Enhance Helm chart with ServiceAccount support and configurable ports

- Updated Chart.yaml to version 0.2.0 and added annotations for changes.
- Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases.
- Introduced ServiceAccount configuration in values.yaml and related templates.
- Adjusted internal container ports to prevent conflicts between nginx and aptly.
- Updated README.md and NOTES.txt to reflect new configurations and usage instructions.

charts/aptly/templates/NOTES.txt

@@ -15,7 +15,7 @@ aptly ({{ .Chart.AppVersion }}, chart {{ .Chart.Version }}) is deploying as {{ $
 --- Check it's up -------------------------------------------------------
 
   kubectl exec -n {{ .Release.Namespace }} {{ $fullname }}-0 -c aptly -- \
-    curl -fsS http://127.0.0.1:8080/api/ready
+    curl -fsS http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready
 
   kubectl logs -n {{ .Release.Namespace }} job/{{ $fullname }}-reconcile
     # (only present right after install/upgrade in `hook` mode)

charts/aptly/templates/_helpers.tpl

@@ -73,6 +73,19 @@ confirms it's intended.
 {{- end -}}
 {{- end -}}
 
+{{/*
+Resolves to the ServiceAccount name the pod should bind to: a generated or
+overridden name when serviceAccount.create is true, the explicit override
+when false, or "" (falls back to the namespace's "default" SA) otherwise.
+*/}}
+{{- define "aptly.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- default (include "aptly.fullname" .) .Values.serviceAccount.name -}}
+{{- else -}}
+{{- .Values.serviceAccount.name -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "aptly.imagePullSecrets" -}}
 {{- $secrets := concat (.Values.global.imagePullSecrets | default list) (.Values.image.pullSecrets | default list) -}}
 {{- if $secrets }}
@@ -94,7 +107,7 @@ templates/statefulset.yaml (the aptly config) and templates/ingress.yaml
 {{- end -}}
 
 {{- define "aptly.apiListen" -}}
-{{- if .Values.proxy.enabled -}}127.0.0.1:8080{{- else -}}0.0.0.0:8080{{- end -}}
+{{- if .Values.proxy.enabled -}}127.0.0.1:{{ .Values.ports.aptly }}{{- else -}}0.0.0.0:{{ .Values.ports.aptly }}{{- end -}}
 {{- end -}}
 
 {{/*
@@ -163,7 +176,7 @@ compose/config/nginx.*.conf for the same constraint hit empirically).
 {{- $sec := include "aptly.security" . | fromJson -}}
 {{- $p := .Values.proxy -}}
 server {
-  listen 8080;
+  listen {{ .Values.ports.nginx }};
   server_name _;
   client_max_body_size {{ $p.maxUploadSize }};
   absolute_redirect off;
@@ -176,8 +189,8 @@ server {
 {{- end }}
 
   location = /healthz { access_log off; return 200 "ok\n"; }
-  location = /api/ready   { access_log off; proxy_pass http://127.0.0.1:8080; }
-  location = /api/healthy { access_log off; proxy_pass http://127.0.0.1:8080; }
+  location = /api/ready   { access_log off; proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; }
+  location = /api/healthy { access_log off; proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; }
 
 {{- if $sec.w }}
   location /api/ {
@@ -200,7 +213,7 @@ server {
 {{- else }}
     auth_basic off;
 {{- end }}
-    proxy_pass              http://127.0.0.1:8080;
+    proxy_pass              http://127.0.0.1:{{ .Values.ports.aptly }};
     proxy_http_version      1.1;
     proxy_set_header        Host $host;
     proxy_request_buffering off;
@@ -254,9 +267,9 @@ server {
 # Separate, unauthenticated listener so scraping never needs the write-path
 # credentials and a ServiceMonitor never needs a basicAuth secret.
 server {
-  listen 9090;
+  listen {{ .Values.ports.metrics }};
   server_name _;
-  location = /api/metrics { proxy_pass http://127.0.0.1:8080; }
+  location = /api/metrics { proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; }
   location / { return 404; }
 }
 {{- end }}

charts/aptly/templates/job-reconcile.yaml

@@ -39,6 +39,10 @@ spec:
     spec:
       restartPolicy: Never
       {{- include "aptly.imagePullSecrets" . | nindent 6 }}
+      {{- with include "aptly.serviceAccountName" . }}
+      serviceAccountName: {{ . }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:

charts/aptly/templates/networkpolicy.yaml

@@ -15,7 +15,7 @@ spec:
   ingress:
     {{- if .Values.networkPolicy.allowedNamespaces }}
     # Restricted to these namespaces (plus this one). NOTE: this applies to
-    # the whole nginx:8080 endpoint — read and write share one port, so this
+    # the whole nginx endpoint — read and write share one port, so this
     # cannot itself express "reads are public, writes are cluster-only" any
     # more precisely than security.write.allowCIDRs can (see the warning
     # rendered into nginx.conf for that). Use it to fence the Service off

charts/aptly/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "aptly.serviceAccountName" . }}
+  labels:
+    {{- include "aptly.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end -}}

charts/aptly/templates/statefulset.yaml

@@ -41,6 +41,10 @@ spec:
         {{- end }}
     spec:
       {{- include "aptly.imagePullSecrets" . | nindent 6 }}
+      {{- with include "aptly.serviceAccountName" . }}
+      serviceAccountName: {{ . }}
+      {{- end }}
+      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
       terminationGracePeriodSeconds: {{ .Values.workload.terminationGracePeriodSeconds }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
@@ -165,7 +169,7 @@ spec:
           {{- end }}
           ports:
             - name: aptly
-              containerPort: 8080
+              containerPort: {{ .Values.ports.aptly }}
           volumeMounts:
             - name: data
               mountPath: /var/lib/aptly
@@ -199,10 +203,10 @@ spec:
             {{- toYaml .Values.nginx.securityContext | nindent 12 }}
           ports:
             - name: http
-              containerPort: 8080
+              containerPort: {{ .Values.ports.nginx }}
             {{- if .Values.metrics.service.enabled }}
             - name: metrics
-              containerPort: 9090
+              containerPort: {{ .Values.ports.metrics }}
             {{- end }}
           volumeMounts:
             - name: data