feat(gitea): replace Bitnami PostgreSQL and Redis with CNPG and Valkey

[adamancini]

Summary

• Remove all four Bitnami subchart dependencies (postgresql, postgresql-ha, redis-cluster, redis) from the Gitea Helm chart
• Deploy PostgreSQL via CloudNativePG operator (same pattern as storagebox)
• Deploy Valkey (Redis-compatible) via the official valkey-io/valkey-helm chart as a subchart
• Wire Gitea to use these external services via gitea.config.database.* and gitea.config.cache/session/queue.*
• Add CNPG operator (0.27.0) and cert-manager (v1.19.1) as Embedded Cluster extensions
• Update EC version to 2.13.3+k8s-1.33 and ingress-nginx to 4.14.1
• Replace bitnami/kubectl image with registry.k8s.io/kubectl:v1.33.0
• Add KOTS config group for Valkey cache settings
• Default internal_postgres_enabled to true (aligns with Valkey which already defaults true)
• Bump chart version to 11.0.0
• Fix deprecated helm.sh/hook: test-success annotation to test
• Add CI workflow (gitea-ci.yml) with lint-and-template and helm-install-test jobs
• Add Python smoke tests validating Gitea HTTP, CNPG PostgreSQL, and Valkey connectivity
• Add Makefile test targets (test-lint, test-install-operators, test-install, test-smoke, test-all)

Motivation

Bitnami is transitioning to a paid Broadcom subscription model after September 2025. Rather than forking/modifying the upstream Gitea chart templates, this disables the Bitnami subcharts and wires Gitea to operator-managed PostgreSQL and Valkey. The Gitea chart's _helpers.tpl already supports this — when subchart conditions are false, explicit gitea.config.* values take precedence.

External database support

The chart supports both embedded (CNPG) and external PostgreSQL. When postgres.embedded.enabled: false, no CNPG Cluster CR is created and Gitea connects to whatever gitea.config.database.HOST points to. The KOTS config exposes postgres_host as a user-editable field for this purpose.

Test plan

• helm dependency update charts/gitea resolves Valkey, no Bitnami
• helm lint charts/gitea passes
• helm template gitea charts/gitea --debug renders CNPG Cluster CR, Valkey subchart, and correct Gitea connection strings
• Verify gitea.config.database.HOST, cache.HOST, session.PROVIDER_CONFIG, queue.CONN_STR all point to correct services
• make package-and-update packages chart as gitea-11.0.0.tgz
• Deploy to CMX k3s 1.32 cluster and verify Gitea connects to CNPG PostgreSQL and Valkey
• Smoke tests pass: Gitea HTTP (v1.22.3), PostgreSQL TCP, Valkey TCP
• registry.k8s.io/kubectl:v1.33.0 resolves correctly (v prefix required)

Review feedback addressed

• kubectl image tag needs v prefix (v1.33.0 not 1.33.0) — fixed in 84f19d6
• Replicated SDK dependency — out of scope, tracked in Add Replicated SDK Chart to applications #105
• CNPG as EC extension vs subchart — explained: EC extensions install before the app, ensuring CRDs exist. For helm install, users can pre-install the operator or point to an external database.

Resolves #97

[xavpaice]

if we've removed redis, should we remove this stanza?

[adamancini]

the stanza is for upstream compatibility since we're vendoring the Gitea chart; if we completely remove the redis stanza we'll have to keep removing it on every rebase from upstream — since both redis-cluster.enabled and redis.enabled are false, it falls through to the Valkey branch.

[jmboby]

@adamancini I found this issue with the release:

# gitea-chart.yaml
#Line 50 | Error: unexpected "\\" in operand
#Error unable-to-render.

HOST: "redis://:repl{{ ConfigOption \"valkey_password\" }}@gitea-valkey:6379/0?pool_size=100&idle_timeout=180s&"

Naturally this is causing the Admin Console to fail spinning up:

[adamancini]

@adamancini I found this issue with the release:

```shell # gitea-chart.yaml #Line 50 | Error: unexpected "\\" in operand #Error unable-to-render.

HOST: "redis://:repl{{ ConfigOption "valkey_password" }}@gitea-valkey:6379/0?pool_size=100&idle_timeout=180s&"

Naturally this is causing the Admin Console to fail spinning up:

<img alt="image" width="1597" height="174" src="https://private-user-images.githubusercontent.com/14128934/551695813-9b06e404-fce2-4235-9142-7433574de02f.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzIxMTg5NjEsIm5iZiI6MTc3MjExODY2MSwicGF0aCI6Ii8xNDEyODkzNC81NTE2OTU4MTMtOWIwNmU0MDQtZmNlMi00MjM1LTkxNDItNzQzMzU3NGRlMDJmLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAyMjYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMjI2VDE1MTEwMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWIwNzk3ZDVjNjUwYmM3OTQzOTY5M2U4YjUxZGM0ZjIyZjQ5MDEzNmI0YjYwMDQwOWU4NzljNTcyMmY2MmU1YjMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.MYkESnx8fTOcZdQPQiZgFFeSGeZMeBRZOcQ6JwjEOQQ">

fixt

[scottrigby]

nice work @adamancini

good questions @jmboby. appreciated reading Ada's answers
I would have also asked the redis string one. making merging easier as Ada said makes sense.

lgtm

[scottrigby]

nice