Chart: opt-in service account and pod labels (backport to r8.0)

[MusaMisto]

What

This backports #303 to releases/r8.0. It's a git cherry-pick -x of the merged commit 7f93814, with the same three files and the same change. Two opt-in values are added to the bitween chart:

Value	Default	Renders
serviceAccount.name	''	serviceAccountName on the pod spec, quoted. The chart doesn't create the ServiceAccount.
podLabels	{}	Extra labels on the pod template only, never on the selector. Values are quoted, and app, draft and release are rejected.

Both are empty by default, so nothing changes for anyone who doesn't set them.

Why

GIG runs bitween on the 8.1 line:

• Staging runs bitween-8.1.64. This was checked with helm list -n autoparts on the staging cluster.
• Prod and DR run 8.1.65. This is inferred from the chart index: it's the version their last unpinned deploy would have pulled on 2026-08-06, before 10.0.0 existed.

The chart version is also the app version, because the image tag is .Chart.Version. So moving GIG's deploy onto the org's helm-deploy-values.yml without a major 8.1 → 10.0 app upgrade needs an 8.1 chart with these values. Today, GIG gets the service account and label from a Python --post-renderer on Helm 3.12, and Helm 4 only accepts post-renderer plugins.

Verification

• The patch applies cleanly. The cherry-pick has no conflicts. The only other chart difference between r8.0 and r10.0 is comments and the $root fix in the extra-secrets loop, which this doesn't touch.

• The tests pass on the r8.0 chart. All of Chart: opt-in service account and pod labels #303's render tests pass (13 of 13) on this branch. The untouched r8.0 chart fails the 8 new-feature cases, as expected.

• Default output is unchanged. With nothing set, the render is byte-identical to the untouched r8.0 chart, in both ingress and Gateway API mode.

• The only change since GIG's version is this one. charts/default hasn't changed on r8.0 since GIG's 8.1.64.

• End-to-end GIG check. GIG staging's values were rendered two ways:

  • today's command on the running 8.1.64 chart, piped through its real post-renderer, with fake secrets of the same shape
  • the extracted code of helm-deploy-values.yml and the helm-deploy action, using this branch's chart

  The two renders are semantically identical across the Secret, Service, Deployment and Ingress.

Release impact

• Merging publishes a new 8.1.x. Merging into releases/r8.0 runs the r8.0 release, which publishes the next 8.1.x chart and image.
• It also rolls playground back to 8.1. The release deploys to playground. That's the same bitween release on app-dev.bitween.io that the r10.0 pipeline deploys, so playground runs 8.1.x until the next r10.0 push. Every r8.0 push already does this.
• Unpinned consumers are unaffected. They pick the highest version, which is 10.0.x, so they don't receive this.

Rollback

Revert this commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Umepkp3PVYEjJSi9v3j9Xs

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (8)

• ^main$
• ^master$
• ^staging$
• ^development$
• ^gigstaging$
• ^develop$
• ^releases$
• ^releases/r10.0$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 52c31661-218b-42ca-a312-84a982d9b5bf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}