add helm charts

2025-11-09 13:22:40 +03:30
parent 282c3e52d0
commit 38e4d749ad
1352 changed files with 190457 additions and 0 deletions
--- a/backing-services/gitea/charts/postgresql-ha/templates/NOTES.txt
+++ b/backing-services/gitea/charts/postgresql-ha/templates/NOTES.txt
@@ -0,0 +1,98 @@
+CHART NAME: {{ .Chart.Name }}
+CHART VERSION: {{ .Chart.Version }}
+APP VERSION: {{ .Chart.AppVersion }}
+
+{{- $releaseNamespace := include "common.names.namespace" . }}
+{{- $clusterDomain := .Values.clusterDomain }}
+{{- $postgresqlSecretName := include "postgresql-ha.postgresqlSecretName" . }}
+{{- $postgresqlUsername := include "postgresql-ha.postgresqlUsername" . }}
+{{- $postgresqlDatabase := include "postgresql-ha.postgresqlDatabase" . }}
+{{- $postgresqlCredentials := printf "-U %s%s" $postgresqlUsername (ternary "" (printf " -d %s" $postgresqlDatabase) (empty $postgresqlDatabase)) }}
+{{- $pgpoolSvcName := include "postgresql-ha.pgpool" . }}
+
+⚠ WARNING: Since August 28th, 2025, only a limited subset of images/charts are available for free.
+    Subscribe to Bitnami Secure Images to receive continued support and security updates.
+    More info at https://bitnami.com and https://github.com/bitnami/containers/issues/83267
+
+** Please be patient while the chart is being deployed **
+
+{{- if .Values.diagnosticMode.enabled }}
+The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with:
+
+  command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" .) | nindent 4 }}
+  args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" .) | nindent 4 }}
+
+Get the list of pods by executing:
+
+  kubectl get pods --namespace {{ $releaseNamespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
+
+Access the pod you want to debug by executing
+
+  kubectl exec --namespace {{ $releaseNamespace }} -ti <NAME OF THE POD> -- bash
+
+In order to replicate the container startup scripts, check the /opt/bitnami/scripts folder.
+
+  Default PostgreSQL startup command
+
+    /opt/bitnami/scripts/postgresql-repmgr/entrypoint.sh /opt/bitnami/scripts/postgresql-repmgr/run.sh
+
+  Default Pgpool-II startup command
+
+    /opt/bitnami/scripts/pgpool/entrypoint.sh /opt/bitnami/scripts/pgpool/run.sh
+
+{{- else }}
+PostgreSQL can be accessed through Pgpool-II via port {{ .Values.service.ports.postgresql }} on the following DNS name from within your cluster:
+
+    {{ $pgpoolSvcName }}.{{ $releaseNamespace }}.svc.{{ $clusterDomain }}
+
+Pgpool-II acts as a load balancer for PostgreSQL and forward read/write connections to the primary node while read-only connections are forwarded to standby nodes.
+
+To get the password for {{ $postgresqlUsername | quote }} user run:
+
+    {{ include "common.utils.secret.getvalue" (dict "secret" $postgresqlSecretName "field" "password" "context" $) }}
+
+To connect to your database run the following command:
+
+    kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ $releaseNamespace }} \
+        --image {{ include "postgresql-ha.postgresql.image" . }} --env="PGPASSWORD=$PASSWORD" {{ if and (.Values.pgpool.networkPolicy.enabled) (not .Values.pgpool.networkPolicy.allowExternal) }}--labels="{{ include "common.names.fullname" . }}-client=true" {{- end }} \
+        --command -- psql -h {{ $pgpoolSvcName }} -p {{ .Values.service.ports.postgresql }} {{ $postgresqlCredentials }}
+
+{{- if and .Values.pgpool.networkPolicy.enabled (not .Values.pgpool.networkPolicy.allowExternal) }}
+
+Note: Since NetworkPolicy is enabled, only pods with label "{{ $pgpoolSvcName }}-client=true" will be able to connect Pgpool-II.
+
+{{- end }}
+
+To connect to your database from outside the cluster execute the following commands:
+
+{{- if contains "NodePort" .Values.service.type }}
+
+    export NODE_IP=$(kubectl get nodes --namespace {{ $releaseNamespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+    export NODE_PORT=$(kubectl get --namespace {{ $releaseNamespace }} -o jsonpath="{.spec.ports[0].nodePort}" svc {{ $pgpoolSvcName }})
+    PGPASSWORD="$PASSWORD" psql -h $NODE_IP -p $NODE_PORT {{ $postgresqlCredentials }}
+
+{{- else if contains "LoadBalancer" .Values.service.type }}
+
+  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+        Watch the status with: 'kubectl get svc --namespace {{ $releaseNamespace }} -w {{ $pgpoolSvcName }}
+
+    export SERVICE_IP=$(kubectl get svc --namespace {{ $releaseNamespace }} {{ $pgpoolSvcName }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
+    PGPASSWORD="$PASSWORD" psql -h $SERVICE_IP -p {{ .Values.service.ports.postgresql }} {{ $postgresqlCredentials }}
+
+{{- else if contains "ClusterIP" .Values.service.type }}
+
+    kubectl port-forward --namespace {{ $releaseNamespace }} svc/{{ $pgpoolSvcName }} {{ .Values.service.ports.postgresql }}:{{ .Values.service.ports.postgresql }} &
+    psql -h 127.0.0.1 -p {{ .Values.service.ports.postgresql }} {{ $postgresqlCredentials }}
+
+{{- end }}
+{{- end }}
+
+{{- include "postgresql-ha.validateValues" . }}
+{{- $resourcesSections := list "postgresql" "pgpool" }}
+{{- if .Values.witness.create }}
+    {{- $resourcesSections = append $resourcesSections "witness" }}
+{{- end }}
+{{- include "postgresql-ha.checkRollingTags" . }}
+{{- include "common.warnings.resources" (dict "sections" $resourcesSections "context" .) }}
+{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.metrics.image .Values.volumePermissions.image) "context" .) }}
+{{- include "common.errors.insecureImages" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.metrics.image .Values.volumePermissions.image) "context" .) }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/_helpers.tpl
+++ b/backing-services/gitea/charts/postgresql-ha/templates/_helpers.tpl
@@ -0,0 +1,452 @@
+{{/*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Fully qualified app name for PostgreSQL
+*/}}
+{{- define "postgresql-ha.postgresql" -}}
+{{- printf "%s-postgresql" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Fully qualified app name for Pgpool-II
+*/}}
+{{- define "postgresql-ha.pgpool" -}}
+{{- printf "%s-pgpool" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Fully qualified app name for LDAP
+*/}}
+{{- define "postgresql-ha.ldap" -}}
+{{- printf "%s-ldap" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "postgresql-ha.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the proper PostgreSQL image name
+*/}}
+{{- define "postgresql-ha.postgresql.image" -}}
+{{- include "common.images.image" ( dict "imageRoot" .Values.postgresql.image "global" .Values.global ) -}}
+{{- end -}}
+
+{{/*
+Return the proper Pgpool-II image name
+*/}}
+{{- define "postgresql-ha.pgpool.image" -}}
+{{- include "common.images.image" ( dict "imageRoot" .Values.pgpool.image "global" .Values.global ) -}}
+{{- end -}}
+
+{{/*
+Return the proper PostgreSQL Prometheus exporter image name
+*/}}
+{{- define "postgresql-ha.volumePermissions.image" -}}
+{{- include "common.images.image" ( dict "imageRoot" .Values.volumePermissions.image "global" .Values.global ) -}}
+{{- end -}}
+
+{{/*
+Return the proper PostgreSQL Prometheus exporter image name
+*/}}
+{{- define "postgresql-ha.metrics.image" -}}
+{{- include "common.images.image" ( dict "imageRoot" .Values.metrics.image "global" .Values.global ) -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names
+*/}}
+{{- define "postgresql-ha.image.pullSecrets" -}}
+{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.postgresql.image .Values.pgpool.image .Values.volumePermissions.image .Values.metrics.image) "context" $) -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL username
+*/}}
+{{- define "postgresql-ha.postgresqlUsername" -}}
+{{- coalesce ((.Values.global).postgresql).username .Values.postgresql.username | default "" -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL database to create
+*/}}
+{{- define "postgresql-ha.postgresqlDatabase" -}}
+{{- coalesce ((.Values.global).postgresql).database .Values.postgresql.database "postgres" -}}
+{{- end -}}
+
+{{/*
+Return the Pgpool Admin username
+*/}}
+{{- define "postgresql-ha.pgpoolAdminUsername" -}}
+{{- coalesce ((.Values.global).pgpool).adminUsername .Values.pgpool.adminUsername | default "" -}}
+{{- end -}}
+
+
+{{/*
+Return the Pgpool-II SR Check username
+*/}}
+{{- define "postgresql-ha.pgoolSrCheckUsername" -}}
+{{- coalesce ((.Values.global).pgpool).srCheckUsername .Values.pgpool.srCheckUsername | default "" -}}
+{{- end -}}
+
+{{/*
+Get the metrics ConfigMap name.
+*/}}
+{{- define "postgresql.metricsCM" -}}
+{{- printf "%s-metrics" (include "common.names.fullname" .) -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL Repmgr username
+*/}}
+{{- define "postgresql-ha.postgresqlRepmgrUsername" -}}
+{{- coalesce ((.Values.global).postgresql).repmgrUsername .Values.postgresql.repmgrUsername | default "" -}}
+{{- end -}}
+
+{{/*
+Return the database to use for Repmgr
+*/}}
+{{- define "postgresql-ha.repmgrDatabase" -}}
+{{- coalesce ((.Values.global).postgresql).repmgrDatabase .Values.postgresql.repmgrDatabase | default "" -}}
+{{- end -}}
+
+{{/*
+Return true if the PostgreSQL credential secret has a separate entry for the postgres user
+*/}}
+{{- define "postgresql-ha.postgresqlSeparatePostgresPassword" -}}
+{{- if (include "postgresql-ha.postgresqlCreateSecret" .) -}}
+    {{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
+        {{- true -}}
+    {{- end -}}
+{{- else -}}
+    {{- $pgSecret := index (lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .)) "data" -}}
+    {{- if and $pgSecret (index $pgSecret "postgres-password") -}}
+        {{- true -}}
+    {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return true if a secret object should be created for PostgreSQL
+*/}}
+{{- define "postgresql-ha.postgresqlCreateSecret" -}}
+{{- if empty (coalesce ((.Values.global).postgresql).existingSecret .Values.postgresql.existingSecret | default "") -}}
+    {{- true -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL credentials secret.
+*/}}
+{{- define "postgresql-ha.postgresqlSecretName" -}}
+{{- if include "postgresql-ha.postgresqlCreateSecret" . -}}
+    {{- print (include "postgresql-ha.postgresql" .) -}}
+{{- else }}
+    {{- print (tpl (coalesce ((.Values.global).postgresql).existingSecret .Values.postgresql.existingSecret) .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return true if a secret object should be created for Pgpool-II
+*/}}
+{{- define "postgresql-ha.pgpoolCreateSecret" -}}
+{{- if empty (coalesce ((.Values.global).pgpool).existingSecret .Values.pgpool.existingSecret | default "") -}}
+    {{- true -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the Pgpool credentials secret.
+*/}}
+{{- define "postgresql-ha.pgpoolSecretName" -}}
+{{- if include "postgresql-ha.pgpoolCreateSecret" . -}}
+    {{- print (include "postgresql-ha.pgpool" .) -}}
+{{- else }}
+    {{- print (tpl (coalesce ((.Values.global).pgpool).existingSecret .Values.pgpool.existingSecret) .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL configuration ConfigMap
+*/}}
+{{- define "postgresql-ha.postgresqlConfigurationCM" -}}
+{{- if .Values.postgresql.configurationCM -}}
+    {{- print (tpl .Values.postgresql.configurationCM .) -}}
+{{- else -}}
+    {{- printf "%s-configuration" (include "postgresql-ha.postgresql" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL extended configuration ConfigMap
+*/}}
+{{- define "postgresql-ha.postgresqlExtendedConfCM" -}}
+{{- if .Values.postgresql.extendedConfCM -}}
+    {{- print (tpl .Values.postgresql.extendedConfCM .) -}}
+{{- else -}}
+    {{- printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the Pgpool-II configuration ConfigMap
+*/}}
+{{- define "postgresql-ha.pgpoolConfigurationCM" -}}
+{{- if .Values.pgpool.configurationCM -}}
+    {{- print (tpl .Values.pgpool.configurationCM .) -}}
+{{- else -}}
+    {{- printf "%s-configuration" (include "postgresql-ha.pgpool" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the PostgreSQL initdb scripts ConfigMap
+*/}}
+{{- define "postgresql-ha.postgresqlInitdbScriptsCM" -}}
+{{- if .Values.postgresql.initdbScriptsCM -}}
+    {{- print (tpl .Values.postgresql.initdbScriptsCM .) -}}
+{{- else -}}
+    {{- printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get the initialization scripts Secret name.
+*/}}
+{{- define "postgresql-ha.postgresqlInitdbScriptsSecret" -}}
+{{- if .Values.postgresql.initdbScriptsSecret -}}
+{{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScriptsSecret "context" $) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the Pgpool-II initdb scripts configmap.
+*/}}
+{{- define "postgresql-ha.pgpoolInitdbScriptsCM" -}}
+{{- if .Values.pgpool.initdbScriptsCM -}}
+{{- printf "%s" (tpl .Values.pgpool.initdbScriptsCM $) -}}
+{{- else -}}
+{{- printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get the pgpool initialization scripts Secret name.
+*/}}
+{{- define "postgresql-ha.pgpoolInitdbScriptsSecret" -}}
+{{- if .Values.pgpool.initdbScriptsSecret -}}
+{{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScriptsSecret "context" $) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the LDAP bind password
+*/}}
+{{- define "postgresql-ha.ldapPassword" -}}
+{{- coalesce ((.Values.global).ldap).bindpw .Values.ldap.bindpw (randAlphaNum 10) -}}
+{{- end -}}
+
+{{/*
+Return true if a secret object should be created for LDAP
+*/}}
+{{- define "postgresql-ha.ldapCreateSecret" -}}
+{{- if empty (coalesce ((.Values.global).ldap).existingSecret .Values.ldap.existingSecret | default "") -}}
+    {{- true -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the LDAP credentials secret.
+*/}}
+{{- define "postgresql-ha.ldapSecretName" -}}
+{{- if include "postgresql-ha.ldapCreateSecret" . -}}
+    {{- print (include "postgresql-ha.ldap" .) -}}
+{{- else }}
+    {{- print (tpl (coalesce ((.Values.global).ldap).existingSecret .Values.ldap.existingSecret) .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Check if there are rolling tags in the images */}}
+{{- define "postgresql-ha.checkRollingTags" -}}
+{{- include "common.warnings.rollingTag" .Values.postgresql.image -}}
+{{- include "common.warnings.rollingTag" .Values.pgpool.image -}}
+{{- include "common.warnings.rollingTag" .Values.metrics.image -}}
+{{- include "common.warnings.rollingTag" .Values.volumePermissions.image -}}
+{{- end -}}
+
+{{/*
+Compile all warnings into a single message, and call fail.
+*/}}
+{{- define "postgresql-ha.validateValues" -}}
+{{- $messages := list -}}
+{{- $messages := append $messages (include "postgresql-ha.validateValues.nodesHostnames" .) -}}
+{{- $messages := append $messages (include "postgresql-ha.validateValues.ldap" .) -}}
+{{- $messages := append $messages (include "postgresql-ha.validateValues.ldapPgHba" .) -}}
+{{- $messages := append $messages (include "postgresql-ha.validateValues.upgradeRepmgrExtension" .) -}}
+{{- $messages := without $messages "" -}}
+{{- $message := join "\n" $messages -}}
+
+{{- if $message -}}
+{{-   printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Validate values of PostgreSQL HA - PostgreSQL nodes hostnames cannot be longer than 128 characters */}}
+{{- define "postgresql-ha.validateValues.nodesHostnames" -}}
+{{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
+{{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
+{{- $nodeHostname := printf "%s-00.%s" $postgresqlFullname $postgresqlHeadlessServiceName }}
+{{- if gt (len $nodeHostname) 128 -}}
+postgresql-ha: Nodes hostnames
+    PostgreSQL nodes hostnames ({{ $nodeHostname }}) exceeds the characters limit for Pgpool: 128.
+    Consider using a shorter release name or namespace.
+{{- end -}}
+{{- end -}}
+
+{{/* Validate values of PostgreSQL HA - must provide mandatory LDAP parameters when LDAP is enabled */}}
+{{- define "postgresql-ha.validateValues.ldap" -}}
+{{- if and .Values.ldap.enabled (or (empty .Values.ldap.uri) (empty .Values.ldap.basedn) (empty .Values.ldap.binddn) (and (empty .Values.ldap.bindpw) (empty .Values.ldap.existingSecret))) -}}
+postgresql-ha: LDAP
+    Invalid LDAP configuration. When enabling LDAP support, the parameters "ldap.uri",
+    "ldap.basedn", "ldap.binddn", and "ldap.bindpw" are mandatory. Please provide them:
+
+    $ helm install {{ .Release.Name }} oci://registry-1.docker.io/bitnamicharts/postgresql-ha \
+      --set ldap.enabled=true \
+      --set ldap.uri="ldap://my_ldap_server" \
+      --set ldap.basedn="dc=example\,dc=org" \
+      --set ldap.binddn="cn=admin\,dc=example\,dc=org" \
+      --set ldap.bindpw="admin"
+{{- end -}}
+{{- end -}}
+
+{{/* Validate values of PostgreSQL HA - PostgreSQL HBA configuration must trust every user when LDAP is enabled */}}
+{{- define "postgresql-ha.validateValues.ldapPgHba" -}}
+{{- if and .Values.ldap.enabled (not .Values.postgresql.pgHbaTrustAll) }}
+postgresql-ha: LDAP & pg_hba.conf
+    PostgreSQL HBA configuration must trust every user when LDAP is enabled.
+    Please configure HBA to trust every user (--set postgresql.pgHbaTrustAll=true)
+{{- end -}}
+{{- end -}}
+
+{{/* Validate values of PostgreSQL HA - There must be an unique replica when upgrading repmgr extension */}}
+{{- define "postgresql-ha.validateValues.upgradeRepmgrExtension" -}}
+{{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
+{{- if and .Values.postgresql.upgradeRepmgrExtension (gt $postgresqlReplicaCount 1) }}
+postgresql-ha: Upgrade repmgr extension
+    There must be only one replica when upgrading repmgr extension:
+
+    $ helm upgrade {{ .Release.Name }} oci://registry-1.docker.io/bitnamicharts/postgresql-ha \
+      --set postgresql.replicaCount=1 \
+      --set postgresql.upgradeRepmgrExtension=true
+{{- end -}}
+{{- end -}}
+
+{{/* Set PostgreSQL PGPASSWORD as environment variable depends on configuration */}}
+{{- define "postgresql-ha.pgpassword" -}}
+{{- if .Values.postgresql.usePasswordFiles -}}
+PGPASSWORD=$(< $POSTGRES_PASSWORD_FILE)
+{{- else -}}
+PGPASSWORD=$POSTGRES_PASSWORD
+{{- end -}}
+{{- end -}}
+
+{{/* Set Pgpool-II PGPASSWORD as environment variable depends on configuration */}}
+{{- define "postgresql-ha.pgpoolPostgresPassword" -}}
+{{- if .Values.postgresql.usePasswordFiles -}}
+PGPASSWORD=$(< $PGPOOL_POSTGRES_PASSWORD_FILE)
+{{- else -}}
+PGPASSWORD=$PGPOOL_POSTGRES_PASSWORD
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the Pgpool-II secret containing custom users to be added to pool_passwd file.
+*/}}
+{{- define "postgresql-ha.pgpoolCustomUsersSecretName" -}}
+{{- if .Values.pgpool.customUsersSecret -}}
+    {{- print (tpl .Values.pgpool.customUsersSecret .) -}}
+{{- else -}}
+    {{- printf "%s-custom-users" (include "postgresql-ha.pgpool" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the path to the cert file.
+*/}}
+{{- define "postgresql-ha.pgpool.tlsCert" -}}
+{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }}
+    {{- printf "/opt/bitnami/pgpool/certs/tls.crt" -}}
+{{- else -}}
+    {{- required "Certificate filename is required when TLS in enabled" .Values.pgpool.tls.certFilename | printf "/opt/bitnami/pgpool/certs/%s" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the path to the cert key file.
+*/}}
+{{- define "postgresql-ha.pgpool.tlsCertKey" -}}
+{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }}
+    {{- printf "/opt/bitnami/pgpool/certs/tls.key" -}}
+{{- else -}}
+    {{- required "Certificate Key filename is required when TLS in enabled" .Values.pgpool.tls.certKeyFilename | printf "/opt/bitnami/pgpool/certs/%s" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the path to the CA cert file.
+*/}}
+{{- define "postgresql-ha.pgpool.tlsCACert" -}}
+{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated }}
+    {{- printf "/opt/bitnami/pgpool/certs/ca.crt" -}}
+{{- else -}}
+    {{- printf "/opt/bitnami/pgpool/certs/%s" .Values.pgpool.tls.certCAFilename -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return true if a TLS credentials secret object should be created
+*/}}
+{{- define "postgresql-ha.createTlsSecret" -}}
+{{- if and .Values.pgpool.tls.enabled .Values.pgpool.tls.autoGenerated (not .Values.pgpool.tls.certificatesSecret) }}
+    {{- true -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the path to the CA cert file.
+*/}}
+{{- define "postgresql-ha.tlsSecretName" -}}
+{{- if .Values.pgpool.tls.enabled }}
+{{- if .Values.pgpool.tls.autoGenerated }}
+    {{- printf "%s-crt" (include "postgresql-ha.pgpool" .) -}}
+{{- else -}}
+    {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.pgpool.tls.certificatesSecret $) }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the path to the cert file.
+*/}}
+{{- define "postgresql-ha.postgresql.tlsCert" -}}
+{{- required "Certificate filename is required when TLS in enabled" .Values.postgresql.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}}
+{{- end -}}
+
+{{/*
+Return the path to the cert key file.
+*/}}
+{{- define "postgresql-ha.postgresql.tlsCertKey" -}}
+{{- required "Certificate Key filename is required when TLS in enabled" .Values.postgresql.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}}
+{{- end -}}
--- a/backing-services/gitea/charts/postgresql-ha/templates/backup/cronjob.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/backup/cronjob.yaml
@@ -0,0 +1,156 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.backup.enabled }}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
+  namespace: {{ .Release.Namespace | quote }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pg_dumpall
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }}
+  {{- if $annotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  schedule: {{ .Values.backup.cronjob.schedule | quote }}
+  {{- if .Values.backup.cronjob.timezone }}
+  timeZone: {{ .Values.backup.cronjob.timezone | quote }}
+  {{- end }}
+  concurrencyPolicy: {{ .Values.backup.cronjob.concurrencyPolicy }}
+  failedJobsHistoryLimit: {{ .Values.backup.cronjob.failedJobsHistoryLimit }}
+  successfulJobsHistoryLimit: {{ .Values.backup.cronjob.successfulJobsHistoryLimit }}
+  {{- if .Values.backup.cronjob.startingDeadlineSeconds }}
+  startingDeadlineSeconds: {{ .Values.backup.cronjob.startingDeadlineSeconds }}
+  {{- end }}
+  jobTemplate:
+    spec:
+      {{- if .Values.backup.cronjob.ttlSecondsAfterFinished }}
+      ttlSecondsAfterFinished: {{ .Values.backup.cronjob.ttlSecondsAfterFinished }}
+      {{- end }}
+      template:
+        metadata:
+          labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 12 }}
+            app.kubernetes.io/component: pg_dumpall
+          {{- if $annotations }}
+          annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 12 }}
+          {{- end }}
+        spec:
+          {{- include "postgresql-ha.image.pullSecrets" . | nindent 10 }}
+          {{- if .Values.backup.cronjob.nodeSelector }}
+          nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.nodeSelector "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.backup.cronjob.tolerations }}
+          tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.tolerations "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.backup.cronjob.affinity }}
+          affinity: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.affinity "context" $) | nindent 12 }}
+          {{- else }}
+          affinity:
+            podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.backup.cronjob.podAffinityPreset "component" "backup" "customLabels" $labels "context" $) | nindent 14 }}
+            nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.backup.cronjob.nodeAffinityPreset.type "key" .Values.backup.cronjob.nodeAffinityPreset.key "values" .Values.backup.cronjob.nodeAffinityPreset.values) | nindent 14 }}
+          {{- end }}
+          containers:
+          - name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
+            image: {{ include "postgresql-ha.postgresql.image" . }}
+            imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
+            env:
+              - name: PGUSER
+                value: "postgres"
+              {{- if .Values.postgresql.usePasswordFiles }}
+              - name: PGPASSWORD_FILE
+                {{- if (include "postgresql-ha.postgresqlSeparatePostgresPassword" .) }}
+                value: "/opt/bitnami/postgresql/secrets/postgres-password"
+                {{- else }}
+                value: "/opt/bitnami/postgresql/secrets/password"
+                {{- end }}
+              {{- else }}
+              - name: PGPASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                    {{- if (include "postgresql-ha.postgresqlSeparatePostgresPassword" .) }}
+                    key: postgres-password
+                    {{- else }}
+                    key: password
+                    {{- end }}
+              {{- end }}
+              - name: PGHOST
+                value: {{ include "postgresql-ha.postgresql" . }}
+              - name: PGPORT
+                value: {{ .Values.service.ports.postgresql | quote }}
+              - name: PGDUMP_DIR
+                value: {{ .Values.backup.cronjob.storage.mountPath }}
+              {{- if .Values.postgresql.tls.enabled }}
+              - name:  PGSSLROOTCERT
+                values: {{ include "postgresql-ha.pgpool.tlsCACert" . }}
+              {{- end }}
+              {{- if .Values.backup.cronjob.extraEnvVars }}
+              {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraEnvVars "context" $) | nindent 14 }}
+              {{- end }}
+            envFrom:
+              {{- if .Values.backup.cronjob.extraEnvVarsCM }}
+              - configMapRef:
+                  name: {{ .Values.backup.cronjob.extraEnvVarsCM }}
+              {{- end }}
+              {{- if .Values.backup.cronjob.extraEnvVarsSecret }}
+              - secretRef:
+                  name: {{ .Values.backup.cronjob.extraEnvVarsSecret }}
+              {{- end }}
+            command: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.command "context" $) | nindent 14 }}
+            volumeMounts:
+              - name: empty-dir
+                mountPath: /tmp
+                subPath: tmp-dir
+              {{- if .Values.postgresql.tls.enabled }}
+              - name: certs
+                mountPath: /certs
+              {{- end }}
+              - name: datadir
+                mountPath: {{ .Values.backup.cronjob.storage.mountPath }}
+                subPath: {{ .Values.backup.cronjob.storage.subPath }}
+              {{- if .Values.postgresql.usePasswordFiles }}
+              - name: password
+                mountPath: /opt/bitnami/postgresql/secrets/
+              {{- end }}
+              {{- if .Values.backup.cronjob.extraVolumeMounts }}
+              {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraVolumeMounts "context" $) | nindent 14 }}
+              {{- end }}
+            {{- if .Values.backup.cronjob.containerSecurityContext.enabled }}
+            securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.backup.cronjob.containerSecurityContext "context" $) | nindent 14 }}
+            {{- end }}
+            {{- if .Values.backup.cronjob.resources }}
+            resources: {{- toYaml .Values.backup.cronjob.resources | nindent 14 }}
+            {{- else if ne .Values.backup.cronjob.resourcesPreset "none" }}
+            resources: {{- include "common.resources.preset" (dict "type" .Values.backup.cronjob.resourcesPreset) | nindent 14 }}
+            {{- end }}
+          restartPolicy: {{ .Values.backup.cronjob.restartPolicy }}
+          {{- if .Values.backup.cronjob.podSecurityContext.enabled }}
+          securityContext:
+            fsGroup: {{ .Values.backup.cronjob.podSecurityContext.fsGroup }}
+          {{- end }}
+          volumes:
+            - name: empty-dir
+              emptyDir: {}
+            {{- if .Values.backup.cronjob.storage.existingClaim }}
+            - name: datadir
+              persistentVolumeClaim:
+                claimName: {{ printf "%s" (tpl .Values.backup.cronjob.storage.existingClaim .) }}
+            {{- else }}
+            - name: datadir
+              persistentVolumeClaim:
+                claimName: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
+            {{- end }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: password
+              secret:
+                secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
+            {{- end }}
+          {{- if .Values.backup.cronjob.extraVolumes }}
+          {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.extraVolumes "context" $) | nindent 12 }}
+          {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/backup/pvc.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/backup/pvc.yaml
@@ -0,0 +1,34 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.backup.enabled (not .Values.backup.cronjob.storage.existingClaim) -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}-pgdumpall
+  namespace: {{ .Release.Namespace | quote }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pg_dumpall
+  {{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations .Values.backup.cronjob.storage.resourcePolicy }}
+  annotations:
+    {{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations }}
+    {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }}
+    {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+    {{- end }}
+    {{- if .Values.backup.cronjob.storage.resourcePolicy }}
+    helm.sh/resource-policy: {{ .Values.backup.cronjob.storage.resourcePolicy | quote }}
+    {{- end }}
+  {{- end }}
+spec:
+  accessModes:
+  {{- range .Values.backup.cronjob.storage.accessModes }}
+    - {{ . | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.backup.cronjob.storage.size | quote }}
+  {{ include "common.storage.class" (dict "persistence" .Values.backup.cronjob.storage "global" .Values.global) }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/extra-list.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/extra-list.yaml
@@ -0,0 +1,9 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- range .Values.extraDeploy }}
+---
+{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/ldap-secrets.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/ldap-secrets.yaml
@@ -0,0 +1,19 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.ldap.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "postgresql-ha.ldap" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  bind-password: {{ (include "postgresql-ha.ldapPassword" .) | b64enc | quote }}
+{{- end -}}
--- a/backing-services/gitea/charts/postgresql-ha/templates/metrics-configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/metrics-configmap.yaml
@@ -0,0 +1,18 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "postgresql.metricsCM" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/configmap.yaml
@@ -0,0 +1,28 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and (or .Values.pgpool.configuration .Values.pgpool.poolHbaConfiguration) (not .Values.pgpool.configurationCM) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-configuration" (include "postgresql-ha.pgpool" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{- if .Values.pgpool.configuration }}
+  pgpool.conf: |-
+    {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.configuration "context" $) | nindent 4 }}
+  {{- end }}
+  {{- if .Values.pgpool.poolHbaConfiguration }}
+  pool_hba.conf: |-
+    {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.poolHbaConfiguration "context" $) | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/custom-users-secrets.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/custom-users-secrets.yaml
@@ -0,0 +1,23 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers.usernames }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ printf "%s-custom-users" (include "postgresql-ha.pgpool" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  usernames: {{ .Values.pgpool.customUsers.usernames | b64enc | quote }}
+  passwords: {{ .Values.pgpool.customUsers.passwords | b64enc | quote }}
+{{- end -}}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
@@ -0,0 +1,463 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ include "postgresql-ha.pgpool" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.labels .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+    {{- if and (not .Values.pgpool.customUsersSecret) .Values.pgpool.customUsers.usernames }}
+    checksum/custom-users-secrets: {{ include (print $.Template.BasePath "/pgpool/custom-users-secrets.yaml") . | sha256sum }}
+    {{- end }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.pgpool.replicaCount }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: pgpool
+  {{- if .Values.pgpool.updateStrategy }}
+  strategy: {{- toYaml .Values.pgpool.updateStrategy | nindent 4 }}
+  {{- end }}
+  {{- if .Values.pgpool.minReadySeconds }}
+  minReadySeconds: {{ .Values.pgpool.minReadySeconds }}
+  {{- end }}
+  template:
+    metadata:
+      labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
+        app.kubernetes.io/component: pgpool
+      annotations:
+        {{- if and (or .Values.pgpool.configuration .Values.pgpool.poolHbaConfiguration) (not .Values.pgpool.configurationCM) }}
+        checksum/configuration: {{ include (print $.Template.BasePath "/pgpool/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if .Values.pgpool.podAnnotations }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.podAnnotations "context" $) | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
+      automountServiceAccountToken: {{ .Values.pgpool.automountServiceAccountToken }}
+      {{- if .Values.pgpool.hostAliases }}
+      hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.hostAliases "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.pgpool.affinity }}
+      affinity: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.affinity "context" $) | nindent 8 }}
+      {{- else }}
+      affinity:
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAffinityPreset "component" "pgpool" "customLabels" $podLabels "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.pgpool.podAntiAffinityPreset "component" "pgpool" "customLabels" $podLabels "context" $) | nindent 10 }}
+        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.pgpool.nodeAffinityPreset.type "key" .Values.pgpool.nodeAffinityPreset.key "values" .Values.pgpool.nodeAffinityPreset.values) | nindent 10 }}
+      {{- end }}
+      {{- if .Values.pgpool.nodeSelector }}
+      nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.nodeSelector "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.pgpool.tolerations }}
+      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.tolerations "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.pgpool.priorityClassName }}
+      priorityClassName: {{ .Values.pgpool.priorityClassName }}
+      {{- end }}
+      {{- if .Values.pgpool.schedulerName }}
+      schedulerName: {{ .Values.pgpool.schedulerName | quote }}
+      {{- end }}
+      {{- if .Values.pgpool.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.topologySpreadConstraints "context" .) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.pgpool.podSecurityContext.enabled }}
+      securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.pgpool.podSecurityContext "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.pgpool.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.pgpool.terminationGracePeriodSeconds }}
+      {{- end }}
+      serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
+      {{- if or .Values.pgpool.tls.enabled .Values.pgpool.initContainers }}
+      initContainers:
+      {{- if .Values.pgpool.tls.enabled }}
+        - name: init-chmod-data
+          image: {{ template "postgresql-ha.volumePermissions.image" . }}
+          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
+          command:
+            - /bin/sh
+            - -cx
+            - |
+              cp /tmp/certs/* /opt/bitnami/pgpool/certs/
+              {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
+              chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/pgpool/certs/
+              {{- else }}
+              chown -R {{ .Values.pgpool.containerSecurityContext.runAsUser }}:{{ .Values.pgpool.podSecurityContext.fsGroup }} /opt/bitnami/pgpool/certs/
+              {{- end }}
+              chmod 600 {{ template "postgresql-ha.pgpool.tlsCertKey" . }}
+          {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
+          {{- else }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.volumePermissions.resources }}
+          resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
+          {{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: raw-certificates
+              mountPath: /tmp/certs
+            - name: pgpool-certificates
+              mountPath: /opt/bitnami/pgpool/certs
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+      {{- end }}
+      {{- if .Values.pgpool.initContainers }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initContainers "context" $) | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      # Auxiliary vars to populate environment variables
+      {{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
+      {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
+      {{- $postgresalContainerPort := int .Values.postgresql.containerPorts.postgresql }}
+      {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
+      containers:
+        - name: pgpool
+          image: {{ include "postgresql-ha.pgpool.image" . }}
+          imagePullPolicy: {{ .Values.pgpool.image.pullPolicy | quote }}
+          {{- if .Values.pgpool.containerSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.pgpool.containerSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- else if .Values.pgpool.command }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else if .Values.pgpool.args }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.args "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.pgpool.lifecycleHooks }}
+          lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.lifecycleHooks "context" $) | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          {{- $clusterDomain:= .Values.clusterDomain }}
+          env:
+            - name: BITNAMI_DEBUG
+              value: {{ ternary "true" "false" (or .Values.pgpool.image.debug .Values.diagnosticMode.enabled) | quote }}
+            {{- if or .Values.pgpool.customUsersSecret .Values.pgpool.customUsers.usernames }}
+            - name: PGPOOL_POSTGRES_CUSTOM_USERS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }}
+                  key: usernames
+            - name: PGPOOL_POSTGRES_CUSTOM_PASSWORDS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.pgpoolCustomUsersSecretName" . }}
+                  key: passwords
+            {{- end }}
+            - name: REPMGR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: PGPOOL_BACKEND_NODES
+              value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $i }}:{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}:{{ $postgresalContainerPort }},{{ end }}
+            - name: PGPOOL_SR_CHECK_USER
+              value: {{ (include "postgresql-ha.pgoolSrCheckUsername" .) | quote }}
+            {{- if .Values.pgpool.usePasswordFiles }}
+            - name: PGPOOL_SR_CHECK_PASSWORD_FILE
+              value: "/opt/bitnami/pgpool/secrets/sr-check-password"
+            {{- else }}
+            - name: PGPOOL_SR_CHECK_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.pgpoolSecretName" . }}
+                  key: sr-check-password
+            {{- end }}
+            - name: PGPOOL_SR_CHECK_DATABASE
+              value: {{ .Values.pgpool.srCheckDatabase | quote  }}
+            - name: PGPOOL_ENABLE_LDAP
+              value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }}
+            {{- if .Values.ldap.enabled }}
+            - name: LDAP_URI
+              value: {{ .Values.ldap.uri | quote }}
+            - name: LDAP_BASE
+              value: {{ .Values.ldap.basedn | quote }}
+            - name: LDAP_BIND_DN
+              value: {{ .Values.ldap.binddn | quote }}
+            - name: LDAP_BIND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.ldapSecretName" . }}
+                  key: bind-password
+            {{- if .Values.ldap.bslookup }}
+            - name: LDAP_BASE_LOOKUP
+              value: {{ .Values.ldap.bslookup | quote }}
+            {{- end }}
+            {{- if .Values.ldap.scope }}
+            - name: LDAP_SCOPE
+              value: {{ .Values.ldap.scope | quote }}
+            {{- end }}
+            {{- if .Values.ldap.searchfilter }}
+            - name: LDAP_SEARCH_FILTER
+              value: {{ .Values.ldap.searchfilter | quote }}
+            {{- end }}
+            {{- if .Values.ldap.searchmap }}
+            - name: LDAP_SEARCH_MAP
+              value: {{ .Values.ldap.searchmap | quote }}
+            {{- end }}
+            {{- if .Values.ldap.tlsReqcert }}
+            - name: LDAP_TLS_REQCERT
+              value: {{ .Values.ldap.tlsReqcert | quote }}
+            {{- end }}
+            - name: LDAP_NSS_INITGROUPS_IGNOREUSERS
+              value: {{ .Values.ldap.nssInitgroupsIgnoreusers | quote }}
+            {{- end }}
+            - name: PGPOOL_POSTGRES_USERNAME
+              value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
+            {{- if .Values.pgpool.usePasswordFiles }}
+            - name: PGPOOL_POSTGRES_PASSWORD_FILE
+              value: "/opt/bitnami/pgpool/secrets/pgpool-password"
+            {{- else }}
+            - name: PGPOOL_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  {{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }} 
+                  key: postgres-password
+                  {{- else }}
+                  key: password
+                  {{- end }}
+            {{- end }}
+            - name: PGPOOL_ADMIN_USERNAME
+              value: {{ (include "postgresql-ha.pgpoolAdminUsername" .) | quote }}
+            {{- if .Values.pgpool.usePasswordFiles }}
+            - name: PGPOOL_ADMIN_PASSWORD_FILE
+              value: "/opt/bitnami/pgpool/secrets/admin-password"
+            {{- else }}
+            - name: PGPOOL_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.pgpoolSecretName" . }}
+                  key: admin-password
+            {{- end }}
+            - name: PGPOOL_AUTHENTICATION_METHOD
+              value: {{ .Values.pgpool.authenticationMethod | quote }}
+            - name: PGPOOL_ENABLE_LOAD_BALANCING
+              value: {{ ternary "yes" "no" .Values.pgpool.useLoadBalancing | quote }}
+            - name: PGPOOL_ENABLE_CONNECTION_CACHE
+              value: {{ ternary "yes" "no" .Values.pgpool.useConnectionCache | quote }}
+            {{- if .Values.pgpool.useLoadBalancing }}
+            - name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
+              value: {{ .Values.pgpool.disableLoadBalancingOnWrite | quote }}
+            {{- end }}
+            - name: PGPOOL_ENABLE_LOG_CONNECTIONS
+              value: {{ ternary "yes" "no" .Values.pgpool.logConnections | quote }}
+            - name: PGPOOL_ENABLE_LOG_HOSTNAME
+              value: {{ ternary "yes" "no" .Values.pgpool.logHostname | quote }}
+            - name: PGPOOL_ENABLE_LOG_PCP_PROCESSES
+              value: {{ ternary "yes" "no" .Values.pgpool.logPcpProcesses | quote }}
+            - name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
+              value: {{ ternary "yes" "no" .Values.pgpool.logPerNodeStatement | quote }}
+            {{- if .Values.pgpool.logLinePrefix }}
+            - name: PGPOOL_LOG_LINE_PREFIX
+              value: {{ .Values.pgpool.logLinePrefix | quote }}
+            {{- end }}
+            {{- if .Values.pgpool.numInitChildren }}
+            - name: PGPOOL_NUM_INIT_CHILDREN
+              value: {{ .Values.pgpool.numInitChildren | quote }}
+            {{- end }}
+            {{- if .Values.pgpool.reservedConnections }}
+            - name: PGPOOL_RESERVED_CONNECTIONS
+              value: '{{ .Values.pgpool.reservedConnections }}'
+            {{- end }}
+            {{- if .Values.pgpool.maxPool }}
+            - name: PGPOOL_MAX_POOL
+              value: {{ .Values.pgpool.maxPool | quote }}
+            {{- end }}
+            {{- if .Values.pgpool.childMaxConnections }}
+            - name: PGPOOL_CHILD_MAX_CONNECTIONS
+              value: {{ .Values.pgpool.childMaxConnections | quote }}
+            {{- end }}
+            {{- $childlifetime := .Values.pgpool.childLifeTime | quote }}
+            {{- if or $childlifetime (eq "0" $childlifetime) }}
+            - name: PGPOOL_CHILD_LIFE_TIME
+              value: {{ $childlifetime }}
+            {{- end }}
+            {{- if .Values.pgpool.clientIdleLimit }}
+            - name: PGPOOL_CLIENT_IDLE_LIMIT
+              value: {{ .Values.pgpool.clientIdleLimit | quote }}
+            {{- end }}
+            {{- if .Values.pgpool.connectionLifeTime }}
+            - name: PGPOOL_CONNECTION_LIFE_TIME
+              value: {{ .Values.pgpool.connectionLifeTime | quote }}
+            {{- end }}
+            {{- if or .Values.pgpool.configuration .Values.pgpool.configurationCM }}
+            - name: PGPOOL_USER_CONF_FILE
+              value: "/opt/bitnami/pgpool/user_config/pgpool.conf"
+            {{- end }}
+            {{- if or .Values.pgpool.poolHbaConfiguration .Values.pgpool.configurationCM }}
+            - name: PGPOOL_USER_HBA_FILE
+              value: "/opt/bitnami/pgpool/user_config/pool_hba.conf"
+            {{- end }}
+            - name: PGPOOL_ENABLE_TLS
+              value: {{ ternary "yes" "no" .Values.pgpool.tls.enabled | quote }}
+            {{- if .Values.pgpool.tls.enabled }}
+            - name: PGPOOL_TLS_PREFER_SERVER_CIPHERS
+              value: {{ ternary "yes" "no" .Values.pgpool.tls.preferServerCiphers | quote }}
+            - name: PGPOOL_TLS_CERT_FILE
+              value: {{ template "postgresql-ha.pgpool.tlsCert" . }}
+            - name: PGPOOL_TLS_KEY_FILE
+              value: {{ template "postgresql-ha.pgpool.tlsCertKey" . }}
+            {{- if .Values.pgpool.tls.certCAFilename }}
+            - name: PGPOOL_TLS_CA_FILE
+              value: {{ template "postgresql-ha.pgpool.tlsCACert" . }}
+            {{- end }}
+            {{- end }}
+            - name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
+            {{- if .Values.pgpool.customLivenessProbe }}
+              value: {{ add 1 (default 1 .Values.pgpool.customLivenessProbe.timeoutSeconds) | quote }}
+            {{- else }}
+              value: {{ add 1 (default 1 .Values.pgpool.livenessProbe.timeoutSeconds) | quote }}
+            {{- end }}
+            {{- if .Values.pgpool.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          envFrom:
+            {{- if .Values.pgpool.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ .Values.pgpool.extraEnvVarsCM }}
+            {{- end }}
+            {{- if .Values.pgpool.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ .Values.pgpool.extraEnvVarsSecret }}
+            {{- end }}
+          ports:
+            - name: postgresql
+              containerPort: {{ .Values.pgpool.containerPorts.postgresql }}
+              protocol: TCP
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.pgpool.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.pgpool.livenessProbe.enabled }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.livenessProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - /opt/bitnami/scripts/pgpool/healthcheck.sh
+          {{- end }}
+          {{- if .Values.pgpool.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.pgpool.readinessProbe.enabled }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.readinessProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - bash
+                - -ec
+                - '{{ include "postgresql-ha.pgpoolPostgresPassword" . }} psql -U {{ (include "postgresql-ha.postgresqlUsername" .) | quote }} {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}{{- end }} -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null'
+          {{- end }}
+          {{- if .Values.pgpool.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.pgpool.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.pgpool.startupProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - /opt/bitnami/scripts/pgpool/healthcheck.sh
+          {{- end }}
+          {{- end }}
+          {{- if .Values.pgpool.resources }}
+          resources: {{- toYaml .Values.pgpool.resources | nindent 12 }}
+          {{- else if ne .Values.pgpool.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.pgpool.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/pgpool/etc
+              subPath: app-etc-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/pgpool/conf
+              subPath: app-conf-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/pgpool/tmp
+              subPath: app-tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/pgpool/logs
+              subPath: app-logs-dir
+            {{- if or .Values.pgpool.configuration .Values.pgpool.poolHbaConfiguration .Values.pgpool.configurationCM }}
+            - name: pgpool-config
+              mountPath: /opt/bitnami/pgpool/user_config
+            {{- end }}
+            {{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM  }}
+            - name: custom-init-scripts
+              mountPath: /docker-entrypoint-initdb.d/
+            {{- end }}
+            {{- if .Values.pgpool.initdbScriptsSecret }}
+            - name: custom-init-scripts-secret
+              mountPath: /docker-entrypoint-initdb.d/secret
+            {{- end }}
+            {{- if .Values.pgpool.usePasswordFiles }}
+            - name: postgresql-creds
+              subPath: pgpool-password
+              mountPath: /opt/bitnami/pgpool/secrets/pgpool-password
+            - name: pgpool-creds
+              subPath: admin-password
+              mountPath: /opt/bitnami/pgpool/secrets/admin-password
+            - name: pgpool-creds
+              subPath: sr-check-password
+              mountPath: /opt/bitnami/pgpool/secrets/sr-check-password
+            {{- end }}
+            {{- if .Values.pgpool.tls.enabled }}
+            - name: pgpool-certificates
+              mountPath: /opt/bitnami/pgpool/certs
+            {{- end }}
+            {{- if .Values.pgpool.extraVolumeMounts }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumeMounts "context" $) | nindent 12 }}
+            {{- end }}
+        {{- if .Values.pgpool.sidecars }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.sidecars "context" $) | nindent 8 }}
+        {{- end }}
+      volumes:
+        - name: empty-dir
+          emptyDir: {}
+        {{- if or .Values.pgpool.configuration .Values.pgpool.poolHbaConfiguration .Values.pgpool.configurationCM }}
+        - name: pgpool-config
+          configMap:
+            name: {{ include "postgresql-ha.pgpoolConfigurationCM" . }}
+        {{- end }}
+        {{- if or .Values.pgpool.initdbScripts .Values.pgpool.initdbScriptsCM }}
+        - name: custom-init-scripts
+          configMap:
+            name: {{ template "postgresql-ha.pgpoolInitdbScriptsCM" . }}
+        {{- end }}
+        {{- if .Values.pgpool.initdbScriptsSecret }}
+        - name: custom-init-scripts-secret
+          secret:
+            secretName: {{ template "postgresql-ha.pgpoolInitdbScriptsSecret" . }}
+        {{- end }}
+        {{- if .Values.pgpool.usePasswordFiles }}
+        - name: postgresql-creds
+          secret:
+            secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
+            items:
+              - key: password
+                path: pgpool-password
+        - name: pgpool-creds
+          secret:
+            secretName: {{ include "postgresql-ha.pgpoolSecretName" . }}
+        {{- end }}
+        {{- if .Values.pgpool.tls.enabled }}
+        - name: raw-certificates
+          secret:
+            secretName: {{ include "postgresql-ha.tlsSecretName" . }}
+        - name: pgpool-certificates
+          emptyDir: {}
+        {{- end }}
+        {{- if .Values.pgpool.extraVolumes }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.extraVolumes "context" $) | nindent 8 }}
+        {{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/initdb-scripts-configmap.yaml
@@ -0,0 +1,21 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.pgpool.initdbScripts (not .Values.pgpool.initdbScriptsCM) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.pgpool" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{- include "common.tplvalues.render" (dict "value" .Values.pgpool.initdbScripts "context" $) | nindent 4 }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
@@ -0,0 +1,88 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.pgpool.networkPolicy.enabled }}
+kind: NetworkPolicy
+apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
+metadata:
+  name: {{ include "postgresql-ha.pgpool" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+    role: data
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }}
+  podSelector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: pgpool
+  policyTypes:
+    - Ingress
+    - Egress
+  {{- if .Values.pgpool.networkPolicy.allowExternalEgress }}
+  egress:
+    - {}
+  {{- else }}
+  egress:
+    # Allow dns resolution
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Allow outbound connections to other cluster pods
+    - ports:
+        - port: {{ .Values.service.ports.postgresql }}
+        - port: {{ .Values.pgpool.containerPorts.postgresql }}
+      to:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
+              app.kubernetes.io/component: pgpool
+    # Allow outbound connections to other postgresql pods
+    - ports:
+        - port: {{ .Values.service.ports.postgresql }}
+        - port: {{ .Values.postgresql.containerPorts.postgresql }}
+      to:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
+              app.kubernetes.io/component: postgresql
+    {{- if .Values.pgpool.networkPolicy.extraEgress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  ingress:
+    - ports:
+        - port: {{ .Values.pgpool.containerPorts.postgresql }}
+        {{- if .Values.metrics.enabled }}
+        - port: {{ .Values.metrics.containerPorts.http }}
+        {{- end }}
+      {{- if not .Values.pgpool.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
+        - podSelector:
+            matchLabels:
+              {{ template "postgresql-ha.pgpool" . }}-client: "true"
+        {{- if .Values.pgpool.networkPolicy.ingressNSMatchLabels }}
+        - namespaceSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.pgpool.networkPolicy.ingressNSMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- if .Values.pgpool.networkPolicy.ingressNSPodMatchLabels }}
+          podSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.pgpool.networkPolicy.ingressNSPodMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- if .Values.pgpool.networkPolicy.extraIngress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.pgpool.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
+    {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
@@ -0,0 +1,30 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.pgpool.pdb.create }}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "postgresql-ha.pgpool" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.pgpool.pdb.minAvailable }}
+  minAvailable: {{ .Values.pgpool.pdb.minAvailable }}
+  {{- end }}
+  {{- if or .Values.pgpool.pdb.maxUnavailable (not .Values.pgpool.pdb.minAvailable) }}
+  maxUnavailable: {{ .Values.pgpool.pdb.maxUnavailable | default 1 }}
+  {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: pgpool
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
@@ -0,0 +1,23 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if (include "postgresql-ha.pgpoolCreateSecret" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "postgresql-ha.pgpool" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" . ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  admin-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.pgpool" .) "key" "admin-password" "providedValues" (list "global.pgpool.adminPassword" "pgpool.adminPassword") "length" 10 "context" .) }}
+  sr-check-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.pgpool" .) "key" "sr-check-password" "providedValues" (list "global.pgpool.srCheckPassword" "pgpool.srCheckPassword") "length" 10 "failOnNew" false "context" .) }}
+{{- end -}}
--- a/backing-services/gitea/charts/postgresql-ha/templates/pgpool/service.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/pgpool/service.yaml
@@ -0,0 +1,54 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "postgresql-ha.pgpool" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.pgpool.image "chart" .Chart ) ) }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.serviceLabels .Values.commonLabels $versionLabel ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
+  {{- if or .Values.pgpool.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if .Values.service.sessionAffinity }}
+  sessionAffinity: {{ .Values.service.sessionAffinity }}
+  {{- end }}
+  {{- if .Values.service.sessionAffinityConfig }}
+  sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.service.sessionAffinityConfig "context" $) | nindent 4 }}
+  {{- end }}
+  {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{- toYaml .Values.service.loadBalancerSourceRanges | nindent 4 }}
+  {{- end }}
+  {{- if and (not (empty .Values.service.loadBalancerIP)) (eq .Values.service.type "LoadBalancer") }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
+  clusterIP: {{ .Values.service.clusterIP }}
+  {{- end }}
+  ports:
+    - name: {{ .Values.service.portName | quote }}
+      port: {{ .Values.service.ports.postgresql }}
+      targetPort: postgresql
+      protocol: TCP
+      {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.postgresql)) }}
+      nodePort: {{ .Values.service.nodePorts.postgresql }}
+      {{- else if eq .Values.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+    {{- if .Values.service.extraPorts }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
+    {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.pgpool.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: pgpool
--- a/backing-services/gitea/charts/postgresql-ha/templates/podsecuritypolicy.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/podsecuritypolicy.yaml
@@ -0,0 +1,44 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  privileged: false
+  allowedCapabilities:
+    - CHOWN
+  volumes:
+    - 'configMap'
+    - 'secret'
+    - 'persistentVolumeClaim'
+    - 'emptyDir'
+    - 'projected'
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/configmap.yaml
@@ -0,0 +1,30 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-configuration" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{- if .Values.postgresql.repmgrConfiguration }}
+  repmgr.conf: |-
+    {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.repmgrConfiguration "context" $ ) | nindent 4 }}
+  {{- end }}
+  {{- if .Values.postgresql.configuration }}
+  postgresql.conf: |-
+    {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.configuration "context" $ ) | nindent 4 }}
+  {{- end }}
+  {{- if .Values.postgresql.pgHbaConfiguration }}
+  pg_hba.conf: |-
+    {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.pgHbaConfiguration "context" $ ) | nindent 4 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/extended-configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/extended-configmap.yaml
@@ -0,0 +1,20 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.postgresql.extendedConf (not .Values.postgresql.extendedConfCM) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-extended-configuration" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  override.conf: |-
+    {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.extendedConf "context" $ ) | nindent 4 }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/initdb-scripts-configmap.yaml
@@ -0,0 +1,19 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.postgresql.initdbScripts (not .Values.postgresql.initdbScriptsCM) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-initdb-scripts" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.initdbScripts "context" $) | nindent 4 }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/metrics-service.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/metrics-service.yaml
@@ -0,0 +1,47 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.metrics.enabled .Values.metrics.service.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ printf "%s-metrics" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    {{- if .Values.metrics.serviceMonitor.selector }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if or .Values.metrics.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.metrics.service.type }}
+  {{- if (or (eq .Values.metrics.service.type "LoadBalancer") (eq .Values.metrics.service.type "NodePort")) }}
+  externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{ if .Values.metrics.service.clusterIP }}
+  clusterIP: {{ .Values.metrics.service.clusterIP }}
+  {{ end }}
+  {{ if eq .Values.metrics.service.type "LoadBalancer" }}
+  loadBalancerSourceRanges: {{ .Values.metrics.service.loadBalancerSourceRanges }}
+  {{ end }}
+  {{- if (and (eq .Values.metrics.service.type "LoadBalancer") (not (empty .Values.metrics.service.loadBalancerIP))) }}
+  loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }}
+  {{- end }}
+  ports:
+    - name: metrics
+      port: {{ .Values.metrics.service.ports.metrics }}
+      targetPort: metrics
+      {{- if (and (or (eq .Values.metrics.service.type "NodePort") (eq .Values.metrics.service.type "LoadBalancer")) (not (empty .Values.metrics.service.nodePorts.metrics))) }}
+      nodePort: {{ .Values.metrics.service.nodePorts.metrics }}
+      {{- else if eq .Values.metrics.service.type "ClusterIP" }}
+      nodePort: null
+      {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
@@ -0,0 +1,80 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.postgresql.networkPolicy.enabled }}
+kind: NetworkPolicy
+apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: data
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  podSelector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
+  {{- if .Values.postgresql.networkPolicy.allowExternalEgress }}
+  egress:
+    - {}
+  {{- else }}
+  egress:
+    # Allow dns resolution
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Allow outbound connections to other cluster pods
+    - ports:
+        - port: {{ .Values.service.ports.postgresql }}
+        - port: {{ .Values.postgresql.containerPorts.postgresql }}
+      to:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
+              app.kubernetes.io/component: postgresql
+    {{- if .Values.postgresql.networkPolicy.extraEgress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  ingress:
+    - ports:
+        - port: {{ .Values.postgresql.containerPorts.postgresql }}
+        {{- if .Values.metrics.enabled }}
+        - port: {{ .Values.metrics.containerPorts.http }}
+        {{- end }}
+      {{- if not .Values.postgresql.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
+        - podSelector:
+            matchLabels:
+              {{ template "postgresql-ha.postgresql" . }}-client: "true"
+        {{- if .Values.postgresql.networkPolicy.ingressNSMatchLabels }}
+        - namespaceSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- if .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }}
+          podSelector:
+            matchLabels:
+              {{- range $key, $value := .Values.postgresql.networkPolicy.ingressNSPodMatchLabels }}
+              {{ $key | quote }}: {{ $value | quote }}
+              {{- end }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- if .Values.postgresql.networkPolicy.extraIngress }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.postgresql.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
+    {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
@@ -0,0 +1,28 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.postgresql.pdb.create }}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.postgresql.pdb.minAvailable }}
+  minAvailable: {{ .Values.postgresql.pdb.minAvailable }}
+  {{- end }}
+  {{- if or .Values.postgresql.pdb.maxUnavailable (not .Values.postgresql.pdb.minAvailable) }}
+  maxUnavailable: {{ .Values.postgresql.pdb.maxUnavailable | default 1 }}
+  {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: postgresql
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/scripts-configmap.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/scripts-configmap.yaml
@@ -0,0 +1,159 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-scripts" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" .) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" .) | nindent 4 }}
+  {{- end }}
+data:
+  pre-stop.sh: |-
+    #!/bin/bash
+
+    set -o errexit
+    set -o pipefail
+    set -o nounset
+
+    # Debug section
+    exec 3>&1
+    exec 4>&2
+
+    # Process input parameters
+    MIN_DELAY_AFTER_PG_STOP_SECONDS=$1
+
+    # Load Libraries
+    . /opt/bitnami/scripts/libpostgresql.sh
+    . /opt/bitnami/scripts/librepmgr.sh
+
+    # Load PostgreSQL & repmgr environment variables
+    . /opt/bitnami/scripts/postgresql-env.sh
+
+    # Auxiliary functions
+    is_new_primary_ready() {
+        local -a current_primary_node
+        readarray -t current_primary_node < <(repmgr_get_primary_node)
+        local current_primary_host="${current_primary_node[0]}"
+
+        if [[ -n "$current_primary_host" ]] && [[ "$current_primary_host" != "$REPMGR_NODE_NETWORK_NAME" ]]; then
+            info "New primary detected, leaving the cluster..."
+            return 0
+        fi
+
+        info "Waiting for a new primary to be available..."
+        return 1
+    }
+
+    export MODULE="pre-stop-hook"
+    if ! is_boolean_yes "$BITNAMI_DEBUG"; then
+        exec 1>/dev/null
+        exec 2>/dev/null
+    fi
+
+    postgresql_enable_nss_wrapper
+
+    # Prepare env vars for managing roles
+    readarray -t primary_node < <(repmgr_get_upstream_node)
+    primary_host="${primary_node[0]}"
+
+    # Stop postgresql for graceful exit.
+    PG_STOP_INIT=$EPOCHSECONDS
+    postgresql_stop
+
+    if [[ -z "$primary_host" ]] || [[ "$primary_host" = "$REPMGR_NODE_NETWORK_NAME" ]]; then
+        info "Primary node need to wait for a new primary node before leaving the cluster"
+        retry_while is_new_primary_ready 10 5
+    else
+        info "Standby node doesn't need to wait for a new primary switchover. Leaving the cluster"
+    fi
+
+    # Make sure pre-stop hook waits at least 25 seconds after stop of PG to make sure Pgpool-II detects node is down.
+    # default terminationGracePeriodSeconds=30 seconds
+    PG_STOP_DURATION=$((EPOCHSECONDS - PG_STOP_INIT))
+    if (( PG_STOP_DURATION < MIN_DELAY_AFTER_PG_STOP_SECONDS )); then
+        WAIT_TO_PG_POOL_TIME=$((MIN_DELAY_AFTER_PG_STOP_SECONDS - PG_STOP_DURATION))
+        info "Waiting additional $WAIT_TO_PG_POOL_TIME seconds for Pgpool-II to detect node is down"
+        sleep $WAIT_TO_PG_POOL_TIME
+    fi
+  liveness-probe.sh: |-
+    #!/bin/bash
+
+    set -o errexit
+    set -o pipefail
+    set -o nounset
+
+    # Load Libraries
+    . /opt/bitnami/scripts/libpostgresql.sh
+    . /opt/bitnami/scripts/librepmgr.sh
+
+    # Load PostgreSQL & repmgr environment variables
+    . /opt/bitnami/scripts/postgresql-env.sh
+
+    # Check if PG is ready
+    pg_isready_args=("-U" "postgres" "-p" "$POSTGRESQL_PORT_NUMBER" "-h" "127.0.0.1")
+    is_boolean_yes "$POSTGRESQL_ENABLE_TLS" && pg_isready_args+=("-d" "sslcert=$POSTGRESQL_TLS_CERT_FILE sslkey=$POSTGRESQL_TLS_KEY_FILE")
+    debug_execute pg_isready "${pg_isready_args[@]}"
+
+    # Check if repmgr has split-brain issues
+    postgresql_enable_nss_wrapper
+    repmgr_check_status
+  readiness-probe.sh: |-
+    #!/bin/bash
+
+    set -o errexit
+    set -o pipefail
+    set -o nounset
+
+    # Load Libraries
+    . /opt/bitnami/scripts/libpostgresql.sh
+    . /opt/bitnami/scripts/librepmgr.sh
+
+    # Load PostgreSQL & repmgr environment variables
+    . /opt/bitnami/scripts/postgresql-env.sh
+
+    # We should not proceed if a standby clone is in progress
+    if ps waux | grep "data standby clone" | grep -qv grep; then
+        echo "standby clone in progress"
+        exit 1
+    fi
+
+    # Then, let's check if PG is responding to queries
+{{- if .Values.postgresql.headlessWithNotReadyAddresses }}
+    MIN_DELAY_AFTER_POD_READY_FIRST_TIME={{ add .Values.pgpool.livenessProbe.periodSeconds .Values.pgpool.livenessProbe.timeoutSeconds }}
+    FIRST_READY_TS_FILE="/tmp/.first-ready.epoch"
+    DELAY_SEMAPHORE="/tmp/.delay"
+{{- end }}
+    if [[ $(PGPASSWORD="$POSTGRESQL_PASSWORD" psql -w -U "$POSTGRESQL_USERNAME" -d $POSTGRESQL_DATABASE -h 127.0.0.1 -p "$POSTGRESQL_PORT_NUMBER" -tA -c "SELECT 1" 2> /dev/null || true) = 1 ]]; then
+{{- if .Values.postgresql.headlessWithNotReadyAddresses }}
+        # DB up, but initial readiness delay not applied
+        if [[ ! -f "$DELAY_SEMAPHORE" ]] && [[ -f "$FIRST_READY_TS_FILE" ]]; then
+            # calculate delay from the first readiness success
+            FIRST_READY_TS=$(cat $FIRST_READY_TS_FILE)
+            CURRENT_DELAY_SECONDS=$((EPOCHSECONDS - FIRST_READY_TS))
+            # Wait for the minimal delay after the first readiness state
+            if (( CURRENT_DELAY_SECONDS > MIN_DELAY_AFTER_POD_READY_FIRST_TIME )); then
+                # mark delay as applied
+                touch "$DELAY_APPLIED_FILE"
+            else
+                echo "minimal delay not met"
+                exit 1
+            fi
+        # first ever readiness test success - store timestamp and report failure
+        elif [[ ! -f "$DELAY_SEMAPHORE" ]]; then
+            echo $EPOCHSECONDS > $FIRST_READY_TS_FILE
+            exit 1
+        fi
+{{- end }}
+        # Finally, check if repmgr has split-brain issues
+        postgresql_enable_nss_wrapper
+        repmgr_check_status
+    else
+        echo "connection to database failed"
+        exit 1
+    fi
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
@@ -0,0 +1,24 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" . ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" . ) | nindent 4 }}
+  {{- end }}
+type: Opaque
+data:
+  {{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
+  postgres-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.postgresql" .) "key" "postgres-password" "providedValues" (list "global.postgresql.postgresPassword" "postgresql.postgresPassword") "length" 10 "context" .) }}
+  {{- end }}
+  password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.postgresql" .) "key" "password" "providedValues" (list "global.postgresql.password" "postgresql.password") "length" 10 "context" .) }}
+  repmgr-password: {{ include "common.secrets.passwords.manage" (dict "secret" (include "postgresql-ha.postgresql" .) "key" "repmgr-password" "providedValues" (list "global.postgresql.repmgrPassword" "postgresql.repmgrPassword") "length" 10 "context" .) }}
+{{- end -}}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
@@ -0,0 +1,28 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations .Values.service.headless.annotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: {{ .Values.postgresql.headlessWithNotReadyAddresses }}
+  ports:
+    - name: {{ .Values.service.portName | quote }}
+      port: {{ .Values.postgresql.containerPorts.postgresql }}
+      targetPort: postgresql
+      protocol: TCP
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: data
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/service-witness.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/service-witness.yaml
@@ -0,0 +1,29 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.witness.create }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.commonAnnotations .Values.service.headless.annotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+    - name: {{ .Values.service.portName | quote }}
+      port: {{ .Values.postgresql.containerPorts.postgresql }}
+      targetPort: postgresql
+      protocol: TCP
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: witness
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/service.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/service.yaml
@@ -0,0 +1,31 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.serviceLabels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if or .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.serviceAnnotations .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: {{ .Values.service.portName | quote }}
+      port: {{ .Values.service.ports.postgresql }}
+      targetPort: postgresql
+      protocol: TCP
+    {{- if .Values.service.extraPorts }}
+    {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
+    {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: data
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/servicemonitor.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/servicemonitor.yaml
@@ -0,0 +1,49 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}
+  namespace: {{ coalesce .Values.metrics.serviceMonitor.namespace (include "common.names.namespace" .) | quote }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+  {{- if or .Values.commonAnnotations .Values.metrics.serviceMonitor.annotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.metrics.serviceMonitor.jobLabel }}
+  jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
+  {{- end }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
+      {{- if .Values.metrics.serviceMonitor.selector }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
+      {{- end }}
+      app.kubernetes.io/component: postgresql
+  endpoints:
+    - port: metrics
+      {{- if .Values.metrics.serviceMonitor.interval }}
+      interval: {{ .Values.metrics.serviceMonitor.interval }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.honorLabels }}
+      honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.metricRelabelings }}
+      metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.relabelings }}
+      relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 8 }}
+      {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ include "common.names.namespace" . | quote }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
@@ -0,0 +1,701 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
+kind: StatefulSet
+metadata:
+  name: {{ include "postgresql-ha.postgresql" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.labels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: data
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.postgresql.replicaCount }}
+  podManagementPolicy: {{ .Values.postgresql.podManagementPolicy | quote }}
+  serviceName: {{ printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
+  updateStrategy: {{- toYaml .Values.postgresql.updateStrategy | nindent 4 }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: postgresql
+      role: data
+  template:
+    metadata:
+      labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
+        app.kubernetes.io/component: postgresql
+        role: data
+      annotations:
+        {{- if and (or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration) (not .Values.postgresql.configurationCM) }}
+        checksum/configuration: {{ include (print $.Template.BasePath "/postgresql/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if .Values.postgresql.podAnnotations }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.podAnnotations "context" $) | nindent 8 }}
+        {{- end }}
+        {{- if and .Values.metrics.enabled .Values.metrics.annotations }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
+      automountServiceAccountToken: {{ .Values.postgresql.automountServiceAccountToken }}
+      {{- if .Values.postgresql.hostAliases }}
+      hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.hostAliases "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.postgresql.affinity }}
+      affinity: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.affinity "context" $) | nindent 8 }}
+      {{- else }}
+      affinity:
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.postgresql.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
+        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.postgresql.nodeAffinityPreset.type "key" .Values.postgresql.nodeAffinityPreset.key "values" .Values.postgresql.nodeAffinityPreset.values) | nindent 10 }}
+      {{- end }}
+      {{- if .Values.postgresql.nodeSelector }}
+      nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.nodeSelector "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.postgresql.tolerations }}
+      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.tolerations "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.postgresql.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.topologySpreadConstraints "context" .) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.postgresql.priorityClassName }}
+      priorityClassName: {{ .Values.postgresql.priorityClassName | quote }}
+      {{- end }}
+      {{- if .Values.postgresql.schedulerName }}
+      schedulerName: {{ .Values.postgresql.schedulerName }}
+      {{- end }}
+      {{- if .Values.postgresql.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.postgresql.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- if .Values.postgresql.podSecurityContext.enabled }}
+      securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.podSecurityContext "context" $) | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
+      hostNetwork: {{ .Values.postgresql.hostNetwork }}
+      hostIPC: {{ .Values.postgresql.hostIPC }}
+      {{- if or .Values.postgresql.tls.enabled .Values.postgresql.initContainers .Values.postgresql.extraInitContainers (and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled)) }}
+      initContainers:
+      {{- if .Values.postgresql.tls.enabled }}
+        - name: init-chmod-tls
+          image: {{ template "postgresql-ha.volumePermissions.image" . }}
+          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
+          command:
+            - /bin/sh
+            - -cx
+            - |
+              cp /tmp/certs/* /opt/bitnami/postgresql/certs/
+              {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
+              chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/
+              {{- else }}
+              chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/
+              {{- end }}
+              chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
+          {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
+          {{- else }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.volumePermissions.resources }}
+          resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
+          {{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: raw-certificates
+              mountPath: /tmp/certs
+            - name: postgresql-certificates
+              mountPath: /opt/bitnami/postgresql/certs
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+      {{- end }}
+      {{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.postgresql.extendedConf)) (not (empty .Values.postgresql.extendedConfCM))) .Values.persistence.enabled) }}
+        - name: init-chmod-data
+          image: {{ include "postgresql-ha.volumePermissions.image" . }}
+          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
+              chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
+              chown {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
+              find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
+                xargs -r chown -R {{ .Values.postgresql.containerSecurityContext.runAsUser }}:{{ .Values.postgresql.podSecurityContext.fsGroup }}
+          {{- if .Values.volumePermissions.podSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.volumePermissions.resources }}
+          resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
+          {{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath }}
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+      {{- end }}
+      {{- if or .Values.postgresql.initContainers .Values.postgresql.extraInitContainers }}
+      {{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.postgresql.initContainers .Values.postgresql.extraInitContainers) "context" $ ) | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      containers:
+        - name: postgresql
+          image: {{ include "postgresql-ha.postgresql.image" . }}
+          imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
+          {{- if .Values.postgresql.containerSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.postgresql.containerSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.postgresql.lifecycleHooks }}
+          lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.lifecycleHooks "context" $) | nindent 12 }}
+          {{- else }}
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /pre-stop.sh
+                  - {{ .Values.postgresql.preStopDelayAfterPgStopSeconds | quote }}
+          {{- end }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- else if .Values.postgresql.command }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else if .Values.postgresql.args }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.args "context" $) | nindent 12 }}
+          {{- end }}
+          # Auxiliary vars to populate environment variables
+          {{- $postgresqlReplicaCount := int .Values.postgresql.replicaCount }}
+          {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
+          {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
+          {{- $clusterDomain:= .Values.clusterDomain }}
+          env:
+            - name: BITNAMI_DEBUG
+              value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }}
+            # PostgreSQL configuration
+            - name: POSTGRESQL_VOLUME_DIR
+              value: {{ .Values.persistence.mountPath | quote }}
+            - name: PGDATA
+              value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }}
+            {{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: POSTGRES_POSTGRES_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/postgres-password"
+            {{- else }}
+            - name: POSTGRES_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "postgresql-ha.postgresqlSecretName" . }}
+                  key: postgres-password
+            {{- end }}
+            {{- end }}
+            - name: POSTGRES_USER
+              value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: POSTGRES_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/password"
+            {{- else }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  {{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
+                  key: password
+                  {{- else }}
+                  {{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }}
+                  key: postgres-password
+                  {{- else }}
+                  key: password
+                  {{- end }}
+                  {{- end }}
+            {{- end }}
+            {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }}
+            - name: POSTGRES_DB
+              value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}
+            {{- end }}
+            - name: POSTGRESQL_LOG_HOSTNAME
+              value: {{ .Values.postgresql.audit.logHostname | quote }}
+            - name: POSTGRESQL_LOG_CONNECTIONS
+              value: {{ .Values.postgresql.audit.logConnections | quote }}
+            - name: POSTGRESQL_LOG_DISCONNECTIONS
+              value: {{ .Values.postgresql.audit.logDisconnections | quote }}
+            {{- if .Values.postgresql.audit.logLinePrefix }}
+            - name: POSTGRESQL_LOG_LINE_PREFIX
+              value: {{ .Values.postgresql.audit.logLinePrefix | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.audit.logTimezone }}
+            - name: POSTGRESQL_LOG_TIMEZONE
+              value: {{ .Values.postgresql.audit.logTimezone | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.audit.pgAuditLog }}
+            - name: POSTGRESQL_PGAUDIT_LOG
+              value: {{ .Values.postgresql.audit.pgAuditLog | quote }}
+            {{- end }}
+            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
+              value: {{ .Values.postgresql.audit.pgAuditLogCatalog | quote }}
+            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
+              value: {{ .Values.postgresql.audit.clientMinMessages | quote }}
+            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
+              value: {{ .Values.postgresql.sharedPreloadLibraries | quote }}
+            {{- if .Values.postgresql.maxConnections }}
+            - name: POSTGRESQL_MAX_CONNECTIONS
+              value: {{ .Values.postgresql.maxConnections | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.usePgRewind }}
+            - name: REPMGR_USE_PGREWIND
+              value: {{ .Values.postgresql.usePgRewind | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.postgresConnectionLimit }}
+            - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT
+              value: {{ .Values.postgresql.postgresConnectionLimit | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.dbUserConnectionLimit }}
+            - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT
+              value: {{ .Values.postgresql.dbUserConnectionLimit | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.tcpKeepalivesInterval }}
+            - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL
+              value: {{ .Values.postgresql.tcpKeepalivesInterval | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.tcpKeepalivesIdle }}
+            - name: POSTGRESQL_TCP_KEEPALIVES_IDLE
+              value: {{ .Values.postgresql.tcpKeepalivesIdle | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.tcpKeepalivesCount }}
+            - name: POSTGRESQL_TCP_KEEPALIVES_COUNT
+              value: {{ .Values.postgresql.tcpKeepalivesCount | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.statementTimeout }}
+            - name: POSTGRESQL_STATEMENT_TIMEOUT
+              value: {{ .Values.postgresql.statementTimeout | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.pghbaRemoveFilters }}
+            - name: POSTGRESQL_PGHBA_REMOVE_FILTERS
+              value: {{ .Values.postgresql.pghbaRemoveFilters | quote }}
+            {{- end }}
+            - name: POSTGRESQL_ENABLE_TLS
+              value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }}
+            {{- if .Values.postgresql.tls.enabled }}
+            - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS
+              value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }}
+            - name: POSTGRESQL_TLS_CERT_FILE
+              value: {{ template "postgresql-ha.postgresql.tlsCert" . }}
+            - name: POSTGRESQL_TLS_KEY_FILE
+              value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
+            {{- end }}
+            - name: POSTGRESQL_PORT_NUMBER
+              value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
+            # Repmgr configuration
+            - name: REPMGR_PORT_NUMBER
+              value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
+            - name: REPMGR_PRIMARY_PORT
+              value: {{ .Values.postgresql.containerPorts.postgresql | quote }}
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: REPMGR_UPGRADE_EXTENSION
+              value: {{ ternary "yes" "no" .Values.postgresql.upgradeRepmgrExtension | quote }}
+            - name: REPMGR_PGHBA_TRUST_ALL
+              value: {{ ternary "yes" "no" .Values.postgresql.pgHbaTrustAll | quote }}
+            - name: REPMGR_MOUNTED_CONF_DIR
+              value: "/bitnami/repmgr/conf"
+            - name: REPMGR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: REPMGR_PARTNER_NODES
+              value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }}
+            - name: REPMGR_PRIMARY_HOST
+              value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }}
+            - name: REPMGR_NODE_NAME
+              value: "$(MY_POD_NAME)"
+            - name: REPMGR_NODE_NETWORK_NAME
+              value: "$(MY_POD_NAME).{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}"
+            - name: REPMGR_NODE_TYPE
+              value: "data"
+            - name: REPMGR_LOG_LEVEL
+              value: {{ .Values.postgresql.repmgrLogLevel | quote }}
+            - name: REPMGR_CONNECT_TIMEOUT
+              value: {{ .Values.postgresql.repmgrConnectTimeout | quote }}
+            - name: REPMGR_RECONNECT_ATTEMPTS
+              value: {{ .Values.postgresql.repmgrReconnectAttempts | quote }}
+            - name: REPMGR_RECONNECT_INTERVAL
+              value: {{ .Values.postgresql.repmgrReconnectInterval | quote }}
+            - name: REPMGR_USERNAME
+              value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: REPMGR_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/repmgr-password"
+            {{- else }}
+            - name: REPMGR_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  key: repmgr-password
+            {{- end }}
+            {{- if .Values.postgresql.repmgrUsePassfile }}
+            - name: REPMGR_USE_PASSFILE
+              value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }}
+            - name: REPMGR_PASSFILE_PATH
+              value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }}
+            {{- end }}
+            {{- if (include "postgresql-ha.repmgrDatabase" .) }}
+            - name: REPMGR_DATABASE
+              value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }}
+            {{- end }}
+            - name: REPMGR_FENCE_OLD_PRIMARY
+              value: {{ ternary "yes" "no" .Values.postgresql.repmgrFenceOldPrimary | quote }}
+            {{- if .Values.postgresql.repmgrChildNodesCheckInterval }}
+            - name: REPMGR_CHILD_NODES_CHECK_INTERVAL
+              value: {{ .Values.postgresql.repmgrChildNodesCheckInterval | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.repmgrChildNodesConnectedMinCount }}
+            - name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
+              value: {{ .Values.postgresql.repmgrChildNodesConnectedMinCount | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.repmgrChildNodesDisconnectTimeout }}
+            - name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
+              value: {{ .Values.postgresql.repmgrChildNodesDisconnectTimeout | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.syncReplication }}
+            - name: POSTGRESQL_NUM_SYNCHRONOUS_REPLICAS
+              value: {{ sub (int .Values.postgresql.replicaCount) 1 | quote }}
+            {{- end }}
+            {{- if .Values.postgresql.syncReplicationMode }}
+            - name: POSTGRESQL_SYNCHRONOUS_REPLICAS_MODE
+              value: {{ .Values.postgresql.syncReplicationMode | quote }}
+            {{- end }}
+            - name: POSTGRESQL_SR_CHECK
+              value: "yes"
+            - name: POSTGRESQL_SR_CHECK_USERNAME
+              value: {{ (include "postgresql-ha.pgoolSrCheckUsername" .) | quote }}
+            - name: POSTGRESQL_SR_CHECK_DATABASE
+              value: {{ .Values.pgpool.srCheckDatabase | quote  }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: POSTGRESQL_SR_CHECK_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/sr-check-password"
+            {{- else }}
+            - name: POSTGRESQL_SR_CHECK_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.pgpoolSecretName" . }}
+                  key: sr-check-password
+            {{- end }}
+            {{- if .Values.postgresql.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          envFrom:
+            {{- if .Values.postgresql.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ .Values.postgresql.extraEnvVarsCM }}
+            {{- end }}
+            {{- if .Values.postgresql.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ .Values.postgresql.extraEnvVarsSecret }}
+            {{- end }}
+          ports:
+            - name: postgresql
+              containerPort: {{ .Values.postgresql.containerPorts.postgresql }}
+              protocol: TCP
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.postgresql.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.postgresql.livenessProbe.enabled }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.livenessProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - /liveness-probe.sh
+          {{- end }}
+          {{- if .Values.postgresql.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.postgresql.readinessProbe.enabled }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.readinessProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - /readiness-probe.sh
+          {{- end }}
+          {{- if .Values.postgresql.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.postgresql.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.postgresql.startupProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - bash
+                - -ec
+                - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.postgresql.containerPorts.postgresql }} -c "SELECT 1"'
+          {{- end }}
+          {{- end }}
+          {{- if .Values.postgresql.resources }}
+          resources: {{- toYaml .Values.postgresql.resources | nindent 12 }}
+          {{- else if ne .Values.postgresql.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.postgresql.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/postgresql/conf
+              subPath: app-conf-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/postgresql/tmp
+              subPath: app-tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/repmgr/conf
+              subPath: repmgr-conf-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/repmgr/tmp
+              subPath: repmgr-tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/repmgr/logs
+              subPath: repmgr-logs-dir
+            {{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }}
+            - name: postgresql-config
+              mountPath: /bitnami/repmgr/conf
+            {{- end }}
+            {{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }}
+            - name: postgresql-extended-config
+              mountPath: /bitnami/postgresql/conf/conf.d/
+            {{- end }}
+            {{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }}
+            - name: custom-init-scripts
+              mountPath: /docker-entrypoint-initdb.d/
+            {{- end }}
+            {{- if .Values.postgresql.initdbScriptsSecret }}
+            - name: custom-init-scripts-secret
+              mountPath: /docker-entrypoint-initdb.d/secret
+            {{- end }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            {{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
+            - name: postgresql-creds
+              mountPath: /opt/bitnami/postgresql/secrets/postgres-password
+              subPath: postgres-password
+            {{- end }}
+            - name: postgresql-creds
+              subPath: password
+              mountPath: /opt/bitnami/postgresql/secrets/password
+            - name: postgresql-creds
+              subPath: repmgr-password
+              mountPath: /opt/bitnami/postgresql/secrets/repmgr-password
+            - name: pgpool-creds
+              subPath: sr-check-password
+              mountPath: /opt/bitnami/postgresql/secrets/sr-check-password
+            {{- end }}
+            {{- if .Values.postgresql.tls.enabled }}
+            - name: postgresql-certificates
+              mountPath: /opt/bitnami/postgresql/certs
+            {{- end }}
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath }}
+            - name: scripts
+              mountPath: /pre-stop.sh
+              subPath: pre-stop.sh
+            - name: scripts
+              mountPath: /liveness-probe.sh
+              subPath: liveness-probe.sh
+            - name: scripts
+              mountPath: /readiness-probe.sh
+              subPath: readiness-probe.sh
+            {{- if .Values.postgresql.extraVolumeMounts }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumeMounts "context" $) | nindent 12 }}
+            {{- end }}
+        {{- if .Values.metrics.enabled }}
+        - name: metrics
+          image: {{ include "postgresql-ha.metrics.image" . }}
+          imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
+          {{- if .Values.metrics.podSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          env:
+            - name: PG_EXPORTER_WEB_LISTEN_ADDRESS
+              value: :{{ .Values.metrics.containerPorts.http }}
+            - name: DATA_SOURCE_URI
+              value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.postgresql.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: DATA_SOURCE_PASS_FILE
+              value: "/opt/bitnami/postgresql/secrets/password"
+            {{- else }}
+            - name: DATA_SOURCE_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  key: password
+            {{- end }}
+            - name: DATA_SOURCE_USER
+              value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
+            {{- if .Values.metrics.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          envFrom:
+            {{- if .Values.metrics.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ .Values.metrics.extraEnvVarsCM }}
+            {{- end }}
+            {{- if .Values.metrics.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ .Values.metrics.extraEnvVarsSecret }}
+            {{- end }}
+          ports:
+            - name: metrics
+              containerPort: {{ .Values.metrics.containerPorts.http }}
+              protocol: TCP
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.metrics.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.metrics.livenessProbe.enabled }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
+            tcpSocket:
+              port: metrics
+          {{- end }}
+          {{- if .Values.metrics.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.metrics.readinessProbe.enabled }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /
+              port: metrics
+          {{- end }}
+          {{- if .Values.metrics.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.metrics.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /
+              port: metrics
+          {{- end }}
+          {{- end }}
+          {{- if .Values.metrics.resources }}
+          resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
+          {{- else if ne .Values.metrics.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+          {{- if or .Values.postgresql.usePasswordFiles .Values.metrics.customMetrics }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: postgresql-creds
+              mountPath: /opt/bitnami/postgresql/secrets/
+            {{- end }}
+            {{- if .Values.metrics.customMetrics }}
+            - name: custom-metrics
+              mountPath: /conf
+              readOnly: true
+            {{- end }}
+          {{- end }}
+          {{- if .Values.metrics.customMetrics }}
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else }}
+          args: ["--extend.query-path", "/conf/custom-metrics.yaml"]
+          {{- end }}
+          {{- end }}
+        {{- end }}
+        {{- if .Values.postgresql.sidecars }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.sidecars "context" $) | nindent 8 }}
+        {{- end }}
+      volumes:
+        {{- if .Values.postgresql.extraVolumes }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.postgresql.extraVolumes "context" $) | nindent 8 }}
+        {{- end }}
+        - name: empty-dir
+          emptyDir: {}
+        {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
+        - name: custom-metrics
+          configMap:
+            name: {{ include "postgresql.metricsCM" . }}
+        {{- end }}
+        - name: scripts
+          configMap:
+            name: {{ printf "%s-scripts" (include "postgresql-ha.postgresql" .) }}
+            defaultMode: 0755
+        {{- if or .Values.postgresql.repmgrConfiguration .Values.postgresql.configuration .Values.postgresql.pgHbaConfiguration .Values.postgresql.configurationCM }}
+        - name: postgresql-config
+          configMap:
+            name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }}
+        {{- end }}
+        {{- if or .Values.postgresql.extendedConf .Values.postgresql.extendedConfCM }}
+        - name: postgresql-extended-config
+          configMap:
+            name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }}
+        {{- end }}
+        {{- if .Values.postgresql.initdbScriptsSecret }}
+        - name: custom-init-scripts-secret
+          secret:
+            secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }}
+        {{- end }}
+        {{- if .Values.postgresql.usePasswordFiles }}
+        - name: postgresql-creds
+          secret:
+            secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
+        - name: pgpool-creds
+          secret:
+            secretName: {{ include "postgresql-ha.pgpoolSecretName" . }}
+        {{- end }}
+        {{- if or .Values.postgresql.initdbScriptsCM .Values.postgresql.initdbScripts }}
+        - name: custom-init-scripts
+          configMap:
+            name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }}
+        {{- end }}
+        {{- if .Values.postgresql.tls.enabled }}
+        - name: raw-certificates
+          secret:
+            secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }}
+        - name: postgresql-certificates
+          emptyDir: {}
+        {{- end }}
+      {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
+        - name: data
+          persistentVolumeClaim:
+      {{- with .Values.persistence.existingClaim }}
+            claimName: {{ tpl . $ }}
+      {{- end }}
+      {{- else if not .Values.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+  {{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+  {{- if .Values.persistentVolumeClaimRetentionPolicy.enabled }}
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: {{ .Values.persistentVolumeClaimRetentionPolicy.whenDeleted }}
+    whenScaled: {{ .Values.persistentVolumeClaimRetentionPolicy.whenScaled }}
+  {{- end }}
+  volumeClaimTemplates:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: data
+        {{- if .Values.persistence.annotations }}
+        annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
+        {{- end }}
+        {{- if .Values.persistence.labels }}
+        labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
+        {{- end }}
+      spec:
+        accessModes:
+        {{- range .Values.persistence.accessModes }}
+          - {{ . | quote }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.persistence.size | quote }}
+        {{- if .Values.persistence.selector }}
+        selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
+        {{- end -}}
+        {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
+  {{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
@@ -0,0 +1,30 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.witness.pdb.create }}
+apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }} 
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: witness
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.witness.pdb.minAvailable }}
+  minAvailable: {{ .Values.witness.pdb.minAvailable }}
+  {{- end }}
+  {{- if or .Values.witness.pdb.maxUnavailable (not .Values.witness.pdb.minAvailable) }}
+  maxUnavailable: {{ .Values.witness.pdb.maxUnavailable | default 1 }}
+  {{- end }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.postgresql.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: postgresql
+      role: witness
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/postgresql/witness-statefulset.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/postgresql/witness-statefulset.yaml
@@ -0,0 +1,631 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.witness.create }}
+apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
+kind: StatefulSet
+metadata:
+  name: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.labels .Values.commonLabels ) "context" . ) }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: postgresql
+    role: witness
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.witness.replicaCount }}
+  podManagementPolicy: Parallel
+  serviceName: {{ printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
+  updateStrategy: {{- toYaml .Values.witness.updateStrategy | nindent 4 }}
+  {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.witness.podLabels .Values.commonLabels ) "context" . ) }}
+  selector:
+    matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+      app.kubernetes.io/component: postgresql
+      role: witness
+  template:
+    metadata:
+      labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
+        app.kubernetes.io/component: postgresql
+        role: witness
+      {{- if or .Values.witness.podAnnotations (and .Values.metrics.enabled .Values.metrics.annotations) }}
+      annotations:
+      {{- if .Values.witness.podAnnotations }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.witness.podAnnotations "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if and .Values.metrics.enabled .Values.metrics.annotations }}
+      {{- include "common.tplvalues.render" (dict "value" .Values.metrics.annotations "context" $) | nindent 8 }}
+      {{- end }}
+      {{- end }}
+    spec:
+      {{- include "postgresql-ha.image.pullSecrets" . | nindent 6 }}
+      automountServiceAccountToken: {{ .Values.witness.automountServiceAccountToken }}
+      {{- if .Values.witness.hostAliases }}
+      hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.witness.hostAliases "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.witness.affinity }}
+      affinity: {{- include "common.tplvalues.render" (dict "value" .Values.witness.affinity "context" $) | nindent 8 }}
+      {{- else }}
+      affinity:
+        podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
+        podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.witness.podAntiAffinityPreset "component" "postgresql" "customLabels" $podLabels "context" $) | nindent 10 }}
+        nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.witness.nodeAffinityPreset.type "key" .Values.witness.nodeAffinityPreset.key "values" .Values.witness.nodeAffinityPreset.values) | nindent 10 }}
+      {{- end }}
+      {{- if .Values.witness.nodeSelector }}
+      nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.witness.nodeSelector "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.witness.tolerations }}
+      tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.witness.tolerations "context" $) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.witness.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.witness.topologySpreadConstraints "context" .) | nindent 8 }}
+      {{- end }}
+      {{- if .Values.witness.priorityClassName }}
+      priorityClassName: {{ .Values.witness.priorityClassName | quote }}
+      {{- end }}
+      {{- if .Values.witness.schedulerName }}
+      schedulerName: {{ .Values.witness.schedulerName }}
+      {{- end }}
+      {{- if .Values.witness.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.witness.terminationGracePeriodSeconds }}
+      {{- end }}
+      {{- if .Values.witness.podSecurityContext.enabled }}
+      securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.podSecurityContext "context" $) | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "postgresql-ha.serviceAccountName" . }}
+      hostNetwork: {{ .Values.witness.hostNetwork }}
+      hostIPC: {{ .Values.witness.hostIPC }}
+      initContainers:
+      {{- if .Values.postgresql.tls.enabled }}
+        - name: init-chmod-tls
+          image: {{ template "postgresql-ha.volumePermissions.image" . }}
+          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
+          command:
+            - /bin/sh
+            - -cx
+            - |
+              cp /tmp/certs/* /opt/bitnami/postgresql/certs/
+              {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
+              chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/
+              {{- else }}
+              chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/
+              {{- end }}
+              chmod 600 {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
+          {{- if eq ( toString ( .Values.volumePermissions.podSecurityContext.runAsUser )) "auto" }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" (omit .Values.volumePermissions.podSecurityContext "runAsUser") "context" $) | nindent 12 }}
+          {{- else }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: raw-certificates
+              mountPath: /tmp/certs
+            - name: postgresql-certificates
+              mountPath: /opt/bitnami/postgresql/certs
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+      {{- end }}
+      {{- if and .Values.volumePermissions.enabled (or (or (not (empty .Values.witness.extendedConf)) (not (empty .Values.witness.extendedConfCM))) .Values.persistence.enabled) }}
+        - name: init-chmod-data
+          image: {{ include "postgresql-ha.volumePermissions.image" . }}
+          imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
+          command:
+            - sh
+            - -c
+            - |
+              mkdir -p {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
+              chmod 700 {{ .Values.persistence.mountPath }}/conf {{ .Values.persistence.mountPath }}/data {{ .Values.persistence.mountPath }}/lock
+              chown {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
+              find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
+                xargs -r chown -R {{ .Values.witness.containerSecurityContext.runAsUser }}:{{ .Values.witness.podSecurityContext.fsGroup }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.volumePermissions.podSecurityContext "context" $) | nindent 12 }}
+          {{- if .Values.volumePermissions.resources }}
+          resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
+          {{- else if ne .Values.volumePermissions.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.volumePermissions.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath }}
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+      {{- end }}
+      {{- if or .Values.witness.initContainers .Values.witness.extraInitContainers }}
+      {{- include "common.tplvalues.render" ( dict "value" (coalesce .Values.witness.initContainers .Values.witness.extraInitContainers) "context" $ ) | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: postgresql
+          image: {{ include "postgresql-ha.postgresql.image" . }}
+          imagePullPolicy: {{ .Values.postgresql.image.pullPolicy | quote }}
+          {{- if .Values.witness.containerSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.witness.containerSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.witness.lifecycleHooks }}
+          lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.witness.lifecycleHooks "context" $) | nindent 12 }}
+          {{- else }}
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - /pre-stop.sh
+          {{- end }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- else if .Values.witness.command }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.witness.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else if .Values.witness.args }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.witness.args "context" $) | nindent 12 }}
+          {{- end }}
+          # Auxiliary vars to populate environment variables
+          {{- $postgresqlReplicaCount := int .Values.witness.replicaCount }}
+          {{- $postgresqlFullname := include "postgresql-ha.postgresql" . }}
+          {{- $postgresqlHeadlessServiceName := printf "%s-headless" (include "postgresql-ha.postgresql" .) }}
+          {{- $postgresqlWitnessServiceName := printf "%s-witness" (include "postgresql-ha.postgresql" .) }}
+          {{- $clusterDomain:= .Values.clusterDomain }}
+          env:
+            - name: BITNAMI_DEBUG
+              value: {{ ternary "true" "false" (or .Values.postgresql.image.debug .Values.diagnosticMode.enabled) | quote }}
+            # PostgreSQL configuration
+            - name: POSTGRESQL_VOLUME_DIR
+              value: {{ .Values.persistence.mountPath | quote }}
+            - name: PGDATA
+              value: {{ printf "%s/%s" .Values.persistence.mountPath "data" | quote }}
+            {{- if not (eq (include "postgresql-ha.postgresqlUsername" .) "postgres") }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: POSTGRES_POSTGRES_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/postgres-password"
+            {{- else }}
+            - name: POSTGRES_POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "postgresql-ha.postgresqlSecretName" . }}
+                  key: postgres-password
+            {{- end }}
+            {{- end }}
+            - name: POSTGRES_USER
+              value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: POSTGRES_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/password"
+            {{- else }}
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  {{- if (include "postgresql-ha.postgresqlCreateSecret" .) }}
+                  key: password
+                  {{- else }}
+                  {{- if ( index ( lookup "v1" "Secret" (include "common.names.namespace" .) (include "postgresql-ha.postgresqlSecretName" .) ) ".data.postgres-password" ) }}
+                  key: postgres-password
+                  {{- else }}
+                  key: password
+                  {{- end }}
+                  {{- end }}
+            {{- end }}
+            {{- if not (empty (include "postgresql-ha.postgresqlDatabase" .)) }}
+            - name: POSTGRES_DB
+              value: {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }}
+            {{- end }}
+            - name: POSTGRESQL_LOG_HOSTNAME
+              value: {{ .Values.witness.audit.logHostname | quote }}
+            - name: POSTGRESQL_LOG_CONNECTIONS
+              value: {{ .Values.witness.audit.logConnections | quote }}
+            - name: POSTGRESQL_LOG_DISCONNECTIONS
+              value: {{ .Values.witness.audit.logDisconnections | quote }}
+            {{- if .Values.witness.audit.logLinePrefix }}
+            - name: POSTGRESQL_LOG_LINE_PREFIX
+              value: {{ .Values.witness.audit.logLinePrefix | quote }}
+            {{- end }}
+            {{- if .Values.witness.audit.logTimezone }}
+            - name: POSTGRESQL_LOG_TIMEZONE
+              value: {{ .Values.witness.audit.logTimezone | quote }}
+            {{- end }}
+            {{- if .Values.witness.audit.pgAuditLog }}
+            - name: POSTGRESQL_PGAUDIT_LOG
+              value: {{ .Values.witness.audit.pgAuditLog | quote }}
+            {{- end }}
+            - name: POSTGRESQL_PGAUDIT_LOG_CATALOG
+              value: {{ .Values.witness.audit.pgAuditLogCatalog | quote }}
+            - name: POSTGRESQL_CLIENT_MIN_MESSAGES
+              value: {{ .Values.witness.audit.clientMinMessages | quote }}
+            - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
+              value: {{ .Values.postgresql.sharedPreloadLibraries | quote }}
+            {{- if .Values.witness.maxConnections }}
+            - name: POSTGRESQL_MAX_CONNECTIONS
+              value: {{ .Values.witness.maxConnections | quote }}
+            {{- end }}
+            {{- if .Values.witness.postgresConnectionLimit }}
+            - name: POSTGRESQL_POSTGRES_CONNECTION_LIMIT
+              value: {{ .Values.witness.postgresConnectionLimit | quote }}
+            {{- end }}
+            {{- if .Values.witness.dbUserConnectionLimit }}
+            - name: POSTGRESQL_USERNAME_CONNECTION_LIMIT
+              value: {{ .Values.witness.dbUserConnectionLimit | quote }}
+            {{- end }}
+            {{- if .Values.witness.tcpKeepalivesInterval }}
+            - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL
+              value: {{ .Values.witness.tcpKeepalivesInterval | quote }}
+            {{- end }}
+            {{- if .Values.witness.tcpKeepalivesIdle }}
+            - name: POSTGRESQL_TCP_KEEPALIVES_IDLE
+              value: {{ .Values.witness.tcpKeepalivesIdle | quote }}
+            {{- end }}
+            {{- if .Values.witness.tcpKeepalivesCount }}
+            - name: POSTGRESQL_TCP_KEEPALIVES_COUNT
+              value: {{ .Values.witness.tcpKeepalivesCount | quote }}
+            {{- end }}
+            {{- if .Values.witness.statementTimeout }}
+            - name: POSTGRESQL_STATEMENT_TIMEOUT
+              value: {{ .Values.witness.statementTimeout | quote }}
+            {{- end }}
+            {{- if .Values.witness.pghbaRemoveFilters }}
+            - name: POSTGRESQL_PGHBA_REMOVE_FILTERS
+              value: {{ .Values.witness.pghbaRemoveFilters | quote }}
+            {{- end }}
+            - name: POSTGRESQL_ENABLE_TLS
+              value: {{ ternary "yes" "no" .Values.postgresql.tls.enabled | quote }}
+            {{- if .Values.postgresql.tls.enabled }}
+            - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS
+              value: {{ ternary "yes" "no" .Values.postgresql.tls.preferServerCiphers | quote }}
+            - name: POSTGRESQL_TLS_CERT_FILE
+              value: {{ template "postgresql-ha.postgresql.tlsCert" . }}
+            - name: POSTGRESQL_TLS_KEY_FILE
+              value: {{ template "postgresql-ha.postgresql.tlsCertKey" . }}
+            {{- end }}
+            - name: POSTGRESQL_PORT_NUMBER
+              value: {{ .Values.witness.containerPorts.postgresql | quote }}
+            # Repmgr configuration
+            - name: REPMGR_PORT_NUMBER
+              value: {{ .Values.witness.containerPorts.postgresql | quote }}
+            - name: REPMGR_PRIMARY_PORT
+              value: {{ .Values.witness.containerPorts.postgresql | quote }}
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: REPMGR_UPGRADE_EXTENSION
+              value: {{ ternary "yes" "no" .Values.witness.upgradeRepmgrExtension | quote }}
+            - name: REPMGR_PGHBA_TRUST_ALL
+              value: {{ ternary "yes" "no" .Values.witness.pgHbaTrustAll | quote }}
+            - name: REPMGR_MOUNTED_CONF_DIR
+              value: "/bitnami/repmgr/conf"
+            - name: REPMGR_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: REPMGR_PARTNER_NODES
+              value: {{ range $e, $i := until $postgresqlReplicaCount }}{{ $postgresqlFullname }}-{{ $i }}.{{ $postgresqlHeadlessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }},{{ end }}
+            - name: REPMGR_PRIMARY_HOST
+              value: {{ printf "%s-0.%s.$(REPMGR_NAMESPACE).svc.%s" $postgresqlFullname $postgresqlHeadlessServiceName $clusterDomain | quote }}
+            - name: REPMGR_NODE_NAME
+              value: "$(MY_POD_NAME)"
+            - name: REPMGR_NODE_NETWORK_NAME
+              value: "$(MY_POD_NAME).{{ $postgresqlWitnessServiceName }}.$(REPMGR_NAMESPACE).svc.{{ $clusterDomain }}"
+            - name: REPMGR_NODE_TYPE
+              value: "witness"
+            - name: REPMGR_NODE_ID_START_SEED
+              value: "2000"
+            - name: REPMGR_LOG_LEVEL
+              value: {{ .Values.witness.repmgrLogLevel | quote }}
+            - name: REPMGR_CONNECT_TIMEOUT
+              value: {{ .Values.witness.repmgrConnectTimeout | quote }}
+            - name: REPMGR_RECONNECT_ATTEMPTS
+              value: {{ .Values.witness.repmgrReconnectAttempts | quote }}
+            - name: REPMGR_RECONNECT_INTERVAL
+              value: {{ .Values.witness.repmgrReconnectInterval | quote }}
+            - name: REPMGR_USERNAME
+              value: {{ (include "postgresql-ha.postgresqlRepmgrUsername" .) | quote }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: REPMGR_PASSWORD_FILE
+              value: "/opt/bitnami/postgresql/secrets/repmgr-password"
+            {{- else }}
+            - name: REPMGR_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  key: repmgr-password
+            {{- end }}
+            {{- if .Values.postgresql.repmgrUsePassfile }}
+            - name: REPMGR_USE_PASSFILE
+              value: {{ ternary "true" "false" .Values.postgresql.repmgrUsePassfile | quote }}
+            - name: REPMGR_PASSFILE_PATH
+              value: {{ default "/opt/bitnami/repmgr/conf/.pgpass" .Values.postgresql.repmgrPassfilePath }}
+            {{- end }}
+            {{- if (include "postgresql-ha.repmgrDatabase" .) }}
+            - name: REPMGR_DATABASE
+              value: {{ (include "postgresql-ha.repmgrDatabase" .) | quote }}
+            {{- end }}
+            {{- if .Values.witness.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.witness.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          envFrom:
+            {{- if .Values.witness.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ .Values.witness.extraEnvVarsCM }}
+            {{- end }}
+            {{- if .Values.witness.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ .Values.witness.extraEnvVarsSecret }}
+            {{- end }}
+          ports:
+            - name: postgresql
+              containerPort: {{ .Values.witness.containerPorts.postgresql }}
+              protocol: TCP
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.witness.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.witness.livenessProbe.enabled }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.livenessProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - postgres
+                - -h
+                - "127.0.0.1"
+                - -p
+                - {{ .Values.witness.containerPorts.postgresql | quote }}
+          {{- end }}
+          {{- if .Values.witness.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.witness.readinessProbe.enabled }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.readinessProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - bash
+                - -ec
+                - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"'
+          {{- end }}
+          {{- if .Values.witness.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.witness.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.witness.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.witness.startupProbe "enabled") "context" $) | nindent 12 }}
+            exec:
+              command:
+                - bash
+                - -ec
+                - '{{ include "postgresql-ha.pgpassword" . }} psql -w -U {{ include "postgresql-ha.postgresqlUsername" . | quote }} -d {{ (include "postgresql-ha.postgresqlDatabase" .) | quote }} -h 127.0.0.1 -p {{ .Values.witness.containerPorts.postgresql }} -c "SELECT 1"'
+          {{- end }}
+          {{- end }}
+          {{- if .Values.witness.resources }}
+          resources: {{- toYaml .Values.witness.resources | nindent 12 }}
+          {{- else if ne .Values.witness.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.witness.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/postgresql/conf
+              subPath: app-conf-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/postgresql/tmp
+              subPath: app-tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/repmgr/conf
+              subPath: repmgr-conf-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/repmgr/tmp
+              subPath: repmgr-tmp-dir
+            - name: empty-dir
+              mountPath: /opt/bitnami/repmgr/logs
+              subPath: repmgr-logs-dir
+            {{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }}
+            - name: postgresql-config
+              mountPath: /bitnami/repmgr/conf
+            {{- end }}
+            {{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }}
+            - name: postgresql-extended-config
+              mountPath: /bitnami/postgresql/conf/conf.d/
+            {{- end }}
+            {{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }}
+            - name: custom-init-scripts
+              mountPath: /docker-entrypoint-initdb.d/
+            {{- end }}
+            {{- if .Values.witness.initdbScriptsSecret }}
+            - name: custom-init-scripts-secret
+              mountPath: /docker-entrypoint-initdb.d/secret
+            {{- end }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: password
+              mountPath: /opt/bitnami/postgresql/secrets/
+            {{- end }}
+            {{- if .Values.postgresql.tls.enabled }}
+            - name: postgresql-certificates
+              mountPath: /opt/bitnami/postgresql/certs
+            {{- end }}
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath }}
+            - name: scripts
+              mountPath: /pre-stop.sh
+              subPath: pre-stop.sh
+            {{- if .Values.witness.extraVolumeMounts }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumeMounts "context" $) | nindent 12 }}
+            {{- end }}
+        {{- if .Values.metrics.enabled }}
+        - name: metrics
+          image: {{ include "postgresql-ha.metrics.image" . }}
+          imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }}
+          {{- if .Values.metrics.podSecurityContext.enabled }}
+          securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.metrics.podSecurityContext "context" $) | nindent 12 }}
+          {{- end }}
+          env:
+            - name: PG_EXPORTER_WEB_LISTEN_ADDRESS
+              value: :{{ .Values.metrics.containerPorts.http }}
+            - name: DATA_SOURCE_URI
+              value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (.Values.witness.containerPorts.postgresql | int64) (include "postgresql-ha.postgresqlDatabase" .) | quote }}
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: DATA_SOURCE_PASS_FILE
+              value: "/opt/bitnami/postgresql/secrets/password"
+            {{- else }}
+            - name: DATA_SOURCE_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "postgresql-ha.postgresqlSecretName" . }}
+                  key: password
+            {{- end }}
+            - name: DATA_SOURCE_USER
+              value: {{ (include "postgresql-ha.postgresqlUsername" .) | quote }}
+            {{- if .Values.metrics.extraEnvVars }}
+            {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }}
+            {{- end }}
+          envFrom:
+            {{- if .Values.metrics.extraEnvVarsCM }}
+            - configMapRef:
+                name: {{ .Values.metrics.extraEnvVarsCM }}
+            {{- end }}
+            {{- if .Values.metrics.extraEnvVarsSecret }}
+            - secretRef:
+                name: {{ .Values.metrics.extraEnvVarsSecret }}
+            {{- end }}
+          ports:
+            - name: metrics
+              containerPort: {{ .Values.metrics.containerPorts.http }}
+              protocol: TCP
+          {{- if not .Values.diagnosticMode.enabled }}
+          {{- if .Values.metrics.customLivenessProbe }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.metrics.livenessProbe.enabled }}
+          livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }}
+            tcpSocket:
+              port: metrics
+          {{- end }}
+          {{- if .Values.metrics.customReadinessProbe }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }}
+          {{- else if .Values.metrics.readinessProbe.enabled }}
+          readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /
+              port: metrics
+          {{- end }}
+          {{- if .Values.metrics.customStartupProbe }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }}
+          {{- else if .Values.metrics.startupProbe.enabled }}
+          startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }}
+            httpGet:
+              path: /
+              port: metrics
+          {{- end }}
+          {{- end }}
+          {{- if .Values.metrics.resources }}
+          resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
+          {{- else if ne .Values.metrics.resourcesPreset "none" }}
+          resources: {{- include "common.resources.preset" (dict "type" .Values.metrics.resourcesPreset) | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: empty-dir
+              mountPath: /tmp
+              subPath: tmp-dir
+            {{- if .Values.postgresql.usePasswordFiles }}
+            - name: password
+              mountPath: /opt/bitnami/postgresql/secrets/
+            {{- end }}
+            {{- if .Values.metrics.customMetrics }}
+            - name: custom-metrics
+              mountPath: /conf
+              readOnly: true
+          {{- if .Values.diagnosticMode.enabled }}
+          command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
+          {{- end }}
+          {{- if .Values.diagnosticMode.enabled }}
+          args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
+          {{- else }}
+          args: ["--extend.query-path", "/conf/custom-metrics.yaml"]
+          {{- end }}
+          {{- end }}
+        {{- end }}
+        {{- if .Values.witness.sidecars }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.witness.sidecars "context" $) | nindent 8 }}
+        {{- end }}
+      volumes:
+        {{- if .Values.witness.extraVolumes }}
+        {{- include "common.tplvalues.render" (dict "value" .Values.witness.extraVolumes "context" $) | nindent 8 }}
+        {{- end }}
+        - name: empty-dir
+          emptyDir: {}
+        {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }}
+        - name: custom-metrics
+          configMap:
+            name: {{ include "postgresql.metricsCM" . }}
+        {{- end }}
+        - name: scripts
+          configMap:
+            name: {{ printf "%s-scripts" (include "postgresql-ha.postgresql" .) }}
+            defaultMode: 0755
+        {{- if or .Values.witness.repmgrConfiguration .Values.witness.configuration .Values.witness.pgHbaConfiguration .Values.witness.configurationCM }}
+        - name: postgresql-config
+          configMap:
+            name: {{ include "postgresql-ha.postgresqlConfigurationCM" . }}
+        {{- end }}
+        {{- if or .Values.witness.extendedConf .Values.witness.extendedConfCM }}
+        - name: postgresql-extended-config
+          configMap:
+            name: {{ template "postgresql-ha.postgresqlExtendedConfCM" . }}
+        {{- end }}
+        {{- if .Values.witness.initdbScriptsSecret }}
+        - name: custom-init-scripts-secret
+          secret:
+            secretName: {{ template "postgresql-ha.postgresqlInitdbScriptsSecret" . }}
+        {{- end }}
+        {{- if .Values.postgresql.usePasswordFiles }}
+        - name: password
+          secret:
+            secretName: {{ include "postgresql-ha.postgresqlSecretName" . }}
+        {{- end }}
+        {{- if or .Values.witness.initdbScriptsCM .Values.witness.initdbScripts }}
+        - name: custom-init-scripts
+          configMap:
+            name: {{ template "postgresql-ha.postgresqlInitdbScriptsCM" . }}
+        {{- end }}
+        {{- if .Values.postgresql.tls.enabled }}
+        - name: raw-certificates
+          secret:
+            secretName: {{ required "A secret containing TLS certificates is required when TLS is enabled" (tpl .Values.postgresql.tls.certificatesSecret .) }}
+        - name: postgresql-certificates
+          emptyDir: {}
+        {{- end }}
+      {{- if and .Values.persistence.enabled .Values.persistence.existingClaim }}
+        - name: data
+          persistentVolumeClaim:
+      {{- with .Values.persistence.existingClaim }}
+            claimName: {{ tpl . $ }}
+      {{- end }}
+      {{- else if not .Values.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+  {{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+  volumeClaimTemplates:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: data
+        {{- if .Values.persistence.annotations }}
+        annotations: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
+        {{- end }}
+        {{- if .Values.persistence.labels }}
+        labels: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.labels "context" $) | nindent 10 }}
+        {{- end }}
+      spec:
+        accessModes:
+        {{- range .Values.persistence.accessModes }}
+          - {{ . | quote }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.persistence.size | quote }}
+        {{- if .Values.persistence.selector }}
+        selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.selector "context" $) | nindent 10 }}
+        {{- end -}}
+        {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/role.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/role.yaml
@@ -0,0 +1,27 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.rbac.create }}
+kind: Role
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+rules:
+  {{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }}
+  - apiGroups: ["extensions"]
+    resources: ["podsecuritypolicies"]
+    verbs: ["use"]
+    resourceNames:
+      - {{ template "common.names.fullname" . }}
+  {{- end }}
+  {{- if .Values.rbac.rules }}
+  {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }}
+  {{- end }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/rolebinding.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/rolebinding.yaml
@@ -0,0 +1,24 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.rbac.create }}
+kind: RoleBinding
+apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
+metadata:
+  name: {{ template "common.names.fullname" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+roleRef:
+  kind: Role
+  name: {{ template "common.names.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ default (include "common.names.fullname" . ) .Values.serviceAccount.name }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
--- a/backing-services/gitea/charts/postgresql-ha/templates/serviceaccount.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "postgresql-ha.serviceAccountName" . }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
+  {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end -}}
--- a/backing-services/gitea/charts/postgresql-ha/templates/tls-secrets.yaml
+++ b/backing-services/gitea/charts/postgresql-ha/templates/tls-secrets.yaml
@@ -0,0 +1,29 @@
+{{- /*
+Copyright Broadcom, Inc. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+{{- if (include "postgresql-ha.createTlsSecret" . ) }}
+{{- $secretName := printf "%s-crt" (include "postgresql-ha.pgpool" .) }}
+{{- $ca := genCA "postgresql-ha-internal-ca" 365 }}
+{{- $fullname := include "postgresql-ha.pgpool" . }}
+{{- $releaseNamespace := .Release.Namespace }}
+{{- $clusterDomain := .Values.clusterDomain }}
+{{- $serviceName := include "postgresql-ha.pgpool" . }}
+{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname }}
+{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
+  tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
+  ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
+{{- end }}