chore(deps): update helm release gitlab to v9.11.14

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gitlab](https://about.gitlab.com/) ([source](https://gitlab.com/gitlab-org/charts/gitlab)) | minor | `9.8.2` → `9.11.14` | --- ### Release Notes <details> <summary>gitlab-org/charts/gitlab (gitlab)</summary> ### [`v9.11.14`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91114-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.13...v9.11.14) No changes. ### [`v9.11.13`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91113-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.12...v9.11.13) No changes. ### [`v9.11.12`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91112-2026-08-14) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.10...v9.11.12) No changes. ### [`v9.11.10`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91110-2026-08-06) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.9...v9.11.10) No changes. ### [`v9.11.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9119-2026-08-03) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.8...v9.11.9) No changes. ### [`v9.11.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9118-2026-07-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.7...v9.11.8) No changes. ### [`v9.11.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9117-2026-06-23) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.6...v9.11.7) No changes. ### [`v9.11.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9116-2026-06-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.5...v9.11.6) No changes. ### [`v9.11.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9115-2026-05-26) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.4...v9.11.5) ##### Fixed (2 changes) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/f79c362451298a4bfc3a888e33440a4ae31d6823) - [Revert make kerberos keytab updates dynamic](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/3022ff18281ab97b846d7610aece464c6525d378) ### [`v9.11.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9114-2026-05-13) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.3...v9.11.4) ##### Added (1 change) - [Gateway API: Support backend TLS for KAS/Registry/Workhorse](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/7f6efbbed24956f5bbd0ec8396572e60389c6da4) ##### Fixed (1 change) - [Fix dependencyProxy bucket validation when disabled](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/26e4da55ca2c1e9e192a732150a2ca15cd84a62f) ##### Changed (2 changes) - [Update gitlab-runner to v0.88.2](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/8f7e27f76912818061825eb2549275af5f74b98e) - [chore: bump gitlab-zoekt chart to 3.11.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/fcc32831c118f14bb588337a83c045e8e1d04f5e) ### [`v9.11.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9113-2026-05-05) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.2...v9.11.3) No changes. ### [`v9.11.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9112-2026-04-28) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.1...v9.11.2) ##### Changed (1 change) - [Update gitlab-runner to v0.88.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d5a1c79236b4d370966259297fc3c64ed3a5c712) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4992)) ### [`v9.11.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91113-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.0...v9.11.1) No changes. ### [`v9.11.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9110-2026-04-15) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.8...v9.11.0) ##### Added (3 changes) - [Add `trusted_user_ca_keys` support to gitlab-shell chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/e66b479f46c355f6f000363bae601cebfdd5d8cd) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4913)) - [Add Redis and Sentinel TLS support to GitLab Helm Chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f8d12ba2730102801e94335e5fdd1b55d71c13dc) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4720)) - [Gateway API: Support Smartcard authentication](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/72100a0905e0bf6bb1c04d09c6d321c74b4cc8ed) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4850)) ##### Fixed (3 changes) - [Guard Gateway API route templates with service enabled checks](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5ff2f18cfb9fea324a34401014878954c26dbf39) by [@weijiany](https://github.com/weijiany) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4916)) - [Use nested Redis auth secrets when password key is absent](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7e3df81ec82a869c87549cefa31413789a3cff3d) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4911)) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0a377d75f2d6c269c3bd434726fee458ea54c0dd) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4912)) ##### Changed (9 changes) - [Update openbao to v0.14.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/076cd94b8f775371d7e5ce5a6b13b02479cf3dc3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4947)) - [Update cert-manager to v1.20.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f07432d0fe1ee945af576cba4495c06907e63798) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4865)) - [Bump openbao chart version to 0.13.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/b8d51d7f7b3ea59458490187005b562bef39adbd) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4932)) - [Use a dedicated database for OpenBao instead of the main Rails database](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/64e44a659e47352a1d1b6eddc7a27bc843274ff9) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4827)) - [Update NGINX Ingress to 1.15.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a1fa5629eda9adad93e299606322b7c9d4d98641) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4890)) - [Update gitlab-runner to v0.87.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ed282852692b0516c875d7b0f3b1d743a03c5d10) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4904)) - [Update gitlab-exporter to v16.7.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/37981d9e8b352c9d62908df776a248c41c316901) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4866)) - [Update container-registry to v4.39.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/be5ece2d4387f2d561000c549c2cc754ed95feb9) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4886)) - [Gateway API: Unglobalize Gateway API resources](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/fb5977af6be6eb874f6be1f2fee7d74d03c27665) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4862)) ### [`v9.10.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9108-2026-06-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.7...v9.10.8) No changes. ### [`v9.10.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9107-2026-05-26) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.6...v9.10.7) ##### Fixed (2 changes) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/038dcac41a6bff8c527c227e8339bfdc2dac587a) - [Revert make kerberos keytab updates dynamic](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/426c481af8c20560622a51e2a6582adf4cb3507b) ##### Changed (1 change) - [chore: bump gitlab-zoekt chart to 3.10.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/c1264745b50a0e02d01335371f7ee14c7e2eb27d) ### [`v9.10.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9106-2026-05-13) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.5...v9.10.6) ##### Changed (1 change) - [Update gitlab-runner to v0.87.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/5669a1e36b1acd9d9f990b92f508e9ead504d132) ### [`v9.10.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9105-2026-04-28) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.4...v9.10.5) ##### Fixed (1 change) - [Guard Gateway API route templates with service enabled checks](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/2c1aa6b335d0d0613bc7cde51394fe3df341cb5f) by [@weijiany](https://github.com/weijiany) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4941)) ### [`v9.10.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9104-2026-04-21) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.3...v9.10.4) ##### Fixed (1 change) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/69a370090f573afc23d510b5586ba8c20044a783) ##### Changed (1 change) - [Bump gitlab-zoekt chart to 3.8.3](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/74f4e6490669560919e6ec2e130da584530651d5) ### [`v9.10.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9103-2026-04-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.1...v9.10.3) No changes. ### [`v9.10.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9101-2026-03-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.0...v9.10.1) No changes. ### [`v9.10.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9100-2026-03-18) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.9...v9.10.0) ##### Added (4 changes) - [Add HTTP-to-HTTPS redirect for Gateway API deployment](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/b7a3b164f7d00cf18545a8ca2495c9aef2037c30) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4868)) - [Add knowledge graph support](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/6ada639ff0f899a6e5ece55e0bbf179d052e1a6f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4855)) - [Add ServiceMonitor and PodMonitor for Envoy](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/56f079186510e63e6588457693cab4f98286ed28) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4811)) - [Add statusCode configuration for Workhorse load shedding](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7db69723b7f798a970d54ab9cf552c67a5458560) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4858)) ##### Fixed (2 changes) - [Fix inverted namespaceInPath condition for pages Gateway listener](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/886efc28b5193047c86b501ad90a6ecf53e8086e) by [@weijiany](https://github.com/weijiany) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4859)) - [Create minio httproute only when minio is enabled](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/847caf3802cf710f3b3523c20442e808aba5934d) by [@achupryn](https://github.com/achupryn) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4838)) ##### Changed (10 changes) - [Update Envoy Gateway to v1.7.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5a83c3fd73146e7824996e38b327f91c9bbed04f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4874)) - [Re-enable HTTP audit logging for Secrets Manager](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/72cb9df468a56d2e6494127550669617749062c6) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4875)) - [Update container-registry to v4.38.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7aaf66bcf23fcdf30fbb1de5d9c5a1543caf75f2) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4852)) - [Update cert-manager from 1.17.4 to 1.19.4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f9bba1afa813d5d9b3a062e5802655a0cc99050a) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4754)) - [Update gitlab-exporter to v16.6.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d89ea9b9f95fc4d068679c164aaaa2ba625eecf0) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4601)) - [Update gitlab-zoekt to v3.8.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/6e88ff4845fda37245acfcf5a78e0f9bc4653ec3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4832)) - [Update GitLab exporter from 16.2 to 16.4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/8a927a76aa0ec94632de9d1657558fbcdb626ea7) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4830)) - [Update gitlab-runner to v0.86.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5989b6d58df3cd6333f896ac6d6186a97099b863) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4823)) - [Update container-registry to v4.37.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f225950cc5b21f2c4dd09f30f989cb40185cd929) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4813)) - [Remove Zoekt basic auth from main GitLab Helm chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/bf6e3d48b050e0ba467d2adc98784ad123d2aa98) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4782)) ### [`v9.9.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#999-2026-05-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.8...v9.9.9) No changes. ### [`v9.9.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#998-2026-05-13) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.7...v9.9.8) ##### Changed (1 change) - [chore: bump gitlab-zoekt chart to 3.9.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/9096e93eeb366b0444bd594bca29074d234d954e) ### [`v9.9.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#997-2026-04-21) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.6...v9.9.7) ##### Fixed (1 change) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/4cc9a05181676d3afe3fcf732e7f2ad7fcda8fb2) ### [`v9.9.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#996-2026-04-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.4...v9.9.6) No changes. ### [`v9.9.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#994-2026-03-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.3...v9.9.4) No changes. ### [`v9.9.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#993-2026-03-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.2...v9.9.3) No changes. ### [`v9.9.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#992-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.1...v9.9.2) ##### Fixed (1 change) - [Backport gomplate 5.x compatibility](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/355f21be8525178b54423802df7a0285afef8316) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4846)) ### [`v9.9.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#991-2026-02-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.0...v9.9.1) No changes. ### [`v9.9.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1010-2026-06-17) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.12...v9.9.0) ##### Added (2 changes) - [Add Topology Service mTLS support to GitLab Shell](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d2d4b487b651ef914ac6b94c1889d69854d676c3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5111)) - [feat(smtp): support reading SMTP username from a Kubernetes Secret](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/4e97064c5577328944de34be677ce8350e6f3279) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5083)) ##### Fixed (1 change) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d59e3ac36385049e5e2d2d08b88e5f0b64c0d26b) by [@alanrichman](https://github.com/alanrichman) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5074)) ##### Changed (9 changes) - [gitlab-shell: add ingressClassName to IngressRouteTCP](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d944bbea1ca21e0f53834384824b98ef32d36fc4) by [@ioanalytica](https://github.com/ioanalytica) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5084)) - [Update Envoy Gateway to v1.8.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0a4f4de2514cf582f6d14b6103052e720e61e864) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5105)) - [Update gitlab-zoekt to v4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ab49fcd89c9954323c4477a8d1274e3786daf9ac) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5026)) - [Update gitlab-runner to v0.89.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5e024be82a74917a0856ac1dd622dc6e6840cfc5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5081)) - [Update prometheus to v29.9.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5d8e835a0ffcf70529918014e4e7c9ad2d56fbd8) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5082)) - [Update container-registry to v4.40.1-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a0180e805dc02d1a3a98ef83eb7ee1c6b73d3b14) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5079)) - [Update prometheus to v29.7.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c51ebff848d1b22e82ee67eb3c4dc5569a5af5e2) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5070)) - [Update helm to v4.2.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c4a987f65aeaa012ea6f87e336aa0c92538929ba) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5071)) - [Update ai-gateway to v0.12.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c0f3f8f16cadd83232eecd4f5134270fefac0666) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5068)) ### [`v9.8.12`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9812-2026-06-29) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.11...v9.8.12) No changes. ### [`v9.8.11`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9811-2026-05-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.10...v9.8.11) ##### Fixed (1 change) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f722c3034ec827301c09afa2fa160cda9a5ec4ea) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4929)) ### [`v9.8.10`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9810-2026-04-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.8...v9.8.10) No changes. ### [`v9.8.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#988-2026-03-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.7...v9.8.8) No changes. ### [`v9.8.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#987-2026-03-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.6...v9.8.7) No changes. ### [`v9.8.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#986-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.5...v9.8.6) ##### Fixed (1 change) - [Fix: Fixup Gomplate rendering for 5.0.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/caf765bb38f556724aa9ff2adb28e14719cd8482) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4854)) ### [`v9.8.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#985-2026-02-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.4...v9.8.5) No changes. ### [`v9.8.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#984-2026-02-09) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.3...v9.8.4) No changes. ### [`v9.8.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#983-2026-02-04) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.2...v9.8.3) ##### Changed (1 change) - [Update Helm release gitlab-runner to v0.85.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/584e98f2e769eaac44d3f49bc03f7e39db433a44) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4749)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-08 10:11:11 +00:00

Update Helm release gitlab to v9.11.8 3639342265

renovate-bot changed title from ~~Update Helm release gitlab to v9.11.8~~ to chore(deps): update helm release gitlab to v9.11.8

2026-07-17 23:12:57 +00:00

renovate-bot changed title from ~~chore(deps): update helm release gitlab to v9.11.8~~ to Update Helm release gitlab to v9.11.8

2026-07-21 01:09:43 +00:00

renovate-bot changed title from ~~Update Helm release gitlab to v9.11.8~~ to chore(deps): update helm release gitlab to v9.11.8

2026-07-21 02:09:57 +00:00

renovate-bot force-pushed renovate/gitlab-9.x from 3639342265 to e8d2f8a540

2026-09-21 19:18:03 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update helm release gitlab to v9.11.8~~ to chore(deps): update helm release gitlab to v9.11.12

2026-09-21 19:18:30 +00:00

renovate-bot force-pushed renovate/gitlab-9.x from e8d2f8a540 to 25e7e0504c

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-09-23 09:10:26 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update helm release gitlab to v9.11.12~~ to chore(deps): update helm release gitlab to v9.11.13

2026-09-23 09:10:41 +00:00

ci-bot commented

2026-09-23 09:13:38 +00:00

Member

flate diff

data.gitlab-exporter.yml.erb  (v1/ConfigMap/gitlab/gitlab-gitlab-exporter)
  ± value change in multiline text (one insert, no deletions)
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
      
      [27 lines unchanged)]
      
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
    +       
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
      
      [19 lines unchanged)]
      
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
  
  

data  (v1/ConfigMap/gitlab/gitlab-migrations)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (three inserts, no deletions)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [43 lines unchanged)]
      
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
    +   dependency_proxy:
    +     enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [five lines unchanged)]
      
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
    +   gravatar:
    +     plain_url: 
    +     ssl_url: 
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (two inserts, one deletion)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [157 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   # Zoekt secrets are present, load them.
    -   zoekt:
    -     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    -     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
    +   
    +   iam_auth_service:
    +     enabled: false
    +     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    +     http:
    +       host: ""
    +       port: 0
    +     grpc:
    +       host: ""
    +       port: 0
    +     jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [16 lines unchanged)]
      
            enabled: true
            address: "*"
            port: 3808
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-toolbox)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (two inserts, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
    + 
    + # Mount point for registry DB secrets. Needs to be pre-created as later the
    + # volume is remounted read-only
    + mkdir "/${secret_dir}/registry-db/"
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      
      [17 lines unchanged)]
      
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
  
  

data.configure-gsutil  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, one deletion)
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file

      [four lines unchanged)]

      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
    -   echo '[GoogleCompute]\nservice_account = default' > ~/.boto
    +   printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto
      fi


data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (three inserts, one deletion)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [22 lines unchanged)]
      
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
    +   gravatar:
    +     plain_url: 
    +     ssl_url: 
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
      
      [105 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   # Zoekt secrets are present, load them.
    -   zoekt:
    -     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    -     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
    +   
    +   iam_auth_service:
    +     enabled: false
    +     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    +     http:
    +       host: ""
    +       port: 0
    +     grpc:
    +       host: ""
    +       port: 0
    +     jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [nine lines unchanged)]
      
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-webservice)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (two inserts, one deletion)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [148 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   # Zoekt secrets are present, load them.
    -   zoekt:
    -     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    -     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
    +   
    +   iam_auth_service:
    +     enabled: false
    +     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    +     http:
    +       host: ""
    +       port: 0
    +     grpc:
    +       host: ""
    +       port: 0
    +     jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [33 lines unchanged)]
      
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data.workhorse-config.toml.tpl  (v1/ConfigMap/gitlab/gitlab-workhorse-default)
  ± value change in multiline text (one insert, one deletion)
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
    - {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%}
    + {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
      
      [29 lines unchanged)]
      
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
  
  

data.gitlabChartVersion  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
  ± value change
    - 9.8.2
    + 9.11.13

data.gitlabVersion  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
  ± value change
    - 18.8.2
    + 18.11.12

spec.template.spec.containers.gitlab-gitlab-runner.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-runner)
  ± value change
    - registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2
    + registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2

spec.template.spec.containers.gitlab-exporter.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.containers.gitlab-shell.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.containers.kas.image  (apps/v1/Deployment/gitlab/gitlab-kas)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-kas)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.containers.sidekiq.env  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  + one list entry added:
    - name: GITLAB_SIDEKIQ_MAX_REPLICAS
      value: "10"

spec.template.spec.containers.sidekiq.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12

spec.template.spec.volumes.init-sidekiq-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  - one list entry removed:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.toolbox.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12

spec.template.spec.containers.toolbox.volumeMounts  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  + one list entry added:
    - name: registry-db-config
      mountPath: /etc/gitlab/registry-db/
      readOnly: true

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.volumes  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  + one list entry added:
    - name: registry-db-config
      projected:
        defaultMode: 288
        sources:
        - configMap:
            name: gitlab-registry-db-connection-config
            optional: true
            items:
            - key: db-connection.env
              path: connection.env
        - configMap:
            name: gitlab-toolbox-registry-db-backuprestore-users
            optional: true
            items:
            - key: backup-user
              path: backup-user.env
            - key: restore-user
              path: restore-user.env
        - secret:
            name: gitlab-toolbox-registry-database-password
            optional: true
            items:
            - key: backupPassword
              path: backup-pass
            - key: restorePassword
              path: restore-pass

spec.template.spec.volumes.init-toolbox-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  - one list entry removed:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.webservice.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12

spec.template.spec.containers.gitlab-workhorse.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12

spec.template.spec.volumes.init-webservice-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  - one list entry removed:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.registry.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab
  

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab
  

spec.template.spec.containers.gitaly.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.jobTemplate.spec.template.spec.containers.toolbox-backup.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12

spec.jobTemplate.spec.template.spec.containers.toolbox-backup.volumeMounts  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  + one list entry added:
    - name: registry-db-config
      mountPath: /etc/gitlab/registry-db/
      readOnly: true

spec.jobTemplate.spec.template.spec.initContainers.certificates.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.jobTemplate.spec.template.spec.initContainers.configure.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.jobTemplate.spec.template.spec.volumes  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  + one list entry added:
    - name: registry-db-config
      projected:
        defaultMode: 288
        sources:
        - configMap:
            name: gitlab-registry-db-connection-config
            optional: true
            items:
            - key: db-connection.env
              path: connection.env
        - configMap:
            name: gitlab-toolbox-registry-db-backuprestore-users
            optional: true
            items:
            - key: backup-user
              path: backup-user.env
            - key: restore-user
              path: restore-user.env
        - secret:
            name: gitlab-toolbox-registry-database-password
            optional: true
            items:
            - key: backupPassword
              path: backup-pass
            - key: restorePassword
              path: restore-pass

data.generate-secrets  (v1/ConfigMap/gitlab/gitlab-shared-secrets)
  ± value change in multiline text (one insert, one deletion)
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      
      [34 lines unchanged)]
      
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
    -     secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
    +     secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
      
      [157 lines unchanged)]
      
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
  
  

data.runcheck  (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check)
  ± value change in multiline text (one insert, one deletion)
      #!/bin/sh
      
      set -e
      
      
      [29 lines unchanged)]
      
            exit 1
          fi
        fi
      fi
    - MIN_VERSION=18.5
    - CHART_MIN_VERSION=9.5
    + MIN_VERSION=18.8
    + CHART_MIN_VERSION=9.8
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      
      [38 lines unchanged)]
      
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  
  

spec.template.spec.containers.run-check.env.GITLAB_VERSION.value  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - 18.8.2
    + 18.11.12

spec.template.spec.containers.run-check.env.CHART_VERSION.value  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - 9.8.2
    + 9.11.13

spec.template.spec.containers.run-check.image  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-c0164a8)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-c0164a8
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-8e2a9a9
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)  (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry-db-connection-config
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    db-connection.env: |
      REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc"
      REGISTRY_DATABASE_PORT="5432"
      REGISTRY_DATABASE_NAME="gl-registry"
      REGISTRY_DATABASE_SSLMODE="disable"

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-d559a5f)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-d559a5f
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-46dd770
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}

Pipeline

## flate diff ``` data.gitlab-exporter.yml.erb (v1/ConfigMap/gitlab/gitlab-gitlab-exporter) ± value change in multiline text (one insert, no deletions) server: name: webrick listen_address: "*" listen_port: 9168 [27 lines unchanged)] - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + redis_enable_client: false probe_non_namespaced: true ruby: &ruby [19 lines unchanged)] <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common data (v1/ConfigMap/gitlab/gitlab-migrations) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (three inserts, no deletions) production: &base gitlab: host: code.nogweii.net https: true [43 lines unchanged)] terraform_state: enabled: true ci_secure_files: enabled: true + dependency_proxy: + enabled: true gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [five lines unchanged)] log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 + gravatar: + plain_url: + ssl_url: data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data (v1/ConfigMap/gitlab/gitlab-sidekiq) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (two inserts, one deletion) production: &base gitlab: host: code.nogweii.net https: true [157 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - # Zoekt secrets are present, load them. - zoekt: - username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username - password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password + + iam_auth_service: + enabled: false + secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret + http: + host: "" + port: 0 + grpc: + host: "" + port: 0 + jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [16 lines unchanged)] enabled: true address: "*" port: 3808 data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data (v1/ConfigMap/gitlab/gitlab-toolbox) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (two inserts, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets + + # Mount point for registry DB secrets. Needs to be pre-created as later the + # volume is remounted read-only + mkdir "/${secret_dir}/registry-db/" if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) [17 lines unchanged)] EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi data.configure-gsutil (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, one deletion) if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file [four lines unchanged)] else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. - echo '[GoogleCompute]\nservice_account = default' > ~/.boto + printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto fi data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (three inserts, one deletion) production: &base gitlab: host: code.nogweii.net https: true [22 lines unchanged)] email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" + gravatar: + plain_url: + ssl_url: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true [105 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - # Zoekt secrets are present, load them. - zoekt: - username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username - password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password + + iam_auth_service: + enabled: false + secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret + http: + host: "" + port: 0 + grpc: + host: "" + port: 0 + jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [nine lines unchanged)] - 127.0.0.0/8 sidekiq_exporter: extra: data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data (v1/ConfigMap/gitlab/gitlab-webservice) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (two inserts, one deletion) production: &base gitlab: host: code.nogweii.net https: true [148 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - # Zoekt secrets are present, load them. - zoekt: - username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username - password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password + + iam_auth_service: + enabled: false + secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret + http: + host: "" + port: 0 + grpc: + host: "" + port: 0 + jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [33 lines unchanged)] client_certificate_required_port: 443 san_extensions: false required_for_git_access: false data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data.workhorse-config.toml.tpl (v1/ConfigMap/gitlab/gitlab-workhorse-default) ± value change in multiline text (one insert, one deletion) shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} - {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%} + {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} [29 lines unchanged)] max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" data.gitlabChartVersion (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) ± value change - 9.8.2 + 9.11.13 data.gitlabVersion (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) ± value change - 18.8.2 + 18.11.12 spec.template.spec.containers.gitlab-gitlab-runner.image (apps/v1/Deployment/gitlab/gitlab-gitlab-runner) ± value change - registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2 + registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2 spec.template.spec.containers.gitlab-exporter.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0 + registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.containers.gitlab-shell.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5 + registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.containers.kas.image (apps/v1/Deployment/gitlab/gitlab-kas) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-kas) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.containers.sidekiq.env (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) + one list entry added: - name: GITLAB_SIDEKIQ_MAX_REPLICAS value: "10" spec.template.spec.containers.sidekiq.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12 spec.template.spec.volumes.init-sidekiq-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) - one list entry removed: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.toolbox.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12 spec.template.spec.containers.toolbox.volumeMounts (apps/v1/Deployment/gitlab/gitlab-toolbox) + one list entry added: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.volumes (apps/v1/Deployment/gitlab/gitlab-toolbox) + one list entry added: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass spec.template.spec.volumes.init-toolbox-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-toolbox) - one list entry removed: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.webservice.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12 spec.template.spec.containers.gitlab-workhorse.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12 spec.template.spec.volumes.init-webservice-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-webservice-default) - one list entry removed: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.registry.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab spec.template.spec.containers.gitaly.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.jobTemplate.spec.template.spec.containers.toolbox-backup.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12 spec.jobTemplate.spec.template.spec.containers.toolbox-backup.volumeMounts (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) + one list entry added: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true spec.jobTemplate.spec.template.spec.initContainers.certificates.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.jobTemplate.spec.template.spec.initContainers.configure.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.jobTemplate.spec.template.spec.volumes (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) + one list entry added: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass data.generate-secrets (v1/ConfigMap/gitlab/gitlab-shared-secrets) ± value change in multiline text (one insert, one deletion) # vim: set filetype=sh: namespace=gitlab release=gitlab [34 lines unchanged)] secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ - secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm + secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ [157 lines unchanged)] generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] data.runcheck (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check) ± value change in multiline text (one insert, one deletion) #!/bin/sh set -e [29 lines unchanged)] exit 1 fi fi fi - MIN_VERSION=18.5 - CHART_MIN_VERSION=9.5 + MIN_VERSION=18.8 + CHART_MIN_VERSION=9.8 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} [38 lines unchanged)] notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi spec.template.spec.containers.run-check.env.GITLAB_VERSION.value (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - 18.8.2 + 18.11.12 spec.template.spec.containers.run-check.env.CHART_VERSION.value (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - 9.8.2 + 9.11.13 spec.template.spec.containers.run-check.image (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 (root level) (batch/v1/Job/gitlab/gitlab-migrations-c0164a8) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-c0164a8 namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-8e2a9a9 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry-db-connection-config namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: db-connection.env: | REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc" REGISTRY_DATABASE_PORT="5432" REGISTRY_DATABASE_NAME="gl-registry" REGISTRY_DATABASE_SSLMODE="disable" (root level) (batch/v1/Job/gitlab/gitlab-migrations-d559a5f) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-d559a5f namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-46dd770 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/377)

renovate-bot force-pushed renovate/gitlab-9.x from 25e7e0504c

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 1755d48fc7

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-10 21:10:10 +00:00

Compare

ci-bot commented

2026-10-10 21:13:56 +00:00

Member

flate diff

data.gitlab-exporter.yml.erb  (v1/ConfigMap/gitlab/gitlab-gitlab-exporter)
  ± value change in multiline text (one insert, no deletions)
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
      
      [27 lines unchanged)]
      
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
    +       
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
      
      [19 lines unchanged)]
      
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
  
  

data  (v1/ConfigMap/gitlab/gitlab-migrations)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (three inserts, no deletions)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [43 lines unchanged)]
      
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
    +   dependency_proxy:
    +     enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [five lines unchanged)]
      
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
    +   gravatar:
    +     plain_url: 
    +     ssl_url: 
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-migrations)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (two inserts, one deletion)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [157 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   # Zoekt secrets are present, load them.
    -   zoekt:
    -     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    -     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
    +   
    +   iam_auth_service:
    +     enabled: false
    +     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    +     http:
    +       host: ""
    +       port: 0
    +     grpc:
    +       host: ""
    +       port: 0
    +     jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [16 lines unchanged)]
      
            enabled: true
            address: "*"
            port: 3808
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-sidekiq)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-toolbox)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (two inserts, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
    + 
    + # Mount point for registry DB secrets. Needs to be pre-created as later the
    + # volume is remounted read-only
    + mkdir "/${secret_dir}/registry-db/"
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      
      [17 lines unchanged)]
      
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
  
  

data.configure-gsutil  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, one deletion)
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file

      [four lines unchanged)]

      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
    -   echo '[GoogleCompute]\nservice_account = default' > ~/.boto
    +   printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto
      fi


data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (three inserts, one deletion)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [22 lines unchanged)]
      
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
    +   gravatar:
    +     plain_url: 
    +     ssl_url: 
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
      
      [105 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   # Zoekt secrets are present, load them.
    -   zoekt:
    -     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    -     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
    +   
    +   iam_auth_service:
    +     enabled: false
    +     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    +     http:
    +       host: ""
    +       port: 0
    +     grpc:
    +       host: ""
    +       port: 0
    +     jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [nine lines unchanged)]
      
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-toolbox)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data  (v1/ConfigMap/gitlab/gitlab-webservice)
  - one map entry removed:
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    
  

data.cable.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
        adapter: redis
  
  

data.configure  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, one deletion)
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      
      [two lines unchanged)]
      
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
    - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
    + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
  
  

data.gitlab.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (two inserts, one deletion)
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
      
      [148 lines unchanged)]
      
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
    +     client_max_attempts: 4
    +     client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
      
      [ten lines unchanged)]
      
          
        
        
        
    -   # Zoekt secrets are present, load them.
    -   zoekt:
    -     username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
    -     password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
    +   
    +   iam_auth_service:
    +     enabled: false
    +     secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
    +     http:
    +       host: ""
    +       port: 0
    +     grpc:
    +       host: ""
    +       port: 0
    +     jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
      
      [33 lines unchanged)]
      
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
  
  

data.resque.yml.erb  (v1/ConfigMap/gitlab/gitlab-webservice)
  ± value change in multiline text (one insert, no deletions)
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
    +   
        id:
  
  

data.workhorse-config.toml.tpl  (v1/ConfigMap/gitlab/gitlab-workhorse-default)
  ± value change in multiline text (one insert, one deletion)
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
    - {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%}
    + {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
      
      [29 lines unchanged)]
      
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
  
  

data.gitlabChartVersion  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
  ± value change
    - 9.8.2
    + 9.11.13

data.gitlabVersion  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
  ± value change
    - 18.8.2
    + 18.11.12

spec.template.spec.containers.gitlab-gitlab-runner.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-runner)
  ± value change
    - registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2
    + registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2

spec.template.spec.containers.gitlab-exporter.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.containers.gitlab-shell.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.containers.kas.image  (apps/v1/Deployment/gitlab/gitlab-kas)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-kas)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.containers.sidekiq.env  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  + one list entry added:
    - name: GITLAB_SIDEKIQ_MAX_REPLICAS
      value: "10"

spec.template.spec.containers.sidekiq.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12

spec.template.spec.volumes.init-sidekiq-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
  - one list entry removed:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.toolbox.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12

spec.template.spec.containers.toolbox.volumeMounts  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  + one list entry added:
    - name: registry-db-config
      mountPath: /etc/gitlab/registry-db/
      readOnly: true

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.volumes  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  + one list entry added:
    - name: registry-db-config
      projected:
        defaultMode: 288
        sources:
        - configMap:
            name: gitlab-registry-db-connection-config
            optional: true
            items:
            - key: db-connection.env
              path: connection.env
        - configMap:
            name: gitlab-toolbox-registry-db-backuprestore-users
            optional: true
            items:
            - key: backup-user
              path: backup-user.env
            - key: restore-user
              path: restore-user.env
        - secret:
            name: gitlab-toolbox-registry-database-password
            optional: true
            items:
            - key: backupPassword
              path: backup-pass
            - key: restorePassword
              path: restore-pass

spec.template.spec.volumes.init-toolbox-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-toolbox)
  - one list entry removed:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.webservice.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12

spec.template.spec.containers.gitlab-workhorse.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12

spec.template.spec.volumes.init-webservice-secrets.projected.sources  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
  - one list entry removed:
    - secret:
        name: gitlab-zoekt-basicauth
        optional: true
        items:
        - key: gitlab_username
          path: zoekt/.gitlab_zoekt_username
        - key: gitlab_password
          path: zoekt/.gitlab_zoekt_password

spec.template.spec.containers.registry.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab
  

spec.template.spec.initContainers.certificates.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.template.spec.initContainers.dependencies.image  (apps/v1/Deployment/gitlab/gitlab-registry)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab
  

spec.template.spec.containers.gitaly.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12

spec.template.spec.initContainers.certificates.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.template.spec.initContainers.configure.image  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.jobTemplate.spec.template.spec.containers.toolbox-backup.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12

spec.jobTemplate.spec.template.spec.containers.toolbox-backup.volumeMounts  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  + one list entry added:
    - name: registry-db-config
      mountPath: /etc/gitlab/registry-db/
      readOnly: true

spec.jobTemplate.spec.template.spec.initContainers.certificates.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12

spec.jobTemplate.spec.template.spec.initContainers.configure.image  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

spec.jobTemplate.spec.template.spec.volumes  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
  + one list entry added:
    - name: registry-db-config
      projected:
        defaultMode: 288
        sources:
        - configMap:
            name: gitlab-registry-db-connection-config
            optional: true
            items:
            - key: db-connection.env
              path: connection.env
        - configMap:
            name: gitlab-toolbox-registry-db-backuprestore-users
            optional: true
            items:
            - key: backup-user
              path: backup-user.env
            - key: restore-user
              path: restore-user.env
        - secret:
            name: gitlab-toolbox-registry-database-password
            optional: true
            items:
            - key: backupPassword
              path: backup-pass
            - key: restorePassword
              path: restore-pass

data.generate-secrets  (v1/ConfigMap/gitlab/gitlab-shared-secrets)
  ± value change in multiline text (one insert, one deletion)
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      
      [34 lines unchanged)]
      
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
    -     secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
    +     secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
      
      [157 lines unchanged)]
      
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
  
  

data.runcheck  (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check)
  ± value change in multiline text (one insert, one deletion)
      #!/bin/sh
      
      set -e
      
      
      [29 lines unchanged)]
      
            exit 1
          fi
        fi
      fi
    - MIN_VERSION=18.5
    - CHART_MIN_VERSION=9.5
    + MIN_VERSION=18.8
    + CHART_MIN_VERSION=9.8
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      
      [38 lines unchanged)]
      
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  
  

spec.template.spec.containers.run-check.env.GITLAB_VERSION.value  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - 18.8.2
    + 18.11.12

spec.template.spec.containers.run-check.env.CHART_VERSION.value  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - 9.8.2
    + 9.11.13

spec.template.spec.containers.run-check.image  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
  ± value change
    - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2
    + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-c0164a8)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-c0164a8
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-8e2a9a9
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)  (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config)
+ one document added:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry-db-connection-config
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    db-connection.env: |
      REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc"
      REGISTRY_DATABASE_PORT="5432"
      REGISTRY_DATABASE_NAME="gl-registry"
      REGISTRY_DATABASE_SSLMODE="disable"

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-d559a5f)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-d559a5f
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-46dd770
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign)
+ one document added:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}

Pipeline

## flate diff ``` data.gitlab-exporter.yml.erb (v1/ConfigMap/gitlab/gitlab-gitlab-exporter) ± value change in multiline text (one insert, no deletions) server: name: webrick listen_address: "*" listen_port: 9168 [27 lines unchanged)] - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + redis_enable_client: false probe_non_namespaced: true ruby: &ruby [19 lines unchanged)] <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common data (v1/ConfigMap/gitlab/gitlab-migrations) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (three inserts, no deletions) production: &base gitlab: host: code.nogweii.net https: true [43 lines unchanged)] terraform_state: enabled: true ci_secure_files: enabled: true + dependency_proxy: + enabled: true gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [five lines unchanged)] log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 + gravatar: + plain_url: + ssl_url: data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-migrations) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data (v1/ConfigMap/gitlab/gitlab-sidekiq) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (two inserts, one deletion) production: &base gitlab: host: code.nogweii.net https: true [157 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - # Zoekt secrets are present, load them. - zoekt: - username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username - password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password + + iam_auth_service: + enabled: false + secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret + http: + host: "" + port: 0 + grpc: + host: "" + port: 0 + jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [16 lines unchanged)] enabled: true address: "*" port: 3808 data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-sidekiq) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data (v1/ConfigMap/gitlab/gitlab-toolbox) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (two inserts, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets + + # Mount point for registry DB secrets. Needs to be pre-created as later the + # volume is remounted read-only + mkdir "/${secret_dir}/registry-db/" if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) [17 lines unchanged)] EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi data.configure-gsutil (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, one deletion) if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file [four lines unchanged)] else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. - echo '[GoogleCompute]\nservice_account = default' > ~/.boto + printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto fi data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (three inserts, one deletion) production: &base gitlab: host: code.nogweii.net https: true [22 lines unchanged)] email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" + gravatar: + plain_url: + ssl_url: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true [105 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - # Zoekt secrets are present, load them. - zoekt: - username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username - password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password + + iam_auth_service: + enabled: false + secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret + http: + host: "" + port: 0 + grpc: + host: "" + port: 0 + jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [nine lines unchanged)] - 127.0.0.0/8 sidekiq_exporter: extra: data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-toolbox) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data (v1/ConfigMap/gitlab/gitlab-webservice) - one map entry removed: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: data.cable.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: adapter: redis data.configure (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, one deletion) # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" [two lines unchanged)] mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional - for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do + for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets data.gitlab.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (two inserts, one deletion) production: &base gitlab: host: code.nogweii.net https: true [148 lines unchanged)] secret_key: shared: gitaly: client_path: /home/git/gitaly/bin + client_max_attempts: 4 + client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: [ten lines unchanged)] - # Zoekt secrets are present, load them. - zoekt: - username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username - password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password + + iam_auth_service: + enabled: false + secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret + http: + host: "" + port: 0 + grpc: + host: "" + port: 0 + jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true [33 lines unchanged)] client_certificate_required_port: 443 san_extensions: false required_for_git_access: false data.resque.yml.erb (v1/ConfigMap/gitlab/gitlab-webservice) ± value change in multiline text (one insert, no deletions) production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 + id: data.workhorse-config.toml.tpl (v1/ConfigMap/gitlab/gitlab-workhorse-default) ± value change in multiline text (one insert, one deletion) shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} - {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%} + {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} [29 lines unchanged)] max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" data.gitlabChartVersion (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) ± value change - 9.8.2 + 9.11.13 data.gitlabVersion (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) ± value change - 18.8.2 + 18.11.12 spec.template.spec.containers.gitlab-gitlab-runner.image (apps/v1/Deployment/gitlab/gitlab-gitlab-runner) ± value change - registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2 + registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2 spec.template.spec.containers.gitlab-exporter.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0 + registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.containers.gitlab-shell.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5 + registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.containers.kas.image (apps/v1/Deployment/gitlab/gitlab-kas) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-kas) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.containers.sidekiq.env (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) + one list entry added: - name: GITLAB_SIDEKIQ_MAX_REPLICAS value: "10" spec.template.spec.containers.sidekiq.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12 spec.template.spec.volumes.init-sidekiq-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) - one list entry removed: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.toolbox.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12 spec.template.spec.containers.toolbox.volumeMounts (apps/v1/Deployment/gitlab/gitlab-toolbox) + one list entry added: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-toolbox) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.volumes (apps/v1/Deployment/gitlab/gitlab-toolbox) + one list entry added: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass spec.template.spec.volumes.init-toolbox-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-toolbox) - one list entry removed: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.webservice.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12 spec.template.spec.containers.gitlab-workhorse.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-webservice-default) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12 spec.template.spec.volumes.init-webservice-secrets.projected.sources (apps/v1/Deployment/gitlab/gitlab-webservice-default) - one list entry removed: - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password spec.template.spec.containers.registry.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab spec.template.spec.initContainers.certificates.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.template.spec.initContainers.dependencies.image (apps/v1/Deployment/gitlab/gitlab-registry) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab + registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab spec.template.spec.containers.gitaly.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12 spec.template.spec.initContainers.certificates.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.template.spec.initContainers.configure.image (apps/v1/StatefulSet/gitlab/gitlab-gitaly) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.jobTemplate.spec.template.spec.containers.toolbox-backup.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12 spec.jobTemplate.spec.template.spec.containers.toolbox-backup.volumeMounts (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) + one list entry added: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true spec.jobTemplate.spec.template.spec.initContainers.certificates.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12 spec.jobTemplate.spec.template.spec.initContainers.configure.image (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 spec.jobTemplate.spec.template.spec.volumes (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) + one list entry added: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass data.generate-secrets (v1/ConfigMap/gitlab/gitlab-shared-secrets) ± value change in multiline text (one insert, one deletion) # vim: set filetype=sh: namespace=gitlab release=gitlab [34 lines unchanged)] secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ - secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm + secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ [157 lines unchanged)] generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] data.runcheck (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check) ± value change in multiline text (one insert, one deletion) #!/bin/sh set -e [29 lines unchanged)] exit 1 fi fi fi - MIN_VERSION=18.5 - CHART_MIN_VERSION=9.5 + MIN_VERSION=18.8 + CHART_MIN_VERSION=9.8 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} [38 lines unchanged)] notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi spec.template.spec.containers.run-check.env.GITLAB_VERSION.value (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - 18.8.2 + 18.11.12 spec.template.spec.containers.run-check.env.CHART_VERSION.value (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - 9.8.2 + 9.11.13 spec.template.spec.containers.run-check.image (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) ± value change - registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2 + registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12 (root level) (batch/v1/Job/gitlab/gitlab-migrations-c0164a8) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-c0164a8 namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-8e2a9a9 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config) + one document added: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry-db-connection-config namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: db-connection.env: | REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc" REGISTRY_DATABASE_PORT="5432" REGISTRY_DATABASE_NAME="gl-registry" REGISTRY_DATABASE_SSLMODE="disable" (root level) (batch/v1/Job/gitlab/gitlab-migrations-d559a5f) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-d559a5f namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-46dd770 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign) + one document added: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/517)

renovate-bot force-pushed renovate/gitlab-9.x from 1755d48fc7

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 96275035e9

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-diff Pipeline failed

Details

2026-10-21 18:12:20 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update helm release gitlab to v9.11.13~~ to chore(deps): update helm release gitlab to v9.11.14

2026-10-21 18:12:33 +00:00

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-diff Pipeline failed

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/gitlab-9.x:renovate/gitlab-9.x

git switch renovate/gitlab-9.x

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/gitlab-9.x

git switch renovate/gitlab-9.x

git rebase main

git switch main

git merge --ff-only renovate/gitlab-9.x

git switch renovate/gitlab-9.x

git rebase main

git switch main

git merge --no-ff renovate/gitlab-9.x

git switch main

git merge --squash renovate/gitlab-9.x

git switch main

git merge --ff-only renovate/gitlab-9.x

git switch main

git merge renovate/gitlab-9.x

git push origin main

Rows
Columns

chore(deps): update helm release gitlab to v9.11.14 #42

Release Notes

Fixed (2 changes)

Added (1 change)

Fixed (1 change)

Changed (2 changes)

Changed (1 change)

Added (3 changes)

Fixed (3 changes)

Changed (9 changes)

Fixed (2 changes)

Changed (1 change)

Changed (1 change)

Fixed (1 change)

Fixed (1 change)

Changed (1 change)

Added (4 changes)

Fixed (2 changes)

Changed (10 changes)

Changed (1 change)

Fixed (1 change)

Fixed (1 change)

Added (2 changes)

Fixed (1 change)

Changed (9 changes)

Fixed (1 change)

Fixed (1 change)

Changed (1 change)

Configuration

flate diff

flate diff

Checkout

Merge