:
+          path: spec.template.spec.initContainers[0].env
+          content:
+            name: VARIABLE
+            value: my-value
+      - contains:
+          path: spec.template.spec.initContainers[1].env
+          content:
+            name: VARIABLE
+            value: my-value
+      - contains:
+          path: spec.template.spec.initContainers[2].env
+          content:
+            name: VARIABLE
+            value: my-value
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: VARIABLE
+            value: my-value
+  - it: CPU resources are defined as well as GOMAXPROCS
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.gitea.resources:
         limits:
           cpu: 200ms
           memory: 200Mi
@@ -73,8 +314,47 @@ tests:
             requests:
               cpu: 100ms
               memory: 100Mi
+  - it: container resources default to an empty map and GOMAXPROCS is omitted
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources
+          value: {}
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: GOMAXPROCS
+            valueFrom:
+              resourceFieldRef:
+                divisor: "1"
+                resource: limits.cpu
+  - it: pod level resources are undefined
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.resources
+  - it: pod level resources are defined
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.resources:
+        limits:
+          cpu: 500m
+          memory: 512Mi
+        requests:
+          cpu: 250m
+          memory: 256Mi
+    asserts:
+      - equal:
+          path: spec.template.spec.resources
+          value:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 250m
+              memory: 256Mi
   - it: Init containers have correct volumeMount path
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       initContainersScriptsVolumeMountPath: "/custom/init/path"
     asserts:
@@ -85,7 +365,7 @@ tests:
           path: spec.template.spec.initContainers[*].volumeMounts[?(@.name=="config")].mountPath
           value: "/custom/init/path"
   - it: Init containers have correct volumeMount path if there is no override
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     asserts:
       - equal:
           path: spec.template.spec.initContainers[*].volumeMounts[?(@.name=="init")].mountPath

unittests/helm/deployment/checksum-annotations.yaml

@@ -0,0 +1,158 @@
+suite: deployment template (checksum annotations)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
+tests:
+  - it: omits the checksum annotations by default
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.enabled: true
+      secrets.config.enabled: true
+      secrets.gpg.enabled: true
+      secrets.gpg.new.privateKey: |
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+        -----END PGP PRIVATE KEY BLOCK-----
+      secrets.init.enabled: true
+      secrets.inlineConfig.enabled: true
+      secrets.metrics.enabled: true
+    asserts:
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/admin"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/config"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/gpg"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/init"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/metrics"]
+
+  - it: adds a checksum annotation for every Secret when addSHASumAnnotation is enabled
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.addSHASumAnnotation: true
+      secrets.admin.enabled: true
+
+      secrets.config.addSHASumAnnotation: true
+      secrets.config.enabled: true
+
+      secrets.gpg.addSHASumAnnotation: true
+      secrets.gpg.enabled: true
+      secrets.gpg.new.privateKey: |
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+        -----END PGP PRIVATE KEY BLOCK-----
+
+      secrets.init.addSHASumAnnotation: true
+      secrets.init.enabled: true
+
+      secrets.inlineConfig.addSHASumAnnotation: true
+      secrets.inlineConfig.enabled: true
+
+      secrets.metrics.addSHASumAnnotation: true
+      secrets.metrics.enabled: true
+    asserts:
+      - exists:
+          path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/config"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/gpg"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/init"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/metrics"]
+
+  - it: omits the checksum annotation of a single disabled Secret only
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.addSHASumAnnotation: false
+      secrets.admin.enabled: true
+
+      secrets.config.addSHASumAnnotation: false
+      secrets.config.enabled: true
+
+      secrets.gpg.addSHASumAnnotation: false
+      secrets.gpg.enabled: true
+      secrets.gpg.new.privateKey: |
+        -----BEGIN PGP PRIVATE KEY BLOCK-----
+        -----END PGP PRIVATE KEY BLOCK-----
+
+      secrets.init.addSHASumAnnotation: false
+      secrets.init.enabled: true
+
+      secrets.inlineConfig.addSHASumAnnotation: false
+      secrets.inlineConfig.enabled: true
+
+      secrets.metrics.addSHASumAnnotation: false
+      secrets.metrics.enabled: true
+    asserts:
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/admin"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/config"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/gpg"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/init"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      - notExists:
+          path: spec.template.metadata.annotations["checksum/metrics"]
+
+  - it: adds the checksum of Secrets provided by the user
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.admin.enabled: true
+      secrets.admin.addSHASumAnnotation: true
+      secrets.admin.existingSecret.enabled: true
+      secrets.admin.existingSecret.secretName: custom-admin
+
+      secrets.config.enabled: true
+      secrets.config.addSHASumAnnotation: true
+      secrets.config.existingSecret.enabled: true
+      secrets.config.existingSecret.secretName: custom-config
+
+      secrets.gpg.enabled: true
+      secrets.gpg.addSHASumAnnotation: true
+      secrets.gpg.existingSecret.enabled: true
+      secrets.gpg.existingSecret.secretName: custom-gpg
+
+      secrets.init.enabled: true
+      secrets.init.addSHASumAnnotation: true
+      secrets.init.existingSecret.enabled: true
+      secrets.init.existingSecret.secretName: custom-init
+
+      secrets.inlineConfig.enabled: true
+      secrets.inlineConfig.addSHASumAnnotation: true
+      secrets.inlineConfig.existingSecret.enabled: true
+      secrets.inlineConfig.existingSecret.secretName: custom-inline-config
+
+      secrets.metrics.enabled: true
+      secrets.metrics.addSHASumAnnotation: true
+      secrets.metrics.existingSecret.enabled: true
+      secrets.metrics.existingSecret.secretName: custom-metrics
+    asserts:
+      - exists:
+          path: spec.template.metadata.annotations["checksum/admin"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/config"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/gpg"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/init"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/inlineConfig"]
+      - exists:
+          path: spec.template.metadata.annotations["checksum/metrics"]

unittests/helm/deployment/deployment-additional-config.yaml

@@ -3,11 +3,16 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/deployment.yaml
-  - templates/config.yaml
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
 tests:
   - it: Renders a deployment
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     asserts:
       - hasDocuments:
           count: 1
@@ -16,7 +21,7 @@ tests:
           apiVersion: apps/v1
           name: gitea-unittests
   - it: Deployment with empty additionalConfigFromEnvs
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       gitea.additionalConfigFromEnvs: []
     asserts:
@@ -44,7 +49,7 @@ tests:
               - name: ENV_TO_INI_MOUNT_POINT
                 value: /env-to-ini-mounts
   - it: Deployment with standard additionalConfigFromEnvs
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       gitea.additionalConfigFromEnvs: [{name: GITEA_database_HOST, value: my-db:123}, {name: GITEA_database_USER, value: my-user}]
     asserts:
@@ -76,7 +81,7 @@ tests:
               - name: GITEA_database_USER
                 value: my-user
   - it: Deployment with templated additionalConfigFromEnvs
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       gitea.misc.host: my-db-host:321
       gitea.misc.user: my-db-user
@@ -110,7 +115,7 @@ tests:
               - name: GITEA_database_USER
                 value: my-db-user
   - it: Deployment with additionalConfigFromEnvs templated secret name
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       gitea.misc.existingSecret: my-db-secret
       gitea.additionalConfigFromEnvs[0]:

unittests/helm/deployment/deprecations.yaml

@@ -0,0 +1,208 @@
+suite: deprecation template (deployment)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/deprecation.yaml
+tests:
+  - it: renders nothing with the default values
+    asserts:
+      - hasDocuments:
+          count: 0
+  - it: fails when the removed `affinity` value is set
+    set:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+    asserts:
+      - failedTemplate:
+          errorMessage: "`affinity` does no longer exist. Please refer to the changelog and configure `deployment.affinity` instead."
+  - it: fails when the removed `containerSecurityContext` value is set
+    set:
+      containerSecurityContext:
+        runAsUser: 1000
+    asserts:
+      - failedTemplate:
+          errorMessage: "`containerSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.gitea.securityContext` instead."
+  - it: fails when the removed `deployment.env` value is set
+    set:
+      deployment.env:
+        - name: VARIABLE
+          value: my-value
+    asserts:
+      - failedTemplate:
+          errorMessage: "`deployment.env` does no longer exist. Please refer to the changelog and configure `deployment.gitea.env` instead."
+  - it: fails when the removed `dnsConfig` value is set
+    set:
+      dnsConfig:
+        nameservers:
+          - 192.0.2.1
+    asserts:
+      - failedTemplate:
+          errorMessage: "`dnsConfig` does no longer exist. Please refer to the changelog and configure `deployment.dnsConfig` instead."
+  - it: fails when the removed `extraContainerVolumeMounts` value is set
+    set:
+      extraContainerVolumeMounts:
+        - name: postgres-ssl-vol
+          mountPath: /pg-ssl
+    asserts:
+      - failedTemplate:
+          errorMessage: "`extraContainerVolumeMounts` does no longer exist. Please refer to the changelog and configure `deployment.gitea.volumeMounts` instead."
+  - it: fails when the removed `extraVolumes` value is set
+    set:
+      extraVolumes:
+        - name: postgres-ssl-vol
+          secret:
+            secretName: gitea-postgres-ssl
+    asserts:
+      - failedTemplate:
+          errorMessage: "`extraVolumes` does no longer exist. Please refer to the changelog and configure `deployment.volumes` instead."
+  - it: fails when the removed `nodeSelector` value is set
+    set:
+      nodeSelector:
+        foo: bar
+    asserts:
+      - failedTemplate:
+          errorMessage: "`nodeSelector` does no longer exist. Please refer to the changelog and configure `deployment.nodeSelector` instead."
+  - it: fails when the removed `openshift.hostUsers` value is set
+    set:
+      openshift.hostUsers: false
+    asserts:
+      - failedTemplate:
+          errorMessage: "`openshift.hostUsers` does no longer exist. Please refer to the changelog and configure `deployment.hostUsers` instead."
+  - it: fails when the removed `priorityClassName` value is set
+    set:
+      priorityClassName: high-priority
+    asserts:
+      - failedTemplate:
+          errorMessage: "`priorityClassName` does no longer exist. Please refer to the changelog and configure `deployment.priorityClassName` instead."
+  - it: fails when the removed `podSecurityContext` value is set
+    set:
+      podSecurityContext:
+        fsGroup: 1000
+    asserts:
+      - failedTemplate:
+          errorMessage: "`podSecurityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` instead."
+  - it: fails when the removed `postExtraInitContainers` value is set
+    set:
+      postExtraInitContainers:
+        - name: post-init-container
+          image: docker.io/library/busybox
+    asserts:
+      - failedTemplate:
+          errorMessage: "`postExtraInitContainers` does no longer exist. Please refer to the changelog and append an entry with a `container` key to `deployment.initContainers` instead."
+  - it: fails when the removed `preExtraInitContainers` value is set
+    set:
+      preExtraInitContainers:
+        - name: pre-init-container
+          image: docker.io/library/busybox
+    asserts:
+      - failedTemplate:
+          errorMessage: "`preExtraInitContainers` does no longer exist. Please refer to the changelog and prepend an entry with a `container` key to `deployment.initContainers` instead."
+  - it: fails when the removed `resources` value is set
+    set:
+      resources:
+        limits:
+          cpu: 100m
+    asserts:
+      - failedTemplate:
+          errorMessage: "`resources` does no longer exist. Please refer to the changelog and configure `deployment.gitea.resources` instead."
+  - it: fails when the removed `replicaCount` value is set
+    set:
+      replicaCount: 2
+    asserts:
+      - failedTemplate:
+          errorMessage: "`replicaCount` does no longer exist. Please refer to the changelog and configure `deployment.replicas` instead."
+  - it: fails when the removed `schedulerName` value is set
+    set:
+      schedulerName: stork
+    asserts:
+      - failedTemplate:
+          errorMessage: "`schedulerName` does no longer exist. Please refer to the changelog and configure `deployment.schedulerName` instead."
+  - it: fails when the removed `securityContext` value is set
+    set:
+      securityContext:
+        runAsUser: 1000
+    asserts:
+      - failedTemplate:
+          errorMessage: "`securityContext` does no longer exist. Please refer to the changelog and configure `deployment.securityContext` and `deployment.gitea.securityContext` instead."
+  - it: fails when the removed `strategy` value is set
+    set:
+      strategy:
+        type: Recreate
+    asserts:
+      - failedTemplate:
+          errorMessage: "`strategy` does no longer exist. Please refer to the changelog and configure `deployment.strategy` instead."
+  - it: fails when the removed `tolerations` value is set
+    set:
+      tolerations:
+        - key: database/type
+          operator: Equal
+          value: postgres
+          effect: NoSchedule
+    asserts:
+      - failedTemplate:
+          errorMessage: "`tolerations` does no longer exist. Please refer to the changelog and configure `deployment.tolerations` instead."
+  - it: fails when the removed `topologySpreadConstraints` value is set
+    set:
+      topologySpreadConstraints:
+        - topologyKey: kubernetes.io/hostname
+    asserts:
+      - failedTemplate:
+          errorMessage: "`topologySpreadConstraints` does no longer exist. Please refer to the changelog and configure `deployment.topologySpreadConstraints` instead."
+  - it: skips the deprecation checks when `checkDeprecation` is disabled
+    set:
+      checkDeprecation: false
+      affinity:
+        nodeAffinity: {}
+      containerSecurityContext:
+        runAsUser: 1000
+      deployment.env:
+        - name: VARIABLE
+          value: my-value
+      dnsConfig:
+        nameservers:
+          - 192.0.2.1
+      extraContainerVolumeMounts:
+        - name: postgres-ssl-vol
+          mountPath: /pg-ssl
+      extraVolumes:
+        - name: postgres-ssl-vol
+          secret:
+            secretName: gitea-postgres-ssl
+      nodeSelector:
+        foo: bar
+      podSecurityContext:
+        fsGroup: 1000
+      postExtraInitContainers:
+        - name: post-init-container
+          image: docker.io/library/busybox
+      preExtraInitContainers:
+        - name: pre-init-container
+          image: docker.io/library/busybox
+      priorityClassName: high-priority
+      replicaCount: 2
+      resources:
+        limits:
+          cpu: 100m
+      schedulerName: stork
+      securityContext:
+        runAsUser: 1000
+      strategy:
+        type: Recreate
+      tolerations:
+        - key: database/type
+          operator: Equal
+          value: postgres
+          effect: NoSchedule
+      topologySpreadConstraints:
+        - topologyKey: kubernetes.io/hostname
+    asserts:
+      - hasDocuments:
+          count: 0

unittests/helm/deployment/extraEnvSourceFile.yaml

@@ -0,0 +1,87 @@
+suite: deployment template (extraEnvSourceFile)
+release:
+  name: gitea-unittests
+  namespace: testing
+templates:
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
+tests:
+  - it: uses direct execution when extraEnvSourceFile is not set
+    template: templates/gitea/deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[1].command
+          value: ["/usr/sbinx/config_environment.sh"]
+      - notExists:
+          path: spec.template.spec.initContainers[1].args
+      - equal:
+          path: spec.template.spec.initContainers[2].command
+          value: ["/usr/sbinx/configure_gitea.sh"]
+      - notExists:
+          path: spec.template.spec.initContainers[2].args
+
+  - it: sources env file in init-app-ini when extraEnvSourceFile is set
+    template: templates/gitea/deployment.yaml
+    set:
+      gitea:
+        extraEnvSourceFile: /vault/secrets/gitea
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[1].command
+          value: ["/bin/bash", "-c"]
+      - matchRegex:
+          path: spec.template.spec.initContainers[1].args[0]
+          pattern: source /vault/secrets/gitea
+      - matchRegex:
+          path: spec.template.spec.initContainers[1].args[0]
+          pattern: config_environment\.sh
+
+  - it: sources env file in configure-gitea when extraEnvSourceFile is set
+    template: templates/gitea/deployment.yaml
+    set:
+      gitea:
+        extraEnvSourceFile: /vault/secrets/gitea
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[2].command
+          value: ["/bin/bash", "-c"]
+      - matchRegex:
+          path: spec.template.spec.initContainers[2].args[0]
+          pattern: source /vault/secrets/gitea
+      - matchRegex:
+          path: spec.template.spec.initContainers[2].args[0]
+          pattern: configure_gitea\.sh
+
+  - it: sources env file in configure-gpg when extraEnvSourceFile is set with signing enabled
+    template: templates/gitea/deployment.yaml
+    set:
+      secrets.gpg.enabled: true
+      secrets.gpg.existingSecret.enabled: true
+      secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
+      gitea:
+        extraEnvSourceFile: /vault/secrets/gitea
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[2].command
+          value: ["/bin/bash", "-c"]
+      - matchRegex:
+          path: spec.template.spec.initContainers[2].args[0]
+          pattern: source /vault/secrets/gitea
+      - matchRegex:
+          path: spec.template.spec.initContainers[2].args[0]
+          pattern: configure_gpg_environment\.sh
+
+  - it: includes file existence check in source command
+    template: templates/gitea/deployment.yaml
+    set:
+      gitea:
+        extraEnvSourceFile: /vault/secrets/gitea
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[1].args[0]
+          pattern: "test -f /vault/secrets/gitea"

unittests/helm/deployment/extraInitContainers.yaml

@@ -3,57 +3,111 @@ release:
   name: gitea-unittests
   namespace: testing
 templates:
-  - templates/deployment.yaml
-  - templates/config.yaml
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
 tests:
   - it: Render the deployment (default)
     asserts:
       - hasDocuments:
           count: 1
-        template: templates/deployment.yaml
+        template: templates/gitea/deployment.yaml
       - lengthEqual:
           path: spec.template.spec.initContainers
           count: 3
-        template: templates/deployment.yaml
+        template: templates/gitea/deployment.yaml
 
   - it: Render the deployment (signing)
     set:
-      signing.enabled: true
+      secrets.gpg.enabled: true
+      secrets.gpg.existingSecret.enabled: true
+      secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
     asserts:
       - hasDocuments:
           count: 1
-        template: templates/deployment.yaml
+        template: templates/gitea/deployment.yaml
       - lengthEqual:
           path: spec.template.spec.initContainers
           count: 4
-        template: templates/deployment.yaml
+        template: templates/gitea/deployment.yaml
 
   - it: Render the deployment (extraInitContainers)
     set:
-      postExtraInitContainers:
-        - name: foo
-          image: docker.io/library/busybox:latest
-      preExtraInitContainers:
-        - name: bar
-          image: docker.io/library/busybox:latest
-      signing.enabled: true
+      deployment.initContainers:
+        - container:
+            name: bar
+            image: docker.io/library/busybox:latest
+        - link: "initDirectories"
+        - link: "initAppIni"
+        - link: "initConfigureGPG"
+        - link: "initConfigureGitea"
+        - container:
+            name: foo
+            image: docker.io/library/busybox:latest
+      secrets.gpg.enabled: true
+      secrets.gpg.existingSecret.enabled: true
+      secrets.gpg.existingSecret.secretName: "custom-gpg-secret"
     asserts:
       - hasDocuments:
           count: 1
-        template: templates/deployment.yaml
+        template: templates/gitea/deployment.yaml
       - lengthEqual:
           path: spec.template.spec.initContainers
           count: 6
-        template: templates/deployment.yaml
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
+        template: templates/gitea/deployment.yaml
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: bar
+        template: templates/gitea/deployment.yaml
+      - equal:
+          path: spec.template.spec.initContainers[5].name
+          value: foo
+        template: templates/gitea/deployment.yaml
+
+  - it: renders the chart-managed init containers in the configured order
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - link: "initConfigureGitea"
+        - link: "initDirectories"
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].name
+          value: configure-gitea
+      - equal:
+          path: spec.template.spec.initContainers[1].name
+          value: init-directories
+
+  - it: fails when an init container entry sets both container and link
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - link: "initDirectories"
+          container:
             name: foo
             image: docker.io/library/busybox:latest
-        template: templates/deployment.yaml
-      - contains:
-          path: spec.template.spec.initContainers
-          content:
-            name: bar
-            image: docker.io/library/busybox:latest
-        template: templates/deployment.yaml
+    asserts:
+      - failedTemplate:
+          errorMessage: "deployment.initContainers[0]: `container` and `link` are mutually exclusive"
+
+  - it: fails when an init container entry sets neither container nor link
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - name: foo
+    asserts:
+      - failedTemplate:
+          errorMessage: "deployment.initContainers[0]: either `container` or `link` must be set"
+
+  - it: fails when an init container links to an unknown configuration
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initContainers:
+        - link: "initSomething"
+    asserts:
+      - failedTemplate:
+          errorMessage: "deployment.initContainers[0]: unknown link `initSomething`, expected one of: initAppIni, initConfigureGPG, initConfigureGitea, initDirectories"

unittests/helm/deployment/image-configuration.yaml

@@ -6,41 +6,46 @@ chart:
   # Override appVersion to be consistent with used digest :)
   appVersion: 1.19.3
 templates:
-  - templates/deployment.yaml
-  - templates/config.yaml
+  - templates/gitea/deployment.yaml
+  - templates/gitea/secret_admin.yaml
+  - templates/gitea/secret_config.yaml
+  - templates/gitea/secret_gpg.yaml
+  - templates/gitea/secret_init.yaml
+  - templates/gitea/secret_inlineConfig.yaml
+  - templates/gitea/secret_metrics.yaml
 tests:
   - it: default values
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3-rootless"
   - it: tag override
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image.tag: "1.19.4"
+      deployment.gitea.image.tag: "1.19.4"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.4-rootless"
   - it: root-based image
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image.rootless: false
+      deployment.gitea.image.rootless: false
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3"
   - it: scoped registry
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image.registry: "example.com"
+      deployment.gitea.image.registry: "example.com"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "example.com/gitea:1.19.3-rootless"
   - it: global registry
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       global.imageRegistry: "global.example.com"
     asserts:
@@ -48,53 +53,63 @@ tests:
           path: spec.template.spec.containers[0].image
           value: "global.example.com/gitea:1.19.3-rootless"
   - it: digest for rootless image
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image:
-        rootless: true
-        digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
+      deployment:
+        gitea:
+          image:
+            rootless: true
+            digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3-rootless@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
   - it: image fullOverride (does not append rootless)
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image:
-        fullOverride: docker.gitea.com/gitea:1.19.3
-        # setting rootless, registry, repository, tag, and digest to prove that override works
-        rootless: true
-        registry: example.com
-        repository: example/image
-        tag: "1.0.0"
-        digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
+      deployment:
+        gitea:
+          image:
+            fullOverride: docker.gitea.com/gitea:1.19.3
+            # setting rootless, registry, repository, tag, and digest to prove that override works
+            rootless: true
+            registry: example.com
+            repository: example/image
+            tag: "1.0.0"
+            digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3"
   - it: digest for root-based image
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image:
-        rootless: false
-        digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
+      deployment:
+        gitea:
+          image:
+            rootless: false
+            digest: sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.19.3@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
   - it: digest and global registry
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
       global.imageRegistry: "global.example.com"
-      image.digest: "sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
+      deployment.gitea.image.digest: "sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "global.example.com/gitea:1.19.3-rootless@sha256:b28e8f3089b52ebe6693295df142f8c12eff354e9a4a5bfbb5c10f296c3a537a"
   - it: correctly renders floating tag references
-    template: templates/deployment.yaml
+    template: templates/gitea/deployment.yaml
     set:
-      image.tag: 1.21 # use non-quoted value on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
+      # use non-quoted values on purpose. See: https://gitea.com/gitea/helm-gitea/issues/631
+      deployment.gitea.image.tag: 1.21
+      deployment.initDirectories.image.tag: 1.21
+      deployment.initAppIni.image.tag: 1.21
+      deployment.initConfigureGitea.image.tag: 1.21
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].image
@@ -108,3 +123,18 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].image
           value: "docker.gitea.com/gitea:1.21-rootless"
+  - it: init containers use their own image configuration
+    template: templates/gitea/deployment.yaml
+    set:
+      deployment.initDirectories.image.registry: "init.example.com"
+      deployment.initDirectories.image.tag: "1.19.4"
+    asserts:
+      - equal:
+          path: spec.template.spec.initContainers[0].image
+          value: "init.example.com/gitea:1.19.4-rootless"
+      - equal:
+          path: spec.template.spec.initContainers[1].image
+          value: "docker.gitea.com/gitea:1.19.3-rootless"
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: "docker.gitea.com/gitea:1.19.3-rootless"

unittests/helm/deployment/ingress-configuration.yaml

@@ -1,45 +0,0 @@
-suite: Test ingress tpl use
-templates:
-  - templates/ingress.yaml
-tests:
-  - it: Ingress Class using TPL
-    set:
-      global.ingress.className: "ingress-class"
-      ingress.className: "{{ .Values.global.ingress.className }}"
-      ingress.enabled: true
-      ingress.hosts[0].host: "some-host"
-      ingress.tls:
-        - secretName: gitea-tls
-          hosts:
-            - "some-host"
-    asserts:
-      - isKind:
-          of: Ingress
-      - equal:
-          path: spec.tls[0].hosts[0]
-          value: "some-host"
-      - equal:
-          path: spec.rules[0].host
-          value: "some-host"
-      - equal:
-          path: spec.ingressClassName
-          value: "ingress-class"
-
-  - it: hostname using TPL
-    set:
-      global.giteaHostName: "gitea.example.com"
-      ingress.enabled: true
-      ingress.hosts[0].host: "{{ .Values.global.giteaHostName }}"
-      ingress.tls:
-        - secretName: gitea-tls
-          hosts:
-            - "{{ .Values.global.giteaHostName }}"
-    asserts:
-      - isKind:
-          of: Ingress
-      - equal:
-          path: spec.tls[0].hosts[0]
-          value: "gitea.example.com"
-      - equal:
-          path: spec.rules[0].host
-          value: "gitea.example.com"