fix

2023-10-23 21:30:01 +02:00
parent 9f284f3ea3
commit 63c82580ac
23 changed files with 3372 additions and 288 deletions
--- a/apps/gitea/apps_v1_Deployment_gitea-memcached.yaml
+++ b/apps/gitea/apps_v1_Deployment_gitea-memcached.yaml
@@ -1,89 +0,0 @@
-# Source: gitea/charts/memcached/templates/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gitea-memcached
-  namespace: vynil-ci
-  labels:
-    app.kubernetes.io/name: memcached
-    helm.sh/chart: memcached-6.3.14
-    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/managed-by: Helm
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: memcached
-      app.kubernetes.io/instance: gitea
-  replicas: 1
-  strategy:
-    rollingUpdate: {}
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: memcached
-        helm.sh/chart: memcached-6.3.14
-        app.kubernetes.io/instance: gitea
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-    spec:
-      
-      affinity:
-        podAffinity:
-          
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: memcached
-                    app.kubernetes.io/instance: gitea
-                topologyKey: kubernetes.io/hostname
-              weight: 1
-        nodeAffinity:
-          
-      securityContext:
-        fsGroup: 1001
-      serviceAccountName: default
-      containers:
-        - name: memcached
-          image: docker.io/bitnami/memcached:1.6.19-debian-11-r7
-          imagePullPolicy: "IfNotPresent"
-          securityContext:
-            runAsNonRoot: true
-            runAsUser: 1001
-          env:
-            - name: BITNAMI_DEBUG
-              value: "false"
-            - name: MEMCACHED_PORT_NUMBER
-              value: "11211"
-          ports:
-            - name: memcache
-              containerPort: 11211
-          livenessProbe:
-            failureThreshold: 6
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-            tcpSocket:
-              port: memcache
-          readinessProbe:
-            failureThreshold: 6
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            successThreshold: 1
-            timeoutSeconds: 3
-            tcpSocket:
-              port: memcache
-          resources:
-            limits: {}
-            requests:
-              cpu: 250m
-              memory: 256Mi
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-      volumes:
-        - name: tmp
-          emptyDir: {}
--- a/apps/gitea/apps_v1_Deployment_gitea-postgresql-ha-pgpool.yaml
+++ b/apps/gitea/apps_v1_Deployment_gitea-postgresql-ha-pgpool.yaml
@@ -0,0 +1,140 @@
+# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea-postgresql-ha-pgpool
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: pgpool
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: gitea
+      app.kubernetes.io/name: postgresql-ha
+      app.kubernetes.io/component: pgpool
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: gitea
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: postgresql-ha
+        helm.sh/chart: postgresql-ha-11.9.4
+        app.kubernetes.io/component: pgpool
+    spec:
+      
+      affinity:
+        podAffinity:
+          
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/instance: gitea
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: pgpool
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+        nodeAffinity:
+          
+      securityContext:
+        fsGroup: 1001
+      # Auxiliary vars to populate environment variables
+      containers:
+        - name: pgpool
+          image: docker.io/bitnami/pgpool:4.4.4-debian-11-r24
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
+            runAsNonRoot: true
+            runAsUser: 1001
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: PGPOOL_BACKEND_NODES
+              value: 0:gitea-postgresql-ha-postgresql-0.gitea-postgresql-ha-postgresql-headless:5432,1:gitea-postgresql-ha-postgresql-1.gitea-postgresql-ha-postgresql-headless:5432,2:gitea-postgresql-ha-postgresql-2.gitea-postgresql-ha-postgresql-headless:5432,
+            - name: PGPOOL_SR_CHECK_USER
+              value: "repmgr"
+            - name: PGPOOL_SR_CHECK_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-postgresql-ha-postgresql
+                  key: repmgr-password
+            - name: PGPOOL_SR_CHECK_DATABASE
+              value: "postgres"
+            - name: PGPOOL_ENABLE_LDAP
+              value: "no"
+            - name: PGPOOL_POSTGRES_USERNAME
+              value: "gitea"
+            - name: PGPOOL_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-postgresql-ha-postgresql
+                  key: password
+            - name: PGPOOL_ADMIN_USERNAME
+              value: "admin"
+            - name: PGPOOL_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-postgresql-ha-pgpool
+                  key: admin-password
+            - name: PGPOOL_AUTHENTICATION_METHOD
+              value: "scram-sha-256"
+            - name: PGPOOL_ENABLE_LOAD_BALANCING
+              value: "yes"
+            - name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
+              value: "transaction"
+            - name: PGPOOL_ENABLE_LOG_CONNECTIONS
+              value: "no"
+            - name: PGPOOL_ENABLE_LOG_HOSTNAME
+              value: "yes"
+            - name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
+              value: "no"
+            - name: PGPOOL_RESERVED_CONNECTIONS
+              value: '1'
+            - name: PGPOOL_CHILD_LIFE_TIME
+              value: ""
+            - name: PGPOOL_ENABLE_TLS
+              value: "no"
+            - name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
+              value: "6"
+          envFrom:
+          ports:
+            - name: postgresql
+              containerPort: 5432
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 5
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+            exec:
+              command:
+                - /opt/bitnami/scripts/pgpool/healthcheck.sh
+          readinessProbe:
+            failureThreshold: 5
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            successThreshold: 1
+            timeoutSeconds: 5
+            exec:
+              command:
+                - bash
+                - -ec
+                - PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
+          resources:
+            limits: {}
+            requests: {}
--- a/apps/gitea/apps_v1_StatefulSet_gitea.yaml
+++ b/apps/gitea/apps_v1_StatefulSet_gitea.yaml
@@ -1,36 +1,40 @@
-# Source: gitea/templates/gitea/statefulset.yaml
+# Source: gitea/templates/gitea/deployment.yaml
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
  name: gitea
  annotations:
  labels:
-    helm.sh/chart: gitea-8.3.0
+    helm.sh/chart: gitea-9.5.1
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.19.3"
-    version: "1.19.3"
+    app.kubernetes.io/version: "1.20.5"
+    version: "1.20.5"
    app.kubernetes.io/managed-by: Helm
 spec:
  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 100%
  selector:
    matchLabels:
      app.kubernetes.io/name: gitea
      app.kubernetes.io/instance: gitea
-  serviceName: gitea
  template:
    metadata:
      annotations:
-        checksum/config: 27af0e4460a4b6fa0279e60d04c3d82609060dda7af59dd2051139acc1cdb203
+        checksum/config: 72e9f265887a3c590ee592f44e642a853eb0644a78dd50445883f2e2991fc207
        checksum/ldap_0: 9356e28431e375c7fc7d624460a9f41c243f14c3f9765c40aa2b13cf46203eaf
      labels:
-        helm.sh/chart: gitea-8.3.0
+        helm.sh/chart: gitea-9.5.1
        app: gitea
        app.kubernetes.io/name: gitea
        app.kubernetes.io/instance: gitea
-        app.kubernetes.io/version: "1.19.3"
-        version: "1.19.3"
+        app.kubernetes.io/version: "1.20.5"
+        version: "1.20.5"
        app.kubernetes.io/managed-by: Helm
    spec:
      
@@ -38,7 +42,7 @@ spec:
        fsGroup: 1000
      initContainers:
        - name: init-directories
-          image: "gitea/gitea:1.19.3"
+          image: "gitea/gitea:1.20.5-rootless"
          imagePullPolicy: Always
          command: ["/usr/sbin/init_directory_structure.sh"]
          env:
@@ -50,8 +54,6 @@ spec:
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
-            - name: TZ
-              value: Europe/Paris
          volumeMounts:
            - name: init
              mountPath: /usr/sbin
@@ -70,7 +72,7 @@ spec:
              cpu: 100m
              memory: 128Mi
        - name: init-app-ini
-          image: "gitea/gitea:1.19.3"
+          image: "gitea/gitea:1.20.5-rootless"
          imagePullPolicy: Always
          command: ["/usr/sbin/config_environment.sh"]
          env:
@@ -82,8 +84,6 @@ spec:
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
-            - name: TZ
-              value: Europe/Paris
            - name: ENV_TO_INI__DATABASE__LOG_SQL
              value: "false"
            - name: ENV_TO_INI__LOG__LEVEL
@@ -108,7 +108,7 @@ spec:
              cpu: 100m
              memory: 128Mi
        - name: configure-gitea
-          image: "gitea/gitea:1.19.3"
+          image: "gitea/gitea:1.20.5-rootless"
          command: ["/usr/sbin/configure_gitea.sh"]
          imagePullPolicy: Always
          securityContext:
@@ -125,6 +125,8 @@ spec:
              value: /data
            - name: GITEA_TEMP
              value: /tmp/gitea
+            - name: HOME
+              value: /data/gitea/git
            - name: GITEA_LDAP_BIND_DN_0
              valueFrom:
                secretKeyRef:
@@ -145,8 +147,6 @@ spec:
                secretKeyRef:
                  key:  password
                  name: gitea-admin-user
-            - name: TZ
-              value: Europe/Paris
          volumeMounts:
            - name: init
              mountPath: /usr/sbin
@@ -163,7 +163,7 @@ spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: gitea
-          image: "gitea/gitea:1.19.3"
+          image: "gitea/gitea:1.20.5-rootless"
          imagePullPolicy: Always
          env:
            # SSH Port values have to be set here as well for openssh configuration
@@ -171,8 +171,6 @@ spec:
              value: "2222"
            - name: SSH_PORT
              value: "2222"
-            - name: SSH_LOG_LEVEL
-              value: "INFO"
            - name: GITEA_APP_INI
              value: /data/gitea/conf/app.ini
            - name: GITEA_CUSTOM
@@ -183,8 +181,8 @@ spec:
              value: /tmp/gitea
            - name: TMPDIR
              value: /tmp/gitea
-            - name: TZ
-              value: Europe/Paris
+            - name: HOME
+              value: /data/gitea/git
          ports:
            - name: ssh
              containerPort: 2222
@@ -236,12 +234,6 @@ spec:
            secretName: gitea-inline-config
        - name: temp
          emptyDir: {}
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes:
-            - "ReadWriteOnce"        
-        resources:
-          requests:
-            storage: "10Gi"
+        - name: data
+          persistentVolumeClaim:
+            claimName: gitea-shared-storage
--- a/apps/gitea/apps_v1_StatefulSet_gitea-postgresql-ha-postgresql.yaml
+++ b/apps/gitea/apps_v1_StatefulSet_gitea-postgresql-ha-postgresql.yaml
@@ -0,0 +1,222 @@
+# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-postgresql-ha-postgresql
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: postgresql
+    role: data
+spec:
+  replicas: 3
+  podManagementPolicy: Parallel
+  serviceName: gitea-postgresql-ha-postgresql-headless
+  updateStrategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: gitea
+      app.kubernetes.io/name: postgresql-ha
+      app.kubernetes.io/component: postgresql
+      role: data
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: gitea
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: postgresql-ha
+        helm.sh/chart: postgresql-ha-11.9.4
+        app.kubernetes.io/component: postgresql
+        role: data
+    spec:
+      
+      affinity:
+        podAffinity:
+          
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/instance: gitea
+                    app.kubernetes.io/name: postgresql-ha
+                    app.kubernetes.io/component: postgresql
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+        nodeAffinity:
+          
+      securityContext:
+        fsGroup: 1001
+      hostNetwork: false
+      hostIPC: false
+      containers:
+        - name: postgresql
+          image: docker.io/bitnami/postgresql-repmgr:15.4.0-debian-11-r31
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
+            runAsNonRoot: true
+            runAsUser: 1001
+            seccompProfile:
+              type: RuntimeDefault
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /pre-stop.sh
+                  - "25"
+          # Auxiliary vars to populate environment variables
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            # PostgreSQL configuration
+            - name: POSTGRESQL_VOLUME_DIR
+              value: "/bitnami/postgresql"
+            - name: PGDATA
+              value: "/bitnami/postgresql/data"
+            - name: POSTGRES_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-postgresql-ha-postgresql
+                  key: postgres-password
+            - name: POSTGRES_USER
+              value: "gitea"
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-postgresql-ha-postgresql
+                  key: password
+            - name: POSTGRES_DB
+              value: "gitea"
+            - name: POSTGRESQL_LOG_HOSTNAME
+              value: "true"
+            - name: POSTGRESQL_LOG_CONNECTIONS
+              value: "false"
+            - name: POSTGRESQL_LOG_DISCONNECTIONS
+              value: "false"
+            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
+              value: "off"
+            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
+              value: "error"
+            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
+              value: "pgaudit, repmgr"
+            - name: POSTGRESQL_ENABLE_TLS
+              value: "no"
+            - name: POSTGRESQL_PORT_NUMBER
+              value: "5432"
+            # Repmgr configuration
+            - name: REPMGR_PORT_NUMBER
+              value: "5432"
+            - name: REPMGR_PRIMARY_PORT
+              value: "5432"
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: REPMGR_UPGRADE_EXTENSION
+              value: "no"
+            - name: REPMGR_PGHBA_TRUST_ALL
+              value: "no"
+            - name: REPMGR_MOUNTED_CONF_DIR
+              value: "/bitnami/repmgr/conf"
+            - name: REPMGR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: REPMGR_PARTNER_NODES
+              value: gitea-postgresql-ha-postgresql-0.gitea-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,gitea-postgresql-ha-postgresql-1.gitea-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,gitea-postgresql-ha-postgresql-2.gitea-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
+            - name: REPMGR_PRIMARY_HOST
+              value: "gitea-postgresql-ha-postgresql-0.gitea-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
+            - name: REPMGR_NODE_NAME
+              value: "$(MY_POD_NAME)"
+            - name: REPMGR_NODE_NETWORK_NAME
+              value: "$(MY_POD_NAME).gitea-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
+            - name: REPMGR_NODE_TYPE
+              value: "data"
+            - name: REPMGR_LOG_LEVEL
+              value: "NOTICE"
+            - name: REPMGR_CONNECT_TIMEOUT
+              value: "5"
+            - name: REPMGR_RECONNECT_ATTEMPTS
+              value: "2"
+            - name: REPMGR_RECONNECT_INTERVAL
+              value: "3"
+            - name: REPMGR_USERNAME
+              value: "repmgr"
+            - name: REPMGR_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-postgresql-ha-postgresql
+                  key: repmgr-password
+            - name: REPMGR_DATABASE
+              value: "repmgr"
+            - name: REPMGR_FENCE_OLD_PRIMARY
+              value: "no"
+            - name: REPMGR_CHILD_NODES_CHECK_INTERVAL
+              value: "5"
+            - name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
+              value: "1"
+            - name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
+              value: "30"
+          envFrom:
+          ports:
+            - name: postgresql
+              containerPort: 5432
+              protocol: TCP
+          livenessProbe:
+            failureThreshold: 6
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+            exec:
+              command:
+                - bash
+                - -ec
+                - 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
+          readinessProbe:
+            failureThreshold: 6
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+            exec:
+              command:
+                - bash
+                - -ec
+                - 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
+          resources:
+            limits: {}
+            requests: {}
+          volumeMounts:
+            - name: data
+              mountPath: /bitnami/postgresql
+            - name: hooks-scripts
+              mountPath: /pre-stop.sh
+              subPath: pre-stop.sh
+            - name: hooks-scripts
+              mountPath: /readiness-probe.sh
+              subPath: readiness-probe.sh
+      volumes:
+        - name: hooks-scripts
+          configMap:
+            name: gitea-postgresql-ha-postgresql-hooks-scripts
+            defaultMode: 0755
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "8Gi"
--- a/apps/gitea/apps_v1_StatefulSet_gitea-redis-cluster.yaml
+++ b/apps/gitea/apps_v1_StatefulSet_gitea-redis-cluster.yaml
@@ -0,0 +1,159 @@
+# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-redis-cluster
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis-cluster
+    helm.sh/chart: redis-cluster-9.0.12
+spec:
+  updateStrategy:
+    rollingUpdate:
+      partition: 0
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: gitea
+      app.kubernetes.io/name: redis-cluster
+  replicas: 6
+  serviceName: gitea-redis-cluster-headless
+  podManagementPolicy: Parallel
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: gitea
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: redis-cluster
+        helm.sh/chart: redis-cluster-9.0.12
+      annotations:
+        checksum/scripts: cbf3399b02d0908e20e159938d15f440a8785a796d325966eec5ad1109862886
+        checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+        checksum/config: 71b60dc7a64c569f8d3f81c1897f0d50077adbfeffbbf13ce0a1ac0520ab1a6e
+    spec:
+      hostNetwork: false
+      enableServiceLinks: false
+      
+      securityContext:
+        fsGroup: 1001
+        runAsUser: 1001
+        sysctls: []
+      serviceAccountName: default
+      affinity:
+        podAffinity:
+          
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/instance: gitea
+                    app.kubernetes.io/name: redis-cluster
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+        nodeAffinity:
+          
+      containers:
+        - name: gitea-redis-cluster
+          image: docker.io/bitnami/redis-cluster:7.2.1-debian-11-r26
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1001
+          command: ['/bin/bash', '-c']
+          args:
+            - |
+              # Backwards compatibility change
+              if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
+                  echo COPYING FILE
+                  cp  /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
+              fi
+              pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
+              pod_index="${pod_index[-1]}"
+              if [[ "$pod_index" == "0" ]]; then
+                export REDIS_CLUSTER_CREATOR="yes"
+                export REDIS_CLUSTER_REPLICAS="1"
+              fi
+              /opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: REDIS_NODES
+              value: "gitea-redis-cluster-0.gitea-redis-cluster-headless gitea-redis-cluster-1.gitea-redis-cluster-headless gitea-redis-cluster-2.gitea-redis-cluster-headless gitea-redis-cluster-3.gitea-redis-cluster-headless gitea-redis-cluster-4.gitea-redis-cluster-headless gitea-redis-cluster-5.gitea-redis-cluster-headless "
+            - name: ALLOW_EMPTY_PASSWORD
+              value: "yes"
+            - name: REDIS_AOF_ENABLED
+              value: "yes"
+            - name: REDIS_TLS_ENABLED
+              value: "no"
+            - name: REDIS_PORT_NUMBER
+              value: "6379"
+          ports:
+            - name: tcp-redis
+              containerPort: 6379
+            - name: tcp-redis-bus
+              containerPort: 16379
+          livenessProbe:
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            # One second longer than command timeout should prevent generation of zombie processes.
+            timeoutSeconds: 6
+            successThreshold: 1
+            failureThreshold: 5
+            exec:
+              command:
+                - sh
+                - -c
+                - /scripts/ping_liveness_local.sh 5
+          readinessProbe:
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            # One second longer than command timeout should prevent generation of zombie processes.
+            timeoutSeconds: 2
+            successThreshold: 1
+            failureThreshold: 5
+            exec:
+              command:
+                - sh
+                - -c
+                - /scripts/ping_readiness_local.sh 1
+          resources:
+            limits: {}
+            requests: {}
+          volumeMounts:
+            - name: scripts
+              mountPath: /scripts
+            - name: redis-data
+              mountPath: /bitnami/redis/data
+              subPath: 
+            - name: default-config
+              mountPath: /opt/bitnami/redis/etc/redis-default.conf
+              subPath: redis-default.conf
+            - name: redis-tmp-conf
+              mountPath: /opt/bitnami/redis/etc/
+      volumes:
+        - name: scripts
+          configMap:
+            name: gitea-redis-cluster-scripts
+            defaultMode: 0755
+        - name: default-config
+          configMap:
+            name: gitea-redis-cluster-default
+        - name: redis-tmp-conf
+          emptyDir: {}
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+        labels:
+          app.kubernetes.io/instance: gitea
+          app.kubernetes.io/name: redis-cluster
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: "8Gi"
--- a/apps/gitea/index.rhai
+++ b/apps/gitea/index.rhai
@@ -4,7 +4,7 @@ const SRC=src;
 const DEST=dest;
 fn pre_pack() {
    shell("helm repo add gitea-charts https://dl.gitea.io/charts/");
-    shell(`helm template gitea --version 8.3.0 gitea-charts/gitea --namespace=vynil-ci --values values.yml >${global::SRC}/chart.yaml`);
+    shell(`helm template gitea --version 9.5.1 gitea-charts/gitea --namespace=vynil-ci --values values.yml >${global::SRC}/chart.yaml`);
 }
 fn post_pack() {
    shell(`rm -f ${global::DEST}/v1_Pod_gitea-test-connection.yaml`);
--- a/apps/gitea/index.yaml
+++ b/apps/gitea/index.yaml
@@ -9,6 +9,36 @@ metadata:
    A painless self-hosted Git service.
    Gitea is a community managed lightweight code hosting solution written in Go. It is published under the MIT license.
 options:
+  app-group:
+    default: dev
+    examples:
+    - dev
+    type: string
+  timezone:
+    default: Europe/Paris
+    examples:
+    - Europe/Paris
+    type: string
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
+    type: string
+  webhook:
+    default:
+      allowed-hosts: private
+      skip-tls-verify: false
+    examples:
+    - allowed-hosts: private
+      skip-tls-verify: false
+    properties:
+      allowed-hosts:
+        default: private
+        type: string
+      skip-tls-verify:
+        default: false
+        type: boolean
+    type: object
  backups:
    default:
      enable: false
@@ -115,11 +145,6 @@ options:
        default: false
        type: boolean
    type: object
-  app-group:
-    default: dev
-    examples:
-    - dev
-    type: string
  domain:
    default: your-company
    examples:
@@ -130,46 +155,6 @@ options:
    examples:
    - letsencrypt-prod
    type: string
-  theme:
-    default: gitea-modern
-    examples:
-    - gitea-modern
-    type: string
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
-  push-create:
-    default:
-      org: 'true'
-      private: 'false'
-      user: 'true'
-    examples:
-    - org: 'true'
-      private: 'false'
-      user: 'true'
-    properties:
-      org:
-        default: 'true'
-        type: string
-      private:
-        default: 'false'
-        type: string
-      user:
-        default: 'true'
-        type: string
-    type: object
-  volume:
-    default:
-      size: 10Gi
-    examples:
-    - size: 10Gi
-    properties:
-      size:
-        default: 10Gi
-        type: string
-    type: object
  load-balancer:
    default:
      ip: ''
@@ -180,36 +165,6 @@ options:
        default: ''
        type: string
    type: object
-  postgres:
-    default:
-      replicas: 1
-      storage: 10Gi
-      version: '14'
-    examples:
-    - replicas: 1
-      storage: 10Gi
-      version: '14'
-    properties:
-      replicas:
-        default: 1
-        type: integer
-      storage:
-        default: 10Gi
-        type: string
-      version:
-        default: '14'
-        type: string
-    type: object
-  ssh-port:
-    default: 2222
-    examples:
-    - 2222
-    type: integer
-  default-branch:
-    default: main
-    examples:
-    - main
-    type: string
  images:
    default:
      gitea:
@@ -273,6 +228,66 @@ options:
            type: string
        type: object
    type: object
+  release:
+    default: 8.3.0
+    examples:
+    - 8.3.0
+    type: string
+  sub-domain:
+    default: git
+    examples:
+    - git
+    type: string
+  ssh-port:
+    default: 2222
+    examples:
+    - 2222
+    type: integer
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
+  default-branch:
+    default: main
+    examples:
+    - main
+    type: string
+  theme:
+    default: gitea-modern
+    examples:
+    - gitea-modern
+    type: string
+  disable-registration:
+    default: true
+    examples:
+    - true
+    type: boolean
+  replicas:
+    default: 1
+    examples:
+    - 1
+    type: integer
+  push-create:
+    default:
+      org: 'true'
+      private: 'false'
+      user: 'true'
+    examples:
+    - org: 'true'
+      private: 'false'
+      user: 'true'
+    properties:
+      org:
+        default: 'true'
+        type: string
+      private:
+        default: 'false'
+        type: string
+      user:
+        default: 'true'
+        type: string
+    type: object
  admin:
    default:
      email: git-admin@git.your_company.com
@@ -288,51 +303,36 @@ options:
        default: gitea_admin
        type: string
    type: object
-  disable-registration:
-    default: true
-    examples:
-    - true
-    type: boolean
-  sub-domain:
-    default: git
-    examples:
-    - git
-    type: string
-  release:
-    default: 8.3.0
-    examples:
-    - 8.3.0
-    type: string
-  replicas:
-    default: 1
-    examples:
-    - 1
-    type: integer
-  webhook:
+  volume:
    default:
-      allowed-hosts: private
-      skip-tls-verify: false
+      size: 10Gi
    examples:
-    - allowed-hosts: private
-      skip-tls-verify: false
+    - size: 10Gi
    properties:
-      allowed-hosts:
-        default: private
+      size:
+        default: 10Gi
        type: string
-      skip-tls-verify:
-        default: false
-        type: boolean
    type: object
-  timezone:
-    default: Europe/Paris
+  postgres:
+    default:
+      replicas: 1
+      storage: 10Gi
+      version: '14'
    examples:
-    - Europe/Paris
-    type: string
-  ingress-class:
-    default: traefik
-    examples:
-    - traefik
-    type: string
+    - replicas: 1
+      storage: 10Gi
+      version: '14'
+    properties:
+      replicas:
+        default: 1
+        type: integer
+      storage:
+        default: 10Gi
+        type: string
+      version:
+        default: '14'
+        type: string
+    type: object
 dependencies:
 - dist: null
  category: share
--- a/apps/gitea/v1_ConfigMap_gitea-postgresql-ha-postgresql-hooks-scripts.yaml
+++ b/apps/gitea/v1_ConfigMap_gitea-postgresql-ha-postgresql-hooks-scripts.yaml
@@ -0,0 +1,134 @@
+# Source: gitea/charts/postgresql-ha/templates/postgresql/hooks-scripts-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-postgresql-ha-postgresql-hooks-scripts
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: postgresql
+data:
+  pre-stop.sh: |-
+    #!/bin/bash
+    set -o errexit
+    set -o pipefail
+    set -o nounset
+
+    # Debug section
+    exec 3>&1
+    exec 4>&2
+
+    # Process input parameters
+    MIN_DELAY_AFTER_PG_STOP_SECONDS=$1
+
+    # Load Libraries
+    . /opt/bitnami/scripts/liblog.sh
+    . /opt/bitnami/scripts/libpostgresql.sh
+    . /opt/bitnami/scripts/librepmgr.sh
+
+    # Load PostgreSQL & repmgr environment variables
+    . /opt/bitnami/scripts/postgresql-env.sh
+
+    # Auxiliary functions
+    is_new_primary_ready() {
+        return_value=1
+        currenty_primary_node="$(repmgr_get_primary_node)"
+        currenty_primary_host="$(echo $currenty_primary_node | awk '{print $1}')"
+
+        info "$currenty_primary_host != $REPMGR_NODE_NETWORK_NAME"
+        if [[ $(echo $currenty_primary_node | wc -w) -eq 2 ]] && [[ "$currenty_primary_host" != "$REPMGR_NODE_NETWORK_NAME" ]]; then
+            info "New primary detected, leaving the cluster..."
+            return_value=0
+        else
+            info "Waiting for a new primary to be available..."
+        fi
+        return $return_value
+    }
+
+    export MODULE="pre-stop-hook"
+
+    if [[ "${BITNAMI_DEBUG}" == "true" ]]; then
+        info "Bash debug is on"
+    else
+        info "Bash debug is off"
+        exec 1>/dev/null
+        exec 2>/dev/null
+    fi
+
+    postgresql_enable_nss_wrapper
+
+    # Prepare env vars for managing roles
+    readarray -t primary_node < <(repmgr_get_upstream_node)
+    primary_host="${primary_node[0]}"
+
+    # Stop postgresql for graceful exit.
+    PG_STOP_TIME=$EPOCHSECONDS
+    postgresql_stop
+
+    if [[ -z "$primary_host" ]] || [[ "$primary_host" == "$REPMGR_NODE_NETWORK_NAME" ]]; then
+        info "Primary node need to wait for a new primary node before leaving the cluster"
+        retry_while is_new_primary_ready 10 5
+    else
+        info "Standby node doesn't need to wait for a new primary switchover. Leaving the cluster"
+    fi
+
+    # Make sure pre-stop hook waits at least 25 seconds after stop of PG to make sure PGPOOL detects node is down.
+    # default terminationGracePeriodSeconds=30 seconds
+    PG_STOP_DURATION=$(($EPOCHSECONDS - $PG_STOP_TIME))
+    if (( $PG_STOP_DURATION < $MIN_DELAY_AFTER_PG_STOP_SECONDS )); then
+        WAIT_TO_PG_POOL_TIME=$(($MIN_DELAY_AFTER_PG_STOP_SECONDS - $PG_STOP_DURATION)) 
+        info "PG stopped including primary switchover in $PG_STOP_DURATION. Waiting additional $WAIT_TO_PG_POOL_TIME seconds for PG pool"
+        sleep $WAIT_TO_PG_POOL_TIME
+    fi
+
+  readiness-probe.sh: |-
+    #!/bin/bash
+    set -o errexit
+    set -o pipefail
+    set -o nounset
+
+    # Debug section
+    exec 3>&1
+    exec 4>&2
+
+    # Load Libraries
+    . /opt/bitnami/scripts/liblog.sh
+    . /opt/bitnami/scripts/libpostgresql.sh
+
+    # Load PostgreSQL & repmgr environment variables
+    . /opt/bitnami/scripts/postgresql-env.sh
+
+    # Process input parameters
+    MIN_DELAY_AFTER_POD_READY_FIRST_TIME=$1
+    TMP_FIRST_READY_FILE_TS="/tmp/ts-first-ready.mark"
+    TMP_DELAY_APPLIED_FILE="/tmp/delay-applied.mark"
+
+
+    DB_CHECK_RESULT=$(echo "SELECT 1" | postgresql_execute "$POSTGRESQL_DATABASE" "$POSTGRESQL_USERNAME" "$POSTGRESQL_PASSWORD" "-h 127.0.0.1 -tA" || "command failed")
+    if [[ "$DB_CHECK_RESULT" == "1" ]]; then
+      if [[ ! -f "$TMP_DELAY_APPLIED_FILE" ]]; then
+        # DB up, but initial readiness delay not applied
+        if [[ -f "$TMP_FIRST_READY_FILE_TS" ]]; then
+          # calculate delay from the first readiness success
+          FIRST_READY_TS=$(cat $TMP_FIRST_READY_FILE_TS)
+          CURRENT_DELAY_SECONDS=$(($EPOCHSECONDS - $FIRST_READY_TS))
+          if (( $CURRENT_DELAY_SECONDS > $MIN_DELAY_AFTER_POD_READY_FIRST_TIME )); then
+            # minimal delay of the first readiness state passed - report success and mark delay as applied
+            touch "$TMP_DELAY_APPLIED_FILE"      
+          else
+            # minimal delay of the first readiness state not reached yet - report failure
+            return 1
+          fi
+        else
+          # first ever readiness test success - store timestamp and report failure
+          echo $EPOCHSECONDS > $TMP_FIRST_READY_FILE_TS
+          return 1
+        fi
+      fi
+    else
+      # DB test failed - report failure
+      return 1
+    fi
--- a/apps/gitea/v1_ConfigMap_gitea-redis-cluster-default.yaml
+++ b/apps/gitea/v1_ConfigMap_gitea-redis-cluster-default.yaml
--- a/apps/gitea/v1_ConfigMap_gitea-redis-cluster-scripts.yaml
+++ b/apps/gitea/v1_ConfigMap_gitea-redis-cluster-scripts.yaml
@@ -0,0 +1,72 @@
+# Source: gitea/charts/redis-cluster/templates/scripts-configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: gitea-redis-cluster-scripts
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis-cluster
+    helm.sh/chart: redis-cluster-9.0.12
+data:
+  ping_readiness_local.sh: |-
+    #!/bin/sh
+    set -e
+
+    REDIS_STATUS_FILE=/tmp/.redis_cluster_check
+    if [ ! -z "$REDIS_PASSWORD" ]; then export REDISCLI_AUTH=$REDIS_PASSWORD; fi;
+    response=$(
+      timeout -s 15 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT_NUMBER \
+        ping
+    )
+    if [ "$?" -eq "124" ]; then
+      echo "Timed out"
+      exit 1
+    fi
+    if [ "$response" != "PONG" ]; then
+      echo "$response"
+      exit 1
+    fi
+    if [ ! -f "$REDIS_STATUS_FILE" ]; then
+      response=$(
+        timeout -s 15 $1 \
+        redis-cli \
+          -h localhost \
+          -p $REDIS_PORT_NUMBER \
+          CLUSTER INFO | grep cluster_state | tr -d '[:space:]'
+      )
+      if [ "$?" -eq "124" ]; then
+        echo "Timed out"
+        exit 1
+      fi
+      if [ "$response" != "cluster_state:ok" ]; then
+        echo "$response"
+        exit 1
+      else
+        touch "$REDIS_STATUS_FILE"
+      fi
+    fi
+  ping_liveness_local.sh: |-
+    #!/bin/sh
+    set -e
+    if [ ! -z "$REDIS_PASSWORD" ]; then export REDISCLI_AUTH=$REDIS_PASSWORD; fi;
+    response=$(
+      timeout -s 15 $1 \
+      redis-cli \
+        -h localhost \
+        -p $REDIS_PORT_NUMBER \
+        ping
+    )
+    if [ "$?" -eq "124" ]; then
+      echo "Timed out"
+      exit 1
+    fi
+    responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
+    if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
+      echo "$response"
+      exit 1
+    fi
--- a/apps/gitea/v1_PersistentVolumeClaim_gitea-shared-storage.yaml
+++ b/apps/gitea/v1_PersistentVolumeClaim_gitea-shared-storage.yaml
@@ -0,0 +1,15 @@
+# Source: gitea/templates/gitea/pvc.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: gitea-shared-storage
+  namespace: vynil-ci
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 10Gi
--- a/apps/gitea/v1_Secret_gitea-init.yaml
+++ b/apps/gitea/v1_Secret_gitea-init.yaml
@@ -4,12 +4,12 @@ kind: Secret
 metadata:
  name: gitea-init
  labels:
-    helm.sh/chart: gitea-8.3.0
+    helm.sh/chart: gitea-9.5.1
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.19.3"
-    version: "1.19.3"
+    app.kubernetes.io/version: "1.20.5"
+    version: "1.20.5"
    app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:
@@ -24,14 +24,12 @@ stringData:
    set -euo pipefail

    set -x
-    chown 1000:1000 /data
    mkdir -p /data/git/.ssh
    chmod -R 700 /data/git/.ssh
    [ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf

    # prepare temp directory structure
    mkdir -p "${GITEA_TEMP}"
-    chown 1000:1000 "${GITEA_TEMP}"
    chmod ug+rwx "${GITEA_TEMP}"

    
@@ -49,6 +47,24 @@ stringData:
      echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
      exit 1
    }
+    function test_redis_connection() {
+      local RETRY=0
+      local MAX=30
+      
+      echo 'Wait for redis to become avialable...'
+      until [ "${RETRY}" -ge "${MAX}" ]; do
+        nc -vz -w2 gitea-redis-cluster-headless.vynil-ci.svc.cluster.local 6379 && break
+        RETRY=$[${RETRY}+1]
+        echo "...not ready yet (${RETRY}/${MAX})"
+      done
+
+      if [ "${RETRY}" -ge "${MAX}" ]; then
+        echo "Redis not reachable after '${MAX}' attempts!"
+        exit 1
+      fi
+    }
+
+    test_redis_connection
    function configure_admin_user() {
      local ACCOUNT_ID=$(gitea admin user list --admin | grep -e "\s\+${GITEA_ADMIN_USERNAME}\s\+" | awk -F " " "{printf \$1}")
      if [[ -z "${ACCOUNT_ID}" ]]; then
--- a/apps/gitea/v1_Secret_gitea-postgresql-ha-pgpool.yaml
+++ b/apps/gitea/v1_Secret_gitea-postgresql-ha-pgpool.yaml
@@ -0,0 +1,16 @@
+---
+# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-postgresql-ha-pgpool
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: pgpool
+type: Opaque
+data:
+  admin-password: "Y2hhbmdlbWUz"
--- a/apps/gitea/v1_Secret_gitea-postgresql-ha-postgresql.yaml
+++ b/apps/gitea/v1_Secret_gitea-postgresql-ha-postgresql.yaml
@@ -0,0 +1,17 @@
+# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gitea-postgresql-ha-postgresql
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: postgresql
+type: Opaque
+data:
+  postgres-password: "Y2hhbmdlbWUx"
+  password: "Z2l0ZWE="
+  repmgr-password: "Y2hhbmdlbWUy"
--- a/apps/gitea/v1_Secret_gitea.yaml
+++ b/apps/gitea/v1_Secret_gitea.yaml
@@ -4,15 +4,16 @@ kind: Secret
 metadata:
  name: gitea
  labels:
-    helm.sh/chart: gitea-8.3.0
+    helm.sh/chart: gitea-9.5.1
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.19.3"
-    version: "1.19.3"
+    app.kubernetes.io/version: "1.20.5"
+    version: "1.20.5"
    app.kubernetes.io/managed-by: Helm
 type: Opaque
 stringData:
+  assertions: |
  config_environment.sh: |-
    #!/usr/bin/env bash
    set -euo pipefail
@@ -50,14 +51,14 @@ stringData:
      env2ini::log "    + '${setting}'"

      if [[ -z "${section}" ]]; then
-        export "ENV_TO_INI____${setting^^}=${value}"                           # '^^' makes the variable content uppercase
+        export "GITEA____${setting^^}=${value}"                           # '^^' makes the variable content uppercase
        return
      fi

      local masked_section="${section//./_0X2E_}"                            # '//' instructs to replace all matches
      masked_section="${masked_section//-/_0X2D_}"

-      export "ENV_TO_INI__${masked_section^^}__${setting^^}=${value}"        # '^^' makes the variable content uppercase
+      export "GITEA__${masked_section^^}__${setting^^}=${value}"        # '^^' makes the variable content uppercase
    }

    function env2ini::reload_preset_envs() {
@@ -131,15 +132,16 @@ stringData:
      #   - initially used to set up Gitea
      # Anyway, they won't harm existing app.ini files

-      export ENV_TO_INI__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
-      export ENV_TO_INI__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
-      export ENV_TO_INI__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
-      export ENV_TO_INI__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
+      export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
+      export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
+      export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
+      export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)

      env2ini::log "...Initial secrets generated\n"
    }
-
-    env | (grep ENV_TO_INI || [[ $? == 1 ]]) > /tmp/existing-envs
+    
+    # save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
+    env | (grep GITEA || [[ $? == 1 ]]) > /tmp/existing-envs
    
    # MUST BE CALLED BEFORE OTHER CONFIGURATION
    env2ini::generate_initial_secrets
@@ -160,10 +162,10 @@ stringData:
      env2ini::log '  - oauth2.JWT_SECRET'
      env2ini::log '  - server.LFS_JWT_SECRET'

-      unset ENV_TO_INI__SECURITY__INTERNAL_TOKEN
-      unset ENV_TO_INI__SECURITY__SECRET_KEY
-      unset ENV_TO_INI__OAUTH2__JWT_SECRET
-      unset ENV_TO_INI__SERVER__LFS_JWT_SECRET
+      unset GITEA__SECURITY__INTERNAL_TOKEN
+      unset GITEA__SECURITY__SECRET_KEY
+      unset GITEA__OAUTH2__JWT_SECRET
+      unset GITEA__SERVER__LFS_JWT_SECRET
    fi

-    environment-to-ini -o $GITEA_APP_INI -p ENV_TO_INI
+    environment-to-ini -o $GITEA_APP_INI
--- a/apps/gitea/v1_Service_gitea-http.yaml
+++ b/apps/gitea/v1_Service_gitea-http.yaml
@@ -4,12 +4,12 @@ kind: Service
 metadata:
  name: gitea-http
  labels:
-    helm.sh/chart: gitea-8.3.0
+    helm.sh/chart: gitea-9.5.1
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.19.3"
-    version: "1.19.3"
+    app.kubernetes.io/version: "1.20.5"
+    version: "1.20.5"
    app.kubernetes.io/managed-by: Helm
  annotations:
    {}
@@ -19,7 +19,7 @@ spec:
  ports:
  - name: http
    port: 3000
-    targetPort: 3000
+    targetPort: 
  selector:
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
--- a/apps/gitea/v1_Service_gitea-memcached.yaml
+++ b/apps/gitea/v1_Service_gitea-memcached.yaml
@@ -1,23 +0,0 @@
-# Source: gitea/charts/memcached/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitea-memcached
-  namespace: vynil-ci
-  labels:
-    app.kubernetes.io/name: memcached
-    helm.sh/chart: memcached-6.3.14
-    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-spec:
-  type: ClusterIP
-  sessionAffinity: None
-  ports:
-    - name: memcache
-      port: 11211
-      targetPort: memcache
-      nodePort: null
-  selector:
-    app.kubernetes.io/name: memcached
-    app.kubernetes.io/instance: gitea
--- a/apps/gitea/v1_Service_gitea-postgresql-ha-pgpool.yaml
+++ b/apps/gitea/v1_Service_gitea-postgresql-ha-pgpool.yaml
@@ -0,0 +1,25 @@
+# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgresql-ha-pgpool
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: pgpool
+spec:
+  type: ClusterIP
+  sessionAffinity: None
+  ports:
+    - name: "postgresql"
+      port: 5432
+      targetPort: postgresql
+      protocol: TCP
+      nodePort: null
+  selector:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: postgresql-ha
+    app.kubernetes.io/component: pgpool
--- a/apps/gitea/v1_Service_gitea-postgresql-ha-postgresql-headless.yaml
+++ b/apps/gitea/v1_Service_gitea-postgresql-ha-postgresql-headless.yaml
@@ -0,0 +1,25 @@
+# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgresql-ha-postgresql-headless
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: false
+  ports:
+    - name: "postgresql"
+      port: 5432
+      targetPort: postgresql
+      protocol: TCP
+  selector:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: postgresql-ha
+    app.kubernetes.io/component: postgresql
+    role: data
--- a/apps/gitea/v1_Service_gitea-postgresql-ha-postgresql.yaml
+++ b/apps/gitea/v1_Service_gitea-postgresql-ha-postgresql.yaml
@@ -0,0 +1,24 @@
+# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-postgresql-ha-postgresql
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql-ha
+    helm.sh/chart: postgresql-ha-11.9.4
+    app.kubernetes.io/component: postgresql
+spec:
+  type: ClusterIP
+  ports:
+    - name: "postgresql"
+      port: 5432
+      targetPort: postgresql
+      protocol: TCP
+  selector:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: postgresql-ha
+    app.kubernetes.io/component: postgresql
+    role: data
--- a/apps/gitea/v1_Service_gitea-redis-cluster-headless.yaml
+++ b/apps/gitea/v1_Service_gitea-redis-cluster-headless.yaml
@@ -0,0 +1,25 @@
+# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-redis-cluster-headless
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis-cluster
+    helm.sh/chart: redis-cluster-9.0.12
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: true
+  ports:
+    - name: tcp-redis
+      port: 6379
+      targetPort: tcp-redis
+    - name: tcp-redis-bus
+      port: 16379
+      targetPort: tcp-redis-bus
+  selector:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: redis-cluster
--- a/apps/gitea/v1_Service_gitea-redis-cluster.yaml
+++ b/apps/gitea/v1_Service_gitea-redis-cluster.yaml
@@ -0,0 +1,23 @@
+# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-redis-cluster
+  namespace: "vynil-ci"
+  labels:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: redis-cluster
+    helm.sh/chart: redis-cluster-9.0.12
+spec:
+  type: ClusterIP
+  sessionAffinity: None
+  ports:
+    - name: tcp-redis
+      port: 6379
+      targetPort: tcp-redis
+      protocol: TCP
+      nodePort: null
+  selector:
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/name: redis-cluster
--- a/apps/gitea/v1_Service_gitea-ssh.yaml
+++ b/apps/gitea/v1_Service_gitea-ssh.yaml
@@ -4,12 +4,12 @@ kind: Service
 metadata:
  name: gitea-ssh
  labels:
-    helm.sh/chart: gitea-8.3.0
+    helm.sh/chart: gitea-9.5.1
    app: gitea
    app.kubernetes.io/name: gitea
    app.kubernetes.io/instance: gitea
-    app.kubernetes.io/version: "1.19.3"
-    version: "1.19.3"
+    app.kubernetes.io/version: "1.20.5"
+    version: "1.20.5"
    app.kubernetes.io/managed-by: Helm
  annotations:
    metallb.universe.tf/address-pool: mlb-pool-public