chore(deps): update helm release gitlab to v10

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gitlab](https://about.gitlab.com/) ([source](https://gitlab.com/gitlab-org/charts/gitlab)) | major | `9.8.2` → `10.5.1` | --- ### Release Notes <details> <summary>gitlab-org/charts/gitlab (gitlab)</summary> ### [`v10.5.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1051-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.5.0...v10.5.1) No changes. ### [`v10.5.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1050-2026-10-15) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.4.3...v10.5.0) ##### Added (3 changes) - [Support KAS gRPC Ingress with Traefik](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/de24b83ad7f65ab3e16df81cf5fed4d1c84185b6) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5448)) - [Mount PostgreSQL SSL certificates in Praefect](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/2580423ef71a8d066ecd0f3ff7e8af0f2ed96024) by [@vivekyarra567](https://github.com/vivekyarra567) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5215)) - [feat(email): add outgoing email toggle](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/716738f8815c1ccb6f93a5625ca15eebc4b33be2) by @dkalics\_fs ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5366)) ##### Fixed (6 changes) - [Encode Redis Sentinel passwords inside runtime ERB](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/12f007f0b24098c95f00f9582b5e4bc54b24f45c) by [@vivekyarra567](https://github.com/vivekyarra567) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5450)) - [Default toolbox backup CronJob to batch/v1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5d508d00ef37285ccdcec7da880f3df5aafea209) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5416)) - [Default HorizontalPodAutoscaler to autoscaling/v2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/96dc00680f8b3af21363fe1ec2a1a7a55a71bfaa) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5409)) - [Add SSL cert mount to registry init container](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0712bf72a36f2f4d287b2edec7410996c2435de3) by [@dcc-netcraft](https://github.com/dcc-netcraft) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5369)) - [Fix path configuration check](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/2e6436dcee284c6c42152a67c8b6e972c906d454) by [@iposadat](https://github.com/iposadat) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5375)) - [Document the Pages bucket override in globals.md](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/cddfc2ef08024c9b025c93e0b50eba1fccae8e6b) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5362)) ##### Changed (13 changes) - [Bump openbao chart to 0.20.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/480d0d952ac94110bc1f93a94f2850fffad3b1ea) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5457)) - [Update Envoy Gateway to v1.9.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a80f12c0b8bca1d0836ccf4b6dd7cf62d42ae773) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5431)) - [Prometheus: disable default scrapeConfigs jobs individually](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/9cd90e2c3f9622726956dc9e1ffe966e3d568e26) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5374)) - [Update container-registry to v4.42.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/2e0febe59607705aab8a35a3ed559732760e1c52) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5397)) - [Upgrade Openbao version to v2.6.2-gitlab1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/978fd8cde49d429658858b82e9ffd92094311314) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5393)) - [Update ai-gateway to v0.15.3](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ac6e15d167bacd8d2ee6f12cb674e84663bef758) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5389)) - [Update prometheus to v29.31.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a7d107c5d0b0082b02d38bc9dd67e8eb5ce83f3b) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5374)) - [Update gateway-crds-helm to v1.9.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/9cd215cc8b339500462493bdc4451a5a3932d17d) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5382)) - [Update ai-gateway to v0.15.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/1a31a3eeea153decc91d7da0af58464e4ea46e29) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5371)) - [Update gitlab-runner to v0.93.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/da77860926b6d9fd90d45bf9050d12a61cb0c7a1) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5365)) - [Update prometheus to v29.30.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c4d796208dab291d49ff5a8c14b1444a0e144a65) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5351)) - [Advertise grpcs to agents by default](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/e825a29e39504c37233e59d5fb2b5d6ce57773ff) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5333)) - [Update container-registry to v4.41.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/66dd7f336dd721c9b9a6b2576f94967f39322e65) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5226)) ##### Other (2 changes) - [Reuse the global Topology Service TLS guard](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ace1cf6c49e30cf188710c2fb97fb76e90b52b88) by [@vivekyarra567](https://github.com/vivekyarra567) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5458)) - [Document GitLab Shell HPA scaling guidance for traffic spikes](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/85a8478ee39b32b7bd399347a99426531e469eec) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5426)) ### [`v10.4.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1043-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.4.2...v10.4.3) No changes. ### [`v10.4.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1042-2026-10-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.4.1...v10.4.2) ##### Changed (1 change) - [Update ai-gateway to v0.15.3](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/964fe1175cf9dc90f0cf63345b36e843482fb012) ### [`v10.4.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1041-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.4.0...v10.4.1) ##### Changed (1 change) - [Update gitlab-runner to v0.93.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/17a1a43312e05a034010bc4ba7ea21f6d64f8325) ### [`v10.4.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1040-2026-09-16) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.7...v10.4.0) ##### Added (6 changes) - [Add allowed download modes Helm configuration](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/bc842c24de5d5c97f240918477b0705e3817337e) by [@duewel1982](https://github.com/duewel1982) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5313)) - [Allow backup cron template to have custom annotations](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/eb5292aeb326a1289ac4dc592706f1a7a2e0f9db) by [@vivekyarra567](https://github.com/vivekyarra567) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5322)) - [Add extraVolumes support to Praefect](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/b865528a05fd9f9cd0793b00c771161efae99af3) by [@vivekyarra567](https://github.com/vivekyarra567) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5214)) - [Implement Openbao unseal rotation](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/eab177067a67c96baf75e396180bb5ecc14e30df) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5186)) - [Make BackendTrafficPolicies configurable, add missing ones](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a0e1d70fa81a6cfaeece6e8a96386685853edb0f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5296)) - [Add mobile push APNs configuration](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/908089f0d3536c32fd539228eb581f3ebaa6967a) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5257)) ##### Fixed (4 changes) - [Guard toolbox .s3cfg copy so it starts without backups.objectStorage.config](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7bd35f172aa042979fe0bacefe5bab7e87310366) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5334)) - [Fix redisYmlOverride writing URL-encoded Redis password](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/218cd8f5c729f75a2e8e59633caf5100848f32f8) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5332)) - [Only render sentinel\_password when instance has Sentinels](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/848abae5cf56ca0f2b557a814325a8a61dcc1467) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5331)) - [Stop skipping route-targeting Envoy policies for a cross-namespace Gateway](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/35817a5bceab5c2d853a6872d3895efe6f026585) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5328)) ##### Changed (12 changes) - [Update gitlab-runner to v0.92.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/e34bf38b4f0627f90d77e0b784a94a4f3e5e2542) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5354)) - [Update prometheus to v29.29.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0854cb13cd7d9cce0edb9995730c671b3cc96d8d) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5339)) - [Update cert-manager to v1.21.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7d199209981a3dd1000dd39cff9da625c9892965) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5341)) - [Update helm to v4.2.4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/44e21083c3630bf8630b194d749b751db2887b66) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5280)) - [Update prometheus to v29.27.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/845ac6aa073fa4f3d3c4716fe2166e977e703e54) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5323)) - [Update gitlab-exporter to v17.0.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/392188d1d313048ad2b15ab9ff2926cf68db4a0c) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5311)) - [Update gitlab-exporter to v17](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7067d6d1fbaaf630d96617a158df11f5b491fc17) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5308)) - [Update openbao to v0.18.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/cff40725077b84e6547422a068f3c106c4b63981) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5299)) - [Update Envoy Gateway to v1.9.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/2267d872ea48127684da85ca92243cc521d5cf8f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5300)) - [Update gitlab-runner to v0.92.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c4058ff60a97d518b5c4d71dbb2804af8f7d74ba) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5292)) - [Update Debian base from bookworm to trixie](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f22d142fdac57c5d3832bdcb2647f4c7d57bccf9) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5281)) - [Update gitlab-runner to v0.92.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/fca325450df764b23edaf3962066423af5a148c0) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5276)) ### [`v10.3.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1037-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.6...v10.3.7) No changes. ### [`v10.3.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1036-2026-10-12) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.5...v10.3.6) No changes. ### [`v10.3.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1035-2026-10-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.4...v10.3.5) No changes. ### [`v10.3.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1034-2026-09-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.3...v10.3.4) ##### Changed (1 change) - [Update ai-gateway to v0.15.3](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/8e7c032facbd95ea1c701e62f3fc2bd80924a364) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5398)) ### [`v10.3.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1033-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.2...v10.3.3) ##### Changed (1 change) - [Update gitlab-runner to v0.92.2](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/2d4277908935e84e58aad37e550dba599e376014) ### [`v10.3.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1032-2026-09-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.1...v10.3.2) ##### Changed (1 change) - [Update gitlab-runner to v0.92.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/b1bfdd07f5c75c98a3fc40e8d5dd820f85eaf411) ### [`v10.3.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1031-2026-08-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.3.0...v10.3.1) ##### Changed (1 change) - [Update gitlab-runner to v0.92.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/25e30d1a6b2397ed332730f2413eea81774eb7f9) ### [`v10.3.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1030-2026-08-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.9...v10.3.0) ##### Added (4 changes) - [Add Amazon SES mailer chart settings](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/bc768634bb8b74f257cf13cb77016867a7b8dd87) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5190)) - [Set IAM\_SERVICE\_URL for Workhorse from iamAuthService](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/abb409e063caf45bcb8fd59a4b14fa915c1ce6e6) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5251)) - [Support appArmor and seLinux options in security context](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/60c0a2f2be56d3cfbbc4d72cde21dbf636bd0f22) by [@iposadat](https://github.com/iposadat) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5145)) - [Add dnsConfig support for GitLab pod specs](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0689233ee7427c8be7b0c68cdfc49dde8d847ab9) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5133)) ##### Fixed (2 changes) - [feat(gitlab-shell): add BackendTrafficPolicy for PROXY v2 with Envoy Gateway](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5f5fc199f841569bf6fc3d0a32276d1b0fbe8f99) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5207)) - [Remove namespace from GatewayClass](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/76dd6105f65e3710fa967917ea66986b87c59a36) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5228)) ##### Changed (12 changes) - [Add Kubernetes 1.36 to k3d CI version matrix](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/fda73524b77efa6f528894e6d3e9975e57a76c56) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5187)) - [Update gitlab-runner to v0.91.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/1957fd6e4a8066cb8a8f914be59101e1675a3bf3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5258)) - [feat: add Orbit app config alias](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/80fe0762b3b012eae52824c75153ddd607a6b993) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5249)) - [Update ai-gateway to v0.15.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ef1f7c44ea9bd8fc9f505401f3f1fd0cfc7f2a77) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5243)) - [Update openbao to v0.17.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f1b150b455c8b95315e008294053036c7786ae26) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5239)) - [Update cert-manager to v1.21.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/80b60c66c679256e51614b31bf74eb105f940f11) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5234)) - [Webservice: Enable IPv6 binding by default](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/588722a40d104829c88de1eeff7cf9a916c29cea) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5225)) - [Update Envoy Gateway to v1.8.3](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/512d608bc1def344e3f8bd31557bdc8dd3f70dd5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5217)) - [Raise HTTP/2 window on webservice Geo/main ClientTrafficPolicy](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/40e552be9805b3660e2b8f6e8bbc5c29ce3b9e42) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5200)) - [Update helm to v4.2.3](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/4e5bc5b7d74e118096452890ddb971c6364a7c0a) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5202)) - [Update gitlab-runner to v0.91.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/6f8ff0bf646aa6fa2dc3b658b710f3570ba46cd0) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5201)) - [Update prometheus to v29.17.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/de64cf4a6c18fe3b1cd7d2f707eb9ca0a6b1720f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5097)) ### [`v10.2.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1029-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.8...v10.2.9) No changes. ### [`v10.2.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1028-2026-10-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.7...v10.2.8) No changes. ### [`v10.2.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1027-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.6...v10.2.7) No changes. ### [`v10.2.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1026-2026-09-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.5...v10.2.6) No changes. ### [`v10.2.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1025-2026-08-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.4...v10.2.5) ##### Changed (1 change) - [Update gitlab-runner to v0.91.2](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/f11b6ad256a25fc26e4fc5674649b299823e73a7) ### [`v10.2.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1024-2026-08-14) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.2...v10.2.4) No changes. ### [`v10.2.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1022-2026-08-12) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.1...v10.2.2) ##### Fixed (2 changes) - [Prometheus: replace default scrapeConfigs to fix duplicate scrape job](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/f909262c2ca5958248abe8f58e29d2f696f656eb) - [Remove namespace from GatewayClass](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/66ccea6f39b45ec657b027a331e80d2dca85d117) ### [`v10.2.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1021-2026-07-29) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.2.0...v10.2.1) ##### Changed (1 change) - [Update gitlab-runner to v0.91.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/b1e07625237920f740d29e0e5b69aaa3bf0c3876) ### [`v10.2.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1020-2026-07-15) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.9...v10.2.0) ##### Fixed (4 changes) - [Split KAS k8s-proxy into its own HTTPRoute](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5d10ea05cdb3bd06f1fbab7c4073a040bbef7caa) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5156)) - [Fix stray comma in Praefect password generation](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/e2ee6d67ec9135eaab9635718acd562bf6603a92) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5154)) - [Fix shared-secrets silent failures](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/8c1f075b6bb430b9caa67d53b091c4a3c95fa99d) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5154)) - [Fix Pages object storage validation under consolidated config](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/bd8adc0200a917a11e39114681b333b063188b2b) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5124)) ##### Changed (8 changes) - [Update cert-manager to v1.21.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ab5f58178bd58f40420fced1ba6440d4219e5498) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5174)) - [Update gitlab-exporter to v16.9.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/cb277798bcaa2bf999e6bbe21a62f332db16db52) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5172)) - [Update cert-manager to v1.20.3](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/fc1b343d7a460f0c6aace8c6681a5b5ee4eaf33f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5148)) - [Update Envoy Gateway to v1.8.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/598b18b8974a96ebcdf17d6a1ca53b2c5df43085) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5164)) - [Update gitlab-runner to v0.90.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/61343dc7585b5d55cba369fd51090d300b8667d6) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5150)) - [Update helm to v4.2.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a534dceb707369d69c458e09e60a7db2b8897fb5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5130)) - [Update container-registry to v4.40.2-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/991bf40f76b4ea6f948765cb404f314daa0dd179) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5144)) - [Update gitlab-runner to v0.90.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/68c3e43166a2bdcb7b50f16e185dc2773059a778) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5127)) ### [`v10.1.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1019-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.8...v10.1.9) No changes. ### [`v10.1.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1018-2026-09-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.7...v10.1.8) No changes. ### [`v10.1.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1017-2026-08-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.6...v10.1.7) No changes. ### [`v10.1.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1016-2026-08-14) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.4...v10.1.6) No changes. ### [`v10.1.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1014-2026-08-12) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.3...v10.1.4) ##### Fixed (2 changes) - [Prometheus: replace default scrapeConfigs to fix duplicate scrape job](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/afd86bac30637e8ced8427808525b1a9c323de6f) - [Remove namespace from GatewayClass](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/7575a4c36333700aad6ce469154288132ee7a04f) ### [`v10.1.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1013-2026-07-29) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.2...v10.1.3) ##### Fixed (1 change) - [Split KAS k8s-proxy into its own HTTPRoute](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/2d0a987d66bb65a1637b4a4d198156bc14f5e5e7) ### [`v10.1.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1012-2026-07-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.1...v10.1.2) ##### Fixed (1 change) - [fix: add HTTP git paths to long-running HTTPRoute](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/618c725118f4c7127151d139c35712bc1a6c289a) ##### Changed (1 change) - [Update gitlab-runner to v0.90.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/036606cac1f8e0017cdef0a4cde894ddef37d9ab) ### [`v10.1.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1011-2026-06-23) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.1.0...v10.1.1) ##### Fixed (1 change) - [Fix Pages object storage validation under consolidated config](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/d069e0afef34f3c8700b45d37cd2d76dc0701c4d) ### [`v10.1.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1010-2026-06-17) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.10...v10.1.0) ##### Added (2 changes) - [Add Topology Service mTLS support to GitLab Shell](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d2d4b487b651ef914ac6b94c1889d69854d676c3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5111)) - [feat(smtp): support reading SMTP username from a Kubernetes Secret](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/4e97064c5577328944de34be677ce8350e6f3279) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5083)) ##### Fixed (1 change) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d59e3ac36385049e5e2d2d08b88e5f0b64c0d26b) by [@alanrichman](https://github.com/alanrichman) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5074)) ##### Changed (9 changes) - [gitlab-shell: add ingressClassName to IngressRouteTCP](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d944bbea1ca21e0f53834384824b98ef32d36fc4) by [@ioanalytica](https://github.com/ioanalytica) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5084)) - [Update Envoy Gateway to v1.8.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0a4f4de2514cf582f6d14b6103052e720e61e864) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5105)) - [Update gitlab-zoekt to v4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ab49fcd89c9954323c4477a8d1274e3786daf9ac) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5026)) - [Update gitlab-runner to v0.89.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5e024be82a74917a0856ac1dd622dc6e6840cfc5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5081)) - [Update prometheus to v29.9.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5d8e835a0ffcf70529918014e4e7c9ad2d56fbd8) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5082)) - [Update container-registry to v4.40.1-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a0180e805dc02d1a3a98ef83eb7ee1c6b73d3b14) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5079)) - [Update prometheus to v29.7.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c51ebff848d1b22e82ee67eb3c4dc5569a5af5e2) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5070)) - [Update helm to v4.2.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c4a987f65aeaa012ea6f87e336aa0c92538929ba) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5071)) - [Update ai-gateway to v0.12.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c0f3f8f16cadd83232eecd4f5134270fefac0666) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5068)) ### [`v10.0.10`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#10010-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.9...v10.0.10) No changes. ### [`v10.0.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1009-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.8...v10.0.9) No changes. ### [`v10.0.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1008-2026-08-14) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.6...v10.0.8) No changes. ### [`v10.0.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1006-2026-08-12) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.5...v10.0.6) ##### Fixed (2 changes) - [Prometheus: replace default scrapeConfigs to fix duplicate scrape job](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/86a75aea47e38fca6c800b6f82127130ca7267af) - [Remove namespace from GatewayClass](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/24a5b451c62be1992aa53a59464d402d033dc0e4) ### [`v10.0.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1005-2026-07-29) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.4...v10.0.5) ##### Fixed (1 change) - [Split KAS k8s-proxy into its own HTTPRoute](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/e68049679e4cc5dd8d3bc871b3d0a96dc65aa8e2) ### [`v10.0.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1004-2026-07-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.3...v10.0.4) ##### Fixed (1 change) - [fix: add HTTP git paths to long-running HTTPRoute](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/bc35dde02943ad434ca49aa9515dacc5a1722a9b) ### [`v10.0.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1003-2026-06-23) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.2...v10.0.3) ##### Fixed (1 change) - [Fix Pages object storage validation under consolidated config](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/cf0f171906b6348c62c21be2958e6e98ab86f78a) ### [`v10.0.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1002-2026-06-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.1...v10.0.2) ##### Changed (1 change) - [Update gitlab-runner to v0.89.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/e1f905697f042b2afd68de63555ccf9ae2dd886c) ### [`v10.0.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1001-2026-05-26) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v10.0.0...v10.0.1) ##### Fixed (1 change) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/4a2594215a1cf57d5f357c093a2dfe5b70d0a128) ##### fixes (1 change) - [Update container-registry to v4.40.1-gitlab](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/59a332a45f33fc77752c206d105a6107886cd75b) ### [`v10.0.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1000-2026-05-21) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.14...v10.0.0) ##### Added (4 changes) - [Allow configuring revisionHistoryLimit for Deployments and StatefulSets](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0960f7169582b109c5ee89686808ee3b7743fcd0) by [@brookelew](https://github.com/brookelew) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4781)) - [Add Gateway API filter and timeout support to HTTPRoute resources](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/df45a4a5afa2fa8047d16f47f7f136626d8e677a) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4931)) - [Gateway API: Support backend TLS for KAS/Registry/Workhorse](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ead6dcdd8ec4546fb86eb5cc856ca501288ceb15) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4918)) - [Add git timeout configuration for GitLab Shell operations](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/af8116c28a7d95e6d9aff3f8461eb7f77541794a) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4975)) ##### Fixed (2 changes) - [Revert make kerberos keytab updates dynamic](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a5ce3708e9bd4d0a175bf2786e9e924d5b4dcc07) by [@iposadat](https://github.com/iposadat) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5027)) - [Fix dependencyProxy bucket validation when disabled](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/91bbe4d0603f1fa5b18ab1b8e8aa4ca1d8540ec3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5014)) ##### Changed (13 changes) - [feat(migrations): propagate annotations to the ConfigMap](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/504196c83b8b57c7a93938059788d1577d25a878) by [@abdalazizali](https://github.com/abdalazizali) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5033)) - [Update Envoy Gateway to v1.8.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/935c87de033b848feba9ee28c21b8641491f6a9e) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5050)) - [Update container-registry to v4.40.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/15db29b54d2aa6e4e549d75646adff195931dafc) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5055)) - [Update gitlab-runner to v0.88.3](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/cfbea922cbae4ad72b8a5fadad4019918335c017) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5053)) - [Update gitlab-exporter to v16.8.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/1db524b4c8a63da5463d3863d7c65bff5bf6c7e5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5051)) - [Update gitlab-runner to v0.88.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/91463a5f1e36401b1cb3d07f2434968b12960236) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5032)) - [Update ai-gateway to v0.11.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a9d1cab801c5c9f8f6909ba6988199419ed0ce30) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5003)) - [Certmanager: Enable Gateway API by default](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/47523629f34fe4f0898e30d228d104555b4b2dd1) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5010)) - [Update Envoy Gateway to v1.7.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/91934ed30a1d7cea930d11e3dc2f7c942ec8dd28) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4991)) - [Update gitlab-runner to v0.88.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/e747d5172cca4be12007d98175cb52b18eb0ebe5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4994)) - [Update gitlab-runner to v0.88.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/8d5b8a332553aaa2b10803c16f0346812ee5c146) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4990)) - [Update prometheus to v29](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/90ca2ea42d6aabd5ff69d193c87b109bceb4730d) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4940)) - [Update gitlab-runner to v0.87.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/948eee2dad175a06615c2626bc9bec00b607fa06) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4962)) ##### Removed (3 changes) - [Breaking: Remove spamcheck subchart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7dababe2cefe0699131a1ce8d18b3b85c8b99641) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5035)) - [Breaking: Drop bundled MinIO chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/26820c4955e839d5c3af080307c4006951218bd6) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4964)) - [Breaking: Drop bundled Redis and PostgreSQL charts](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/08560add29dc61dd782ceea0730ff1fdcc40e1da) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4950)) ### [`v9.11.14`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91114-2026-10-20) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.13...v9.11.14) No changes. ### [`v9.11.13`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91113-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.12...v9.11.13) No changes. ### [`v9.11.12`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91112-2026-08-14) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.10...v9.11.12) No changes. ### [`v9.11.10`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91110-2026-08-06) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.9...v9.11.10) No changes. ### [`v9.11.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9119-2026-08-03) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.8...v9.11.9) No changes. ### [`v9.11.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9118-2026-07-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.7...v9.11.8) No changes. ### [`v9.11.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9117-2026-06-23) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.6...v9.11.7) No changes. ### [`v9.11.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9116-2026-06-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.5...v9.11.6) No changes. ### [`v9.11.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9115-2026-05-26) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.4...v9.11.5) ##### Fixed (2 changes) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/f79c362451298a4bfc3a888e33440a4ae31d6823) - [Revert make kerberos keytab updates dynamic](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/3022ff18281ab97b846d7610aece464c6525d378) ### [`v9.11.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9114-2026-05-13) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.3...v9.11.4) ##### Added (1 change) - [Gateway API: Support backend TLS for KAS/Registry/Workhorse](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/7f6efbbed24956f5bbd0ec8396572e60389c6da4) ##### Fixed (1 change) - [Fix dependencyProxy bucket validation when disabled](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/26e4da55ca2c1e9e192a732150a2ca15cd84a62f) ##### Changed (2 changes) - [Update gitlab-runner to v0.88.2](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/8f7e27f76912818061825eb2549275af5f74b98e) - [chore: bump gitlab-zoekt chart to 3.11.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/fcc32831c118f14bb588337a83c045e8e1d04f5e) ### [`v9.11.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9113-2026-05-05) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.2...v9.11.3) No changes. ### [`v9.11.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9112-2026-04-28) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.1...v9.11.2) ##### Changed (1 change) - [Update gitlab-runner to v0.88.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d5a1c79236b4d370966259297fc3c64ed3a5c712) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4992)) ### [`v9.11.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#91113-2026-09-22) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.11.0...v9.11.1) No changes. ### [`v9.11.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9110-2026-04-15) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.8...v9.11.0) ##### Added (3 changes) - [Add `trusted_user_ca_keys` support to gitlab-shell chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/e66b479f46c355f6f000363bae601cebfdd5d8cd) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4913)) - [Add Redis and Sentinel TLS support to GitLab Helm Chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f8d12ba2730102801e94335e5fdd1b55d71c13dc) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4720)) - [Gateway API: Support Smartcard authentication](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/72100a0905e0bf6bb1c04d09c6d321c74b4cc8ed) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4850)) ##### Fixed (3 changes) - [Guard Gateway API route templates with service enabled checks](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5ff2f18cfb9fea324a34401014878954c26dbf39) by [@weijiany](https://github.com/weijiany) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4916)) - [Use nested Redis auth secrets when password key is absent](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7e3df81ec82a869c87549cefa31413789a3cff3d) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4911)) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0a377d75f2d6c269c3bd434726fee458ea54c0dd) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4912)) ##### Changed (9 changes) - [Update openbao to v0.14.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/076cd94b8f775371d7e5ce5a6b13b02479cf3dc3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4947)) - [Update cert-manager to v1.20.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f07432d0fe1ee945af576cba4495c06907e63798) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4865)) - [Bump openbao chart version to 0.13.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/b8d51d7f7b3ea59458490187005b562bef39adbd) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4932)) - [Use a dedicated database for OpenBao instead of the main Rails database](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/64e44a659e47352a1d1b6eddc7a27bc843274ff9) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4827)) - [Update NGINX Ingress to 1.15.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a1fa5629eda9adad93e299606322b7c9d4d98641) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4890)) - [Update gitlab-runner to v0.87.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ed282852692b0516c875d7b0f3b1d743a03c5d10) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4904)) - [Update gitlab-exporter to v16.7.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/37981d9e8b352c9d62908df776a248c41c316901) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4866)) - [Update container-registry to v4.39.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/be5ece2d4387f2d561000c549c2cc754ed95feb9) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4886)) - [Gateway API: Unglobalize Gateway API resources](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/fb5977af6be6eb874f6be1f2fee7d74d03c27665) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4862)) ### [`v9.10.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9108-2026-06-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.7...v9.10.8) No changes. ### [`v9.10.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9107-2026-05-26) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.6...v9.10.7) ##### Fixed (2 changes) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/038dcac41a6bff8c527c227e8339bfdc2dac587a) - [Revert make kerberos keytab updates dynamic](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/426c481af8c20560622a51e2a6582adf4cb3507b) ##### Changed (1 change) - [chore: bump gitlab-zoekt chart to 3.10.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/c1264745b50a0e02d01335371f7ee14c7e2eb27d) ### [`v9.10.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9106-2026-05-13) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.5...v9.10.6) ##### Changed (1 change) - [Update gitlab-runner to v0.87.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/5669a1e36b1acd9d9f990b92f508e9ead504d132) ### [`v9.10.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9105-2026-04-28) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.4...v9.10.5) ##### Fixed (1 change) - [Guard Gateway API route templates with service enabled checks](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/2c1aa6b335d0d0613bc7cde51394fe3df341cb5f) by [@weijiany](https://github.com/weijiany) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4941)) ### [`v9.10.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9104-2026-04-21) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.3...v9.10.4) ##### Fixed (1 change) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/69a370090f573afc23d510b5586ba8c20044a783) ##### Changed (1 change) - [Bump gitlab-zoekt chart to 3.8.3](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/74f4e6490669560919e6ec2e130da584530651d5) ### [`v9.10.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9103-2026-04-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.1...v9.10.3) No changes. ### [`v9.10.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9101-2026-03-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.10.0...v9.10.1) No changes. ### [`v9.10.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9100-2026-03-18) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.9...v9.10.0) ##### Added (4 changes) - [Add HTTP-to-HTTPS redirect for Gateway API deployment](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/b7a3b164f7d00cf18545a8ca2495c9aef2037c30) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4868)) - [Add knowledge graph support](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/6ada639ff0f899a6e5ece55e0bbf179d052e1a6f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4855)) - [Add ServiceMonitor and PodMonitor for Envoy](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/56f079186510e63e6588457693cab4f98286ed28) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4811)) - [Add statusCode configuration for Workhorse load shedding](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7db69723b7f798a970d54ab9cf552c67a5458560) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4858)) ##### Fixed (2 changes) - [Fix inverted namespaceInPath condition for pages Gateway listener](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/886efc28b5193047c86b501ad90a6ecf53e8086e) by [@weijiany](https://github.com/weijiany) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4859)) - [Create minio httproute only when minio is enabled](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/847caf3802cf710f3b3523c20442e808aba5934d) by [@achupryn](https://github.com/achupryn) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4838)) ##### Changed (10 changes) - [Update Envoy Gateway to v1.7.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5a83c3fd73146e7824996e38b327f91c9bbed04f) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4874)) - [Re-enable HTTP audit logging for Secrets Manager](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/72cb9df468a56d2e6494127550669617749062c6) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4875)) - [Update container-registry to v4.38.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/7aaf66bcf23fcdf30fbb1de5d9c5a1543caf75f2) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4852)) - [Update cert-manager from 1.17.4 to 1.19.4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f9bba1afa813d5d9b3a062e5802655a0cc99050a) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4754)) - [Update gitlab-exporter to v16.6.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d89ea9b9f95fc4d068679c164aaaa2ba625eecf0) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4601)) - [Update gitlab-zoekt to v3.8.2](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/6e88ff4845fda37245acfcf5a78e0f9bc4653ec3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4832)) - [Update GitLab exporter from 16.2 to 16.4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/8a927a76aa0ec94632de9d1657558fbcdb626ea7) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4830)) - [Update gitlab-runner to v0.86.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5989b6d58df3cd6333f896ac6d6186a97099b863) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4823)) - [Update container-registry to v4.37.0-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f225950cc5b21f2c4dd09f30f989cb40185cd929) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4813)) - [Remove Zoekt basic auth from main GitLab Helm chart](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/bf6e3d48b050e0ba467d2adc98784ad123d2aa98) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4782)) ### [`v9.9.9`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#999-2026-05-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.8...v9.9.9) No changes. ### [`v9.9.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#998-2026-05-13) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.7...v9.9.8) ##### Changed (1 change) - [chore: bump gitlab-zoekt chart to 3.9.0](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/9096e93eeb366b0444bd594bca29074d234d954e) ### [`v9.9.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#997-2026-04-21) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.6...v9.9.7) ##### Fixed (1 change) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/security/charts/gitlab/-/commit/4cc9a05181676d3afe3fcf732e7f2ad7fcda8fb2) ### [`v9.9.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#996-2026-04-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.4...v9.9.6) No changes. ### [`v9.9.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#994-2026-03-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.3...v9.9.4) No changes. ### [`v9.9.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#993-2026-03-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.2...v9.9.3) No changes. ### [`v9.9.2`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#992-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.1...v9.9.2) ##### Fixed (1 change) - [Backport gomplate 5.x compatibility](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/355f21be8525178b54423802df7a0285afef8316) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4846)) ### [`v9.9.1`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#991-2026-02-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.9.0...v9.9.1) No changes. ### [`v9.9.0`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#1010-2026-06-17) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.12...v9.9.0) ##### Added (2 changes) - [Add Topology Service mTLS support to GitLab Shell](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d2d4b487b651ef914ac6b94c1889d69854d676c3) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5111)) - [feat(smtp): support reading SMTP username from a Kubernetes Secret](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/4e97064c5577328944de34be677ce8350e6f3279) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5083)) ##### Fixed (1 change) - [Toolbox: Fix boto config when using Workload Identity](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d59e3ac36385049e5e2d2d08b88e5f0b64c0d26b) by [@alanrichman](https://github.com/alanrichman) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5074)) ##### Changed (9 changes) - [gitlab-shell: add ingressClassName to IngressRouteTCP](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/d944bbea1ca21e0f53834384824b98ef32d36fc4) by [@ioanalytica](https://github.com/ioanalytica) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5084)) - [Update Envoy Gateway to v1.8.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/0a4f4de2514cf582f6d14b6103052e720e61e864) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5105)) - [Update gitlab-zoekt to v4](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/ab49fcd89c9954323c4477a8d1274e3786daf9ac) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5026)) - [Update gitlab-runner to v0.89.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5e024be82a74917a0856ac1dd622dc6e6840cfc5) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5081)) - [Update prometheus to v29.9.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/5d8e835a0ffcf70529918014e4e7c9ad2d56fbd8) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5082)) - [Update container-registry to v4.40.1-gitlab](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/a0180e805dc02d1a3a98ef83eb7ee1c6b73d3b14) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5079)) - [Update prometheus to v29.7.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c51ebff848d1b22e82ee67eb3c4dc5569a5af5e2) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5070)) - [Update helm to v4.2.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c4a987f65aeaa012ea6f87e336aa0c92538929ba) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5071)) - [Update ai-gateway to v0.12.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/c0f3f8f16cadd83232eecd4f5134270fefac0666) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/5068)) ### [`v9.8.12`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9812-2026-06-29) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.11...v9.8.12) No changes. ### [`v9.8.11`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9811-2026-05-25) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.10...v9.8.11) ##### Fixed (1 change) - [Fix certmanager annotation regression in Helm 3.20.1](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/f722c3034ec827301c09afa2fa160cda9a5ec4ea) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4929)) ### [`v9.8.10`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#9810-2026-04-07) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.8...v9.8.10) No changes. ### [`v9.8.8`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#988-2026-03-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.7...v9.8.8) No changes. ### [`v9.8.7`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#987-2026-03-10) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.6...v9.8.7) No changes. ### [`v9.8.6`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#986-2026-03-05) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.5...v9.8.6) ##### Fixed (1 change) - [Fix: Fixup Gomplate rendering for 5.0.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/caf765bb38f556724aa9ff2adb28e14719cd8482) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4854)) ### [`v9.8.5`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#985-2026-02-24) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.4...v9.8.5) No changes. ### [`v9.8.4`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#984-2026-02-09) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.3...v9.8.4) No changes. ### [`v9.8.3`](https://gitlab.com/gitlab-org/charts/gitlab/blob/HEAD/CHANGELOG.md#983-2026-02-04) [Compare Source](https://gitlab.com/gitlab-org/charts/gitlab/compare/v9.8.2...v9.8.3) ##### Changed (1 change) - [Update Helm release gitlab-runner to v0.85.0](https://gitlab.com/gitlab-org/charts/gitlab/-/commit/584e98f2e769eaac44d3f49bc03f7e39db433a44) ([merge request](https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4749)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-08 23:05:45 +00:00

Update Helm release gitlab to v10 2967bd395b

renovate-bot force-pushed renovate/gitlab-10.x from 2967bd395b to 30848848a0

ci/crow/push/dns-test Pipeline failed

Details

ci/crow/pr/dns-test Pipeline failed

Details

ci/crow/pr/tanka-diff Pipeline failed

Details

ci/crow/push/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-test Pipeline failed

Details

2026-07-16 14:10:47 +00:00

Compare

renovate-bot changed title from ~~Update Helm release gitlab to v10~~ to chore(deps): update helm release gitlab to v10

2026-07-17 23:16:09 +00:00

renovate-bot changed title from ~~chore(deps): update helm release gitlab to v10~~ to Update Helm release gitlab to v10

2026-07-21 01:12:15 +00:00

renovate-bot changed title from ~~Update Helm release gitlab to v10~~ to chore(deps): update helm release gitlab to v10

2026-07-21 02:12:12 +00:00

renovate-bot force-pushed renovate/gitlab-10.x from f6d39386db to 7f5161c756

2026-09-21 19:23:03 +00:00

Compare

renovate-bot force-pushed renovate/gitlab-10.x from 7f5161c756 to e40c25aa15

ci/crow/pr/tanka-diff Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline failed

Details

2026-09-23 09:13:56 +00:00

Compare

ci-bot commented

2026-09-23 09:20:00 +00:00

Member

flate diff

(root level)  (networking.k8s.io/v1/NetworkPolicy/gitlab/gitlab-redis)
- one document removed:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: gitlab-redis
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    - ports:
      - port: 9121
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    policyTypes:
    - Ingress
    - Egress

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-kas)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: kas
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-sidekiq-all-in-1-v1)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-sidekiq-all-in-1-v1
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-registry-v1)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-registry-v1
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: registry
        release: gitlab

(root level)  (v1/ServiceAccount/gitlab/gitlab-runner-access)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-runner-access
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab

(root level)  (v1/ServiceAccount/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-runner)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    check-live: |
      #!/bin/bash
      set -eou pipefail
      
      # default timeout is 3 seconds, can be overriden
      VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}}
      
      if ! /usr/bin/pgrep -f ".*register-the-runner"  > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner"  > /dev/null ; then
        exit 1
      fi
      
      status=0
      # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL)
      verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$?
      
      # timeout exit code is 143 with busybox, and 124 with coreutils
      if (( status == 143 )) || (( status == 124 )) ; then
        echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2
        exit 0
      elif (( status > 0 )) ; then
        exit ${status}
      fi
      
      grep -qE "is (alive|valid)" <<<"${verify_output}"
      
    config.template.toml: |
      [[runners]]
        [runners.kubernetes]
        image = "archlinux/archlinux:latest"
        namespace_per_job = true
        node_selector_overwrite_allowed = "kubernetes.io/arch=.*"
        pull_policy = ["always", "always"]
      
        [runners.kubernetes.node_selector]
        "kubernetes.io/arch" = "amd64"
      
        [runners.cache]
          Type = "s3"
          Path = "gitlab-runner"
          Shared = true
          [runners.cache.s3]
            ServerAddress = "brickyard.home.arpa:3900"
            BucketName = "gitlab-runner-cache"
            BucketLocation = "apartment"
            Insecure = true
            AuthenticationType = "access-key"
            PathStyle = true
      
    config.toml: |
      shutdown_timeout = 0
      concurrent = 10
      check_interval = 3
      log_level = "info"
      
    entrypoint: |
      #!/bin/bash
      set -e
      
      export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/"
      mkdir -p ${CONFIG_PATH_FOR_INIT}
      cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT}
      
      # Set up environment variables for cache
      if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
        export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
        export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
      fi
      
      if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
      elif [[ -f /secrets/gcs-application-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
      else
        if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
          export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
          # echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
          export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
        fi
      fi
      
      if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
        export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
        export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
      fi
      
      if [[ -f /secrets/runner-registration-token ]]; then
        export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
      fi
      
      if [[ -f /secrets/runner-token ]]; then
        export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
      fi
      
      # Register the runner
      if ! sh /configmaps/register-the-runner; then
        exit 1
      fi
      
      # Run pre-entrypoint-script
      if ! bash /configmaps/pre-entrypoint-script; then
        exit 1
      fi
      
      # Start the runner
      exec /entrypoint run \
        --working-directory=/home/gitlab-runner
      
    pre-entrypoint-script: 
    register-the-runner: |
      #!/bin/sh
      signal_handler() {
        if [ ! -d "/proc/$register_pid" ]; then
          wait $register_pid
        fi
        exit
      }
      trap 'signal_handler' QUIT INT
      
      MAX_REGISTER_ATTEMPTS=30
      
      # Reset/unset the not needed flags when an authentication token
      RUN_UNTAGGED=""
      ACCESS_LEVEL=""
      
      if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then
        RUN_UNTAGGED=""
        ACCESS_LEVEL=""
        unset REGISTER_LOCKED
        unset RUNNER_TAG_LIST
      fi
      
      for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
        echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
        /entrypoint register \
          ${RUN_UNTAGGED} \
          ${ACCESS_LEVEL} \
          --template-config /configmaps/config.template.toml \
          --non-interactive &
      
        register_pid=$!
        wait $register_pid
        retval=$?
      
        if [ ${retval} = 0 ]; then
          break
        elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
          exit 1
        fi
      
        sleep 5
      done
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.toml.tpl: |
      # The directory where Gitaly's executables are stored
      bin_dir = "/usr/local/bin"
      
      # listen on a TCP socket. This is insecure (no authentication)
      listen_addr = ":8075"
      
      # Directory where internal sockets reside
      # note: no value will result in a `/tmp/gitlab-internal-*` path
      # internal_socket_dir = "/home/git"
      
      # If metrics collection is enabled, inform gitaly about that
      prometheus_listen_addr = ":9236"
      
      # Graceful shutdown timeout, how long to wait for in-flight requests to complete
      graceful_restart_timeout = "25s"
      
      # Storage configuration
      {% $storages := coll.Slice  "default" %}
      {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %}
      {% $index := 0 %}
      {% if regexp.Match "^[0-9]+$" $hostid %}
        {% $index = conv.ToInt64 $hostid %}
      {% end %}
      {% if len $storages | lt $index %}
      [[storage]]
      name = "{% index $storages $index %}"
      path = "/home/git/repositories"
      {% else %}
      {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %}
      {% end %}
      
      [logging]
      format = "json"
      dir = "/var/log/gitaly"
      
      [auth]
      token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %}
      
      [git]
      use_bundled_binaries = true
      ignore_gitconfig = true
      
      [gitlab-shell]
      # The directory where gitlab-shell is installed
      dir = "/srv/gitlab-shell"
      
      [gitlab]
      # location of shared secret for GitLab Shell / API interaction
      secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret"
      # URL of API
      url = "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      [gitlab.http-settings]
      # read_timeout = 300
      # user = someone
      # password = somepass
      # ca_file = /etc/ssl/cert.pem
      # ca_path = /etc/pki/tls/certs
      
      [hooks]
      # directory containing custom hooks
      custom_hooks_dir = "/home/git/custom_hooks"
      
    configure: |
      set -e
      mkdir -p /init-secrets/gitaly /init-secrets/shell
      cp -v -r -L /init-config/.gitlab_shell_secret  /init-secrets/shell/.gitlab_shell_secret
      cp -v -r -L /init-config/gitaly_token  /init-secrets/gitaly/gitaly_token
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # optional
      for secret in redis redis-sentinel postgres gitlab-exporter ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    gitlab-exporter.yml.erb: |
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
        
      
      probes:
        db_common: &db_common
          methods:
            - probe_db
          opts:
            connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>'
        database:
          multiple: true
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
        database_bloat:
          class_name: Database::BloatProber
          <<: *db_common
      
        sidekiq: &sidekiq
          methods:
            - probe_queues
            - probe_workers
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
            
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
          methods:
            - probe_gc
          opts:
            quantiles: false
      
        metrics:
          multiple: true
          ruby:
            <<: *ruby
          sidekiq:
            <<: *sidekiq
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-shell-sshd)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell-sshd
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    sshd_config: |
      #	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
      
      # This is the sshd server system-wide configuration file.  See
      # sshd_config(5) for more information.
      
      # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
      
      # The strategy used for options in the default sshd_config shipped with
      # OpenSSH is to specify options with their default value where
      # possible, but leave them commented.  Uncommented options override the
      # default value.
      
      Port 2222
      #AddressFamily any
      #ListenAddress 0.0.0.0
      #ListenAddress ::
      
      #HostKey /etc/ssh/ssh_host_rsa_key
      #HostKey /etc/ssh/ssh_host_dsa_key
      #HostKey /etc/ssh/ssh_host_ecdsa_key
      #HostKey /etc/ssh/ssh_host_ed25519_key
      
      # Ciphers and keying
      #RekeyLimit default none
      
      # Logging
      #SyslogFacility AUTH
      LogLevel ERROR
      
      # Authentication:
      
      PermitRootLogin no
      #StrictModes yes
      #MaxAuthTries 6
      #MaxSessions 10
      
      #PubkeyAuthentication yes
      
      #AuthorizedPrincipalsFile none
      
      # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
      #HostbasedAuthentication no
      # Change to yes if you don't trust ~/.ssh/known_hosts for
      # HostbasedAuthentication
      #IgnoreUserKnownHosts no
      # Don't read the user's ~/.rhosts and ~/.shosts files
      #IgnoreRhosts yes
      
      #PermitEmptyPasswords no
      
      # Change to no to disable s/key passwords
      #ChallengeResponseAuthentication yes
      
      # Kerberos options
      #KerberosAuthentication no
      #KerberosOrLocalPasswd yes
      #KerberosTicketCleanup yes
      #KerberosGetAFSToken no
      
      # GSSAPI options
      #GSSAPIAuthentication no
      #GSSAPICleanupCredentials yes
      
      # Set this to 'yes' to enable PAM authentication, account processing,
      # and session processing. If this is enabled, PAM authentication will
      # be allowed through the ChallengeResponseAuthentication and
      # PasswordAuthentication.  Depending on your PAM configuration,
      # PAM authentication via ChallengeResponseAuthentication may bypass
      # the setting of "PermitRootLogin without-password".
      # If you just want the PAM account and session checks to run without
      # PAM authentication, then enable this but set PasswordAuthentication
      # and ChallengeResponseAuthentication to 'no'.
      #UsePAM no
      
      #AllowAgentForwarding yes
      #AllowTcpForwarding yes
      #GatewayPorts no
      #X11Forwarding no
      #X11DisplayOffset 10
      #X11UseLocalhost yes
      #PermitTTY yes
      #PrintMotd yes
      #PrintLastLog yes
      #TCPKeepAlive yes
      #UseLogin no
      #PermitUserEnvironment no
      #Compression delayed
      ClientAliveInterval 0
      #ClientAliveCountMax 3
      #UseDNS no
      PidFile /srv/sshd/sshd.pid
      #PermitTunnel no
      #ChrootDirectory none
      #VersionAddendum none
      
      # no default banner path
      #Banner none
      
      # override default of no subsystems
      # Subsystem	sftp	/usr/lib/ssh/sftp-server
      
      # the following are HPN related configuration options
      # tcp receive buffer polling. disable in non autotuning kernels
      #TcpRcvBufPoll yes
      
      # disable hpn performance boosts
      #HPNDisabled no
      
      # buffer size for hpn to non-hpn connections
      #HPNBufferSize 2048
      
      
      # Example of overriding settings on a per-user basis
      #Match User anoncvs
      #	X11Forwarding no
      #	AllowTcpForwarding no
      #	PermitTTY no
      #	ForceCommand cvs server
      
      # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
      # but this is overridden so installations will only check .ssh/authorized_keys
      AuthorizedKeysFile	.ssh/authorized_keys
      
      AuthorizedKeysCommand /authorized_keys %u %k
      AuthorizedKeysCommandUser git
      
      PasswordAuthentication no
      
      AllowUsers git
      
      # Enable the use of Git protcol v2
      AcceptEnv GIT_PROTOCOL
      
      # Hard disable all forwarding
      DisableForwarding yes
      
      # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
      # See `man sshd_config(5)`
      
      MaxStartups 10:30:100
      
      
      # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in
      LoginGraceTime 60
      
      # Includes
      Include /etc/ssh/sshd_config.d/*.conf
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      # GitLab user. git by default
      user: git
      
      # Url to gitlab instance. Used for api calls. Should end with a slash.
      gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret
      
      # File used as authorized_keys for gitlab user
      auth_file: "/home/git/.ssh/authorized_keys"
      
      # Log file.
      # Default is gitlab-shell.log in the root directory.
      log_file: "/var/log/gitlab-shell/gitlab-shell.log"
      
      log_format: json
      
      # Audit usernames.
      # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but
      # incurs an extra API call on every gitlab-shell command.
      audit_usernames: false
      
      
      lfs:
        pure_ssh_protocol: false
      pat:
        enabled: true
        allowed_scopes:
          []
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # END gitlab.scripts.configure.secrets
      mkdir -p /${secret_dir}/ssh
      cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/
      chmod 0400 /${secret_dir}/ssh/ssh_host_*
      
    krb5.conf: 
  


(root level)  (v1/ConfigMap/gitlab/gitlab-nginx-ingress-tcp)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-nginx-ingress-tcp
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:"

(root level)  (v1/ConfigMap/gitlab/gitlab-kas)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yaml: |
      agent:
        kubernetes_api:
          listen:
            address: :8154
          url_path_prefix: /k8s-proxy
          websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret
        listen:
          address: :8150
          websocket: true
      api:
        listen:
          address: :8153
          authentication_secret_file: /etc/kas/.gitlab_kas_secret
      gitlab:
        address: http://gitlab-webservice-default.gitlab.svc:8181
        authentication_secret_file: /etc/kas/.gitlab_kas_secret
        external_url: https://code.nogweii.net
      observability:
        listen:
          address: :8151
        liveness_probe:
          url_path: /liveness
        readiness_probe:
          url_path: /readiness
      private_api:
        listen:
          address: :8155
          authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret
      redis:
        database_index: 0
        password_file: /etc/kas/redis/redis-password
        server:
          address: gitlab-redis-master.gitlab.svc:6379
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-migrations)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-migrations
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in rails-secrets migrations gitaly ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          signup_enabled: false
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
          client_max_attempts: 4
          client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        gravatar:
          plain_url: 
          ssl_url: 
        
      
    installation_type: |
      gitlab-helm-chart
      
    pages_redirect_uri: "https://projects.aether.page/auth"
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-sidekiq)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-sidekiq
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          client_max_attempts: 4
          client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        
        iam_auth_service:
          enabled: false
          secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
          http:
            host: ""
            port: 0
          grpc:
            host: ""
            port: 0
          jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "127.0.0.0/8"
            - "::1/128"
          sidekiq_exporter:
            enabled: true
            address: "*"
            port: 3807
            log_enabled: false
          sidekiq_health_checks:
            enabled: true
            address: "*"
            port: 3808
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-toolbox)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
      
      # Mount point for registry DB secrets. Needs to be pre-created as later the
      # volume is remounted read-only
      mkdir "/${secret_dir}/registry-db/"
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      secret_key = $(cat /init-secrets/minio/secretkey)
      bucket_location = us-east-1
      host_base = minio.code.nogweii.net
      host_bucket = minio.code.nogweii.net/%(bucket)
      default_mime_type = binary/octet-stream
      enable_multipart = True
      multipart_max_chunks = 10000
      multipart_chunk_size_mb = 128
      recursive = True
      recv_chunk = 65536
      send_chunk = 65536
      server_side_encryption = False
      signature_v2 = True
      socket_timeout = 300
      use_mime_magic = False
      verbosity = WARNING
      website_endpoint = https://minio.code.nogweii.net
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
      
    configure-gsutil: |
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file
        # 2) Do not set permissions for key file
        # 3) GCP Project ID
        # 4) Decline anonymous usage statistics
        printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e
      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
        printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto
      fi
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          client_max_attempts: 4
          client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        
        iam_auth_service:
          enabled: false
          secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
          http:
            host: ""
            port: 0
          grpc:
            host: ""
            port: 0
          jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
      
    krb5.conf: 
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-webservice)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_color_mode: 
          default_syntax_highlighting_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        gitlab_docs:
          enabled: false
          host: ""
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          client_max_attempts: 4
          client_max_backoff: "1.4s"
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        
        iam_auth_service:
          enabled: false
          secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret
          http:
            host: ""
            port: 0
          grpc:
            host: ""
            port: 0
          jwt_audience: "gitlab-rails"
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
          secret_file: /etc/gitlab/gitlab-workhorse/secret
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "0.0.0.0/0"
            - "::/0"
          web_exporter:
            enabled: true
            address: "0.0.0.0"
            port: 8083
          sidekiq_exporter:
        shutdown:
          blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %>
        rack_attack:
          git_basic_auth:
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        smartcard:
          enabled: false
          ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt'
          client_certificate_required_host: smartcard.code.nogweii.net
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-workhorse-default)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-workhorse-default
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      set -e
      mkdir -p /init-secrets-workhorse/gitlab-workhorse
      cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret
      mkdir -p /init-secrets-workhorse/redis
      cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/
      if [ -f /init-config/objectstorage/object_store ]; then
        mkdir -p /init-secrets-workhorse/objectstorage
        cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/
      fi
      
    installation_type: |
      gitlab-helm-chart
      
    workhorse-config.toml.tpl: |
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
      {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
        {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%}
      {%- end %}
      {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %}
        {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%}
      {%- end %}
      {%- if has $supported_providers $connection.provider %}
      [object_storage]
      provider = "{% $connection.provider %}"
      {%-   if eq $connection.provider "AWS" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %}
      # AWS / S3 object storage configuration.
      [object_storage.s3]
      # access/secret can be blank!
      aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %}
      aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "AzureRM" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %}
      # Azure Blob storage configuration.
      [object_storage.azurerm]
      azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %}
      azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "Google" %}
      # Google storage configuration.
      [object_storage.google]
      {% $connection | coll.Omit "provider" | data.ToTOML %}
      {%-   end %}
      {%- end %}
      [image_resizer]
      max_scaler_procs = 2
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-webservice-tests)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice-tests
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    test_login: |
      set -e
      echo 'Start Test'
      endpoint="https://code.nogweii.net"
      cookie_read="-c /tmp/test_login.cookie"
      cookie_readwrite="$cookie_read -b /tmp/test_login.cookie"
      
      signin_url="$endpoint/users/sign_in"
      echo "Login to create a session: $signin_url"
      csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*')
      curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)"
      
      profile_url="$endpoint/-/profile"
      echo "Confirm session valid: $profile_url"
      profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url)
      
      if [ "$profile_status" != "200" ]; then
        echo "Error: Session Invalid"
        cat /tmp/profile_output
        exit 1
      fi
      
      echo 'Test Passed'
      exit 0
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-redis-configuration)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-configuration
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    master.conf: |
      dir /data
      # User-supplied master configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of master configuration
    redis.conf: |
      # User-supplied common configuration:
      # Enable AOF https://redis.io/topics/persistence#append-only-file
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration

(root level)  (v1/ConfigMap/gitlab/gitlab-redis-health)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-health
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)  (v1/ConfigMap/gitlab/gitlab-redis-scripts)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-scripts
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
      fi
      if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
      fi
      ARGS=("--port" "${REDIS_PORT}")
      ARGS+=("--requirepass" "${REDIS_PASSWORD}")
      ARGS+=("--masterauth" "${REDIS_PASSWORD}")
      ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
      ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
      exec redis-server "${ARGS[@]}"
  


(root level)  (v1/ConfigMap/gitlab/gitlab-registry)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      http:
        addr: :5000
        # `host` is not configurable
        # `prefix` is not configurable
        debug:
          addr: :5001
          prometheus:
            enabled: false
            path: /metrics
        draintimeout: 0
        headers:
          X-Content-Type-Options: [nosniff]
        secret: "HTTP_SECRET"
        relativeurls: false
      health:
        storagedriver:
          enabled: false
          interval: 10s
          threshold: 3
      auth:
        token:
          realm: https://code.nogweii.net/jwt/auth
          service: container_registry
          issuer: gitlab-issuer
          # This is provided from the initContainer execution, at a known path.
          rootcertbundle: /etc/docker/registry/certificate.crt
          autoredirect: false
      validation:
        disabled: true
        manifests:
          referencelimit: 0
          payloadsizelimit: 0
          urls:
            allow:
            deny:
      
      notifications:
      reporting:
      profiling:
      storage:
        maintenance:
          readonly:
            enabled: false
          uploadpurging:
            enabled: true
            age: 168h
            interval: 24h
            dryrun: false
        redirect:
          disable: true
          exceptions:
      middleware:
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
      gc:
        disabled: false
      redis:
      rate_limiter:
        enabled: false
      
    configure: |
      if [ -e /config/accesskey ] ; then
        sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml
      fi
      # Place the `http.secret` value from the kubernetes secret
      sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml
      # Populate sensitive registry notification secrets in the config file
      if [ -d /config/notifications ]; then
        for i in /config/notifications/*; do
          filename=$(basename $i);
          sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml;
        done
      fi
      # Insert any provided `storage` block from kubernetes secret
      if [ -d /config/storage ]; then
        # Copy contents of storage secret(s)
        mkdir -p /registry/storage
        cp -v -r -L /config/storage/* /registry/storage/
        # Ensure there is a new line in the end
        echo '' >> /registry/storage/config
        # Default `delete.enabled: true` if not present.
        ## Note: busybox grep doesn't support multiline, so we chain `egrep`.
        if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then
          echo 'delete:' >> /registry/storage/config
          echo '  enabled: true' >> /registry/storage/config
        fi
        # Indent /registry/storage/config 2 spaces before inserting into config.yml
        sed -i 's/^/  /' /registry/storage/config
        # Insert into /registry/config.yml after `storage:`
        sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml
        # Remove the now extraneous `config` file
        rm /registry/storage/config
      fi
      # Copy any middleware.storage if present
      if [ -d /config/middleware.storage ]; then
        cp -v -r -L /config/middleware.storage  /registry/middleware.storage
      fi
      # Set to known path, to used ConfigMap
      cat /config/certificate.crt > /registry/certificate.crt
      # Copy the optional profiling keyfile to the expected location
      if [ -f /config/profiling-key.json ]; then
        cp /config/profiling-key.json /registry/profiling-key.json
      fi
      # Insert Database password, if enabled
      if [ -f /config/database_password ] ; then
        sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml
      fi
      # Insert Redis(cache) password, if enabled
      if [ -f /config/registry/redis-password ] ; then
        sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml
      fi
      # Insert Redis(rate-limiter) password, if enabled
      if [ -f /config/registry/redis-rateLimiting-password ] ; then
        sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml
      fi
      # Insert Redis(load balancing) password, if enabled
      if [ -f /config/registry/redis-loadBalancing-password ] ; then
        sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml
      fi
      # Copy the database TLS connection files to the expected location and set permissions
      if [ -d /config/ssl ]; then
        cp -r /config/ssl/ /registry/ssl
        chmod 700 /registry/ssl
        chmod 600 /registry/ssl/*.pem
      fi
      # Copy TLS certificates if present
      if [ -d /config/tls ]; then
        cp -r /config/tls/ /registry/tls
        chmod 700 /registry/tls
        chmod 600 /registry/tls/*
      fi
    migrations-config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
  


(root level)  (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry-db-connection-config
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    db-connection.env: |
      REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc"
      REGISTRY_DATABASE_PORT="5432"
      REGISTRY_DATABASE_NAME="gl-registry"
      REGISTRY_DATABASE_SSLMODE="disable"

(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-chart-info
    namespace: gitlab
    labels:
      app: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    gitlabChartVersion: "9.11.13"
    gitlabVersion: "18.11.12"

(root level)  (rbac.authorization.k8s.io/v1/ClusterRole/gitlab-gitlab-runner)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - create
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - resources:
    - pods/attach
    - pods/exec
    apiGroups:
    -
    verbs:
    - get
    - create
    - patch
    - delete
  - resources:
    - pods/log
    apiGroups:
    -
    verbs:
    - get
    - list
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - update
  - resources:
    - serviceaccounts
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - create
    - get

(root level)  (rbac.authorization.k8s.io/v1/ClusterRoleBinding/gitlab-gitlab-runner)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-gitlab-runner
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: gitlab-runner-access
    kind: ServiceAccount
    namespace: gitlab

(root level)  (v1/Service/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app: gitaly
      release: gitlab
    ports:
    - name: tcp-gitaly
      port: 8075
      targetPort: grpc-gitaly
    - name: http-metrics
      port: 9236
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-exporter
      release: gitlab
    ports:
    - name: http-metrics
      port: 9168
      protocol: TCP
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    annotations:
      tailscale.com/expose: "true"
      tailscale.com/hostname: gitlab-shell
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-shell
      release: gitlab
    ports:
    - name: ssh
      port: 22222
      protocol: TCP
      targetPort: 2222

(root level)  (v1/Service/gitlab/gitlab-kas)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: kas
      release: gitlab
    ports:
    - name: tcp-kas-external-api
      port: 8150
      protocol: TCP
      targetPort: 8150
    - name: tcp-kas-internal-api
      port: 8153
      protocol: TCP
      targetPort: 8153
    - name: tcp-kas-k8s-api
      port: 8154
      protocol: TCP
      targetPort: 8154
    - name: http-metrics
      port: 8151
      protocol: TCP
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: webservice
      gitlab.com/webservice-name: default
      release: gitlab
    ports:
    - name: http-webservice
      port: 8080
      protocol: TCP
      targetPort: http-webservice
    - name: http-workhorse
      port: 8181
      protocol: TCP
      targetPort: http-workhorse
    - name: http-metrics-ws
      port: 8083
      protocol: TCP
      targetPort: http-metrics-ws

(root level)  (v1/Service/gitlab/gitlab-redis-headless)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-headless
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)  (v1/Service/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    sessionAffinity: None
    selector:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)  (v1/Service/gitlab/gitlab-redis-metrics)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-metrics
    namespace: gitlab
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: http-metrics
      port: 9121
      protocol: TCP
      targetPort: metrics

(root level)  (v1/Service/gitlab/gitlab-registry)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: registry
      release: gitlab
    ports:
    - name: http-registry
      port: 5000
      protocol: TCP
      targetPort: http

(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-runner)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: gitlab-gitlab-runner
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_port: "9252"
          gitlab.com/prometheus_scrape: "true"
        labels:
          app: gitlab-gitlab-runner
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab-gitlab-runner
          image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2"
          imagePullPolicy: IfNotPresent
          resources: {}
          command:
          - /usr/bin/dumb-init
          - "--"
          - /bin/bash
          - /configmaps/entrypoint
          ports:
          - name: metrics
            containerPort: 9252
          volumeMounts:
          - name: projected-secrets
            mountPath: /secrets
          - name: etc-gitlab-runner
            mountPath: /home/gitlab-runner/.gitlab-runner
          - name: configmaps
            mountPath: /configmaps
          livenessProbe:
            exec:
              command:
              - /bin/bash
              - /configmaps/check-live
              - "3"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          readinessProbe:
            exec:
              command:
              - /usr/bin/pgrep
              - "gitlab.*runner"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
          env:
          - name: CI_SERVER_URL
            value: "https://code.nogweii.net"
          - name: RUNNER_EXECUTOR
            value: kubernetes
          - name: REGISTER_LOCKED
            value: "false"
          - name: RUNNER_TAG_LIST
            value:
          - name: KUBERNETES_NAMESPACE
            value: gitlab
          - name: CACHE_S3_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_access_key_id
          - name: CACHE_S3_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_secret_access_key
          - name: SESSION_SERVER_ADDRESS
            value: null
          lifecycle:
            preStop:
              exec:
                command:
                - /entrypoint
                - unregister
                - "--all-runners"
        securityContext:
          fsGroup: 65533
          runAsUser: 100
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-runner-access
        terminationGracePeriodSeconds: 3600
        volumes:
        - name: runner-secrets
          emptyDir:
            medium: Memory
        - name: etc-gitlab-runner
          emptyDir:
            medium: Memory
        - name: projected-secrets
          projected:
            sources:
            - secret:
                name: gitlab-gitlab-runner-secret
                items:
                - key: runner-registration-token
                  path: runner-registration-token
                - key: runner-token
                  path: runner-token
        - name: configmaps
          configMap:
            name: gitlab-gitlab-runner

(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: gitlab-exporter
        release: gitlab
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9168"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9168"
          prometheus.io/scrape: "true"
        labels:
          app: gitlab-exporter
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-exporter
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-exporter
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0"
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab-exporter/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitlab-exporter
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          ports:
          - name: http-metrics
            containerPort: 9168
          resources:
            requests:
              cpu: 75m
              memory: 100M
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb
            subPath: gitlab-exporter.yml.erb
          - name: gitlab-exporter-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          readinessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'gitlab-exporter'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /config
            readOnly: true
          - name: init-gitlab-exporter-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitlab-exporter-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: gitlab-exporter-config
          configMap:
            name: gitlab-gitlab-exporter
        - name: init-gitlab-exporter-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
        - name: gitlab-exporter-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: gitlab-shell
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-shell
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-shell
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitlab-shell
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab-shell
          - name: KEYS_DIRECTORY
            value: /etc/gitlab-secrets/ssh
          - name: SSH_DAEMON
            value: openssh
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          ports:
          - name: ssh
            containerPort: 2222
          readinessProbe:
            failureThreshold: 2
            initialDelaySeconds: 10
            periodSeconds: 5
            successThreshold: 1
            tcpSocket:
              port: 2222
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 0
              memory: 6M
          volumeMounts:
          - name: shell-config
            mountPath: /etc/gitlab-shell
          - name: shell-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: shell-config
            mountPath: /etc/krb5.conf
            readOnly: true
            subPath: krb5.conf
          - name: sshd-config
            mountPath: /etc/ssh/sshd_config
            readOnly: true
            subPath: sshd_config
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: shell-config
            mountPath: /config
            readOnly: true
          - name: shell-init-secrets
            mountPath: /init-config
            readOnly: true
          - name: shell-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: shell-config
          configMap:
            name: gitlab-gitlab-shell
        - name: sshd-config
          configMap:
            name: gitlab-gitlab-shell-sshd
        - name: shell-init-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitlab-shell-host-keys
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
        - name: shell-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-kas)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: kas
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8151"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8151"
          prometheus.io/scrape: "true"
        labels:
          app: kas
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: kas
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: kas
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12"
          args:
          - "--configuration-file=/etc/kas/config.yaml"
          env:
          - name: OWN_PRIVATE_API_HOST
            value: gitlab-kas.gitlab.svc
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8151
            initialDelaySeconds: 15
            periodSeconds: 20
          ports:
          - name: kas
            containerPort: 8150
          - name: kas-k8s-api
            containerPort: 8154
          - name: kas-private-api
            containerPort: 8155
          - name: http-metrics
            containerPort: 8151
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8151
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
          - name: init-etc-kas
            mountPath: /etc/kas
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65532
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 65532
          runAsGroup: 65532
          runAsUser: 65532
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 300
        volumes:
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
        - name: init-etc-kas
          projected:
            defaultMode: 288
            sources:
            - configMap:
                name: gitlab-kas
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: .gitlab_kas_secret
            - secret:
                name: gitlab-kas-private-api
                items:
                - key: kas_private_api_secret
                  path: .gitlab_kas_private_api_secret
            - secret:
                name: gitlab-kas-websocket-token
                items:
                - key: kas_websocket_token_secret
                  path: .gitlab_kas_websocket_token_secret
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      queue-pod-name: all-in-1
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "3807"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "3807"
          prometheus.io/scrape: "true"
        labels:
          app: sidekiq
          app.kubernetes.io/name: gitlab
          heritage: Helm
          queue-pod-name: all-in-1
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: sidekiq
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: sidekiq
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12"
          env:
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: GITLAB_SIDEKIQ_MAX_REPLICAS
            value: "10"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: SIDEKIQ_QUEUES
            value: null
          - name: SIDEKIQ_DAEMON_MEMORY_KILLER
            value: "1"
          - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL
            value: "3"
          - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS
            value: "2000000"
          - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME
            value: "900"
          - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT
            value: "30"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /liveness
              port: 3808
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-metrics
            containerPort: 3807
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readiness
              port: 3808
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 900m
              memory: 2G
          volumeMounts:
          - name: sidekiq-metrics
            mountPath: /metrics
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: sidekiq-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: sidekiq-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: sidekiq-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'sidekiq'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: sidekiq-config
            mountPath: /config
            readOnly: true
          - name: init-sidekiq-secrets
            mountPath: /init-config
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12"
          args:
          - /scripts/wait-for-deps
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: sidekiq-metrics
          emptyDir:
            medium: Memory
        - name: sidekiq-config
          projected:
            sources:
            - configMap:
                name: gitlab-sidekiq
        - name: init-sidekiq-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: sidekiq-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-toolbox)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: toolbox
        release: gitlab
    strategy:
      type: Recreate
      rollingUpdate: null
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: toolbox
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: toolbox
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12"
          args:
          - /bin/bash
          - "-c"
          - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done"
          env:
          - name: ARTIFACTS_BUCKET_NAME
            value: gitlab-artifacts
          - name: REGISTRY_BUCKET_NAME
            value: gitlab-container-registry
          - name: LFS_BUCKET_NAME
            value: gitlab-lfs
          - name: UPLOADS_BUCKET_NAME
            value: gitlab-uploads
          - name: PACKAGES_BUCKET_NAME
            value: gitlab-packages
          - name: EXTERNAL_DIFFS_BUCKET_NAME
            value: gitlab-external-diffs
          - name: TERRAFORM_STATE_BUCKET_NAME
            value: gitlab-terraform-state
          - name: CI_SECURE_FILES_BUCKET_NAME
            value: gitlab-ci-secure-files
          - name: BACKUP_BUCKET_NAME
            value: gitlab-backup
          - name: BACKUP_BACKEND
            value: s3
          - name: TMP_BUCKET_NAME
            value: gitlab-tmp-storage
          - name: PAGES_BUCKET_NAME
            value: gitlab-pages
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
              memory: 350M
          volumeMounts:
          - name: registry-db-config
            mountPath: /etc/gitlab/registry-db/
            readOnly: true
          - name: toolbox-config
            mountPath: /var/opt/gitlab/templates
          - name: toolbox-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: toolbox-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: toolbox-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: toolbox-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: toolbox-tmp
            mountPath: /srv/gitlab/tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: toolbox-config
            mountPath: /config
            readOnly: true
          - name: init-toolbox-secrets
            mountPath: /init-config
            readOnly: true
          - name: toolbox-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-db-config
          projected:
            defaultMode: 288
            sources:
            - configMap:
                name: gitlab-registry-db-connection-config
                optional: true
                items:
                - key: db-connection.env
                  path: connection.env
            - configMap:
                name: gitlab-toolbox-registry-db-backuprestore-users
                optional: true
                items:
                - key: backup-user
                  path: backup-user.env
                - key: restore-user
                  path: restore-user.env
            - secret:
                name: gitlab-toolbox-registry-database-password
                optional: true
                items:
                - key: backupPassword
                  path: backup-pass
                - key: restorePassword
                  path: restore-pass
        - name: toolbox-config
          projected:
            sources:
            - configMap:
                name: gitlab-toolbox
        - name: toolbox-tmp
          emptyDir: {}
        - name: init-toolbox-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: s3cmd.cfg
                  path: objectstorage/.s3cfg
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: toolbox-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      app.kubernetes.io/name: gitlab
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8083"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8083"
          prometheus.io/scrape: "true"
        labels:
          app: webservice
          app.kubernetes.io/name: gitlab
          gitlab.com/webservice-name: default
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: webservice
                    gitlab.com/webservice-name: default
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: webservice
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12"
          env:
          - name: TZ
            value: UTC
          - name: GITLAB_WEBSERVER
            value: puma
          - name: TMPDIR
            value: /tmp/gitlab
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: WORKER_PROCESSES
            value: "2"
          - name: WORKER_TIMEOUT
            value: "60"
          - name: INTERNAL_PORT
            value: "8080"
          - name: PUMA_THREADS_MIN
            value: "4"
          - name: PUMA_THREADS_MAX
            value: "4"
          - name: PUMA_WORKER_MAX_MEMORY
            value: 
          - name: DISABLE_PUMA_WORKER_KILLER
            value: "true"
          - name: BIND_IP6
            value: "false"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /-/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-webservice
            containerPort: 8080
          - name: http-metrics-ws
            containerPort: 8083
          readinessProbe:
            failureThreshold: 2
            httpGet:
              path: /-/readiness
              port: 8080
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 300m
              memory: 2.5G
          volumeMounts:
          - name: webservice-metrics
            mountPath: /metrics
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: webservice-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: webservice-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: webservice-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -SIGINT -o ruby"
        - name: gitlab-workhorse
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12"
          env:
          - name: TZ
            value: UTC
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TMPDIR
            value: /tmp/gitlab
          - name: GITLAB_WORKHORSE_AUTH_BACKEND
            value: "http://localhost:8080"
          - name: GITLAB_WORKHORSE_EXTRA_ARGS
            value: 
          - name: GITLAB_WORKHORSE_LISTEN_PORT
            value: "8181"
          - name: GITLAB_WORKHORSE_LOG_FORMAT
            value: json
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          ports:
          - name: http-workhorse
            containerPort: 8181
          resources:
            requests:
              cpu: 100m
              memory: 100M
          volumeMounts:
          - name: workhorse-config
            mountPath: /var/opt/gitlab/templates
          - name: workhorse-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          readinessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep $SHUTDOWN_BLACKOUT_SECONDS"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          args:
          - "-c"
          - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab"
          command:
          - sh
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: webservice-config
            mountPath: /config-webservice
            readOnly: true
          - name: workhorse-config
            mountPath: /config-workhorse
            readOnly: true
          - name: init-webservice-secrets
            mountPath: /init-config
            readOnly: true
          - name: webservice-secrets
            mountPath: /init-secrets
            readOnly: false
          - name: workhorse-secrets
            mountPath: /init-secrets-workhorse
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12"
          args:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "1"
          - name: ENABLE_BOOTSNAP
            value: "1"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: shared-tmp
          emptyDir: {}
        - name: webservice-metrics
          emptyDir:
            medium: Memory
        - name: webservice-config
          configMap:
            name: gitlab-webservice
        - name: workhorse-config
          configMap:
            name: gitlab-workhorse-default
        - name: init-webservice-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-workhorse-secret
                items:
                - key: shared_secret
                  path: gitlab-workhorse/secret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: webservice-secrets
          emptyDir:
            medium: Memory
        - name: workhorse-secrets
          emptyDir:
            medium: Memory
        - name: shared-upload-directory
          emptyDir: {}
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-registry)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: registry
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: registry
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: registry
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: registry
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab"
          env:
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 5000
          - name: debug
            containerPort: 5001
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep 5"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab"
          command:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.crt
                  path: certificate.crt
            - secret:
                name: gitlab-registry-httpsecret
                items:
                - key: secret
                  path: httpSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: registry.yaml
                  path: storage/config
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-gitlab-shell

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-kas)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-kas

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-sidekiq-all-in-1-v2)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 350m
    minReplicas: 1
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-sidekiq-all-in-1-v2

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 1
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-webservice-default

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-registry)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 75
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-registry

(root level)  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    podManagementPolicy: Parallel
    replicas: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab
    serviceName: gitlab-gitaly
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9236"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9236"
          prometheus.io/scrape: "true"
        labels:
          app: gitaly
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitaly
          image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitaly/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitaly
          - name: GITALY_CONFIG_FILE
            value: /etc/gitaly/config.toml
          - name: SSL_CERT_DIR
            value: /etc/ssl/certs
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          ports:
          - name: grpc-gitaly
            containerPort: 8075
          - name: http-metrics
            containerPort: 9236
          readinessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          startupProbe:
            failureThreshold: 60
            grpc:
              port: 8075
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: gitaly-config
            mountPath: /etc/gitaly/templates
          - name: gitaly-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: repo-data
            mountPath: /home/git/repositories
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitaly-config
            mountPath: /config
            readOnly: true
          - name: init-gitaly-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitaly-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
        terminationGracePeriodSeconds: 30
        volumes:
        - name: gitaly-config
          configMap:
            name: gitlab-gitaly
        - name: gitaly-secrets
          emptyDir:
            medium: Memory
        - name: init-gitaly-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly_token
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: .gitlab_shell_secret
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
    volumeClaimTemplates:
    - metadata:
        name: repo-data
        annotations: null
        labels:
          app: gitaly
          release: gitlab
      spec:
        resources:
          requests:
            storage: 50Gi
        selector: null
        storageClassName: nfs-subdir
        accessModes:
        - ReadWriteOnce
  


(root level)  (apps/v1/StatefulSet/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: master
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    serviceName: gitlab-redis-headless
    template:
      metadata:
        annotations:
          prometheus.io/port: "9121"
          prometheus.io/scrape: "true"
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: redis
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: master
                    app.kubernetes.io/instance: gitlab
                    app.kubernetes.io/name: redis
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: redis
          image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-master.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: REDIS_REPLICATION_MODE
            value: master
          - name: ALLOW_EMPTY_PASSWORD
            value: no
          - name: REDIS_PASSWORD_FILE
            value: /opt/bitnami/redis/secrets/redis-password
          - name: REDIS_TLS_ENABLED
            value: no
          - name: REDIS_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: redis-password
            mountPath: /opt/bitnami/redis/secrets/
          - name: redis-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/redis/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/redis/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        - name: metrics
          image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4"
          imagePullPolicy: IfNotPresent
          command:
          - /bin/bash
          - "-c"
          - |
            if [[ -f '/secrets/redis-password' ]]; then
            export REDIS_PASSWORD=$(cat /secrets/redis-password)
            fi
            redis_exporter

          env:
          - name: REDIS_ALIAS
            value: gitlab-redis
          - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
            value: ":9121"
          - name: REDIS_USER
            value: default
          livenessProbe:
            failureThreshold: 5
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: metrics
            timeoutSeconds: 5
          ports:
          - name: metrics
            containerPort: 9121
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: empty-dir
            mountPath: /tmp
            subPath: app-tmp-dir
          - name: redis-password
            mountPath: /secrets/
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: gitlab-redis-master
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: gitlab-redis-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: gitlab-redis-health
            defaultMode: 493
        - name: redis-password
          secret:
            items:
            - key: secret
              path: redis-password
            secretName: gitlab-redis-secret
        - name: config
          configMap:
            name: gitlab-redis-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: redis-data
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/name: redis
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-d559a5f)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-d559a5f
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-46dd770
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
- one document removed:
  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: gitlab-toolbox-backup
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    concurrencyPolicy: Replace
    failedJobsHistoryLimit: 1
    jobTemplate:
      spec:
        backoffLimit: 6
        template:
          metadata:
            annotations:
              cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
            labels:
              app: toolbox
              heritage: Helm
              release: gitlab
          spec:
            containers:
            - name: toolbox-backup
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12"
              args:
              - /bin/bash
              - "-c"
              - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts"
              env:
              - name: ARTIFACTS_BUCKET_NAME
                value: gitlab-artifacts
              - name: REGISTRY_BUCKET_NAME
                value: gitlab-container-registry
              - name: LFS_BUCKET_NAME
                value: gitlab-lfs
              - name: UPLOADS_BUCKET_NAME
                value: gitlab-uploads
              - name: PACKAGES_BUCKET_NAME
                value: gitlab-packages
              - name: EXTERNAL_DIFFS_BUCKET_NAME
                value: gitlab-external-diffs
              - name: TERRAFORM_STATE_BUCKET_NAME
                value: gitlab-terraform-state
              - name: CI_SECURE_FILES_BUCKET_NAME
                value: gitlab-ci-secure-files
              - name: BACKUP_BUCKET_NAME
                value: gitlab-backup
              - name: BACKUP_BACKEND
                value: s3
              - name: TMP_BUCKET_NAME
                value: gitlab-tmp-storage
              - name: PAGES_BUCKET_NAME
                value: gitlab-pages
              - name: CONFIG_TEMPLATE_DIRECTORY
                value: /var/opt/gitlab/templates
              - name: CONFIG_DIRECTORY
                value: /srv/gitlab/config
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
                  memory: 350M
              volumeMounts:
              - name: registry-db-config
                mountPath: /etc/gitlab/registry-db/
                readOnly: true
              - name: toolbox-config
                mountPath: /var/opt/gitlab/templates
              - name: toolbox-secrets
                mountPath: /etc/gitlab
                readOnly: true
              - name: toolbox-secrets
                mountPath: /srv/gitlab/config/secrets.yml
                subPath: rails-secrets/secrets.yml
              - name: toolbox-tmp
                mountPath: /srv/gitlab/tmp
                readOnly: false
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs/
                readOnly: true
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            initContainers:
            - name: certificates
              image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12"
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs
                readOnly: false
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: false
              - name: custom-ca-certificates
                mountPath: /usr/local/share/ca-certificates
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            - name: configure
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
              command:
              - sh
              - /config/configure
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: toolbox-config
                mountPath: /config
                readOnly: true
              - name: init-toolbox-secrets
                mountPath: /init-config
                readOnly: true
              - name: toolbox-secrets
                mountPath: /init-secrets
                readOnly: false
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            restartPolicy: OnFailure
            securityContext:
              fsGroup: 1000
              runAsGroup: 1000
              runAsUser: 1000
              seccompProfile:
                type: RuntimeDefault
            volumes:
            - name: registry-db-config
              projected:
                defaultMode: 288
                sources:
                - configMap:
                    name: gitlab-registry-db-connection-config
                    optional: true
                    items:
                    - key: db-connection.env
                      path: connection.env
                - configMap:
                    name: gitlab-toolbox-registry-db-backuprestore-users
                    optional: true
                    items:
                    - key: backup-user
                      path: backup-user.env
                    - key: restore-user
                      path: restore-user.env
                - secret:
                    name: gitlab-toolbox-registry-database-password
                    optional: true
                    items:
                    - key: backupPassword
                      path: backup-pass
                    - key: restorePassword
                      path: restore-pass
            - name: toolbox-config
              projected:
                sources:
                - configMap:
                    name: gitlab-toolbox
            - name: toolbox-tmp
              emptyDir: {}
            - name: init-toolbox-secrets
              projected:
                defaultMode: 256
                sources:
                - secret:
                    name: gitlab-rails-secret
                    items:
                    - key: secrets.yml
                      path: rails-secrets/secrets.yml
                - secret:
                    name: gitlab-gitlab-shell-secret
                    items:
                    - key: secret
                      path: shell/.gitlab_shell_secret
                - secret:
                    name: gitlab-gitaly-secret
                    items:
                    - key: token
                      path: gitaly/gitaly_token
                - secret:
                    name: gitlab-redis-secret
                    items:
                    - key: secret
                      path: redis/redis-password
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-ci
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-main
                - secret:
                    name: gitlab-registry-secret
                    items:
                    - key: registry-auth.key
                      path: registry/gitlab-registry.key
                - secret:
                    name: gitlab-registry-notification
                    items:
                    - key: secret
                      path: registry/notificationSecret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: s3cmd.cfg
                      path: objectstorage/.s3cfg
                - secret:
                    name: gitlab-gitlab-kas-secret
                    items:
                    - key: kas_shared_secret
                      path: kas/.gitlab_kas_secret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: connection.yaml
                      path: objectstorage/object_store
                - secret:
                    name: authentik-oidc
                    items:
                    - key: config.yaml
                      path: omniauth/authentik-oidc/config.yaml
            - name: toolbox-secrets
              emptyDir:
                medium: Memory
            - name: etc-ssl-certs
              emptyDir:
                medium: Memory
            - name: etc-pki-ca-trust-extracted-pem
              emptyDir:
                medium: Memory
            - name: custom-ca-certificates
              projected:
                defaultMode: 288
                sources:
                - secret:
                    name: aethernet.crt
                - secret:
                    name: gitlab-wildcard-tls-ca
    schedule: @daily
    startingDeadlineSeconds: null
    successfulJobsHistoryLimit: 3
    suspend: false
  


(root level)  (v1/ServiceAccount/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab

(root level)  (v1/ConfigMap/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-3"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    generate-secrets: |
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      env=production
      
      pushd $(mktemp -d)
      
      # Args pattern, length
      function gen_random(){
        head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2
      }
      
      # Args: length
      function gen_random_base64(){
        local len="$1"
        gen_random_bytes "$len" | base64 -w0
      }
      
      # Args: length
      function gen_random_bytes(){
        local len="$1"
        head -c "$len" /dev/urandom
      }
      
      # Args: yaml file, search path
      function fetch_rails_value(){
        local value=$(yq --prettyPrint --no-colors ".${2}" $1)
      
        # Don't return null values
        if [ "${value}" != "null" ]; then echo "${value}"; fi
      }
      
      # Args: secretname
      function label_secret(){
        local secret_name=$1
      # Remove application labels if they exist
        kubectl --namespace=$namespace label \
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
          secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
        local secret_args=( "${@:2}")
        local secret_name=$1
      
        if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then
          kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}
        else
          echo "secret \"$secret_name\" already exists."
      
          for arg in "${secret_args[@]}"; do
            local from=$(echo -n ${arg} | cut -d '=' -f1)
      
            if [ -z "${from##*literal*}" ]; then
              local key=$(echo -n ${arg} | cut -d '=' -f2)
              local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)
              local flags="--namespace=$namespace --allow-missing-template-keys=false"
      
              if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then
                echo "key \"${key}\" does not exist. patching it in."
      
                if [ "${desiredValue}" != "" ]; then
                  desiredValue=$(echo -n "${desiredValue}" | base64 -w 0)
                fi
      
                kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}"
              fi
            fi
          done
        fi
      
        label_secret $secret_name
      }
      
      # Initial root password
      generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      # Redis password
      generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      
      # Gitlab shell
      generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      # Gitaly secret
      generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      # Gitlab runner secret
      generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=""
      
      # GitLab Pages API secret
      
      
      # GitLab Pages auth secret for hashing cookie store when using access control
      
      
      # GitLab Pages OAuth secret
      
      
      # Gitlab-kas secret
      generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas private API secret
      generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas WebSocket Token secret
      generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72)
      
      
      
      
      
      
      
      
      # Registry certificates
      mkdir -p certs
      openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650
      generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt
      
      # config/secrets.yaml
      if [ -n "$env" ]; then
        rails_secret="gitlab-rails-secret"
      
        # Fetch the values from the existing secret if it exists
        if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then
          kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml
          secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base")
          otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base")
          db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base")
          openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key")
          encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base")
      
          active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key")
          active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key")
          active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt")
        fi;
      
        # Generate defaults for any unset secrets
        secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}"
        encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
      
        # 1. We set the following two keys as an array to support keys rotation.
        #    The last key in the array is always used to encrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21
        #    while all the keys are used (in the order they're defined) to decrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.
        #    This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that
        #    runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976
        # 2. We use the same method and length as Rails' defaults:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540
        active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}
      
        # Update the existing secret
        cat << EOF > rails-secrets.yml
      apiVersion: v1
      kind: Secret
      metadata:
        name: $rails_secret
      type: Opaque
      stringData:
        secrets.yml: |-
          $env:
            secret_key_base: $secret_key_base
            otp_key_base: $otp_key_base
            db_key_base: $db_key_base
            encrypted_settings_key_base: $encrypted_settings_key_base
            openid_connect_signing_key: |
      $(echo "${openid_connect_signing_key}" | awk '{print "        " $0}')
            active_record_encryption_primary_key:
              $active_record_encryption_primary_keys
            active_record_encryption_deterministic_key:
              $active_record_encryption_deterministic_keys
            active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt
      EOF
        kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml
        label_secret $rails_secret
      fi
      
      # Shell ssh host keys
      ssh-keygen -A
      mkdir -p host_keys
      cp /etc/ssh/ssh_host_* host_keys/
      generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys
      
      # Gitlab-workhorse secret
      generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Registry http.secret secret
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: before-hook-creation
      helm.sh/hook-weight: "-11"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    runcheck: |
      #!/bin/sh
      
      set -e
      
      notify() {
        echo "$1"
        echo -n "$1 " >> /dev/termination-log
      }
      
      greater_version()
      {
        test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1";
      }
      
      is_semver()
      {
        printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"
        return "$?"
      }
      
      # For the PostgreSQL upgrade, you either need both secrets, or no secrets.
      # If there are no secrets, we will create them for you.
      # If the secrets aren't in either of these states, we assume you are upgrading from an older version
      # This is running ahead of version checks to ensure this always runs. This is to account for
      # installations outside of the official helm repo.
      secrets_dir="/etc/secrets/postgresql"
      if [ -d "${secrets_dir}" ]; then
        if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then
          if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then
            notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart"
            notify "There are some manual steps which need to be performed in order to upgrade the database"
            notify "Please see the upgrade documentation for instructions on how to proceed:"
            notify "https://docs.gitlab.com/charts/installation/upgrade.html"
            exit 1
          fi
        fi
      fi
      MIN_VERSION=18.8
      CHART_MIN_VERSION=9.8
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      # Only run check for semver releases
      if ! is_semver "$GITLAB_VERSION"; then
        exit 0
      fi
      
      NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}')
      NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}')
      
      NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}')
      NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}')
      
      if [ ! -f /chart-info/gitlabVersion ]; then
        notify "It seems you are attempting an unsupported upgrade path."
        notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths"
        exit 1
      fi
      
      OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion)
      OLD_VERSION_STRING=${OLD_VERSION_STRING#v}
      OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion)
      
      # Skip check if old version wasn't semver
      if ! is_semver "$OLD_VERSION_STRING"; then
        exit 0
      fi
      
      OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}')
      OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}')
      OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}')
      OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}')
      
      # Checking Version
      if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then
        notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})."
        notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding."
        # Link to upgrade docs if it is a major version jump
        if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then
          notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html"
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  


(root level)  (rbac.authorization.k8s.io/v1/Role/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - get
    - list
    - create
    - patch

(root level)  (rbac.authorization.k8s.io/v1/RoleBinding/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-shared-secrets
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: gitlab-shared-secrets
    kind: ServiceAccount
    namespace: gitlab

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-28d9d92-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-10"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    backoffLimit: 2
    template:
      metadata:
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: run-check
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12"
          command:
          - /bin/sh
          - /scripts/runcheck
          env:
          - name: GITLAB_VERSION
            value: "18.11.12"
          - name: CHART_VERSION
            value: "9.11.13"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: chart-info
            mountPath: /chart-info
          - name: scripts
            mountPath: /scripts
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65534
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: chart-info
          configMap:
            name: gitlab-gitlab-chart-info
            optional: true
        - name: scripts
          configMap:
            name: gitlab-gitlab-upgrade-check
  


flate error: current snapshot: reconcile completed with 1 failure(s):
  HelmRelease/flux-system/gitlab: helm template flux-system/gitlab: execution error at (gitlab/templates/NOTES.txt:222:3): 
CONFIGURATION CHECKS:

redis:
  You must configure an Redis connetion. Please set `global.redis.host`. Since chart v10.0.0,
  external Redis became required. If you were using the bundled Redis chart refer to
  https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/.

Pipeline

## flate diff ``` (root level) (networking.k8s.io/v1/NetworkPolicy/gitlab/gitlab-redis) - one document removed: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: gitlab-redis namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 - ports: - port: 9121 podSelector: matchLabels: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis policyTypes: - Ingress - Egress (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitaly) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitaly release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitlab-shell release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-kas) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: kas release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-sidekiq-all-in-1-v1) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-sidekiq-all-in-1-v1 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-webservice-default) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-registry-v1) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-registry-v1 namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: registry release: gitlab (root level) (v1/ServiceAccount/gitlab/gitlab-runner-access) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-runner-access namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab (root level) (v1/ServiceAccount/gitlab/gitlab-redis-master) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-runner) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: check-live: | #!/bin/bash set -eou pipefail # default timeout is 3 seconds, can be overriden VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}} if ! /usr/bin/pgrep -f ".*register-the-runner" > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner" > /dev/null ; then exit 1 fi status=0 # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL) verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$? # timeout exit code is 143 with busybox, and 124 with coreutils if (( status == 143 )) || (( status == 124 )) ; then echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2 exit 0 elif (( status > 0 )) ; then exit ${status} fi grep -qE "is (alive|valid)" <<<"${verify_output}" config.template.toml: | [[runners]] [runners.kubernetes] image = "archlinux/archlinux:latest" namespace_per_job = true node_selector_overwrite_allowed = "kubernetes.io/arch=.*" pull_policy = ["always", "always"] [runners.kubernetes.node_selector] "kubernetes.io/arch" = "amd64" [runners.cache] Type = "s3" Path = "gitlab-runner" Shared = true [runners.cache.s3] ServerAddress = "brickyard.home.arpa:3900" BucketName = "gitlab-runner-cache" BucketLocation = "apartment" Insecure = true AuthenticationType = "access-key" PathStyle = true config.toml: | shutdown_timeout = 0 concurrent = 10 check_interval = 3 log_level = "info" entrypoint: | #!/bin/bash set -e export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/" mkdir -p ${CONFIG_PATH_FOR_INIT} cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT} # Set up environment variables for cache if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey) export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey) fi if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file" elif [[ -f /secrets/gcs-application-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file" else if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id) # echo -e used to make private key multiline (in google json auth key private key is oneline with \n) export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key)) fi fi if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name) export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key) fi if [[ -f /secrets/runner-registration-token ]]; then export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token) fi if [[ -f /secrets/runner-token ]]; then export CI_SERVER_TOKEN=$(cat /secrets/runner-token) fi # Register the runner if ! sh /configmaps/register-the-runner; then exit 1 fi # Run pre-entrypoint-script if ! bash /configmaps/pre-entrypoint-script; then exit 1 fi # Start the runner exec /entrypoint run \ --working-directory=/home/gitlab-runner pre-entrypoint-script: register-the-runner: | #!/bin/sh signal_handler() { if [ ! -d "/proc/$register_pid" ]; then wait $register_pid fi exit } trap 'signal_handler' QUIT INT MAX_REGISTER_ATTEMPTS=30 # Reset/unset the not needed flags when an authentication token RUN_UNTAGGED="" ACCESS_LEVEL="" if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then RUN_UNTAGGED="" ACCESS_LEVEL="" unset REGISTER_LOCKED unset RUNNER_TAG_LIST fi for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}" /entrypoint register \ ${RUN_UNTAGGED} \ ${ACCESS_LEVEL} \ --template-config /configmaps/config.template.toml \ --non-interactive & register_pid=$! wait $register_pid retval=$? if [ ${retval} = 0 ]; then break elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then exit 1 fi sleep 5 done (root level) (v1/ConfigMap/gitlab/gitlab-gitaly) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.toml.tpl: | # The directory where Gitaly's executables are stored bin_dir = "/usr/local/bin" # listen on a TCP socket. This is insecure (no authentication) listen_addr = ":8075" # Directory where internal sockets reside # note: no value will result in a `/tmp/gitlab-internal-*` path # internal_socket_dir = "/home/git" # If metrics collection is enabled, inform gitaly about that prometheus_listen_addr = ":9236" # Graceful shutdown timeout, how long to wait for in-flight requests to complete graceful_restart_timeout = "25s" # Storage configuration {% $storages := coll.Slice "default" %} {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %} {% $index := 0 %} {% if regexp.Match "^[0-9]+$" $hostid %} {% $index = conv.ToInt64 $hostid %} {% end %} {% if len $storages | lt $index %} [[storage]] name = "{% index $storages $index %}" path = "/home/git/repositories" {% else %} {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %} {% end %} [logging] format = "json" dir = "/var/log/gitaly" [auth] token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %} [git] use_bundled_binaries = true ignore_gitconfig = true [gitlab-shell] # The directory where gitlab-shell is installed dir = "/srv/gitlab-shell" [gitlab] # location of shared secret for GitLab Shell / API interaction secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret" # URL of API url = "http://gitlab-webservice-default.gitlab.svc:8181/" [gitlab.http-settings] # read_timeout = 300 # user = someone # password = somepass # ca_file = /etc/ssl/cert.pem # ca_path = /etc/pki/tls/certs [hooks] # directory containing custom hooks custom_hooks_dir = "/home/git/custom_hooks" configure: | set -e mkdir -p /init-secrets/gitaly /init-secrets/shell cp -v -r -L /init-config/.gitlab_shell_secret /init-secrets/shell/.gitlab_shell_secret cp -v -r -L /init-config/gitaly_token /init-secrets/gitaly/gitaly_token (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # optional for secret in redis redis-sentinel postgres gitlab-exporter ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets gitlab-exporter.yml.erb: | server: name: webrick listen_address: "*" listen_port: 9168 probes: db_common: &db_common methods: - probe_db opts: connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>' database: multiple: true ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common database_bloat: class_name: Database::BloatProber <<: *db_common sidekiq: &sidekiq methods: - probe_queues - probe_workers - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 redis_enable_client: false probe_non_namespaced: true ruby: &ruby methods: - probe_gc opts: quantiles: false metrics: multiple: true ruby: <<: *ruby sidekiq: <<: *sidekiq ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-shell-sshd) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell-sshd namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: sshd_config: | # $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. Port 2222 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH LogLevel ERROR # Authentication: PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes #AuthorizedPrincipalsFile none # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes #PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. #UsePAM no #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding no #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #PermitUserEnvironment no #Compression delayed ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no PidFile /srv/sshd/sshd.pid #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # override default of no subsystems # Subsystem sftp /usr/lib/ssh/sftp-server # the following are HPN related configuration options # tcp receive buffer polling. disable in non autotuning kernels #TcpRcvBufPoll yes # disable hpn performance boosts #HPNDisabled no # buffer size for hpn to non-hpn connections #HPNBufferSize 2048 # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysCommand /authorized_keys %u %k AuthorizedKeysCommandUser git PasswordAuthentication no AllowUsers git # Enable the use of Git protcol v2 AcceptEnv GIT_PROTOCOL # Hard disable all forwarding DisableForwarding yes # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. # See `man sshd_config(5)` MaxStartups 10:30:100 # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in LoginGraceTime 60 # Includes Include /etc/ssh/sshd_config.d/*.conf (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | # GitLab user. git by default user: git # Url to gitlab instance. Used for api calls. Should end with a slash. gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/" secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret # File used as authorized_keys for gitlab user auth_file: "/home/git/.ssh/authorized_keys" # Log file. # Default is gitlab-shell.log in the root directory. log_file: "/var/log/gitlab-shell/gitlab-shell.log" log_format: json # Audit usernames. # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but # incurs an extra API call on every gitlab-shell command. audit_usernames: false lfs: pure_ssh_protocol: false pat: enabled: true allowed_scopes: [] configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # END gitlab.scripts.configure.secrets mkdir -p /${secret_dir}/ssh cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/ chmod 0400 /${secret_dir}/ssh/ssh_host_* krb5.conf: (root level) (v1/ConfigMap/gitlab/gitlab-nginx-ingress-tcp) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-nginx-ingress-tcp namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: 22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:" (root level) (v1/ConfigMap/gitlab/gitlab-kas) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yaml: | agent: kubernetes_api: listen: address: :8154 url_path_prefix: /k8s-proxy websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret listen: address: :8150 websocket: true api: listen: address: :8153 authentication_secret_file: /etc/kas/.gitlab_kas_secret gitlab: address: http://gitlab-webservice-default.gitlab.svc:8181 authentication_secret_file: /etc/kas/.gitlab_kas_secret external_url: https://code.nogweii.net observability: listen: address: :8151 liveness_probe: url_path: /liveness readiness_probe: url_path: /readiness private_api: listen: address: :8155 authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret redis: database_index: 0 password_file: /etc/kas/redis/redis-password server: address: gitlab-redis-master.gitlab.svc:6379 (root level) (v1/ConfigMap/gitlab/gitlab-migrations) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-migrations namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in rails-secrets migrations gitaly ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true signup_enabled: false # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true gitaly: client_path: /home/git/gitaly/bin client_max_attempts: 4 client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 gravatar: plain_url: ssl_url: installation_type: | gitlab-helm-chart pages_redirect_uri: "https://projects.aether.page/auth" resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: (root level) (v1/ConfigMap/gitlab/gitlab-sidekiq) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-sidekiq namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin client_max_attempts: 4 client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" iam_auth_service: enabled: false secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret http: host: "" port: 0 grpc: host: "" port: 0 jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "127.0.0.0/8" - "::1/128" sidekiq_exporter: enabled: true address: "*" port: 3807 log_enabled: false sidekiq_health_checks: enabled: true address: "*" port: 3808 installation_type: | gitlab-helm-chart krb5.conf: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-toolbox) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets # Mount point for registry DB secrets. Needs to be pre-created as later the # volume is remounted read-only mkdir "/${secret_dir}/registry-db/" if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) secret_key = $(cat /init-secrets/minio/secretkey) bucket_location = us-east-1 host_base = minio.code.nogweii.net host_bucket = minio.code.nogweii.net/%(bucket) default_mime_type = binary/octet-stream enable_multipart = True multipart_max_chunks = 10000 multipart_chunk_size_mb = 128 recursive = True recv_chunk = 65536 send_chunk = 65536 server_side_encryption = False signature_v2 = True socket_timeout = 300 use_mime_magic = False verbosity = WARNING website_endpoint = https://minio.code.nogweii.net EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi configure-gsutil: | if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file # 2) Do not set permissions for key file # 3) GCP Project ID # 4) Decline anonymous usage statistics printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. printf '[GoogleCompute]\nservice_account = default\n' > ~/.boto fi database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin client_max_attempts: 4 client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" iam_auth_service: enabled: false secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret http: host: "" port: 0 grpc: host: "" port: 0 jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - 127.0.0.0/8 sidekiq_exporter: extra: krb5.conf: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-webservice) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_color_mode: default_syntax_highlighting_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: gitlab_docs: enabled: false host: "" sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin client_max_attempts: 4 client_max_backoff: "1.4s" token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" iam_auth_service: enabled: false secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret http: host: "" port: 0 grpc: host: "" port: 0 jwt_audience: "gitlab-rails" gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: secret_file: /etc/gitlab/gitlab-workhorse/secret git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "0.0.0.0/0" - "::/0" web_exporter: enabled: true address: "0.0.0.0" port: 8083 sidekiq_exporter: shutdown: blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %> rack_attack: git_basic_auth: ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> smartcard: enabled: false ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt' client_certificate_required_host: smartcard.code.nogweii.net client_certificate_required_port: 443 san_extensions: false required_for_git_access: false installation_type: | gitlab-helm-chart krb5.conf: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-workhorse-default) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-workhorse-default namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | set -e mkdir -p /init-secrets-workhorse/gitlab-workhorse cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret mkdir -p /init-secrets-workhorse/redis cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/ if [ -f /init-config/objectstorage/object_store ]; then mkdir -p /init-secrets-workhorse/objectstorage cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/ fi installation_type: | gitlab-helm-chart workhorse-config.toml.tpl: | shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} {%- $supported_providers := coll.Slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%} {%- end %} {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %} {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%} {%- end %} {%- if has $supported_providers $connection.provider %} [object_storage] provider = "{% $connection.provider %}" {%- if eq $connection.provider "AWS" %} {%- $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %} # AWS / S3 object storage configuration. [object_storage.s3] # access/secret can be blank! aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %} aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "AzureRM" %} {%- $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %} # Azure Blob storage configuration. [object_storage.azurerm] azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %} azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "Google" %} # Google storage configuration. [object_storage.google] {% $connection | coll.Omit "provider" | data.ToTOML %} {%- end %} {%- end %} [image_resizer] max_scaler_procs = 2 max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" (root level) (v1/ConfigMap/gitlab/gitlab-webservice-tests) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice-tests namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: test_login: | set -e echo 'Start Test' endpoint="https://code.nogweii.net" cookie_read="-c /tmp/test_login.cookie" cookie_readwrite="$cookie_read -b /tmp/test_login.cookie" signin_url="$endpoint/users/sign_in" echo "Login to create a session: $signin_url" csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*') curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)" profile_url="$endpoint/-/profile" echo "Confirm session valid: $profile_url" profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url) if [ "$profile_status" != "200" ]; then echo "Error: Session Invalid" cat /tmp/profile_output exit 1 fi echo 'Test Passed' exit 0 (root level) (v1/ConfigMap/gitlab/gitlab-redis-configuration) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-configuration namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: master.conf: | dir /data # User-supplied master configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of master configuration redis.conf: | # User-supplied common configuration: # Enable AOF https://redis.io/topics/persistence#append-only-file appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration (root level) (v1/ConfigMap/gitlab/gitlab-redis-health) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-health namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? exit $exit_status ping_liveness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? exit $exit_status ping_readiness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) (v1/ConfigMap/gitlab/gitlab-redis-scripts) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-scripts namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: start-master.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf fi if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf fi ARGS=("--port" "${REDIS_PORT}") ARGS+=("--requirepass" "${REDIS_PASSWORD}") ARGS+=("--masterauth" "${REDIS_PASSWORD}") ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") exec redis-server "${ARGS[@]}" (root level) (v1/ConfigMap/gitlab/gitlab-registry) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | version: 0.1 log: fields: service: registry level: info http: addr: :5000 # `host` is not configurable # `prefix` is not configurable debug: addr: :5001 prometheus: enabled: false path: /metrics draintimeout: 0 headers: X-Content-Type-Options: [nosniff] secret: "HTTP_SECRET" relativeurls: false health: storagedriver: enabled: false interval: 10s threshold: 3 auth: token: realm: https://code.nogweii.net/jwt/auth service: container_registry issuer: gitlab-issuer # This is provided from the initContainer execution, at a known path. rootcertbundle: /etc/docker/registry/certificate.crt autoredirect: false validation: disabled: true manifests: referencelimit: 0 payloadsizelimit: 0 urls: allow: deny: notifications: reporting: profiling: storage: maintenance: readonly: enabled: false uploadpurging: enabled: true age: 168h interval: 24h dryrun: false redirect: disable: true exceptions: middleware: database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable gc: disabled: false redis: rate_limiter: enabled: false configure: | if [ -e /config/accesskey ] ; then sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml fi # Place the `http.secret` value from the kubernetes secret sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml # Populate sensitive registry notification secrets in the config file if [ -d /config/notifications ]; then for i in /config/notifications/*; do filename=$(basename $i); sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml; done fi # Insert any provided `storage` block from kubernetes secret if [ -d /config/storage ]; then # Copy contents of storage secret(s) mkdir -p /registry/storage cp -v -r -L /config/storage/* /registry/storage/ # Ensure there is a new line in the end echo '' >> /registry/storage/config # Default `delete.enabled: true` if not present. ## Note: busybox grep doesn't support multiline, so we chain `egrep`. if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then echo 'delete:' >> /registry/storage/config echo ' enabled: true' >> /registry/storage/config fi # Indent /registry/storage/config 2 spaces before inserting into config.yml sed -i 's/^/ /' /registry/storage/config # Insert into /registry/config.yml after `storage:` sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml # Remove the now extraneous `config` file rm /registry/storage/config fi # Copy any middleware.storage if present if [ -d /config/middleware.storage ]; then cp -v -r -L /config/middleware.storage /registry/middleware.storage fi # Set to known path, to used ConfigMap cat /config/certificate.crt > /registry/certificate.crt # Copy the optional profiling keyfile to the expected location if [ -f /config/profiling-key.json ]; then cp /config/profiling-key.json /registry/profiling-key.json fi # Insert Database password, if enabled if [ -f /config/database_password ] ; then sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml fi # Insert Redis(cache) password, if enabled if [ -f /config/registry/redis-password ] ; then sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml fi # Insert Redis(rate-limiter) password, if enabled if [ -f /config/registry/redis-rateLimiting-password ] ; then sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml fi # Insert Redis(load balancing) password, if enabled if [ -f /config/registry/redis-loadBalancing-password ] ; then sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml fi # Copy the database TLS connection files to the expected location and set permissions if [ -d /config/ssl ]; then cp -r /config/ssl/ /registry/ssl chmod 700 /registry/ssl chmod 600 /registry/ssl/*.pem fi # Copy TLS certificates if present if [ -d /config/tls ]; then cp -r /config/tls/ /registry/tls chmod 700 /registry/tls chmod 600 /registry/tls/* fi migrations-config.yml.tpl: | version: 0.1 log: fields: service: registry level: info database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable (root level) (v1/ConfigMap/gitlab/gitlab-registry-db-connection-config) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry-db-connection-config namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: db-connection.env: | REGISTRY_DATABASE_HOST="db-gitlab-rw.gitlab.svc" REGISTRY_DATABASE_PORT="5432" REGISTRY_DATABASE_NAME="gl-registry" REGISTRY_DATABASE_SSLMODE="disable" (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-chart-info namespace: gitlab labels: app: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: gitlabChartVersion: "9.11.13" gitlabVersion: "18.11.12" (root level) (rbac.authorization.k8s.io/v1/ClusterRole/gitlab-gitlab-runner) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab rules: - resources: - events apiGroups: - verbs: - list - watch - resources: - namespaces apiGroups: - verbs: - create - delete - resources: - pods apiGroups: - verbs: - create - delete - get - list - watch - resources: - pods/attach - pods/exec apiGroups: - verbs: - get - create - patch - delete - resources: - pods/log apiGroups: - verbs: - get - list - resources: - secrets apiGroups: - verbs: - create - delete - get - update - resources: - serviceaccounts apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - create - get (root level) (rbac.authorization.k8s.io/v1/ClusterRoleBinding/gitlab-gitlab-runner) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab roleRef: name: gitlab-gitlab-runner apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: gitlab-runner-access kind: ServiceAccount namespace: gitlab (root level) (v1/Service/gitlab/gitlab-gitaly) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP clusterIP: None selector: app: gitaly release: gitlab ports: - name: tcp-gitaly port: 8075 targetPort: grpc-gitaly - name: http-metrics port: 9236 targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-exporter release: gitlab ports: - name: http-metrics port: 9168 protocol: TCP targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-shell namespace: gitlab annotations: tailscale.com/expose: "true" tailscale.com/hostname: gitlab-shell labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-shell release: gitlab ports: - name: ssh port: 22222 protocol: TCP targetPort: 2222 (root level) (v1/Service/gitlab/gitlab-kas) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: kas release: gitlab ports: - name: tcp-kas-external-api port: 8150 protocol: TCP targetPort: 8150 - name: tcp-kas-internal-api port: 8153 protocol: TCP targetPort: 8153 - name: tcp-kas-k8s-api port: 8154 protocol: TCP targetPort: 8154 - name: http-metrics port: 8151 protocol: TCP targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-webservice-default) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: webservice gitlab.com/webservice-name: default release: gitlab ports: - name: http-webservice port: 8080 protocol: TCP targetPort: http-webservice - name: http-workhorse port: 8181 protocol: TCP targetPort: http-workhorse - name: http-metrics-ws port: 8083 protocol: TCP targetPort: http-metrics-ws (root level) (v1/Service/gitlab/gitlab-redis-headless) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-headless namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis port: 6379 targetPort: redis (root level) (v1/Service/gitlab/gitlab-redis-master) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster sessionAffinity: None selector: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) (v1/Service/gitlab/gitlab-redis-metrics) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-metrics namespace: gitlab labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: http-metrics port: 9121 protocol: TCP targetPort: metrics (root level) (v1/Service/gitlab/gitlab-registry) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: registry release: gitlab ports: - name: http-registry port: 5000 protocol: TCP targetPort: http (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-runner) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: revisionHistoryLimit: 10 selector: matchLabels: app: gitlab-gitlab-runner template: metadata: annotations: gitlab.com/prometheus_port: "9252" gitlab.com/prometheus_scrape: "true" labels: app: gitlab-gitlab-runner heritage: Helm release: gitlab spec: containers: - name: gitlab-gitlab-runner image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.11.2" imagePullPolicy: IfNotPresent resources: {} command: - /usr/bin/dumb-init - "--" - /bin/bash - /configmaps/entrypoint ports: - name: metrics containerPort: 9252 volumeMounts: - name: projected-secrets mountPath: /secrets - name: etc-gitlab-runner mountPath: /home/gitlab-runner/.gitlab-runner - name: configmaps mountPath: /configmaps livenessProbe: exec: command: - /bin/bash - /configmaps/check-live - "3" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 readinessProbe: exec: command: - /usr/bin/pgrep - "gitlab.*runner" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: false runAsNonRoot: true env: - name: CI_SERVER_URL value: "https://code.nogweii.net" - name: RUNNER_EXECUTOR value: kubernetes - name: REGISTER_LOCKED value: "false" - name: RUNNER_TAG_LIST value: - name: KUBERNETES_NAMESPACE value: gitlab - name: CACHE_S3_ACCESS_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_access_key_id - name: CACHE_S3_SECRET_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_secret_access_key - name: SESSION_SERVER_ADDRESS value: null lifecycle: preStop: exec: command: - /entrypoint - unregister - "--all-runners" securityContext: fsGroup: 65533 runAsUser: 100 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-runner-access terminationGracePeriodSeconds: 3600 volumes: - name: runner-secrets emptyDir: medium: Memory - name: etc-gitlab-runner emptyDir: medium: Memory - name: projected-secrets projected: sources: - secret: name: gitlab-gitlab-runner-secret items: - key: runner-registration-token path: runner-registration-token - key: runner-token path: runner-token - name: configmaps configMap: name: gitlab-gitlab-runner (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: gitlab-exporter release: gitlab template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9168" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9168" prometheus.io/scrape: "true" labels: app: gitlab-exporter app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-exporter release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-exporter image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.7.0" env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab-exporter/templates - name: CONFIG_DIRECTORY value: /etc/gitlab-exporter - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" ports: - name: http-metrics containerPort: 9168 resources: requests: cpu: 75m memory: 100M volumeMounts: - name: gitlab-exporter-config mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb subPath: gitlab-exporter.yml.erb - name: gitlab-exporter-secrets mountPath: /etc/gitlab readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - pgrep - "-f" - gitlab-exporter readinessProbe: exec: command: - pgrep - "-f" - gitlab-exporter securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'gitlab-exporter'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: gitlab-exporter-config mountPath: /config readOnly: true - name: init-gitlab-exporter-secrets mountPath: /init-config readOnly: true - name: gitlab-exporter-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: gitlab-exporter-config configMap: name: gitlab-gitlab-exporter - name: init-gitlab-exporter-secrets projected: defaultMode: 256 sources: - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - name: gitlab-exporter-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: gitlab-shell release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: gitlab-shell app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-shell release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-shell image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.50.0" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitlab-shell - name: CONFIG_DIRECTORY value: /srv/gitlab-shell - name: KEYS_DIRECTORY value: /etc/gitlab-secrets/ssh - name: SSH_DAEMON value: openssh - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC ports: - name: ssh containerPort: 2222 readinessProbe: failureThreshold: 2 initialDelaySeconds: 10 periodSeconds: 5 successThreshold: 1 tcpSocket: port: 2222 timeoutSeconds: 3 resources: requests: cpu: 0 memory: 6M volumeMounts: - name: shell-config mountPath: /etc/gitlab-shell - name: shell-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: shell-config mountPath: /etc/krb5.conf readOnly: true subPath: krb5.conf - name: sshd-config mountPath: /etc/ssh/sshd_config readOnly: true subPath: sshd_config - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: shell-config mountPath: /config readOnly: true - name: shell-init-secrets mountPath: /init-config readOnly: true - name: shell-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: shell-config configMap: name: gitlab-gitlab-shell - name: sshd-config configMap: name: gitlab-gitlab-shell-sshd - name: shell-init-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitlab-shell-host-keys - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - name: shell-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-kas) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-kas namespace: gitlab labels: app: kas app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: kas release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8151" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8151" prometheus.io/scrape: "true" labels: app: kas app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: kas release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: kas image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.11.12" args: - "--configuration-file=/etc/kas/config.yaml" env: - name: OWN_PRIVATE_API_HOST value: gitlab-kas.gitlab.svc - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: httpGet: path: /liveness port: 8151 initialDelaySeconds: 15 periodSeconds: 20 ports: - name: kas containerPort: 8150 - name: kas-k8s-api containerPort: 8154 - name: kas-private-api containerPort: 8155 - name: http-metrics containerPort: 8151 readinessProbe: httpGet: path: /readiness port: 8151 initialDelaySeconds: 5 periodSeconds: 10 resources: requests: cpu: 100m memory: 256Mi volumeMounts: - name: init-etc-kas mountPath: /etc/kas readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65532 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 65532 runAsGroup: 65532 runAsUser: 65532 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 300 volumes: - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca - name: init-etc-kas projected: defaultMode: 288 sources: - configMap: name: gitlab-kas - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: .gitlab_kas_secret - secret: name: gitlab-kas-private-api items: - key: kas_private_api_secret path: .gitlab_kas_private_api_secret - secret: name: gitlab-kas-websocket-token items: - key: kas_websocket_token_secret path: .gitlab_kas_websocket_token_secret - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password (root level) (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "3807" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "3807" prometheus.io/scrape: "true" labels: app: sidekiq app.kubernetes.io/name: gitlab heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: sidekiq release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: sidekiq image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12" env: - name: prometheus_multiproc_dir value: /metrics - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: GITLAB_SIDEKIQ_MAX_REPLICAS value: "10" - name: SIDEKIQ_TIMEOUT value: "25" - name: SIDEKIQ_QUEUES value: null - name: SIDEKIQ_DAEMON_MEMORY_KILLER value: "1" - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL value: "3" - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS value: "2000000" - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME value: "900" - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT value: "30" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /liveness port: 3808 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-metrics containerPort: 3807 readinessProbe: failureThreshold: 3 httpGet: path: /readiness port: 3808 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 900m memory: 2G volumeMounts: - name: sidekiq-metrics mountPath: /metrics - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: sidekiq-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: sidekiq-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: sidekiq-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'sidekiq'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: sidekiq-config mountPath: /config readOnly: true - name: init-sidekiq-secrets mountPath: /init-config readOnly: true - name: sidekiq-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.11.12" args: - /scripts/wait-for-deps env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: sidekiq-metrics emptyDir: medium: Memory - name: sidekiq-config projected: sources: - configMap: name: gitlab-sidekiq - name: init-sidekiq-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: sidekiq-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-toolbox) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: toolbox release: gitlab strategy: type: Recreate rollingUpdate: null template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: toolbox app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: toolbox image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12" args: - /bin/bash - "-c" - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: ENABLE_BOOTSNAP value: "1" - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: toolbox-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-webservice-default) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8083" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8083" prometheus.io/scrape: "true" labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: webservice image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12" env: - name: TZ value: UTC - name: GITLAB_WEBSERVER value: puma - name: TMPDIR value: /tmp/gitlab - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: prometheus_multiproc_dir value: /metrics - name: ENABLE_BOOTSNAP value: "1" - name: WORKER_PROCESSES value: "2" - name: WORKER_TIMEOUT value: "60" - name: INTERNAL_PORT value: "8080" - name: PUMA_THREADS_MIN value: "4" - name: PUMA_THREADS_MAX value: "4" - name: PUMA_WORKER_MAX_MEMORY value: - name: DISABLE_PUMA_WORKER_KILLER value: "true" - name: BIND_IP6 value: "false" - name: PUMA_CONTROL_PORT value: "9293" - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /-/liveness port: 8080 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-webservice containerPort: 8080 - name: http-metrics-ws containerPort: 8083 readinessProbe: failureThreshold: 2 httpGet: path: /-/readiness port: 8080 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 300m memory: 2.5G volumeMounts: - name: webservice-metrics mountPath: /metrics - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: webservice-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: webservice-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: webservice-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -SIGINT -o ruby" - name: gitlab-workhorse image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.11.12" env: - name: TZ value: UTC - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TMPDIR value: /tmp/gitlab - name: GITLAB_WORKHORSE_AUTH_BACKEND value: "http://localhost:8080" - name: GITLAB_WORKHORSE_EXTRA_ARGS value: - name: GITLAB_WORKHORSE_LISTEN_PORT value: "8181" - name: GITLAB_WORKHORSE_LOG_FORMAT value: json - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: PUMA_CONTROL_PORT value: "9293" ports: - name: http-workhorse containerPort: 8181 resources: requests: cpu: 100m memory: 100M volumeMounts: - name: workhorse-config mountPath: /var/opt/gitlab/templates - name: workhorse-secrets mountPath: /etc/gitlab readOnly: true - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 readinessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep $SHUTDOWN_BLACKOUT_SECONDS" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" args: - "-c" - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab" command: - sh env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: webservice-config mountPath: /config-webservice readOnly: true - name: workhorse-config mountPath: /config-workhorse readOnly: true - name: init-webservice-secrets mountPath: /init-config readOnly: true - name: webservice-secrets mountPath: /init-secrets readOnly: false - name: workhorse-secrets mountPath: /init-secrets-workhorse readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.11.12" args: - /scripts/wait-for-deps env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "1" - name: ENABLE_BOOTSNAP value: "1" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: shared-tmp emptyDir: {} - name: webservice-metrics emptyDir: medium: Memory - name: webservice-config configMap: name: gitlab-webservice - name: workhorse-config configMap: name: gitlab-workhorse-default - name: init-webservice-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-workhorse-secret items: - key: shared_secret path: gitlab-workhorse/secret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: webservice-secrets emptyDir: medium: Memory - name: workhorse-secrets emptyDir: medium: Memory - name: shared-upload-directory emptyDir: {} - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-registry) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-registry namespace: gitlab labels: app: registry app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: registry release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: registry app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: registry release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: registry image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab" env: - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 5000 - name: debug containerPort: 5001 readinessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep 5" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab" command: - /scripts/wait-for-deps env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry - secret: name: gitlab-registry-secret items: - key: registry-auth.crt path: certificate.crt - secret: name: gitlab-registry-httpsecret items: - key: secret path: httpSecret - secret: name: gitlab-object-store-configs items: - key: registry.yaml path: storage/config - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-gitlab-shell (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-kas) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-kas (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-sidekiq-all-in-1-v2) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 350m minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-sidekiq-all-in-1-v2 (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-webservice-default) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 1 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-webservice-default (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-registry) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageUtilization: 75 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-registry (root level) (apps/v1/StatefulSet/gitlab/gitlab-gitaly) - one document removed: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: podManagementPolicy: Parallel replicas: 1 selector: matchLabels: app: gitaly release: gitlab serviceName: gitlab-gitaly template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9236" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9236" prometheus.io/scrape: "true" labels: app: gitaly app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitaly image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.11.12" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitaly/templates - name: CONFIG_DIRECTORY value: /etc/gitaly - name: GITALY_CONFIG_FILE value: /etc/gitaly/config.toml - name: SSL_CERT_DIR value: /etc/ssl/certs - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 ports: - name: grpc-gitaly containerPort: 8075 - name: http-metrics containerPort: 9236 readinessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 3 resources: requests: cpu: 100m memory: 200Mi startupProbe: failureThreshold: 60 grpc: port: 8075 initialDelaySeconds: 1 periodSeconds: 1 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: gitaly-config mountPath: /etc/gitaly/templates - name: gitaly-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: repo-data mountPath: /home/git/repositories securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: gitaly-config mountPath: /config readOnly: true - name: init-gitaly-secrets mountPath: /init-config readOnly: true - name: gitaly-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 terminationGracePeriodSeconds: 30 volumes: - name: gitaly-config configMap: name: gitlab-gitaly - name: gitaly-secrets emptyDir: medium: Memory - name: init-gitaly-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly_token - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: .gitlab_shell_secret - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca volumeClaimTemplates: - metadata: name: repo-data annotations: null labels: app: gitaly release: gitlab spec: resources: requests: storage: 50Gi selector: null storageClassName: nfs-subdir accessModes: - ReadWriteOnce (root level) (apps/v1/StatefulSet/gitlab/gitlab-redis-master) - one document removed: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis serviceName: gitlab-redis-headless template: metadata: annotations: prometheus.io/port: "9121" prometheus.io/scrape: "true" labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: redis image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-master.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: REDIS_REPLICATION_MODE value: master - name: ALLOW_EMPTY_PASSWORD value: no - name: REDIS_PASSWORD_FILE value: /opt/bitnami/redis/secrets/redis-password - name: REDIS_TLS_ENABLED value: no - name: REDIS_PORT value: "6379" ports: - name: redis containerPort: 6379 volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: redis-password mountPath: /opt/bitnami/redis/secrets/ - name: redis-data mountPath: /data - name: config mountPath: /opt/bitnami/redis/mounted-etc - name: empty-dir mountPath: /opt/bitnami/redis/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault - name: metrics image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4" imagePullPolicy: IfNotPresent command: - /bin/bash - "-c" - | if [[ -f '/secrets/redis-password' ]]; then export REDIS_PASSWORD=$(cat /secrets/redis-password) fi redis_exporter env: - name: REDIS_ALIAS value: gitlab-redis - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS value: ":9121" - name: REDIS_USER value: default livenessProbe: failureThreshold: 5 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 tcpSocket: port: metrics timeoutSeconds: 5 ports: - name: metrics containerPort: 9121 readinessProbe: failureThreshold: 3 httpGet: path: / port: metrics initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: empty-dir mountPath: /tmp subPath: app-tmp-dir - name: redis-password mountPath: /secrets/ securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: gitlab-redis-master terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: gitlab-redis-scripts defaultMode: 493 - name: health configMap: name: gitlab-redis-health defaultMode: 493 - name: redis-password secret: items: - key: secret path: redis-password secretName: gitlab-redis-secret - name: config configMap: name: gitlab-redis-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redis-data labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) (batch/v1/Job/gitlab/gitlab-migrations-d559a5f) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-d559a5f namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-46dd770) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-46dd770 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.39.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) - one document removed: apiVersion: batch/v1beta1 kind: CronJob metadata: name: gitlab-toolbox-backup namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: concurrencyPolicy: Replace failedJobsHistoryLimit: 1 jobTemplate: spec: backoffLimit: 6 template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "false" labels: app: toolbox heritage: Helm release: gitlab spec: containers: - name: toolbox-backup image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.11.12" args: - /bin/bash - "-c" - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: registry-db-config mountPath: /etc/gitlab/registry-db/ readOnly: true - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.11.12" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-db-config projected: defaultMode: 288 sources: - configMap: name: gitlab-registry-db-connection-config optional: true items: - key: db-connection.env path: connection.env - configMap: name: gitlab-toolbox-registry-db-backuprestore-users optional: true items: - key: backup-user path: backup-user.env - key: restore-user path: restore-user.env - secret: name: gitlab-toolbox-registry-database-password optional: true items: - key: backupPassword path: backup-pass - key: restorePassword path: restore-pass - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca schedule: @daily startingDeadlineSeconds: null successfulJobsHistoryLimit: 3 suspend: false (root level) (v1/ServiceAccount/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: gitlab heritage: Helm release: gitlab (root level) (v1/ConfigMap/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-3" labels: app: gitlab heritage: Helm release: gitlab data: generate-secrets: | # vim: set filetype=sh: namespace=gitlab release=gitlab env=production pushd $(mktemp -d) # Args pattern, length function gen_random(){ head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2 } # Args: length function gen_random_base64(){ local len="$1" gen_random_bytes "$len" | base64 -w0 } # Args: length function gen_random_bytes(){ local len="$1" head -c "$len" /dev/urandom } # Args: yaml file, search path function fetch_rails_value(){ local value=$(yq --prettyPrint --no-colors ".${2}" $1) # Don't return null values if [ "${value}" != "null" ]; then echo "${value}"; fi } # Args: secretname function label_secret(){ local secret_name=$1 # Remove application labels if they exist kubectl --namespace=$namespace label \ secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ secret $secret_name app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ local secret_args=( "${@:2}") local secret_name=$1 if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]} else echo "secret \"$secret_name\" already exists." for arg in "${secret_args[@]}"; do local from=$(echo -n ${arg} | cut -d '=' -f1) if [ -z "${from##*literal*}" ]; then local key=$(echo -n ${arg} | cut -d '=' -f2) local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-) local flags="--namespace=$namespace --allow-missing-template-keys=false" if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then echo "key \"${key}\" does not exist. patching it in." if [ "${desiredValue}" != "" ]; then desiredValue=$(echo -n "${desiredValue}" | base64 -w 0) fi kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}" fi fi done fi label_secret $secret_name } # Initial root password generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64) # Redis password generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab shell generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitaly secret generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab runner secret generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token="" # GitLab Pages API secret # GitLab Pages auth secret for hashing cookie store when using access control # GitLab Pages OAuth secret # Gitlab-kas secret generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas private API secret generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas WebSocket Token secret generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72) # Registry certificates mkdir -p certs openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650 generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt # config/secrets.yaml if [ -n "$env" ]; then rails_secret="gitlab-rails-secret" # Fetch the values from the existing secret if it exists if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base") otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base") db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base") openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key") encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base") active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key") active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key") active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt") fi; # Generate defaults for any unset secrets secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}" encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) # 1. We set the following two keys as an array to support keys rotation. # The last key in the array is always used to encrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21 # while all the keys are used (in the order they're defined) to decrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26. # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976 # 2. We use the same method and length as Rails' defaults: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540 active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)} # Update the existing secret cat << EOF > rails-secrets.yml apiVersion: v1 kind: Secret metadata: name: $rails_secret type: Opaque stringData: secrets.yml: |- $env: secret_key_base: $secret_key_base otp_key_base: $otp_key_base db_key_base: $db_key_base encrypted_settings_key_base: $encrypted_settings_key_base openid_connect_signing_key: | $(echo "${openid_connect_signing_key}" | awk '{print " " $0}') active_record_encryption_primary_key: $active_record_encryption_primary_keys active_record_encryption_deterministic_key: $active_record_encryption_deterministic_keys active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt EOF kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml label_secret $rails_secret fi # Shell ssh host keys ssh-keygen -A mkdir -p host_keys cp /etc/ssh/ssh_host_* host_keys/ generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys # Gitlab-workhorse secret generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Registry http.secret secret generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation helm.sh/hook-weight: "-11" labels: app: gitlab heritage: Helm release: gitlab data: runcheck: | #!/bin/sh set -e notify() { echo "$1" echo -n "$1 " >> /dev/termination-log } greater_version() { test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1"; } is_semver() { printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" return "$?" } # For the PostgreSQL upgrade, you either need both secrets, or no secrets. # If there are no secrets, we will create them for you. # If the secrets aren't in either of these states, we assume you are upgrading from an older version # This is running ahead of version checks to ensure this always runs. This is to account for # installations outside of the official helm repo. secrets_dir="/etc/secrets/postgresql" if [ -d "${secrets_dir}" ]; then if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart" notify "There are some manual steps which need to be performed in order to upgrade the database" notify "Please see the upgrade documentation for instructions on how to proceed:" notify "https://docs.gitlab.com/charts/installation/upgrade.html" exit 1 fi fi fi MIN_VERSION=18.8 CHART_MIN_VERSION=9.8 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} # Only run check for semver releases if ! is_semver "$GITLAB_VERSION"; then exit 0 fi NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}') NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}') NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}') NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}') if [ ! -f /chart-info/gitlabVersion ]; then notify "It seems you are attempting an unsupported upgrade path." notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths" exit 1 fi OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion) OLD_VERSION_STRING=${OLD_VERSION_STRING#v} OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion) # Skip check if old version wasn't semver if ! is_semver "$OLD_VERSION_STRING"; then exit 0 fi OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}') OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}') OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}') OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}') # Checking Version if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})." notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding." # Link to upgrade docs if it is a major version jump if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html" notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi (root level) (rbac.authorization.k8s.io/v1/Role/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab rules: - resources: - secrets apiGroups: - verbs: - get - list - create - patch (root level) (rbac.authorization.k8s.io/v1/RoleBinding/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab roleRef: name: gitlab-shared-secrets apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: gitlab-shared-secrets kind: ServiceAccount namespace: gitlab (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-28d9d92-selfsign) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-28d9d92-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.11.12" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.11.13 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.11.12" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-10" labels: app: gitlab heritage: Helm release: gitlab spec: backoffLimit: 2 template: metadata: labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: run-check image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.11.12" command: - /bin/sh - /scripts/runcheck env: - name: GITLAB_VERSION value: "18.11.12" - name: CHART_VERSION value: "9.11.13" resources: requests: cpu: 50m volumeMounts: - name: chart-info mountPath: /chart-info - name: scripts mountPath: /scripts securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65534 restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault volumes: - name: chart-info configMap: name: gitlab-gitlab-chart-info optional: true - name: scripts configMap: name: gitlab-gitlab-upgrade-check flate error: current snapshot: reconcile completed with 1 failure(s): HelmRelease/flux-system/gitlab: helm template flux-system/gitlab: execution error at (gitlab/templates/NOTES.txt:222:3): CONFIGURATION CHECKS: redis: You must configure an Redis connetion. Please set `global.redis.host`. Since chart v10.0.0, external Redis became required. If you were using the bundled Redis chart refer to https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/. ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/379)

renovate-bot force-pushed renovate/gitlab-10.x from e40c25aa15

ci/crow/pr/tanka-diff Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline failed

Details

to ef4449401c

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-12 06:12:51 +00:00

Compare

ci-bot commented

2026-10-12 06:16:42 +00:00

Member

flate diff

(root level)  (networking.k8s.io/v1/NetworkPolicy/gitlab/gitlab-redis)
- one document removed:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: gitlab-redis
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    - ports:
      - port: 9121
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    policyTypes:
    - Ingress
    - Egress

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-kas)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: kas
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-sidekiq-all-in-1-v1)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-sidekiq-all-in-1-v1
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-registry-v1)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-registry-v1
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: registry
        release: gitlab

(root level)  (v1/ServiceAccount/gitlab/gitlab-runner-access)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-runner-access
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab

(root level)  (v1/ServiceAccount/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-runner)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    check-live: |
      #!/bin/bash
      set -eou pipefail
      
      # default timeout is 3 seconds, can be overriden
      VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}}
      
      if ! /usr/bin/pgrep -f ".*register-the-runner"  > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner"  > /dev/null ; then
        exit 1
      fi
      
      status=0
      # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL)
      verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$?
      
      # timeout exit code is 143 with busybox, and 124 with coreutils
      if (( status == 143 )) || (( status == 124 )) ; then
        echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2
        exit 0
      elif (( status > 0 )) ; then
        exit ${status}
      fi
      
      grep -qE "is (alive|valid)" <<<"${verify_output}"
      
    config.template.toml: |
      [[runners]]
        [runners.kubernetes]
        image = "archlinux/archlinux:latest"
        namespace_per_job = true
        node_selector_overwrite_allowed = "kubernetes.io/arch=.*"
        pull_policy = ["always", "always"]
      
        [runners.kubernetes.node_selector]
        "kubernetes.io/arch" = "amd64"
      
        [runners.cache]
          Type = "s3"
          Path = "gitlab-runner"
          Shared = true
          [runners.cache.s3]
            ServerAddress = "brickyard.home.arpa:3900"
            BucketName = "gitlab-runner-cache"
            BucketLocation = "apartment"
            Insecure = true
            AuthenticationType = "access-key"
            PathStyle = true
      
    config.toml: |
      shutdown_timeout = 0
      concurrent = 10
      check_interval = 3
      log_level = "info"
      
    entrypoint: |
      #!/bin/bash
      set -e
      
      export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/"
      mkdir -p ${CONFIG_PATH_FOR_INIT}
      cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT}
      
      # Set up environment variables for cache
      if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
        export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
        export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
      fi
      
      if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
      elif [[ -f /secrets/gcs-application-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
      else
        if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
          export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
          # echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
          export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
        fi
      fi
      
      if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
        export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
        export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
      fi
      
      if [[ -f /secrets/runner-registration-token ]]; then
        export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
      fi
      
      if [[ -f /secrets/runner-token ]]; then
        export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
      fi
      
      # Register the runner
      if ! sh /configmaps/register-the-runner; then
        exit 1
      fi
      
      # Run pre-entrypoint-script
      if ! bash /configmaps/pre-entrypoint-script; then
        exit 1
      fi
      
      # Start the runner
      exec /entrypoint run \
        --working-directory=/home/gitlab-runner
      
    pre-entrypoint-script: 
    register-the-runner: |
      #!/bin/sh
      signal_handler() {
        if [ ! -d "/proc/$register_pid" ]; then
          wait $register_pid
        fi
        exit
      }
      trap 'signal_handler' QUIT INT
      
      MAX_REGISTER_ATTEMPTS=30
      
      # Reset/unset the not needed flags when an authentication token
      RUN_UNTAGGED=""
      ACCESS_LEVEL=""
      
      if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then
        RUN_UNTAGGED=""
        ACCESS_LEVEL=""
        unset REGISTER_LOCKED
        unset RUNNER_TAG_LIST
      fi
      
      for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
        echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
        /entrypoint register \
          ${RUN_UNTAGGED} \
          ${ACCESS_LEVEL} \
          --template-config /configmaps/config.template.toml \
          --non-interactive &
      
        register_pid=$!
        wait $register_pid
        retval=$?
      
        if [ ${retval} = 0 ]; then
          break
        elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
          exit 1
        fi
      
        sleep 5
      done
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.toml.tpl: |
      # The directory where Gitaly's executables are stored
      bin_dir = "/usr/local/bin"
      
      # listen on a TCP socket. This is insecure (no authentication)
      listen_addr = ":8075"
      
      # Directory where internal sockets reside
      # note: no value will result in a `/tmp/gitlab-internal-*` path
      # internal_socket_dir = "/home/git"
      
      # If metrics collection is enabled, inform gitaly about that
      prometheus_listen_addr = ":9236"
      
      # Graceful shutdown timeout, how long to wait for in-flight requests to complete
      graceful_restart_timeout = "25s"
      
      # Storage configuration
      {% $storages := coll.Slice  "default" %}
      {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %}
      {% $index := 0 %}
      {% if regexp.Match "^[0-9]+$" $hostid %}
        {% $index = conv.ToInt64 $hostid %}
      {% end %}
      {% if len $storages | lt $index %}
      [[storage]]
      name = "{% index $storages $index %}"
      path = "/home/git/repositories"
      {% else %}
      {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %}
      {% end %}
      
      [logging]
      format = "json"
      dir = "/var/log/gitaly"
      
      [auth]
      token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %}
      
      [git]
      use_bundled_binaries = true
      ignore_gitconfig = true
      
      [gitlab-shell]
      # The directory where gitlab-shell is installed
      dir = "/srv/gitlab-shell"
      
      [gitlab]
      # location of shared secret for GitLab Shell / API interaction
      secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret"
      # URL of API
      url = "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      [gitlab.http-settings]
      # read_timeout = 300
      # user = someone
      # password = somepass
      # ca_file = /etc/ssl/cert.pem
      # ca_path = /etc/pki/tls/certs
      
      [hooks]
      # directory containing custom hooks
      custom_hooks_dir = "/home/git/custom_hooks"
      
    configure: |
      set -e
      mkdir -p /init-secrets/gitaly /init-secrets/shell
      cp -v -r -L /init-config/.gitlab_shell_secret  /init-secrets/shell/.gitlab_shell_secret
      cp -v -r -L /init-config/gitaly_token  /init-secrets/gitaly/gitaly_token
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # optional
      for secret in redis redis-sentinel postgres gitlab-exporter ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    gitlab-exporter.yml.erb: |
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
        
      
      probes:
        db_common: &db_common
          methods:
            - probe_db
          opts:
            connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>'
        database:
          multiple: true
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
        database_bloat:
          class_name: Database::BloatProber
          <<: *db_common
      
        sidekiq: &sidekiq
          methods:
            - probe_queues
            - probe_workers
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
          methods:
            - probe_gc
          opts:
            quantiles: false
      
        metrics:
          multiple: true
          ruby:
            <<: *ruby
          sidekiq:
            <<: *sidekiq
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-shell-sshd)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell-sshd
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    sshd_config: |
      #	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
      
      # This is the sshd server system-wide configuration file.  See
      # sshd_config(5) for more information.
      
      # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
      
      # The strategy used for options in the default sshd_config shipped with
      # OpenSSH is to specify options with their default value where
      # possible, but leave them commented.  Uncommented options override the
      # default value.
      
      Port 2222
      #AddressFamily any
      #ListenAddress 0.0.0.0
      #ListenAddress ::
      
      #HostKey /etc/ssh/ssh_host_rsa_key
      #HostKey /etc/ssh/ssh_host_dsa_key
      #HostKey /etc/ssh/ssh_host_ecdsa_key
      #HostKey /etc/ssh/ssh_host_ed25519_key
      
      # Ciphers and keying
      #RekeyLimit default none
      
      # Logging
      #SyslogFacility AUTH
      LogLevel ERROR
      
      # Authentication:
      
      PermitRootLogin no
      #StrictModes yes
      #MaxAuthTries 6
      #MaxSessions 10
      
      #PubkeyAuthentication yes
      
      #AuthorizedPrincipalsFile none
      
      # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
      #HostbasedAuthentication no
      # Change to yes if you don't trust ~/.ssh/known_hosts for
      # HostbasedAuthentication
      #IgnoreUserKnownHosts no
      # Don't read the user's ~/.rhosts and ~/.shosts files
      #IgnoreRhosts yes
      
      #PermitEmptyPasswords no
      
      # Change to no to disable s/key passwords
      #ChallengeResponseAuthentication yes
      
      # Kerberos options
      #KerberosAuthentication no
      #KerberosOrLocalPasswd yes
      #KerberosTicketCleanup yes
      #KerberosGetAFSToken no
      
      # GSSAPI options
      #GSSAPIAuthentication no
      #GSSAPICleanupCredentials yes
      
      # Set this to 'yes' to enable PAM authentication, account processing,
      # and session processing. If this is enabled, PAM authentication will
      # be allowed through the ChallengeResponseAuthentication and
      # PasswordAuthentication.  Depending on your PAM configuration,
      # PAM authentication via ChallengeResponseAuthentication may bypass
      # the setting of "PermitRootLogin without-password".
      # If you just want the PAM account and session checks to run without
      # PAM authentication, then enable this but set PasswordAuthentication
      # and ChallengeResponseAuthentication to 'no'.
      #UsePAM no
      
      #AllowAgentForwarding yes
      #AllowTcpForwarding yes
      #GatewayPorts no
      #X11Forwarding no
      #X11DisplayOffset 10
      #X11UseLocalhost yes
      #PermitTTY yes
      #PrintMotd yes
      #PrintLastLog yes
      #TCPKeepAlive yes
      #UseLogin no
      #PermitUserEnvironment no
      #Compression delayed
      ClientAliveInterval 0
      #ClientAliveCountMax 3
      #UseDNS no
      PidFile /srv/sshd/sshd.pid
      #PermitTunnel no
      #ChrootDirectory none
      #VersionAddendum none
      
      # no default banner path
      #Banner none
      
      # override default of no subsystems
      # Subsystem	sftp	/usr/lib/ssh/sftp-server
      
      # the following are HPN related configuration options
      # tcp receive buffer polling. disable in non autotuning kernels
      #TcpRcvBufPoll yes
      
      # disable hpn performance boosts
      #HPNDisabled no
      
      # buffer size for hpn to non-hpn connections
      #HPNBufferSize 2048
      
      
      # Example of overriding settings on a per-user basis
      #Match User anoncvs
      #	X11Forwarding no
      #	AllowTcpForwarding no
      #	PermitTTY no
      #	ForceCommand cvs server
      
      # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
      # but this is overridden so installations will only check .ssh/authorized_keys
      AuthorizedKeysFile	.ssh/authorized_keys
      
      AuthorizedKeysCommand /authorized_keys %u %k
      AuthorizedKeysCommandUser git
      
      PasswordAuthentication no
      
      AllowUsers git
      
      # Enable the use of Git protcol v2
      AcceptEnv GIT_PROTOCOL
      
      # Hard disable all forwarding
      DisableForwarding yes
      
      # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
      # See `man sshd_config(5)`
      
      MaxStartups 10:30:100
      
      
      # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in
      LoginGraceTime 60
      
      # Includes
      Include /etc/ssh/sshd_config.d/*.conf
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      # GitLab user. git by default
      user: git
      
      # Url to gitlab instance. Used for api calls. Should end with a slash.
      gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret
      
      # File used as authorized_keys for gitlab user
      auth_file: "/home/git/.ssh/authorized_keys"
      
      # Log file.
      # Default is gitlab-shell.log in the root directory.
      log_file: "/var/log/gitlab-shell/gitlab-shell.log"
      
      log_format: json
      
      # Audit usernames.
      # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but
      # incurs an extra API call on every gitlab-shell command.
      audit_usernames: false
      
      
      lfs:
        pure_ssh_protocol: false
      pat:
        enabled: true
        allowed_scopes:
          []
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # END gitlab.scripts.configure.secrets
      mkdir -p /${secret_dir}/ssh
      cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/
      chmod 0400 /${secret_dir}/ssh/ssh_host_*
      
    krb5.conf: 
  


(root level)  (v1/ConfigMap/gitlab/gitlab-nginx-ingress-tcp)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-nginx-ingress-tcp
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:"

(root level)  (v1/ConfigMap/gitlab/gitlab-kas)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yaml: |
      agent:
        kubernetes_api:
          listen:
            address: :8154
          url_path_prefix: /k8s-proxy
          websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret
        listen:
          address: :8150
          websocket: true
      api:
        listen:
          address: :8153
          authentication_secret_file: /etc/kas/.gitlab_kas_secret
      gitlab:
        address: http://gitlab-webservice-default.gitlab.svc:8181
        authentication_secret_file: /etc/kas/.gitlab_kas_secret
        external_url: https://code.nogweii.net
      observability:
        listen:
          address: :8151
        liveness_probe:
          url_path: /liveness
        readiness_probe:
          url_path: /readiness
      private_api:
        listen:
          address: :8155
          authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret
      redis:
        database_index: 0
        password_file: /etc/kas/redis/redis-password
        server:
          address: gitlab-redis-master.gitlab.svc:6379
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-migrations)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-migrations
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in rails-secrets migrations gitaly ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          signup_enabled: false
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
      
    installation_type: |
      gitlab-helm-chart
      
    pages_redirect_uri: "https://projects.aether.page/auth"
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-sidekiq)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-sidekiq
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "127.0.0.0/8"
            - "::1/128"
          sidekiq_exporter:
            enabled: true
            address: "*"
            port: 3807
            log_enabled: false
          sidekiq_health_checks:
            enabled: true
            address: "*"
            port: 3808
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-toolbox)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      secret_key = $(cat /init-secrets/minio/secretkey)
      bucket_location = us-east-1
      host_base = minio.code.nogweii.net
      host_bucket = minio.code.nogweii.net/%(bucket)
      default_mime_type = binary/octet-stream
      enable_multipart = True
      multipart_max_chunks = 10000
      multipart_chunk_size_mb = 128
      recursive = True
      recv_chunk = 65536
      send_chunk = 65536
      server_side_encryption = False
      signature_v2 = True
      socket_timeout = 300
      use_mime_magic = False
      verbosity = WARNING
      website_endpoint = https://minio.code.nogweii.net
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
      
    configure-gsutil: |
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file
        # 2) Do not set permissions for key file
        # 3) GCP Project ID
        # 4) Decline anonymous usage statistics
        printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e
      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
        echo '[GoogleCompute]\nservice_account = default' > ~/.boto
      fi
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-webservice)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_color_mode: 
          default_syntax_highlighting_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        gitlab_docs:
          enabled: false
          host: ""
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
          secret_file: /etc/gitlab/gitlab-workhorse/secret
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "0.0.0.0/0"
            - "::/0"
          web_exporter:
            enabled: true
            address: "0.0.0.0"
            port: 8083
          sidekiq_exporter:
        shutdown:
          blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %>
        rack_attack:
          git_basic_auth:
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        smartcard:
          enabled: false
          ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt'
          client_certificate_required_host: smartcard.code.nogweii.net
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-workhorse-default)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-workhorse-default
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      set -e
      mkdir -p /init-secrets-workhorse/gitlab-workhorse
      cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret
      mkdir -p /init-secrets-workhorse/redis
      cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/
      if [ -f /init-config/objectstorage/object_store ]; then
        mkdir -p /init-secrets-workhorse/objectstorage
        cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/
      fi
      
    installation_type: |
      gitlab-helm-chart
      
    workhorse-config.toml.tpl: |
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
      {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
        {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%}
      {%- end %}
      {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %}
        {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%}
      {%- end %}
      {%- if has $supported_providers $connection.provider %}
      [object_storage]
      provider = "{% $connection.provider %}"
      {%-   if eq $connection.provider "AWS" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %}
      # AWS / S3 object storage configuration.
      [object_storage.s3]
      # access/secret can be blank!
      aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %}
      aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "AzureRM" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %}
      # Azure Blob storage configuration.
      [object_storage.azurerm]
      azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %}
      azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "Google" %}
      # Google storage configuration.
      [object_storage.google]
      {% $connection | coll.Omit "provider" | data.ToTOML %}
      {%-   end %}
      {%- end %}
      [image_resizer]
      max_scaler_procs = 2
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-webservice-tests)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice-tests
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    test_login: |
      set -e
      echo 'Start Test'
      endpoint="https://code.nogweii.net"
      cookie_read="-c /tmp/test_login.cookie"
      cookie_readwrite="$cookie_read -b /tmp/test_login.cookie"
      
      signin_url="$endpoint/users/sign_in"
      echo "Login to create a session: $signin_url"
      csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*')
      curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)"
      
      profile_url="$endpoint/-/profile"
      echo "Confirm session valid: $profile_url"
      profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url)
      
      if [ "$profile_status" != "200" ]; then
        echo "Error: Session Invalid"
        cat /tmp/profile_output
        exit 1
      fi
      
      echo 'Test Passed'
      exit 0
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-redis-configuration)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-configuration
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    master.conf: |
      dir /data
      # User-supplied master configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of master configuration
    redis.conf: |
      # User-supplied common configuration:
      # Enable AOF https://redis.io/topics/persistence#append-only-file
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration

(root level)  (v1/ConfigMap/gitlab/gitlab-redis-health)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-health
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)  (v1/ConfigMap/gitlab/gitlab-redis-scripts)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-scripts
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
      fi
      if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
      fi
      ARGS=("--port" "${REDIS_PORT}")
      ARGS+=("--requirepass" "${REDIS_PASSWORD}")
      ARGS+=("--masterauth" "${REDIS_PASSWORD}")
      ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
      ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
      exec redis-server "${ARGS[@]}"
  


(root level)  (v1/ConfigMap/gitlab/gitlab-registry)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      http:
        addr: :5000
        # `host` is not configurable
        # `prefix` is not configurable
        debug:
          addr: :5001
          prometheus:
            enabled: false
            path: /metrics
        draintimeout: 0
        headers:
          X-Content-Type-Options: [nosniff]
        secret: "HTTP_SECRET"
        relativeurls: false
      health:
        storagedriver:
          enabled: false
          interval: 10s
          threshold: 3
      auth:
        token:
          realm: https://code.nogweii.net/jwt/auth
          service: container_registry
          issuer: gitlab-issuer
          # This is provided from the initContainer execution, at a known path.
          rootcertbundle: /etc/docker/registry/certificate.crt
          autoredirect: false
      validation:
        disabled: true
        manifests:
          referencelimit: 0
          payloadsizelimit: 0
          urls:
            allow:
            deny:
      
      notifications:
      reporting:
      profiling:
      storage:
        maintenance:
          readonly:
            enabled: false
          uploadpurging:
            enabled: true
            age: 168h
            interval: 24h
            dryrun: false
        redirect:
          disable: true
          exceptions:
      middleware:
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
      gc:
        disabled: false
      redis:
      rate_limiter:
        enabled: false
      
    configure: |
      if [ -e /config/accesskey ] ; then
        sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml
      fi
      # Place the `http.secret` value from the kubernetes secret
      sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml
      # Populate sensitive registry notification secrets in the config file
      if [ -d /config/notifications ]; then
        for i in /config/notifications/*; do
          filename=$(basename $i);
          sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml;
        done
      fi
      # Insert any provided `storage` block from kubernetes secret
      if [ -d /config/storage ]; then
        # Copy contents of storage secret(s)
        mkdir -p /registry/storage
        cp -v -r -L /config/storage/* /registry/storage/
        # Ensure there is a new line in the end
        echo '' >> /registry/storage/config
        # Default `delete.enabled: true` if not present.
        ## Note: busybox grep doesn't support multiline, so we chain `egrep`.
        if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then
          echo 'delete:' >> /registry/storage/config
          echo '  enabled: true' >> /registry/storage/config
        fi
        # Indent /registry/storage/config 2 spaces before inserting into config.yml
        sed -i 's/^/  /' /registry/storage/config
        # Insert into /registry/config.yml after `storage:`
        sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml
        # Remove the now extraneous `config` file
        rm /registry/storage/config
      fi
      # Copy any middleware.storage if present
      if [ -d /config/middleware.storage ]; then
        cp -v -r -L /config/middleware.storage  /registry/middleware.storage
      fi
      # Set to known path, to used ConfigMap
      cat /config/certificate.crt > /registry/certificate.crt
      # Copy the optional profiling keyfile to the expected location
      if [ -f /config/profiling-key.json ]; then
        cp /config/profiling-key.json /registry/profiling-key.json
      fi
      # Insert Database password, if enabled
      if [ -f /config/database_password ] ; then
        sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml
      fi
      # Insert Redis(cache) password, if enabled
      if [ -f /config/registry/redis-password ] ; then
        sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml
      fi
      # Insert Redis(rate-limiter) password, if enabled
      if [ -f /config/registry/redis-rateLimiting-password ] ; then
        sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml
      fi
      # Insert Redis(load balancing) password, if enabled
      if [ -f /config/registry/redis-loadBalancing-password ] ; then
        sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml
      fi
      # Copy the database TLS connection files to the expected location and set permissions
      if [ -d /config/ssl ]; then
        cp -r /config/ssl/ /registry/ssl
        chmod 700 /registry/ssl
        chmod 600 /registry/ssl/*.pem
      fi
      # Copy TLS certificates if present
      if [ -d /config/tls ]; then
        cp -r /config/tls/ /registry/tls
        chmod 700 /registry/tls
        chmod 600 /registry/tls/*
      fi
    migrations-config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-chart-info
    namespace: gitlab
    labels:
      app: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    gitlabChartVersion: "9.8.2"
    gitlabVersion: "18.8.2"

(root level)  (rbac.authorization.k8s.io/v1/ClusterRole/gitlab-gitlab-runner)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - create
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - resources:
    - pods/attach
    - pods/exec
    apiGroups:
    -
    verbs:
    - get
    - create
    - patch
    - delete
  - resources:
    - pods/log
    apiGroups:
    -
    verbs:
    - get
    - list
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - update
  - resources:
    - serviceaccounts
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - create
    - get

(root level)  (rbac.authorization.k8s.io/v1/ClusterRoleBinding/gitlab-gitlab-runner)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-gitlab-runner
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: gitlab-runner-access
    kind: ServiceAccount
    namespace: gitlab

(root level)  (v1/Service/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app: gitaly
      release: gitlab
    ports:
    - name: tcp-gitaly
      port: 8075
      targetPort: grpc-gitaly
    - name: http-metrics
      port: 9236
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-exporter
      release: gitlab
    ports:
    - name: http-metrics
      port: 9168
      protocol: TCP
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    annotations:
      tailscale.com/expose: "true"
      tailscale.com/hostname: gitlab-shell
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-shell
      release: gitlab
    ports:
    - name: ssh
      port: 22222
      protocol: TCP
      targetPort: 2222

(root level)  (v1/Service/gitlab/gitlab-kas)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: kas
      release: gitlab
    ports:
    - name: tcp-kas-external-api
      port: 8150
      protocol: TCP
      targetPort: 8150
    - name: tcp-kas-internal-api
      port: 8153
      protocol: TCP
      targetPort: 8153
    - name: tcp-kas-k8s-api
      port: 8154
      protocol: TCP
      targetPort: 8154
    - name: http-metrics
      port: 8151
      protocol: TCP
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: webservice
      gitlab.com/webservice-name: default
      release: gitlab
    ports:
    - name: http-webservice
      port: 8080
      protocol: TCP
      targetPort: http-webservice
    - name: http-workhorse
      port: 8181
      protocol: TCP
      targetPort: http-workhorse
    - name: http-metrics-ws
      port: 8083
      protocol: TCP
      targetPort: http-metrics-ws

(root level)  (v1/Service/gitlab/gitlab-redis-headless)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-headless
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)  (v1/Service/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    sessionAffinity: None
    selector:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)  (v1/Service/gitlab/gitlab-redis-metrics)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-metrics
    namespace: gitlab
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: http-metrics
      port: 9121
      protocol: TCP
      targetPort: metrics

(root level)  (v1/Service/gitlab/gitlab-registry)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: registry
      release: gitlab
    ports:
    - name: http-registry
      port: 5000
      protocol: TCP
      targetPort: http

(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-runner)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: gitlab-gitlab-runner
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_port: "9252"
          gitlab.com/prometheus_scrape: "true"
        labels:
          app: gitlab-gitlab-runner
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab-gitlab-runner
          image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2"
          imagePullPolicy: IfNotPresent
          resources: {}
          command:
          - /usr/bin/dumb-init
          - "--"
          - /bin/bash
          - /configmaps/entrypoint
          ports:
          - name: metrics
            containerPort: 9252
          volumeMounts:
          - name: projected-secrets
            mountPath: /secrets
          - name: etc-gitlab-runner
            mountPath: /home/gitlab-runner/.gitlab-runner
          - name: configmaps
            mountPath: /configmaps
          livenessProbe:
            exec:
              command:
              - /bin/bash
              - /configmaps/check-live
              - "3"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          readinessProbe:
            exec:
              command:
              - /usr/bin/pgrep
              - "gitlab.*runner"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
          env:
          - name: CI_SERVER_URL
            value: "https://code.nogweii.net"
          - name: RUNNER_EXECUTOR
            value: kubernetes
          - name: REGISTER_LOCKED
            value: "false"
          - name: RUNNER_TAG_LIST
            value:
          - name: KUBERNETES_NAMESPACE
            value: gitlab
          - name: CACHE_S3_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_access_key_id
          - name: CACHE_S3_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_secret_access_key
          - name: SESSION_SERVER_ADDRESS
            value: null
          lifecycle:
            preStop:
              exec:
                command:
                - /entrypoint
                - unregister
                - "--all-runners"
        securityContext:
          fsGroup: 65533
          runAsUser: 100
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-runner-access
        terminationGracePeriodSeconds: 3600
        volumes:
        - name: runner-secrets
          emptyDir:
            medium: Memory
        - name: etc-gitlab-runner
          emptyDir:
            medium: Memory
        - name: projected-secrets
          projected:
            sources:
            - secret:
                name: gitlab-gitlab-runner-secret
                items:
                - key: runner-registration-token
                  path: runner-registration-token
                - key: runner-token
                  path: runner-token
        - name: configmaps
          configMap:
            name: gitlab-gitlab-runner

(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: gitlab-exporter
        release: gitlab
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9168"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9168"
          prometheus.io/scrape: "true"
        labels:
          app: gitlab-exporter
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-exporter
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-exporter
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0"
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab-exporter/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitlab-exporter
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          ports:
          - name: http-metrics
            containerPort: 9168
          resources:
            requests:
              cpu: 75m
              memory: 100M
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb
            subPath: gitlab-exporter.yml.erb
          - name: gitlab-exporter-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          readinessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'gitlab-exporter'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /config
            readOnly: true
          - name: init-gitlab-exporter-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitlab-exporter-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: gitlab-exporter-config
          configMap:
            name: gitlab-gitlab-exporter
        - name: init-gitlab-exporter-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
        - name: gitlab-exporter-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: gitlab-shell
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-shell
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-shell
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitlab-shell
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab-shell
          - name: KEYS_DIRECTORY
            value: /etc/gitlab-secrets/ssh
          - name: SSH_DAEMON
            value: openssh
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          ports:
          - name: ssh
            containerPort: 2222
          readinessProbe:
            failureThreshold: 2
            initialDelaySeconds: 10
            periodSeconds: 5
            successThreshold: 1
            tcpSocket:
              port: 2222
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 0
              memory: 6M
          volumeMounts:
          - name: shell-config
            mountPath: /etc/gitlab-shell
          - name: shell-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: shell-config
            mountPath: /etc/krb5.conf
            readOnly: true
            subPath: krb5.conf
          - name: sshd-config
            mountPath: /etc/ssh/sshd_config
            readOnly: true
            subPath: sshd_config
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: shell-config
            mountPath: /config
            readOnly: true
          - name: shell-init-secrets
            mountPath: /init-config
            readOnly: true
          - name: shell-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: shell-config
          configMap:
            name: gitlab-gitlab-shell
        - name: sshd-config
          configMap:
            name: gitlab-gitlab-shell-sshd
        - name: shell-init-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitlab-shell-host-keys
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
        - name: shell-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-kas)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: kas
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8151"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8151"
          prometheus.io/scrape: "true"
        labels:
          app: kas
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: kas
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: kas
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2"
          args:
          - "--configuration-file=/etc/kas/config.yaml"
          env:
          - name: OWN_PRIVATE_API_HOST
            value: gitlab-kas.gitlab.svc
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8151
            initialDelaySeconds: 15
            periodSeconds: 20
          ports:
          - name: kas
            containerPort: 8150
          - name: kas-k8s-api
            containerPort: 8154
          - name: kas-private-api
            containerPort: 8155
          - name: http-metrics
            containerPort: 8151
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8151
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
          - name: init-etc-kas
            mountPath: /etc/kas
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65532
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 65532
          runAsGroup: 65532
          runAsUser: 65532
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 300
        volumes:
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
        - name: init-etc-kas
          projected:
            defaultMode: 288
            sources:
            - configMap:
                name: gitlab-kas
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: .gitlab_kas_secret
            - secret:
                name: gitlab-kas-private-api
                items:
                - key: kas_private_api_secret
                  path: .gitlab_kas_private_api_secret
            - secret:
                name: gitlab-kas-websocket-token
                items:
                - key: kas_websocket_token_secret
                  path: .gitlab_kas_websocket_token_secret
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password

(root level)  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      queue-pod-name: all-in-1
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "3807"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "3807"
          prometheus.io/scrape: "true"
        labels:
          app: sidekiq
          app.kubernetes.io/name: gitlab
          heritage: Helm
          queue-pod-name: all-in-1
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: sidekiq
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: sidekiq
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2"
          env:
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: SIDEKIQ_QUEUES
            value: null
          - name: SIDEKIQ_DAEMON_MEMORY_KILLER
            value: "1"
          - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL
            value: "3"
          - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS
            value: "2000000"
          - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME
            value: "900"
          - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT
            value: "30"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /liveness
              port: 3808
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-metrics
            containerPort: 3807
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readiness
              port: 3808
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 900m
              memory: 2G
          volumeMounts:
          - name: sidekiq-metrics
            mountPath: /metrics
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: sidekiq-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: sidekiq-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: sidekiq-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'sidekiq'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: sidekiq-config
            mountPath: /config
            readOnly: true
          - name: init-sidekiq-secrets
            mountPath: /init-config
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2"
          args:
          - /scripts/wait-for-deps
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: sidekiq-metrics
          emptyDir:
            medium: Memory
        - name: sidekiq-config
          projected:
            sources:
            - configMap:
                name: gitlab-sidekiq
        - name: init-sidekiq-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: sidekiq-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-toolbox)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: toolbox
        release: gitlab
    strategy:
      type: Recreate
      rollingUpdate: null
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: toolbox
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: toolbox
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done"
          env:
          - name: ARTIFACTS_BUCKET_NAME
            value: gitlab-artifacts
          - name: REGISTRY_BUCKET_NAME
            value: gitlab-container-registry
          - name: LFS_BUCKET_NAME
            value: gitlab-lfs
          - name: UPLOADS_BUCKET_NAME
            value: gitlab-uploads
          - name: PACKAGES_BUCKET_NAME
            value: gitlab-packages
          - name: EXTERNAL_DIFFS_BUCKET_NAME
            value: gitlab-external-diffs
          - name: TERRAFORM_STATE_BUCKET_NAME
            value: gitlab-terraform-state
          - name: CI_SECURE_FILES_BUCKET_NAME
            value: gitlab-ci-secure-files
          - name: BACKUP_BUCKET_NAME
            value: gitlab-backup
          - name: BACKUP_BACKEND
            value: s3
          - name: TMP_BUCKET_NAME
            value: gitlab-tmp-storage
          - name: PAGES_BUCKET_NAME
            value: gitlab-pages
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
              memory: 350M
          volumeMounts:
          - name: toolbox-config
            mountPath: /var/opt/gitlab/templates
          - name: toolbox-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: toolbox-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: toolbox-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: toolbox-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: toolbox-tmp
            mountPath: /srv/gitlab/tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: toolbox-config
            mountPath: /config
            readOnly: true
          - name: init-toolbox-secrets
            mountPath: /init-config
            readOnly: true
          - name: toolbox-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: toolbox-config
          projected:
            sources:
            - configMap:
                name: gitlab-toolbox
        - name: toolbox-tmp
          emptyDir: {}
        - name: init-toolbox-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: s3cmd.cfg
                  path: objectstorage/.s3cfg
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: toolbox-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      app.kubernetes.io/name: gitlab
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8083"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8083"
          prometheus.io/scrape: "true"
        labels:
          app: webservice
          app.kubernetes.io/name: gitlab
          gitlab.com/webservice-name: default
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: webservice
                    gitlab.com/webservice-name: default
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: webservice
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: GITLAB_WEBSERVER
            value: puma
          - name: TMPDIR
            value: /tmp/gitlab
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: WORKER_PROCESSES
            value: "2"
          - name: WORKER_TIMEOUT
            value: "60"
          - name: INTERNAL_PORT
            value: "8080"
          - name: PUMA_THREADS_MIN
            value: "4"
          - name: PUMA_THREADS_MAX
            value: "4"
          - name: PUMA_WORKER_MAX_MEMORY
            value: 
          - name: DISABLE_PUMA_WORKER_KILLER
            value: "true"
          - name: BIND_IP6
            value: "false"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /-/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-webservice
            containerPort: 8080
          - name: http-metrics-ws
            containerPort: 8083
          readinessProbe:
            failureThreshold: 2
            httpGet:
              path: /-/readiness
              port: 8080
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 300m
              memory: 2.5G
          volumeMounts:
          - name: webservice-metrics
            mountPath: /metrics
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: webservice-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: webservice-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: webservice-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -SIGINT -o ruby"
        - name: gitlab-workhorse
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TMPDIR
            value: /tmp/gitlab
          - name: GITLAB_WORKHORSE_AUTH_BACKEND
            value: "http://localhost:8080"
          - name: GITLAB_WORKHORSE_EXTRA_ARGS
            value: 
          - name: GITLAB_WORKHORSE_LISTEN_PORT
            value: "8181"
          - name: GITLAB_WORKHORSE_LOG_FORMAT
            value: json
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          ports:
          - name: http-workhorse
            containerPort: 8181
          resources:
            requests:
              cpu: 100m
              memory: 100M
          volumeMounts:
          - name: workhorse-config
            mountPath: /var/opt/gitlab/templates
          - name: workhorse-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          readinessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep $SHUTDOWN_BLACKOUT_SECONDS"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - "-c"
          - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab"
          command:
          - sh
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: webservice-config
            mountPath: /config-webservice
            readOnly: true
          - name: workhorse-config
            mountPath: /config-workhorse
            readOnly: true
          - name: init-webservice-secrets
            mountPath: /init-config
            readOnly: true
          - name: webservice-secrets
            mountPath: /init-secrets
            readOnly: false
          - name: workhorse-secrets
            mountPath: /init-secrets-workhorse
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2"
          args:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "1"
          - name: ENABLE_BOOTSNAP
            value: "1"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: shared-tmp
          emptyDir: {}
        - name: webservice-metrics
          emptyDir:
            medium: Memory
        - name: webservice-config
          configMap:
            name: gitlab-webservice
        - name: workhorse-config
          configMap:
            name: gitlab-workhorse-default
        - name: init-webservice-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-workhorse-secret
                items:
                - key: shared_secret
                  path: gitlab-workhorse/secret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: webservice-secrets
          emptyDir:
            medium: Memory
        - name: workhorse-secrets
          emptyDir:
            medium: Memory
        - name: shared-upload-directory
          emptyDir: {}
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-registry)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: registry
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: registry
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: registry
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: registry
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          env:
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 5000
          - name: debug
            containerPort: 5001
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep 5"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          command:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.crt
                  path: certificate.crt
            - secret:
                name: gitlab-registry-httpsecret
                items:
                - key: secret
                  path: httpSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: registry.yaml
                  path: storage/config
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-gitlab-shell

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-kas)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-kas

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-sidekiq-all-in-1-v2)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 350m
    minReplicas: 1
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-sidekiq-all-in-1-v2

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 1
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-webservice-default

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-registry)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 75
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-registry

(root level)  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    podManagementPolicy: Parallel
    replicas: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab
    serviceName: gitlab-gitaly
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9236"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9236"
          prometheus.io/scrape: "true"
        labels:
          app: gitaly
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitaly
          image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitaly/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitaly
          - name: GITALY_CONFIG_FILE
            value: /etc/gitaly/config.toml
          - name: SSL_CERT_DIR
            value: /etc/ssl/certs
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          ports:
          - name: grpc-gitaly
            containerPort: 8075
          - name: http-metrics
            containerPort: 9236
          readinessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          startupProbe:
            failureThreshold: 60
            grpc:
              port: 8075
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: gitaly-config
            mountPath: /etc/gitaly/templates
          - name: gitaly-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: repo-data
            mountPath: /home/git/repositories
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitaly-config
            mountPath: /config
            readOnly: true
          - name: init-gitaly-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitaly-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
        terminationGracePeriodSeconds: 30
        volumes:
        - name: gitaly-config
          configMap:
            name: gitlab-gitaly
        - name: gitaly-secrets
          emptyDir:
            medium: Memory
        - name: init-gitaly-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly_token
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: .gitlab_shell_secret
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
    volumeClaimTemplates:
    - metadata:
        name: repo-data
        annotations: null
        labels:
          app: gitaly
          release: gitlab
      spec:
        resources:
          requests:
            storage: 50Gi
        selector: null
        storageClassName: nfs-subdir
        accessModes:
        - ReadWriteOnce

(root level)  (apps/v1/StatefulSet/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: master
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    serviceName: gitlab-redis-headless
    template:
      metadata:
        annotations:
          prometheus.io/port: "9121"
          prometheus.io/scrape: "true"
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: redis
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: master
                    app.kubernetes.io/instance: gitlab
                    app.kubernetes.io/name: redis
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: redis
          image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-master.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: REDIS_REPLICATION_MODE
            value: master
          - name: ALLOW_EMPTY_PASSWORD
            value: no
          - name: REDIS_PASSWORD_FILE
            value: /opt/bitnami/redis/secrets/redis-password
          - name: REDIS_TLS_ENABLED
            value: no
          - name: REDIS_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: redis-password
            mountPath: /opt/bitnami/redis/secrets/
          - name: redis-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/redis/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/redis/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        - name: metrics
          image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4"
          imagePullPolicy: IfNotPresent
          command:
          - /bin/bash
          - "-c"
          - |
            if [[ -f '/secrets/redis-password' ]]; then
            export REDIS_PASSWORD=$(cat /secrets/redis-password)
            fi
            redis_exporter

          env:
          - name: REDIS_ALIAS
            value: gitlab-redis
          - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
            value: ":9121"
          - name: REDIS_USER
            value: default
          livenessProbe:
            failureThreshold: 5
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: metrics
            timeoutSeconds: 5
          ports:
          - name: metrics
            containerPort: 9121
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: empty-dir
            mountPath: /tmp
            subPath: app-tmp-dir
          - name: redis-password
            mountPath: /secrets/
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: gitlab-redis-master
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: gitlab-redis-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: gitlab-redis-health
            defaultMode: 493
        - name: redis-password
          secret:
            items:
            - key: secret
              path: redis-password
            secretName: gitlab-redis-secret
        - name: config
          configMap:
            name: gitlab-redis-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: redis-data
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/name: redis
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-c0164a8)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-c0164a8
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-8e2a9a9
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
- one document removed:
  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: gitlab-toolbox-backup
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    concurrencyPolicy: Replace
    failedJobsHistoryLimit: 1
    jobTemplate:
      spec:
        backoffLimit: 6
        template:
          metadata:
            annotations:
              cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
            labels:
              app: toolbox
              heritage: Helm
              release: gitlab
          spec:
            containers:
            - name: toolbox-backup
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
              args:
              - /bin/bash
              - "-c"
              - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts"
              env:
              - name: ARTIFACTS_BUCKET_NAME
                value: gitlab-artifacts
              - name: REGISTRY_BUCKET_NAME
                value: gitlab-container-registry
              - name: LFS_BUCKET_NAME
                value: gitlab-lfs
              - name: UPLOADS_BUCKET_NAME
                value: gitlab-uploads
              - name: PACKAGES_BUCKET_NAME
                value: gitlab-packages
              - name: EXTERNAL_DIFFS_BUCKET_NAME
                value: gitlab-external-diffs
              - name: TERRAFORM_STATE_BUCKET_NAME
                value: gitlab-terraform-state
              - name: CI_SECURE_FILES_BUCKET_NAME
                value: gitlab-ci-secure-files
              - name: BACKUP_BUCKET_NAME
                value: gitlab-backup
              - name: BACKUP_BACKEND
                value: s3
              - name: TMP_BUCKET_NAME
                value: gitlab-tmp-storage
              - name: PAGES_BUCKET_NAME
                value: gitlab-pages
              - name: CONFIG_TEMPLATE_DIRECTORY
                value: /var/opt/gitlab/templates
              - name: CONFIG_DIRECTORY
                value: /srv/gitlab/config
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
                  memory: 350M
              volumeMounts:
              - name: toolbox-config
                mountPath: /var/opt/gitlab/templates
              - name: toolbox-secrets
                mountPath: /etc/gitlab
                readOnly: true
              - name: toolbox-secrets
                mountPath: /srv/gitlab/config/secrets.yml
                subPath: rails-secrets/secrets.yml
              - name: toolbox-tmp
                mountPath: /srv/gitlab/tmp
                readOnly: false
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs/
                readOnly: true
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            initContainers:
            - name: certificates
              image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs
                readOnly: false
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: false
              - name: custom-ca-certificates
                mountPath: /usr/local/share/ca-certificates
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            - name: configure
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
              command:
              - sh
              - /config/configure
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: toolbox-config
                mountPath: /config
                readOnly: true
              - name: init-toolbox-secrets
                mountPath: /init-config
                readOnly: true
              - name: toolbox-secrets
                mountPath: /init-secrets
                readOnly: false
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            restartPolicy: OnFailure
            securityContext:
              fsGroup: 1000
              runAsGroup: 1000
              runAsUser: 1000
              seccompProfile:
                type: RuntimeDefault
            volumes:
            - name: toolbox-config
              projected:
                sources:
                - configMap:
                    name: gitlab-toolbox
            - name: toolbox-tmp
              emptyDir: {}
            - name: init-toolbox-secrets
              projected:
                defaultMode: 256
                sources:
                - secret:
                    name: gitlab-rails-secret
                    items:
                    - key: secrets.yml
                      path: rails-secrets/secrets.yml
                - secret:
                    name: gitlab-gitlab-shell-secret
                    items:
                    - key: secret
                      path: shell/.gitlab_shell_secret
                - secret:
                    name: gitlab-gitaly-secret
                    items:
                    - key: token
                      path: gitaly/gitaly_token
                - secret:
                    name: gitlab-redis-secret
                    items:
                    - key: secret
                      path: redis/redis-password
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-ci
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-main
                - secret:
                    name: gitlab-registry-secret
                    items:
                    - key: registry-auth.key
                      path: registry/gitlab-registry.key
                - secret:
                    name: gitlab-registry-notification
                    items:
                    - key: secret
                      path: registry/notificationSecret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: s3cmd.cfg
                      path: objectstorage/.s3cfg
                - secret:
                    name: gitlab-gitlab-kas-secret
                    items:
                    - key: kas_shared_secret
                      path: kas/.gitlab_kas_secret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: connection.yaml
                      path: objectstorage/object_store
                - secret:
                    name: authentik-oidc
                    items:
                    - key: config.yaml
                      path: omniauth/authentik-oidc/config.yaml
            - name: toolbox-secrets
              emptyDir:
                medium: Memory
            - name: etc-ssl-certs
              emptyDir:
                medium: Memory
            - name: etc-pki-ca-trust-extracted-pem
              emptyDir:
                medium: Memory
            - name: custom-ca-certificates
              projected:
                defaultMode: 288
                sources:
                - secret:
                    name: aethernet.crt
                - secret:
                    name: gitlab-wildcard-tls-ca
    schedule: @daily
    startingDeadlineSeconds: null
    successfulJobsHistoryLimit: 3
    suspend: false
  


(root level)  (v1/ServiceAccount/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab

(root level)  (v1/ConfigMap/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-3"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    generate-secrets: |
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      env=production
      
      pushd $(mktemp -d)
      
      # Args pattern, length
      function gen_random(){
        head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2
      }
      
      # Args: length
      function gen_random_base64(){
        local len="$1"
        gen_random_bytes "$len" | base64 -w0
      }
      
      # Args: length
      function gen_random_bytes(){
        local len="$1"
        head -c "$len" /dev/urandom
      }
      
      # Args: yaml file, search path
      function fetch_rails_value(){
        local value=$(yq --prettyPrint --no-colors ".${2}" $1)
      
        # Don't return null values
        if [ "${value}" != "null" ]; then echo "${value}"; fi
      }
      
      # Args: secretname
      function label_secret(){
        local secret_name=$1
      # Remove application labels if they exist
        kubectl --namespace=$namespace label \
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
          secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
        local secret_args=( "${@:2}")
        local secret_name=$1
      
        if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then
          kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}
        else
          echo "secret \"$secret_name\" already exists."
      
          for arg in "${secret_args[@]}"; do
            local from=$(echo -n ${arg} | cut -d '=' -f1)
      
            if [ -z "${from##*literal*}" ]; then
              local key=$(echo -n ${arg} | cut -d '=' -f2)
              local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)
              local flags="--namespace=$namespace --allow-missing-template-keys=false"
      
              if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then
                echo "key \"${key}\" does not exist. patching it in."
      
                if [ "${desiredValue}" != "" ]; then
                  desiredValue=$(echo -n "${desiredValue}" | base64 -w 0)
                fi
      
                kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}"
              fi
            fi
          done
        fi
      
        label_secret $secret_name
      }
      
      # Initial root password
      generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      # Redis password
      generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      
      # Gitlab shell
      generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      # Gitaly secret
      generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      # Gitlab runner secret
      generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=""
      
      # GitLab Pages API secret
      
      
      # GitLab Pages auth secret for hashing cookie store when using access control
      
      
      # GitLab Pages OAuth secret
      
      
      # Gitlab-kas secret
      generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas private API secret
      generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas WebSocket Token secret
      generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72)
      
      
      
      
      
      
      
      
      # Registry certificates
      mkdir -p certs
      openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650
      generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt
      
      # config/secrets.yaml
      if [ -n "$env" ]; then
        rails_secret="gitlab-rails-secret"
      
        # Fetch the values from the existing secret if it exists
        if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then
          kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml
          secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base")
          otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base")
          db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base")
          openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key")
          encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base")
      
          active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key")
          active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key")
          active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt")
        fi;
      
        # Generate defaults for any unset secrets
        secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}"
        encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
      
        # 1. We set the following two keys as an array to support keys rotation.
        #    The last key in the array is always used to encrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21
        #    while all the keys are used (in the order they're defined) to decrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.
        #    This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that
        #    runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976
        # 2. We use the same method and length as Rails' defaults:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540
        active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}
      
        # Update the existing secret
        cat << EOF > rails-secrets.yml
      apiVersion: v1
      kind: Secret
      metadata:
        name: $rails_secret
      type: Opaque
      stringData:
        secrets.yml: |-
          $env:
            secret_key_base: $secret_key_base
            otp_key_base: $otp_key_base
            db_key_base: $db_key_base
            encrypted_settings_key_base: $encrypted_settings_key_base
            openid_connect_signing_key: |
      $(echo "${openid_connect_signing_key}" | awk '{print "        " $0}')
            active_record_encryption_primary_key:
              $active_record_encryption_primary_keys
            active_record_encryption_deterministic_key:
              $active_record_encryption_deterministic_keys
            active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt
      EOF
        kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml
        label_secret $rails_secret
      fi
      
      # Shell ssh host keys
      ssh-keygen -A
      mkdir -p host_keys
      cp /etc/ssh/ssh_host_* host_keys/
      generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys
      
      # Gitlab-workhorse secret
      generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Registry http.secret secret
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: before-hook-creation
      helm.sh/hook-weight: "-11"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    runcheck: |
      #!/bin/sh
      
      set -e
      
      notify() {
        echo "$1"
        echo -n "$1 " >> /dev/termination-log
      }
      
      greater_version()
      {
        test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1";
      }
      
      is_semver()
      {
        printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"
        return "$?"
      }
      
      # For the PostgreSQL upgrade, you either need both secrets, or no secrets.
      # If there are no secrets, we will create them for you.
      # If the secrets aren't in either of these states, we assume you are upgrading from an older version
      # This is running ahead of version checks to ensure this always runs. This is to account for
      # installations outside of the official helm repo.
      secrets_dir="/etc/secrets/postgresql"
      if [ -d "${secrets_dir}" ]; then
        if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then
          if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then
            notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart"
            notify "There are some manual steps which need to be performed in order to upgrade the database"
            notify "Please see the upgrade documentation for instructions on how to proceed:"
            notify "https://docs.gitlab.com/charts/installation/upgrade.html"
            exit 1
          fi
        fi
      fi
      MIN_VERSION=18.5
      CHART_MIN_VERSION=9.5
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      # Only run check for semver releases
      if ! is_semver "$GITLAB_VERSION"; then
        exit 0
      fi
      
      NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}')
      NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}')
      
      NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}')
      NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}')
      
      if [ ! -f /chart-info/gitlabVersion ]; then
        notify "It seems you are attempting an unsupported upgrade path."
        notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths"
        exit 1
      fi
      
      OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion)
      OLD_VERSION_STRING=${OLD_VERSION_STRING#v}
      OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion)
      
      # Skip check if old version wasn't semver
      if ! is_semver "$OLD_VERSION_STRING"; then
        exit 0
      fi
      
      OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}')
      OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}')
      OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}')
      OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}')
      
      # Checking Version
      if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then
        notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})."
        notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding."
        # Link to upgrade docs if it is a major version jump
        if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then
          notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html"
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  


(root level)  (rbac.authorization.k8s.io/v1/Role/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - get
    - list
    - create
    - patch

(root level)  (rbac.authorization.k8s.io/v1/RoleBinding/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-shared-secrets
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: gitlab-shared-secrets
    kind: ServiceAccount
    namespace: gitlab

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-10"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    backoffLimit: 2
    template:
      metadata:
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: run-check
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - /bin/sh
          - /scripts/runcheck
          env:
          - name: GITLAB_VERSION
            value: "18.8.2"
          - name: CHART_VERSION
            value: "9.8.2"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: chart-info
            mountPath: /chart-info
          - name: scripts
            mountPath: /scripts
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65534
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: chart-info
          configMap:
            name: gitlab-gitlab-chart-info
            optional: true
        - name: scripts
          configMap:
            name: gitlab-gitlab-upgrade-check

flate error: current snapshot: reconcile completed with 1 failure(s):
  HelmRelease/flux-system/gitlab: helm template flux-system/gitlab: execution error at (gitlab/templates/NOTES.txt:222:3): 
CONFIGURATION CHECKS:

redis:
  You must configure an Redis connetion. Please set `global.redis.host`. Since chart v10.0.0,
  external Redis became required. If you were using the bundled Redis chart refer to
  https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/.

Pipeline

## flate diff ``` (root level) (networking.k8s.io/v1/NetworkPolicy/gitlab/gitlab-redis) - one document removed: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: gitlab-redis namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 - ports: - port: 9121 podSelector: matchLabels: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis policyTypes: - Ingress - Egress (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitaly) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitaly release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitlab-shell release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-kas) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: kas release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-sidekiq-all-in-1-v1) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-sidekiq-all-in-1-v1 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-webservice-default) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-registry-v1) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-registry-v1 namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: registry release: gitlab (root level) (v1/ServiceAccount/gitlab/gitlab-runner-access) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-runner-access namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab (root level) (v1/ServiceAccount/gitlab/gitlab-redis-master) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-runner) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: check-live: | #!/bin/bash set -eou pipefail # default timeout is 3 seconds, can be overriden VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}} if ! /usr/bin/pgrep -f ".*register-the-runner" > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner" > /dev/null ; then exit 1 fi status=0 # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL) verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$? # timeout exit code is 143 with busybox, and 124 with coreutils if (( status == 143 )) || (( status == 124 )) ; then echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2 exit 0 elif (( status > 0 )) ; then exit ${status} fi grep -qE "is (alive|valid)" <<<"${verify_output}" config.template.toml: | [[runners]] [runners.kubernetes] image = "archlinux/archlinux:latest" namespace_per_job = true node_selector_overwrite_allowed = "kubernetes.io/arch=.*" pull_policy = ["always", "always"] [runners.kubernetes.node_selector] "kubernetes.io/arch" = "amd64" [runners.cache] Type = "s3" Path = "gitlab-runner" Shared = true [runners.cache.s3] ServerAddress = "brickyard.home.arpa:3900" BucketName = "gitlab-runner-cache" BucketLocation = "apartment" Insecure = true AuthenticationType = "access-key" PathStyle = true config.toml: | shutdown_timeout = 0 concurrent = 10 check_interval = 3 log_level = "info" entrypoint: | #!/bin/bash set -e export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/" mkdir -p ${CONFIG_PATH_FOR_INIT} cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT} # Set up environment variables for cache if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey) export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey) fi if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file" elif [[ -f /secrets/gcs-application-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file" else if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id) # echo -e used to make private key multiline (in google json auth key private key is oneline with \n) export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key)) fi fi if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name) export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key) fi if [[ -f /secrets/runner-registration-token ]]; then export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token) fi if [[ -f /secrets/runner-token ]]; then export CI_SERVER_TOKEN=$(cat /secrets/runner-token) fi # Register the runner if ! sh /configmaps/register-the-runner; then exit 1 fi # Run pre-entrypoint-script if ! bash /configmaps/pre-entrypoint-script; then exit 1 fi # Start the runner exec /entrypoint run \ --working-directory=/home/gitlab-runner pre-entrypoint-script: register-the-runner: | #!/bin/sh signal_handler() { if [ ! -d "/proc/$register_pid" ]; then wait $register_pid fi exit } trap 'signal_handler' QUIT INT MAX_REGISTER_ATTEMPTS=30 # Reset/unset the not needed flags when an authentication token RUN_UNTAGGED="" ACCESS_LEVEL="" if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then RUN_UNTAGGED="" ACCESS_LEVEL="" unset REGISTER_LOCKED unset RUNNER_TAG_LIST fi for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}" /entrypoint register \ ${RUN_UNTAGGED} \ ${ACCESS_LEVEL} \ --template-config /configmaps/config.template.toml \ --non-interactive & register_pid=$! wait $register_pid retval=$? if [ ${retval} = 0 ]; then break elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then exit 1 fi sleep 5 done (root level) (v1/ConfigMap/gitlab/gitlab-gitaly) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.toml.tpl: | # The directory where Gitaly's executables are stored bin_dir = "/usr/local/bin" # listen on a TCP socket. This is insecure (no authentication) listen_addr = ":8075" # Directory where internal sockets reside # note: no value will result in a `/tmp/gitlab-internal-*` path # internal_socket_dir = "/home/git" # If metrics collection is enabled, inform gitaly about that prometheus_listen_addr = ":9236" # Graceful shutdown timeout, how long to wait for in-flight requests to complete graceful_restart_timeout = "25s" # Storage configuration {% $storages := coll.Slice "default" %} {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %} {% $index := 0 %} {% if regexp.Match "^[0-9]+$" $hostid %} {% $index = conv.ToInt64 $hostid %} {% end %} {% if len $storages | lt $index %} [[storage]] name = "{% index $storages $index %}" path = "/home/git/repositories" {% else %} {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %} {% end %} [logging] format = "json" dir = "/var/log/gitaly" [auth] token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %} [git] use_bundled_binaries = true ignore_gitconfig = true [gitlab-shell] # The directory where gitlab-shell is installed dir = "/srv/gitlab-shell" [gitlab] # location of shared secret for GitLab Shell / API interaction secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret" # URL of API url = "http://gitlab-webservice-default.gitlab.svc:8181/" [gitlab.http-settings] # read_timeout = 300 # user = someone # password = somepass # ca_file = /etc/ssl/cert.pem # ca_path = /etc/pki/tls/certs [hooks] # directory containing custom hooks custom_hooks_dir = "/home/git/custom_hooks" configure: | set -e mkdir -p /init-secrets/gitaly /init-secrets/shell cp -v -r -L /init-config/.gitlab_shell_secret /init-secrets/shell/.gitlab_shell_secret cp -v -r -L /init-config/gitaly_token /init-secrets/gitaly/gitaly_token (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # optional for secret in redis redis-sentinel postgres gitlab-exporter ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets gitlab-exporter.yml.erb: | server: name: webrick listen_address: "*" listen_port: 9168 probes: db_common: &db_common methods: - probe_db opts: connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>' database: multiple: true ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common database_bloat: class_name: Database::BloatProber <<: *db_common sidekiq: &sidekiq methods: - probe_queues - probe_workers - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 redis_enable_client: false probe_non_namespaced: true ruby: &ruby methods: - probe_gc opts: quantiles: false metrics: multiple: true ruby: <<: *ruby sidekiq: <<: *sidekiq ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-shell-sshd) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell-sshd namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: sshd_config: | # $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. Port 2222 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH LogLevel ERROR # Authentication: PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes #AuthorizedPrincipalsFile none # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes #PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. #UsePAM no #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding no #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #PermitUserEnvironment no #Compression delayed ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no PidFile /srv/sshd/sshd.pid #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # override default of no subsystems # Subsystem sftp /usr/lib/ssh/sftp-server # the following are HPN related configuration options # tcp receive buffer polling. disable in non autotuning kernels #TcpRcvBufPoll yes # disable hpn performance boosts #HPNDisabled no # buffer size for hpn to non-hpn connections #HPNBufferSize 2048 # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysCommand /authorized_keys %u %k AuthorizedKeysCommandUser git PasswordAuthentication no AllowUsers git # Enable the use of Git protcol v2 AcceptEnv GIT_PROTOCOL # Hard disable all forwarding DisableForwarding yes # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. # See `man sshd_config(5)` MaxStartups 10:30:100 # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in LoginGraceTime 60 # Includes Include /etc/ssh/sshd_config.d/*.conf (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | # GitLab user. git by default user: git # Url to gitlab instance. Used for api calls. Should end with a slash. gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/" secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret # File used as authorized_keys for gitlab user auth_file: "/home/git/.ssh/authorized_keys" # Log file. # Default is gitlab-shell.log in the root directory. log_file: "/var/log/gitlab-shell/gitlab-shell.log" log_format: json # Audit usernames. # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but # incurs an extra API call on every gitlab-shell command. audit_usernames: false lfs: pure_ssh_protocol: false pat: enabled: true allowed_scopes: [] configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # END gitlab.scripts.configure.secrets mkdir -p /${secret_dir}/ssh cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/ chmod 0400 /${secret_dir}/ssh/ssh_host_* krb5.conf: (root level) (v1/ConfigMap/gitlab/gitlab-nginx-ingress-tcp) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-nginx-ingress-tcp namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: 22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:" (root level) (v1/ConfigMap/gitlab/gitlab-kas) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yaml: | agent: kubernetes_api: listen: address: :8154 url_path_prefix: /k8s-proxy websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret listen: address: :8150 websocket: true api: listen: address: :8153 authentication_secret_file: /etc/kas/.gitlab_kas_secret gitlab: address: http://gitlab-webservice-default.gitlab.svc:8181 authentication_secret_file: /etc/kas/.gitlab_kas_secret external_url: https://code.nogweii.net observability: listen: address: :8151 liveness_probe: url_path: /liveness readiness_probe: url_path: /readiness private_api: listen: address: :8155 authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret redis: database_index: 0 password_file: /etc/kas/redis/redis-password server: address: gitlab-redis-master.gitlab.svc:6379 (root level) (v1/ConfigMap/gitlab/gitlab-migrations) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-migrations namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in rails-secrets migrations gitaly ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true signup_enabled: false # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 installation_type: | gitlab-helm-chart pages_redirect_uri: "https://projects.aether.page/auth" redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: (root level) (v1/ConfigMap/gitlab/gitlab-sidekiq) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-sidekiq namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "127.0.0.0/8" - "::1/128" sidekiq_exporter: enabled: true address: "*" port: 3807 log_enabled: false sidekiq_health_checks: enabled: true address: "*" port: 3808 installation_type: | gitlab-helm-chart krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-toolbox) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) secret_key = $(cat /init-secrets/minio/secretkey) bucket_location = us-east-1 host_base = minio.code.nogweii.net host_bucket = minio.code.nogweii.net/%(bucket) default_mime_type = binary/octet-stream enable_multipart = True multipart_max_chunks = 10000 multipart_chunk_size_mb = 128 recursive = True recv_chunk = 65536 send_chunk = 65536 server_side_encryption = False signature_v2 = True socket_timeout = 300 use_mime_magic = False verbosity = WARNING website_endpoint = https://minio.code.nogweii.net EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi configure-gsutil: | if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file # 2) Do not set permissions for key file # 3) GCP Project ID # 4) Decline anonymous usage statistics printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. echo '[GoogleCompute]\nservice_account = default' > ~/.boto fi database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - 127.0.0.0/8 sidekiq_exporter: extra: krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-webservice) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_color_mode: default_syntax_highlighting_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: gitlab_docs: enabled: false host: "" sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: secret_file: /etc/gitlab/gitlab-workhorse/secret git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "0.0.0.0/0" - "::/0" web_exporter: enabled: true address: "0.0.0.0" port: 8083 sidekiq_exporter: shutdown: blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %> rack_attack: git_basic_auth: ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> smartcard: enabled: false ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt' client_certificate_required_host: smartcard.code.nogweii.net client_certificate_required_port: 443 san_extensions: false required_for_git_access: false installation_type: | gitlab-helm-chart krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-workhorse-default) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-workhorse-default namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | set -e mkdir -p /init-secrets-workhorse/gitlab-workhorse cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret mkdir -p /init-secrets-workhorse/redis cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/ if [ -f /init-config/objectstorage/object_store ]; then mkdir -p /init-secrets-workhorse/objectstorage cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/ fi installation_type: | gitlab-helm-chart workhorse-config.toml.tpl: | shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%} {%- end %} {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %} {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%} {%- end %} {%- if has $supported_providers $connection.provider %} [object_storage] provider = "{% $connection.provider %}" {%- if eq $connection.provider "AWS" %} {%- $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %} # AWS / S3 object storage configuration. [object_storage.s3] # access/secret can be blank! aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %} aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "AzureRM" %} {%- $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %} # Azure Blob storage configuration. [object_storage.azurerm] azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %} azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "Google" %} # Google storage configuration. [object_storage.google] {% $connection | coll.Omit "provider" | data.ToTOML %} {%- end %} {%- end %} [image_resizer] max_scaler_procs = 2 max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" (root level) (v1/ConfigMap/gitlab/gitlab-webservice-tests) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice-tests namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: test_login: | set -e echo 'Start Test' endpoint="https://code.nogweii.net" cookie_read="-c /tmp/test_login.cookie" cookie_readwrite="$cookie_read -b /tmp/test_login.cookie" signin_url="$endpoint/users/sign_in" echo "Login to create a session: $signin_url" csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*') curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)" profile_url="$endpoint/-/profile" echo "Confirm session valid: $profile_url" profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url) if [ "$profile_status" != "200" ]; then echo "Error: Session Invalid" cat /tmp/profile_output exit 1 fi echo 'Test Passed' exit 0 (root level) (v1/ConfigMap/gitlab/gitlab-redis-configuration) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-configuration namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: master.conf: | dir /data # User-supplied master configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of master configuration redis.conf: | # User-supplied common configuration: # Enable AOF https://redis.io/topics/persistence#append-only-file appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration (root level) (v1/ConfigMap/gitlab/gitlab-redis-health) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-health namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? exit $exit_status ping_liveness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? exit $exit_status ping_readiness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) (v1/ConfigMap/gitlab/gitlab-redis-scripts) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-scripts namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: start-master.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf fi if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf fi ARGS=("--port" "${REDIS_PORT}") ARGS+=("--requirepass" "${REDIS_PASSWORD}") ARGS+=("--masterauth" "${REDIS_PASSWORD}") ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") exec redis-server "${ARGS[@]}" (root level) (v1/ConfigMap/gitlab/gitlab-registry) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | version: 0.1 log: fields: service: registry level: info http: addr: :5000 # `host` is not configurable # `prefix` is not configurable debug: addr: :5001 prometheus: enabled: false path: /metrics draintimeout: 0 headers: X-Content-Type-Options: [nosniff] secret: "HTTP_SECRET" relativeurls: false health: storagedriver: enabled: false interval: 10s threshold: 3 auth: token: realm: https://code.nogweii.net/jwt/auth service: container_registry issuer: gitlab-issuer # This is provided from the initContainer execution, at a known path. rootcertbundle: /etc/docker/registry/certificate.crt autoredirect: false validation: disabled: true manifests: referencelimit: 0 payloadsizelimit: 0 urls: allow: deny: notifications: reporting: profiling: storage: maintenance: readonly: enabled: false uploadpurging: enabled: true age: 168h interval: 24h dryrun: false redirect: disable: true exceptions: middleware: database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable gc: disabled: false redis: rate_limiter: enabled: false configure: | if [ -e /config/accesskey ] ; then sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml fi # Place the `http.secret` value from the kubernetes secret sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml # Populate sensitive registry notification secrets in the config file if [ -d /config/notifications ]; then for i in /config/notifications/*; do filename=$(basename $i); sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml; done fi # Insert any provided `storage` block from kubernetes secret if [ -d /config/storage ]; then # Copy contents of storage secret(s) mkdir -p /registry/storage cp -v -r -L /config/storage/* /registry/storage/ # Ensure there is a new line in the end echo '' >> /registry/storage/config # Default `delete.enabled: true` if not present. ## Note: busybox grep doesn't support multiline, so we chain `egrep`. if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then echo 'delete:' >> /registry/storage/config echo ' enabled: true' >> /registry/storage/config fi # Indent /registry/storage/config 2 spaces before inserting into config.yml sed -i 's/^/ /' /registry/storage/config # Insert into /registry/config.yml after `storage:` sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml # Remove the now extraneous `config` file rm /registry/storage/config fi # Copy any middleware.storage if present if [ -d /config/middleware.storage ]; then cp -v -r -L /config/middleware.storage /registry/middleware.storage fi # Set to known path, to used ConfigMap cat /config/certificate.crt > /registry/certificate.crt # Copy the optional profiling keyfile to the expected location if [ -f /config/profiling-key.json ]; then cp /config/profiling-key.json /registry/profiling-key.json fi # Insert Database password, if enabled if [ -f /config/database_password ] ; then sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml fi # Insert Redis(cache) password, if enabled if [ -f /config/registry/redis-password ] ; then sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml fi # Insert Redis(rate-limiter) password, if enabled if [ -f /config/registry/redis-rateLimiting-password ] ; then sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml fi # Insert Redis(load balancing) password, if enabled if [ -f /config/registry/redis-loadBalancing-password ] ; then sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml fi # Copy the database TLS connection files to the expected location and set permissions if [ -d /config/ssl ]; then cp -r /config/ssl/ /registry/ssl chmod 700 /registry/ssl chmod 600 /registry/ssl/*.pem fi # Copy TLS certificates if present if [ -d /config/tls ]; then cp -r /config/tls/ /registry/tls chmod 700 /registry/tls chmod 600 /registry/tls/* fi migrations-config.yml.tpl: | version: 0.1 log: fields: service: registry level: info database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-chart-info namespace: gitlab labels: app: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: gitlabChartVersion: "9.8.2" gitlabVersion: "18.8.2" (root level) (rbac.authorization.k8s.io/v1/ClusterRole/gitlab-gitlab-runner) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab rules: - resources: - events apiGroups: - verbs: - list - watch - resources: - namespaces apiGroups: - verbs: - create - delete - resources: - pods apiGroups: - verbs: - create - delete - get - list - watch - resources: - pods/attach - pods/exec apiGroups: - verbs: - get - create - patch - delete - resources: - pods/log apiGroups: - verbs: - get - list - resources: - secrets apiGroups: - verbs: - create - delete - get - update - resources: - serviceaccounts apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - create - get (root level) (rbac.authorization.k8s.io/v1/ClusterRoleBinding/gitlab-gitlab-runner) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab roleRef: name: gitlab-gitlab-runner apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: gitlab-runner-access kind: ServiceAccount namespace: gitlab (root level) (v1/Service/gitlab/gitlab-gitaly) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP clusterIP: None selector: app: gitaly release: gitlab ports: - name: tcp-gitaly port: 8075 targetPort: grpc-gitaly - name: http-metrics port: 9236 targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-exporter release: gitlab ports: - name: http-metrics port: 9168 protocol: TCP targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-shell namespace: gitlab annotations: tailscale.com/expose: "true" tailscale.com/hostname: gitlab-shell labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-shell release: gitlab ports: - name: ssh port: 22222 protocol: TCP targetPort: 2222 (root level) (v1/Service/gitlab/gitlab-kas) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: kas release: gitlab ports: - name: tcp-kas-external-api port: 8150 protocol: TCP targetPort: 8150 - name: tcp-kas-internal-api port: 8153 protocol: TCP targetPort: 8153 - name: tcp-kas-k8s-api port: 8154 protocol: TCP targetPort: 8154 - name: http-metrics port: 8151 protocol: TCP targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-webservice-default) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: webservice gitlab.com/webservice-name: default release: gitlab ports: - name: http-webservice port: 8080 protocol: TCP targetPort: http-webservice - name: http-workhorse port: 8181 protocol: TCP targetPort: http-workhorse - name: http-metrics-ws port: 8083 protocol: TCP targetPort: http-metrics-ws (root level) (v1/Service/gitlab/gitlab-redis-headless) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-headless namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis port: 6379 targetPort: redis (root level) (v1/Service/gitlab/gitlab-redis-master) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster sessionAffinity: None selector: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) (v1/Service/gitlab/gitlab-redis-metrics) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-metrics namespace: gitlab labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: http-metrics port: 9121 protocol: TCP targetPort: metrics (root level) (v1/Service/gitlab/gitlab-registry) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: registry release: gitlab ports: - name: http-registry port: 5000 protocol: TCP targetPort: http (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-runner) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: revisionHistoryLimit: 10 selector: matchLabels: app: gitlab-gitlab-runner template: metadata: annotations: gitlab.com/prometheus_port: "9252" gitlab.com/prometheus_scrape: "true" labels: app: gitlab-gitlab-runner heritage: Helm release: gitlab spec: containers: - name: gitlab-gitlab-runner image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2" imagePullPolicy: IfNotPresent resources: {} command: - /usr/bin/dumb-init - "--" - /bin/bash - /configmaps/entrypoint ports: - name: metrics containerPort: 9252 volumeMounts: - name: projected-secrets mountPath: /secrets - name: etc-gitlab-runner mountPath: /home/gitlab-runner/.gitlab-runner - name: configmaps mountPath: /configmaps livenessProbe: exec: command: - /bin/bash - /configmaps/check-live - "3" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 readinessProbe: exec: command: - /usr/bin/pgrep - "gitlab.*runner" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: false runAsNonRoot: true env: - name: CI_SERVER_URL value: "https://code.nogweii.net" - name: RUNNER_EXECUTOR value: kubernetes - name: REGISTER_LOCKED value: "false" - name: RUNNER_TAG_LIST value: - name: KUBERNETES_NAMESPACE value: gitlab - name: CACHE_S3_ACCESS_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_access_key_id - name: CACHE_S3_SECRET_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_secret_access_key - name: SESSION_SERVER_ADDRESS value: null lifecycle: preStop: exec: command: - /entrypoint - unregister - "--all-runners" securityContext: fsGroup: 65533 runAsUser: 100 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-runner-access terminationGracePeriodSeconds: 3600 volumes: - name: runner-secrets emptyDir: medium: Memory - name: etc-gitlab-runner emptyDir: medium: Memory - name: projected-secrets projected: sources: - secret: name: gitlab-gitlab-runner-secret items: - key: runner-registration-token path: runner-registration-token - key: runner-token path: runner-token - name: configmaps configMap: name: gitlab-gitlab-runner (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: gitlab-exporter release: gitlab template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9168" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9168" prometheus.io/scrape: "true" labels: app: gitlab-exporter app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-exporter release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-exporter image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0" env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab-exporter/templates - name: CONFIG_DIRECTORY value: /etc/gitlab-exporter - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" ports: - name: http-metrics containerPort: 9168 resources: requests: cpu: 75m memory: 100M volumeMounts: - name: gitlab-exporter-config mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb subPath: gitlab-exporter.yml.erb - name: gitlab-exporter-secrets mountPath: /etc/gitlab readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - pgrep - "-f" - gitlab-exporter readinessProbe: exec: command: - pgrep - "-f" - gitlab-exporter securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'gitlab-exporter'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: gitlab-exporter-config mountPath: /config readOnly: true - name: init-gitlab-exporter-secrets mountPath: /init-config readOnly: true - name: gitlab-exporter-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: gitlab-exporter-config configMap: name: gitlab-gitlab-exporter - name: init-gitlab-exporter-secrets projected: defaultMode: 256 sources: - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - name: gitlab-exporter-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: gitlab-shell release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: gitlab-shell app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-shell release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-shell image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitlab-shell - name: CONFIG_DIRECTORY value: /srv/gitlab-shell - name: KEYS_DIRECTORY value: /etc/gitlab-secrets/ssh - name: SSH_DAEMON value: openssh - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC ports: - name: ssh containerPort: 2222 readinessProbe: failureThreshold: 2 initialDelaySeconds: 10 periodSeconds: 5 successThreshold: 1 tcpSocket: port: 2222 timeoutSeconds: 3 resources: requests: cpu: 0 memory: 6M volumeMounts: - name: shell-config mountPath: /etc/gitlab-shell - name: shell-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: shell-config mountPath: /etc/krb5.conf readOnly: true subPath: krb5.conf - name: sshd-config mountPath: /etc/ssh/sshd_config readOnly: true subPath: sshd_config - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: shell-config mountPath: /config readOnly: true - name: shell-init-secrets mountPath: /init-config readOnly: true - name: shell-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: shell-config configMap: name: gitlab-gitlab-shell - name: sshd-config configMap: name: gitlab-gitlab-shell-sshd - name: shell-init-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitlab-shell-host-keys - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - name: shell-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-kas) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-kas namespace: gitlab labels: app: kas app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: kas release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8151" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8151" prometheus.io/scrape: "true" labels: app: kas app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: kas release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: kas image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2" args: - "--configuration-file=/etc/kas/config.yaml" env: - name: OWN_PRIVATE_API_HOST value: gitlab-kas.gitlab.svc - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: httpGet: path: /liveness port: 8151 initialDelaySeconds: 15 periodSeconds: 20 ports: - name: kas containerPort: 8150 - name: kas-k8s-api containerPort: 8154 - name: kas-private-api containerPort: 8155 - name: http-metrics containerPort: 8151 readinessProbe: httpGet: path: /readiness port: 8151 initialDelaySeconds: 5 periodSeconds: 10 resources: requests: cpu: 100m memory: 256Mi volumeMounts: - name: init-etc-kas mountPath: /etc/kas readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65532 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 65532 runAsGroup: 65532 runAsUser: 65532 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 300 volumes: - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca - name: init-etc-kas projected: defaultMode: 288 sources: - configMap: name: gitlab-kas - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: .gitlab_kas_secret - secret: name: gitlab-kas-private-api items: - key: kas_private_api_secret path: .gitlab_kas_private_api_secret - secret: name: gitlab-kas-websocket-token items: - key: kas_websocket_token_secret path: .gitlab_kas_websocket_token_secret - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password (root level) (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "3807" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "3807" prometheus.io/scrape: "true" labels: app: sidekiq app.kubernetes.io/name: gitlab heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: sidekiq release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: sidekiq image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2" env: - name: prometheus_multiproc_dir value: /metrics - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: SIDEKIQ_QUEUES value: null - name: SIDEKIQ_DAEMON_MEMORY_KILLER value: "1" - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL value: "3" - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS value: "2000000" - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME value: "900" - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT value: "30" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /liveness port: 3808 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-metrics containerPort: 3807 readinessProbe: failureThreshold: 3 httpGet: path: /readiness port: 3808 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 900m memory: 2G volumeMounts: - name: sidekiq-metrics mountPath: /metrics - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: sidekiq-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: sidekiq-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: sidekiq-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'sidekiq'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: sidekiq-config mountPath: /config readOnly: true - name: init-sidekiq-secrets mountPath: /init-config readOnly: true - name: sidekiq-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2" args: - /scripts/wait-for-deps env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: sidekiq-metrics emptyDir: medium: Memory - name: sidekiq-config projected: sources: - configMap: name: gitlab-sidekiq - name: init-sidekiq-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: sidekiq-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-toolbox) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: toolbox release: gitlab strategy: type: Recreate rollingUpdate: null template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: toolbox app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: toolbox image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: ENABLE_BOOTSNAP value: "1" - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: toolbox-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-webservice-default) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8083" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8083" prometheus.io/scrape: "true" labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: webservice image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2" env: - name: TZ value: UTC - name: GITLAB_WEBSERVER value: puma - name: TMPDIR value: /tmp/gitlab - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: prometheus_multiproc_dir value: /metrics - name: ENABLE_BOOTSNAP value: "1" - name: WORKER_PROCESSES value: "2" - name: WORKER_TIMEOUT value: "60" - name: INTERNAL_PORT value: "8080" - name: PUMA_THREADS_MIN value: "4" - name: PUMA_THREADS_MAX value: "4" - name: PUMA_WORKER_MAX_MEMORY value: - name: DISABLE_PUMA_WORKER_KILLER value: "true" - name: BIND_IP6 value: "false" - name: PUMA_CONTROL_PORT value: "9293" - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /-/liveness port: 8080 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-webservice containerPort: 8080 - name: http-metrics-ws containerPort: 8083 readinessProbe: failureThreshold: 2 httpGet: path: /-/readiness port: 8080 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 300m memory: 2.5G volumeMounts: - name: webservice-metrics mountPath: /metrics - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: webservice-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: webservice-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: webservice-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -SIGINT -o ruby" - name: gitlab-workhorse image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2" env: - name: TZ value: UTC - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TMPDIR value: /tmp/gitlab - name: GITLAB_WORKHORSE_AUTH_BACKEND value: "http://localhost:8080" - name: GITLAB_WORKHORSE_EXTRA_ARGS value: - name: GITLAB_WORKHORSE_LISTEN_PORT value: "8181" - name: GITLAB_WORKHORSE_LOG_FORMAT value: json - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: PUMA_CONTROL_PORT value: "9293" ports: - name: http-workhorse containerPort: 8181 resources: requests: cpu: 100m memory: 100M volumeMounts: - name: workhorse-config mountPath: /var/opt/gitlab/templates - name: workhorse-secrets mountPath: /etc/gitlab readOnly: true - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 readinessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep $SHUTDOWN_BLACKOUT_SECONDS" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - "-c" - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab" command: - sh env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: webservice-config mountPath: /config-webservice readOnly: true - name: workhorse-config mountPath: /config-workhorse readOnly: true - name: init-webservice-secrets mountPath: /init-config readOnly: true - name: webservice-secrets mountPath: /init-secrets readOnly: false - name: workhorse-secrets mountPath: /init-secrets-workhorse readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2" args: - /scripts/wait-for-deps env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "1" - name: ENABLE_BOOTSNAP value: "1" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: shared-tmp emptyDir: {} - name: webservice-metrics emptyDir: medium: Memory - name: webservice-config configMap: name: gitlab-webservice - name: workhorse-config configMap: name: gitlab-workhorse-default - name: init-webservice-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-workhorse-secret items: - key: shared_secret path: gitlab-workhorse/secret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: webservice-secrets emptyDir: medium: Memory - name: workhorse-secrets emptyDir: medium: Memory - name: shared-upload-directory emptyDir: {} - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-registry) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-registry namespace: gitlab labels: app: registry app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: registry release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: registry app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: registry release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: registry image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" env: - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 5000 - name: debug containerPort: 5001 readinessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep 5" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" command: - /scripts/wait-for-deps env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry - secret: name: gitlab-registry-secret items: - key: registry-auth.crt path: certificate.crt - secret: name: gitlab-registry-httpsecret items: - key: secret path: httpSecret - secret: name: gitlab-object-store-configs items: - key: registry.yaml path: storage/config - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-gitlab-shell (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-kas) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-kas (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-sidekiq-all-in-1-v2) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 350m minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-sidekiq-all-in-1-v2 (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-webservice-default) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 1 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-webservice-default (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-registry) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageUtilization: 75 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-registry (root level) (apps/v1/StatefulSet/gitlab/gitlab-gitaly) - one document removed: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: podManagementPolicy: Parallel replicas: 1 selector: matchLabels: app: gitaly release: gitlab serviceName: gitlab-gitaly template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9236" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9236" prometheus.io/scrape: "true" labels: app: gitaly app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitaly image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitaly/templates - name: CONFIG_DIRECTORY value: /etc/gitaly - name: GITALY_CONFIG_FILE value: /etc/gitaly/config.toml - name: SSL_CERT_DIR value: /etc/ssl/certs - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 ports: - name: grpc-gitaly containerPort: 8075 - name: http-metrics containerPort: 9236 readinessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 3 resources: requests: cpu: 100m memory: 200Mi startupProbe: failureThreshold: 60 grpc: port: 8075 initialDelaySeconds: 1 periodSeconds: 1 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: gitaly-config mountPath: /etc/gitaly/templates - name: gitaly-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: repo-data mountPath: /home/git/repositories securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: gitaly-config mountPath: /config readOnly: true - name: init-gitaly-secrets mountPath: /init-config readOnly: true - name: gitaly-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 terminationGracePeriodSeconds: 30 volumes: - name: gitaly-config configMap: name: gitlab-gitaly - name: gitaly-secrets emptyDir: medium: Memory - name: init-gitaly-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly_token - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: .gitlab_shell_secret - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca volumeClaimTemplates: - metadata: name: repo-data annotations: null labels: app: gitaly release: gitlab spec: resources: requests: storage: 50Gi selector: null storageClassName: nfs-subdir accessModes: - ReadWriteOnce (root level) (apps/v1/StatefulSet/gitlab/gitlab-redis-master) - one document removed: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis serviceName: gitlab-redis-headless template: metadata: annotations: prometheus.io/port: "9121" prometheus.io/scrape: "true" labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: redis image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-master.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: REDIS_REPLICATION_MODE value: master - name: ALLOW_EMPTY_PASSWORD value: no - name: REDIS_PASSWORD_FILE value: /opt/bitnami/redis/secrets/redis-password - name: REDIS_TLS_ENABLED value: no - name: REDIS_PORT value: "6379" ports: - name: redis containerPort: 6379 volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: redis-password mountPath: /opt/bitnami/redis/secrets/ - name: redis-data mountPath: /data - name: config mountPath: /opt/bitnami/redis/mounted-etc - name: empty-dir mountPath: /opt/bitnami/redis/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault - name: metrics image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4" imagePullPolicy: IfNotPresent command: - /bin/bash - "-c" - | if [[ -f '/secrets/redis-password' ]]; then export REDIS_PASSWORD=$(cat /secrets/redis-password) fi redis_exporter env: - name: REDIS_ALIAS value: gitlab-redis - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS value: ":9121" - name: REDIS_USER value: default livenessProbe: failureThreshold: 5 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 tcpSocket: port: metrics timeoutSeconds: 5 ports: - name: metrics containerPort: 9121 readinessProbe: failureThreshold: 3 httpGet: path: / port: metrics initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: empty-dir mountPath: /tmp subPath: app-tmp-dir - name: redis-password mountPath: /secrets/ securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: gitlab-redis-master terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: gitlab-redis-scripts defaultMode: 493 - name: health configMap: name: gitlab-redis-health defaultMode: 493 - name: redis-password secret: items: - key: secret path: redis-password secretName: gitlab-redis-secret - name: config configMap: name: gitlab-redis-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redis-data labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) (batch/v1/Job/gitlab/gitlab-migrations-c0164a8) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-c0164a8 namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-8e2a9a9 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) - one document removed: apiVersion: batch/v1beta1 kind: CronJob metadata: name: gitlab-toolbox-backup namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: concurrencyPolicy: Replace failedJobsHistoryLimit: 1 jobTemplate: spec: backoffLimit: 6 template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "false" labels: app: toolbox heritage: Helm release: gitlab spec: containers: - name: toolbox-backup image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca schedule: @daily startingDeadlineSeconds: null successfulJobsHistoryLimit: 3 suspend: false (root level) (v1/ServiceAccount/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: gitlab heritage: Helm release: gitlab (root level) (v1/ConfigMap/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-3" labels: app: gitlab heritage: Helm release: gitlab data: generate-secrets: | # vim: set filetype=sh: namespace=gitlab release=gitlab env=production pushd $(mktemp -d) # Args pattern, length function gen_random(){ head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2 } # Args: length function gen_random_base64(){ local len="$1" gen_random_bytes "$len" | base64 -w0 } # Args: length function gen_random_bytes(){ local len="$1" head -c "$len" /dev/urandom } # Args: yaml file, search path function fetch_rails_value(){ local value=$(yq --prettyPrint --no-colors ".${2}" $1) # Don't return null values if [ "${value}" != "null" ]; then echo "${value}"; fi } # Args: secretname function label_secret(){ local secret_name=$1 # Remove application labels if they exist kubectl --namespace=$namespace label \ secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ local secret_args=( "${@:2}") local secret_name=$1 if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]} else echo "secret \"$secret_name\" already exists." for arg in "${secret_args[@]}"; do local from=$(echo -n ${arg} | cut -d '=' -f1) if [ -z "${from##*literal*}" ]; then local key=$(echo -n ${arg} | cut -d '=' -f2) local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-) local flags="--namespace=$namespace --allow-missing-template-keys=false" if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then echo "key \"${key}\" does not exist. patching it in." if [ "${desiredValue}" != "" ]; then desiredValue=$(echo -n "${desiredValue}" | base64 -w 0) fi kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}" fi fi done fi label_secret $secret_name } # Initial root password generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64) # Redis password generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab shell generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitaly secret generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab runner secret generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token="" # GitLab Pages API secret # GitLab Pages auth secret for hashing cookie store when using access control # GitLab Pages OAuth secret # Gitlab-kas secret generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas private API secret generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas WebSocket Token secret generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72) # Registry certificates mkdir -p certs openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650 generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt # config/secrets.yaml if [ -n "$env" ]; then rails_secret="gitlab-rails-secret" # Fetch the values from the existing secret if it exists if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base") otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base") db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base") openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key") encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base") active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key") active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key") active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt") fi; # Generate defaults for any unset secrets secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}" encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) # 1. We set the following two keys as an array to support keys rotation. # The last key in the array is always used to encrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21 # while all the keys are used (in the order they're defined) to decrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26. # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976 # 2. We use the same method and length as Rails' defaults: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540 active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)} # Update the existing secret cat << EOF > rails-secrets.yml apiVersion: v1 kind: Secret metadata: name: $rails_secret type: Opaque stringData: secrets.yml: |- $env: secret_key_base: $secret_key_base otp_key_base: $otp_key_base db_key_base: $db_key_base encrypted_settings_key_base: $encrypted_settings_key_base openid_connect_signing_key: | $(echo "${openid_connect_signing_key}" | awk '{print " " $0}') active_record_encryption_primary_key: $active_record_encryption_primary_keys active_record_encryption_deterministic_key: $active_record_encryption_deterministic_keys active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt EOF kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml label_secret $rails_secret fi # Shell ssh host keys ssh-keygen -A mkdir -p host_keys cp /etc/ssh/ssh_host_* host_keys/ generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys # Gitlab-workhorse secret generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Registry http.secret secret generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation helm.sh/hook-weight: "-11" labels: app: gitlab heritage: Helm release: gitlab data: runcheck: | #!/bin/sh set -e notify() { echo "$1" echo -n "$1 " >> /dev/termination-log } greater_version() { test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1"; } is_semver() { printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" return "$?" } # For the PostgreSQL upgrade, you either need both secrets, or no secrets. # If there are no secrets, we will create them for you. # If the secrets aren't in either of these states, we assume you are upgrading from an older version # This is running ahead of version checks to ensure this always runs. This is to account for # installations outside of the official helm repo. secrets_dir="/etc/secrets/postgresql" if [ -d "${secrets_dir}" ]; then if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart" notify "There are some manual steps which need to be performed in order to upgrade the database" notify "Please see the upgrade documentation for instructions on how to proceed:" notify "https://docs.gitlab.com/charts/installation/upgrade.html" exit 1 fi fi fi MIN_VERSION=18.5 CHART_MIN_VERSION=9.5 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} # Only run check for semver releases if ! is_semver "$GITLAB_VERSION"; then exit 0 fi NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}') NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}') NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}') NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}') if [ ! -f /chart-info/gitlabVersion ]; then notify "It seems you are attempting an unsupported upgrade path." notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths" exit 1 fi OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion) OLD_VERSION_STRING=${OLD_VERSION_STRING#v} OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion) # Skip check if old version wasn't semver if ! is_semver "$OLD_VERSION_STRING"; then exit 0 fi OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}') OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}') OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}') OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}') # Checking Version if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})." notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding." # Link to upgrade docs if it is a major version jump if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html" notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi (root level) (rbac.authorization.k8s.io/v1/Role/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab rules: - resources: - secrets apiGroups: - verbs: - get - list - create - patch (root level) (rbac.authorization.k8s.io/v1/RoleBinding/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab roleRef: name: gitlab-shared-secrets apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: gitlab-shared-secrets kind: ServiceAccount namespace: gitlab (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-10" labels: app: gitlab heritage: Helm release: gitlab spec: backoffLimit: 2 template: metadata: labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: run-check image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - /bin/sh - /scripts/runcheck env: - name: GITLAB_VERSION value: "18.8.2" - name: CHART_VERSION value: "9.8.2" resources: requests: cpu: 50m volumeMounts: - name: chart-info mountPath: /chart-info - name: scripts mountPath: /scripts securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65534 restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault volumes: - name: chart-info configMap: name: gitlab-gitlab-chart-info optional: true - name: scripts configMap: name: gitlab-gitlab-upgrade-check flate error: current snapshot: reconcile completed with 1 failure(s): HelmRelease/flux-system/gitlab: helm template flux-system/gitlab: execution error at (gitlab/templates/NOTES.txt:222:3): CONFIGURATION CHECKS: redis: You must configure an Redis connetion. Please set `global.redis.host`. Since chart v10.0.0, external Redis became required. If you were using the bundled Redis chart refer to https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/. ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/523)

renovate-bot force-pushed renovate/gitlab-10.x from ef4449401c

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to 976834ff71

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

2026-10-15 14:13:31 +00:00

Compare

ci-bot commented

2026-10-15 14:16:57 +00:00

Member

flate diff

rules  (rbac.authorization.k8s.io/v1/ClusterRole/kube-prometheus-stack-operator)
  - six list entries removed:           + three list entries added:
    - resources:                          - resources:
      - alertmanagers                       - alertmanagers
      - prometheusagents                    - alertmanagers/finalizers
      - prometheuses                        - alertmanagers/status
      - thanosrulers                        - alertmanagerconfigs
      apiGroups:                            - prometheuses
      - monitoring.coreos.com               - prometheuses/finalizers
      verbs:                                - prometheuses/status
      - patch                               - prometheusagents
    - resources:                            - prometheusagents/finalizers
      - alertmanagers/status                - prometheusagents/status
      - podmonitors/status                  - thanosrulers
      - probes/status                       - thanosrulers/finalizers
      - prometheuses/status                 - thanosrulers/status
      - prometheusagents/status             - scrapeconfigs
      - prometheusrules/status              - scrapeconfigs/status
      - scrapeconfigs/status                - servicemonitors
      - servicemonitors/status              - servicemonitors/status
      - thanosrulers/status                 - podmonitors
      apiGroups:                            - podmonitors/status
      - monitoring.coreos.com               - probes
      verbs:                                - probes/status
      - create                              - prometheusrules
      - update                              - prometheusrules/status
      - patch                               apiGroups:
      - delete                              - monitoring.coreos.com
    - resources:                            verbs:
      - alertmanagers/finalizers            - "*"
      - prometheusagents/finalizers       - resources:
      - prometheuses/finalizers             - statefulsets
      - thanosrulers/finalizers             apiGroups:
      apiGroups:                            - apps
      - monitoring.coreos.com               verbs:
      verbs:                                - "*"
      - update                            - resources:
    - resources:                            - configmaps
      - alertmanagers                       - secrets
      - alertmanagerconfigs                 apiGroups:
      - podmonitors                         -
      - probes                              verbs:
      - prometheusagents                    - "*"
      - prometheuses
      - prometheusrules
      - servicemonitors
      - scrapeconfigs
      - thanosrulers
      apiGroups:
      - monitoring.coreos.com
      verbs:
      - get
      - list
      - watch
    - resources:
      - statefulsets
      apiGroups:
      - apps
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - patch
      - delete
    - resources:
      - configmaps
      - secrets
      apiGroups:
      -
      verbs:
      - get
      - list
      - watch
      - create
      - update
      - delete

metadata  (v1/Service/kube-privileged/node-exporter)
  + one map entry added:
    annotations:
      prometheus.io/scrape: "true"

spec.template.spec.containers.kube-state-metrics.image  (apps/v1/Deployment/monitoring/kube-state-metrics)
  ± value change
    - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
    + registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1

spec.template.spec  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.template.spec.containers.kube-prometheus-stack.args  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  - three list entries removed:
    - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1"
    - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.4"
    - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1"
    
  
  + three list entries added:
    - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1"
    - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2"
    - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1"
    
  

spec.template.spec.containers.kube-prometheus-stack.image  (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator)
  ± value change
    - quay.io/prometheus-operator/prometheus-operator:v0.94.1
    + quay.io/prometheus-operator/prometheus-operator:v0.92.1

spec  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  - one map entry removed:        + one map entry added:
    nodeSelector:                   hostNetwork: false
      kubernetes.io/os: linux

spec.image  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  ± value change
    - quay.io/prometheus/alertmanager:v0.34.1
    + quay.io/prometheus/alertmanager:v0.33.1

spec.version  (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack)
  ± value change
    - v0.34.1
    + v0.33.1

spec  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.image  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  ± value change
    - quay.io/prometheus/prometheus:v3.15.0-distroless
    + quay.io/prometheus/prometheus:v3.13.1-distroless

spec.version  (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack)
  ± value change
    - v3.15.0-distroless
    + v3.13.1-distroless

spec.groups.kube-apiserver-burnrate.rules.rules  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules)
  - eleven list entries removed:
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
        )
      labels:
        verb: read
      record: "cluster_verb:apiserver_request_sli_bad_events:rate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
        )
      labels:
        verb: write
      record: "cluster_verb:apiserver_request_sli_bad_events:rate5m"
    - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))"
      labels:
        verb: read
      record: "cluster_verb:apiserver_request_sli_events:rate5m"
    - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))"
      labels:
        verb: write
      record: "cluster_verb:apiserver_request_sli_events:rate5m"
    - expr: |
        cluster_verb:apiserver_request_sli_bad_events:rate5m
        /
        cluster_verb:apiserver_request_sli_events:rate5m
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate2h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate30m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate6h"
    - expr: |
        avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[1d])
        /
        avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[1d])
      record: "apiserver_request:burnrate1d"
    - expr: |
        avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[3d])
        /
        avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[3d])
      record: "apiserver_request:burnrate3d"
    
  
  + ten list entries added:
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d]))
      labels:
        verb: read
      record: "apiserver_request:burnrate1d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d]))
      labels:
        verb: read
      record: "apiserver_request:burnrate3d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            (
              (
                sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m]))
                or
                vector(0)
              )
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m]))
              +
              sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m]))
            )
          )
          +
          # errors
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m]))
      labels:
        verb: read
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate1h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate2h"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate30m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d]))
      labels:
        verb: write
      record: "apiserver_request:burnrate3d"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m]))
      labels:
        verb: write
      record: "apiserver_request:burnrate5m"
    - expr: |
        (
          (
            # too slow
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h]))
            -
            sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h]))
          )
          +
          sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h]))
        )
        /
        sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h]))
      labels:
        verb: write
      record: "apiserver_request:burnrate6h"
    
  

spec.groups.kubernetes-apps.rules.KubeJobNotCompleted.expr  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps)
  ± value change in multiline text (one insert, one deletion)
      time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"}
        and
    - kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
    -   unless on (namespace, job_name, cluster)
    - max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1)
    + kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200
  
  

spec.groups.kubernetes-apps.rules.KubePdbNotEnoughHealthyPods.expr  (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps)
  ± value change in multiline text (no inserts, one deletion)
      (
        kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"}
        -
        kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"}
      )
    - > 0
    - and
    - kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"}
      > 0
  
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-coredns)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-etcd)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler)
  - one map entry removed:
    authorization:
      type: Bearer
      credentials:
        name: kube-prometheus-stack-prometheus-token
        key: token
  
  + one map entry added:
    bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
  

spec.endpoints.0.tlsConfig  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler)
  - one map entry removed:
    ca:
      configMap:
        name: kube-root-ca.crt
        key: ca.crt
  
  + one map entry added:
    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
  

spec.endpoints  (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kubelet)
  - three list entries removed:
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - authorization:
        type: Bearer
        credentials:
          name: kube-prometheus-stack-prometheus-token
          key: token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        ca:
          configMap:
            name: kube-root-ca.crt
            key: ca.crt
        insecureSkipVerify: true
    
  
  + three list entries added:
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      metricRelabelings:
      - action: drop
        regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)?
        sourceLabels:
        - __name__
        - le
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      interval: 10s
      metricRelabelings:
      - action: drop
        regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_(mapped_file|swap)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_(file_descriptors|tasks_state|threads_max)
        sourceLabels:
        - __name__
      - action: drop
        regex: container_memory_failures_total;hierarchy
        sourceLabels:
        - __name__
        - scope
      - action: drop
        regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*"
        sourceLabels:
        - __name__
        - interface
      - action: drop
        regex: "container_spec.*"
        sourceLabels:
        - __name__
      - action: drop
        regex: .+;
        sourceLabels:
        - id
        - pod
      path: /metrics/cadvisor
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
      trackTimestampsStaleness: true
    - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      honorLabels: true
      honorTimestamps: true
      path: /metrics/probes
      port: https-metrics
      relabelings:
      - action: replace
        sourceLabels:
        - __metrics_path__
        targetLabel: metrics_path
      scheme: https
      tlsConfig:
        caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecureSkipVerify: true
    
  

spec.template.spec  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.template.spec.containers.create.image  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create)
  ± value change
    - ghcr.io/jkroepke/kube-webhook-certgen:1.11.0
    + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4

spec.template.spec  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch)
  - one map entry removed:
    nodeSelector:
      kubernetes.io/os: linux

spec.template.spec.containers.patch.image  (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch)
  ± value change
    - ghcr.io/jkroepke/kube-webhook-certgen:1.11.0
    + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4

(root level)  (networking.k8s.io/v1/NetworkPolicy/gitlab/gitlab-redis)
- one document removed:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: gitlab-redis
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    egress:
    -   ingress:
    - ports:
      - port: 6379
    - ports:
      - port: 9121
    podSelector:
      matchLabels:
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    policyTypes:
    - Ingress
    - Egress

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-kas)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: kas
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-sidekiq-all-in-1-v1)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-sidekiq-all-in-1-v1
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab

(root level)  (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-registry-v1)
- one document removed:
  apiVersion: policy/v1beta1
  kind: PodDisruptionBudget
  metadata:
    name: gitlab-registry-v1
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxUnavailable: 1
    selector:
      matchLabels:
        app: registry
        release: gitlab

(root level)  (v1/ServiceAccount/gitlab/gitlab-runner-access)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-runner-access
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab

(root level)  (v1/ServiceAccount/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  automountServiceAccountToken: false

(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-runner)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    check-live: |
      #!/bin/bash
      set -eou pipefail
      
      # default timeout is 3 seconds, can be overriden
      VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}}
      
      if ! /usr/bin/pgrep -f ".*register-the-runner"  > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner"  > /dev/null ; then
        exit 1
      fi
      
      status=0
      # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL)
      verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$?
      
      # timeout exit code is 143 with busybox, and 124 with coreutils
      if (( status == 143 )) || (( status == 124 )) ; then
        echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2
        exit 0
      elif (( status > 0 )) ; then
        exit ${status}
      fi
      
      grep -qE "is (alive|valid)" <<<"${verify_output}"
      
    config.template.toml: |
      [[runners]]
        [runners.kubernetes]
        image = "archlinux/archlinux:latest"
        namespace_per_job = true
        node_selector_overwrite_allowed = "kubernetes.io/arch=.*"
        pull_policy = ["always", "always"]
      
        [runners.kubernetes.node_selector]
        "kubernetes.io/arch" = "amd64"
      
        [runners.cache]
          Type = "s3"
          Path = "gitlab-runner"
          Shared = true
          [runners.cache.s3]
            ServerAddress = "brickyard.home.arpa:3900"
            BucketName = "gitlab-runner-cache"
            BucketLocation = "apartment"
            Insecure = true
            AuthenticationType = "access-key"
            PathStyle = true
      
    config.toml: |
      shutdown_timeout = 0
      concurrent = 10
      check_interval = 3
      log_level = "info"
      
    entrypoint: |
      #!/bin/bash
      set -e
      
      export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/"
      mkdir -p ${CONFIG_PATH_FOR_INIT}
      cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT}
      
      # Set up environment variables for cache
      if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
        export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
        export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
      fi
      
      if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
      elif [[ -f /secrets/gcs-application-credentials-file ]]; then
        export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
      else
        if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
          export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
          # echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
          export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
        fi
      fi
      
      if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
        export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
        export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
      fi
      
      if [[ -f /secrets/runner-registration-token ]]; then
        export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
      fi
      
      if [[ -f /secrets/runner-token ]]; then
        export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
      fi
      
      # Register the runner
      if ! sh /configmaps/register-the-runner; then
        exit 1
      fi
      
      # Run pre-entrypoint-script
      if ! bash /configmaps/pre-entrypoint-script; then
        exit 1
      fi
      
      # Start the runner
      exec /entrypoint run \
        --working-directory=/home/gitlab-runner
      
    pre-entrypoint-script: 
    register-the-runner: |
      #!/bin/sh
      signal_handler() {
        if [ ! -d "/proc/$register_pid" ]; then
          wait $register_pid
        fi
        exit
      }
      trap 'signal_handler' QUIT INT
      
      MAX_REGISTER_ATTEMPTS=30
      
      # Reset/unset the not needed flags when an authentication token
      RUN_UNTAGGED=""
      ACCESS_LEVEL=""
      
      if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then
        RUN_UNTAGGED=""
        ACCESS_LEVEL=""
        unset REGISTER_LOCKED
        unset RUNNER_TAG_LIST
      fi
      
      for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
        echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
        /entrypoint register \
          ${RUN_UNTAGGED} \
          ${ACCESS_LEVEL} \
          --template-config /configmaps/config.template.toml \
          --non-interactive &
      
        register_pid=$!
        wait $register_pid
        retval=$?
      
        if [ ${retval} = 0 ]; then
          break
        elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
          exit 1
        fi
      
        sleep 5
      done
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.toml.tpl: |
      # The directory where Gitaly's executables are stored
      bin_dir = "/usr/local/bin"
      
      # listen on a TCP socket. This is insecure (no authentication)
      listen_addr = ":8075"
      
      # Directory where internal sockets reside
      # note: no value will result in a `/tmp/gitlab-internal-*` path
      # internal_socket_dir = "/home/git"
      
      # If metrics collection is enabled, inform gitaly about that
      prometheus_listen_addr = ":9236"
      
      # Graceful shutdown timeout, how long to wait for in-flight requests to complete
      graceful_restart_timeout = "25s"
      
      # Storage configuration
      {% $storages := coll.Slice  "default" %}
      {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %}
      {% $index := 0 %}
      {% if regexp.Match "^[0-9]+$" $hostid %}
        {% $index = conv.ToInt64 $hostid %}
      {% end %}
      {% if len $storages | lt $index %}
      [[storage]]
      name = "{% index $storages $index %}"
      path = "/home/git/repositories"
      {% else %}
      {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %}
      {% end %}
      
      [logging]
      format = "json"
      dir = "/var/log/gitaly"
      
      [auth]
      token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %}
      
      [git]
      use_bundled_binaries = true
      ignore_gitconfig = true
      
      [gitlab-shell]
      # The directory where gitlab-shell is installed
      dir = "/srv/gitlab-shell"
      
      [gitlab]
      # location of shared secret for GitLab Shell / API interaction
      secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret"
      # URL of API
      url = "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      [gitlab.http-settings]
      # read_timeout = 300
      # user = someone
      # password = somepass
      # ca_file = /etc/ssl/cert.pem
      # ca_path = /etc/pki/tls/certs
      
      [hooks]
      # directory containing custom hooks
      custom_hooks_dir = "/home/git/custom_hooks"
      
    configure: |
      set -e
      mkdir -p /init-secrets/gitaly /init-secrets/shell
      cp -v -r -L /init-config/.gitlab_shell_secret  /init-secrets/shell/.gitlab_shell_secret
      cp -v -r -L /init-config/gitaly_token  /init-secrets/gitaly/gitaly_token
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # optional
      for secret in redis redis-sentinel postgres gitlab-exporter ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    gitlab-exporter.yml.erb: |
      server:
        name: webrick
        listen_address: "*"
        listen_port: 9168
        
      
      probes:
        db_common: &db_common
          methods:
            - probe_db
          opts:
            connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>'
        database:
          multiple: true
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
        database_bloat:
          class_name: Database::BloatProber
          <<: *db_common
      
        sidekiq: &sidekiq
          methods:
            - probe_queues
            - probe_workers
            - probe_retries
            - probe_stats
          opts:
            redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
            redis_enable_client: false
            probe_non_namespaced: true
      
        ruby: &ruby
          methods:
            - probe_gc
          opts:
            quantiles: false
      
        metrics:
          multiple: true
          ruby:
            <<: *ruby
          sidekiq:
            <<: *sidekiq
          ci_builds:
            class_name: Database::CiBuildsProber
            <<: *db_common
          tuple_stats:
            class_name: Database::TuplesProber
            <<: *db_common
          rows_count:
            class_name: Database::RowCountProber
            <<: *db_common
          pg_sequences:
            class_name: Database::PgSequencesProber
            <<: *db_common
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-shell-sshd)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell-sshd
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    sshd_config: |
      #	$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $
      
      # This is the sshd server system-wide configuration file.  See
      # sshd_config(5) for more information.
      
      # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
      
      # The strategy used for options in the default sshd_config shipped with
      # OpenSSH is to specify options with their default value where
      # possible, but leave them commented.  Uncommented options override the
      # default value.
      
      Port 2222
      #AddressFamily any
      #ListenAddress 0.0.0.0
      #ListenAddress ::
      
      #HostKey /etc/ssh/ssh_host_rsa_key
      #HostKey /etc/ssh/ssh_host_dsa_key
      #HostKey /etc/ssh/ssh_host_ecdsa_key
      #HostKey /etc/ssh/ssh_host_ed25519_key
      
      # Ciphers and keying
      #RekeyLimit default none
      
      # Logging
      #SyslogFacility AUTH
      LogLevel ERROR
      
      # Authentication:
      
      PermitRootLogin no
      #StrictModes yes
      #MaxAuthTries 6
      #MaxSessions 10
      
      #PubkeyAuthentication yes
      
      #AuthorizedPrincipalsFile none
      
      # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
      #HostbasedAuthentication no
      # Change to yes if you don't trust ~/.ssh/known_hosts for
      # HostbasedAuthentication
      #IgnoreUserKnownHosts no
      # Don't read the user's ~/.rhosts and ~/.shosts files
      #IgnoreRhosts yes
      
      #PermitEmptyPasswords no
      
      # Change to no to disable s/key passwords
      #ChallengeResponseAuthentication yes
      
      # Kerberos options
      #KerberosAuthentication no
      #KerberosOrLocalPasswd yes
      #KerberosTicketCleanup yes
      #KerberosGetAFSToken no
      
      # GSSAPI options
      #GSSAPIAuthentication no
      #GSSAPICleanupCredentials yes
      
      # Set this to 'yes' to enable PAM authentication, account processing,
      # and session processing. If this is enabled, PAM authentication will
      # be allowed through the ChallengeResponseAuthentication and
      # PasswordAuthentication.  Depending on your PAM configuration,
      # PAM authentication via ChallengeResponseAuthentication may bypass
      # the setting of "PermitRootLogin without-password".
      # If you just want the PAM account and session checks to run without
      # PAM authentication, then enable this but set PasswordAuthentication
      # and ChallengeResponseAuthentication to 'no'.
      #UsePAM no
      
      #AllowAgentForwarding yes
      #AllowTcpForwarding yes
      #GatewayPorts no
      #X11Forwarding no
      #X11DisplayOffset 10
      #X11UseLocalhost yes
      #PermitTTY yes
      #PrintMotd yes
      #PrintLastLog yes
      #TCPKeepAlive yes
      #UseLogin no
      #PermitUserEnvironment no
      #Compression delayed
      ClientAliveInterval 0
      #ClientAliveCountMax 3
      #UseDNS no
      PidFile /srv/sshd/sshd.pid
      #PermitTunnel no
      #ChrootDirectory none
      #VersionAddendum none
      
      # no default banner path
      #Banner none
      
      # override default of no subsystems
      # Subsystem	sftp	/usr/lib/ssh/sftp-server
      
      # the following are HPN related configuration options
      # tcp receive buffer polling. disable in non autotuning kernels
      #TcpRcvBufPoll yes
      
      # disable hpn performance boosts
      #HPNDisabled no
      
      # buffer size for hpn to non-hpn connections
      #HPNBufferSize 2048
      
      
      # Example of overriding settings on a per-user basis
      #Match User anoncvs
      #	X11Forwarding no
      #	AllowTcpForwarding no
      #	PermitTTY no
      #	ForceCommand cvs server
      
      # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
      # but this is overridden so installations will only check .ssh/authorized_keys
      AuthorizedKeysFile	.ssh/authorized_keys
      
      AuthorizedKeysCommand /authorized_keys %u %k
      AuthorizedKeysCommandUser git
      
      PasswordAuthentication no
      
      AllowUsers git
      
      # Enable the use of Git protcol v2
      AcceptEnv GIT_PROTOCOL
      
      # Hard disable all forwarding
      DisableForwarding yes
      
      # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon.
      # See `man sshd_config(5)`
      
      MaxStartups 10:30:100
      
      
      # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in
      LoginGraceTime 60
      
      # Includes
      Include /etc/ssh/sshd_config.d/*.conf
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      # GitLab user. git by default
      user: git
      
      # Url to gitlab instance. Used for api calls. Should end with a slash.
      gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/"
      
      secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret
      
      # File used as authorized_keys for gitlab user
      auth_file: "/home/git/.ssh/authorized_keys"
      
      # Log file.
      # Default is gitlab-shell.log in the root directory.
      log_file: "/var/log/gitlab-shell/gitlab-shell.log"
      
      log_format: json
      
      # Audit usernames.
      # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but
      # incurs an extra API call on every gitlab-shell command.
      audit_usernames: false
      
      
      lfs:
        pure_ssh_protocol: false
      pat:
        enabled: true
        allowed_scopes:
          []
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # END gitlab.scripts.configure.secrets
      mkdir -p /${secret_dir}/ssh
      cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/
      chmod 0400 /${secret_dir}/ssh/ssh_host_*
      
    krb5.conf: 
  


(root level)  (v1/ConfigMap/gitlab/gitlab-nginx-ingress-tcp)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-nginx-ingress-tcp
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:"

(root level)  (v1/ConfigMap/gitlab/gitlab-kas)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yaml: |
      agent:
        kubernetes_api:
          listen:
            address: :8154
          url_path_prefix: /k8s-proxy
          websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret
        listen:
          address: :8150
          websocket: true
      api:
        listen:
          address: :8153
          authentication_secret_file: /etc/kas/.gitlab_kas_secret
      gitlab:
        address: http://gitlab-webservice-default.gitlab.svc:8181
        authentication_secret_file: /etc/kas/.gitlab_kas_secret
        external_url: https://code.nogweii.net
      observability:
        listen:
          address: :8151
        liveness_probe:
          url_path: /liveness
        readiness_probe:
          url_path: /readiness
      private_api:
        listen:
          address: :8155
          authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret
      redis:
        database_index: 0
        password_file: /etc/kas/redis/redis-password
        server:
          address: gitlab-redis-master.gitlab.svc:6379
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-migrations)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-migrations
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in rails-secrets migrations gitaly ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          signup_enabled: false
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
      
    installation_type: |
      gitlab-helm-chart
      
    pages_redirect_uri: "https://projects.aether.page/auth"
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-sidekiq)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-sidekiq
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "127.0.0.0/8"
            - "::1/128"
          sidekiq_exporter:
            enabled: true
            address: "*"
            port: 3807
            log_enabled: false
          sidekiq_health_checks:
            enabled: true
            address: "*"
            port: 3808
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-toolbox)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
      
      
      if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then
      cat <<EOF > "/${secret_dir}/.s3cfg"
      [default]
      access_key = $(cat /init-secrets/minio/accesskey)
      secret_key = $(cat /init-secrets/minio/secretkey)
      bucket_location = us-east-1
      host_base = minio.code.nogweii.net
      host_bucket = minio.code.nogweii.net/%(bucket)
      default_mime_type = binary/octet-stream
      enable_multipart = True
      multipart_max_chunks = 10000
      multipart_chunk_size_mb = 128
      recursive = True
      recv_chunk = 65536
      send_chunk = 65536
      server_side_encryption = False
      signature_v2 = True
      socket_timeout = 300
      use_mime_magic = False
      verbosity = WARNING
      website_endpoint = https://minio.code.nogweii.net
      EOF
      else
        mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg"
      fi
      
    configure-gsutil: |
      if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then
        # The following script is used to configure gsutil when creating backups
        # It provides inputs to the `gsutil config -e` prompt as follows:
        # 1) Path to service account JSON key file
        # 2) Do not set permissions for key file
        # 3) GCP Project ID
        # 4) Decline anonymous usage statistics
        printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e
      else
        # If the backup config is not configured, assume that
        # Application Default Credentials are used with a service account.
        # This enables GKE Workload Identity Federation to work.
        echo '[GoogleCompute]\nservice_account = default' > ~/.boto
      fi
      
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - 127.0.0.0/8
          sidekiq_exporter:
        extra:
        
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-webservice)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
        adapter: redis
      
    configure: |
      # BEGIN gitlab.scripts.configure.secrets
      set -e
      config_dir="/init-config"
      secret_dir="/init-secrets"
      # required
      for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do
        mkdir -p "${secret_dir}/${secret}"
        cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
      done
      # optional
      for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do
        if [ -e "${config_dir}/${secret}" ]; then
          mkdir -p "${secret_dir}/${secret}"
          cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
        fi
      done
      # END gitlab.scripts.configure.secrets
    database.yml.erb: |
      
      production:
        main:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: true
          
          
        ci:
          adapter: postgresql
          encoding: unicode
          database: gitlab-prod
          username: gitlab
          password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>
          host: "db-gitlab-rw.gitlab.svc"
          port: 5432
          connect_timeout: 
          keepalives: 
          keepalives_idle: 
          keepalives_interval: 
          keepalives_count: 
          tcp_user_timeout: 
          application_name: 
          prepared_statements: false
          database_tasks: false
          
          
      
    gitlab.yml.erb: |
      production: &base
        gitlab:
          host: code.nogweii.net
          https: true
          ssh_host: "code.nogweii.net"
          action_cable_allowed_origins: []
          max_request_duration_seconds: 57
          impersonation_enabled: 
          application_settings_cache_seconds: 60
          usage_ping_enabled: true
          seat_link_enabled: true
          username_changing_enabled: true
          issue_closing_pattern: 
          default_theme: 
          default_color_mode: 
          default_syntax_highlighting_theme: 
          default_projects_features:
            issues: true
            merge_requests: true
            wiki: true
            snippets: true
            builds: true
            container_registry: true
          signup_enabled: false
          graphql_timeout: 
          webhook_timeout: 
          trusted_proxies:
          time_zone: "UTC"        
          email_from: "gitlab@aether.earth"
          email_display_name: "GitLab"
          email_reply_to: "gitlab+noreply@aether.earth"
          email_subject_suffix: ""
        
        gravatar:
          plain_url: 
          ssl_url: 
        extra:
          
          
          
          
          
          
        # Consolidated object storage configuration
        ## property local configuration will override object_store
        object_store:
          enabled: true
          proxy_download: true
          connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %>
          objects:
            artifacts:
              bucket: gitlab-artifacts
              proxy_download: true
            lfs:
              bucket: gitlab-lfs
              proxy_download: true
            uploads:
              bucket: gitlab-uploads
              proxy_download: true
            packages:
              bucket: gitlab-packages
              proxy_download: true
            external_diffs:
              bucket: gitlab-external-diffs
              proxy_download: true
            terraform_state:
              bucket: gitlab-terraform-state
            dependency_proxy:
              bucket: gitlab-dependency-proxy
              proxy_download: true
            ci_secure_files:
              bucket: gitlab-ci-secure-files
            pages:
              bucket: gitlab-pages
        artifacts:
          enabled: true
        lfs:
          enabled: true
        uploads:
          enabled: true
        packages:
          enabled: true
        external_diffs:
          enabled: true
          when: 
        terraform_state:
          enabled: true
        ci_secure_files:
          enabled: true
        dependency_proxy:
          enabled: true
        
        sentry:
          enabled: false
          dsn: 
          clientside_dsn: 
          environment: 
        gitlab_docs:
          enabled: false
          host: ""
        
        sidekiq:
          log_format: json
        oidc_provider:
          openid_id_token_expire_in_seconds: 120
        
        pages:
          enabled: false
          access_control: false
          artifacts_server: true
          path: /srv/gitlab/shared/pages
          host: aether.page
          port: 443
          https: true
          secret_file: /etc/gitlab/pages/secret
          external_http: false
          external_https: false
          local_store:
            enabled: false
            path: 
          namespace_in_path: false
        
        mattermost:
          enabled: false
        gitlab_ci:
        ldap:
          enabled: false
        
        omniauth:
          enabled: true
          sync_profile_from_provider: ["openid_connect"]
          sync_profile_attributes: ["email","name"]
          allow_single_sign_on: ["openid_connect"]
          block_auto_created_users: false
          auto_link_ldap_user: false
          auto_link_saml_user: false
          auto_link_user: ["openid_connect"]
          external_providers: []
          providers:
            - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %>
        kerberos:
          enabled: false
          keytab: /etc/krb5.keytab
          use_dedicated_port: false
          port: 8443
          https: true
          simple_ldap_linking_allowed_realms: []
        
        duo_auth:
          enabled: false
          hostname: 
          integration_key: 
          secret_key: 
        shared:
        gitaly:
          client_path: /home/git/gitaly/bin
          token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>
        repositories:
          storages: # You must have at least a `default` storage path.
            default:
              path: /var/opt/gitlab/repo
              gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075
            
        backup:
          path: "tmp/backups"   # Relative paths are relative to Rails.root (default: tmp/backups/)
        gitlab_kas:
          enabled: true
          secret_file: /etc/gitlab/kas/.gitlab_kas_secret
          external_url: "wss://k.code.nogweii.net"
          internal_url: "grpc://gitlab-kas.gitlab.svc:8153"
          
        
        
        
        # Zoekt secrets are present, load them.
        zoekt:
          username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username
          password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password
        gitlab_shell:
          path: /home/git/gitlab-shell/
          hooks_path: /home/git/gitlab-shell/hooks/
          upload_pack: true
          receive_pack: true
          ssh_port: 22222
          secret_file: /etc/gitlab/shell/.gitlab_shell_secret
        workhorse:
          secret_file: /etc/gitlab/gitlab-workhorse/secret
        git:
          bin_path: /usr/bin/git
        webpack:
        monitoring:
          ip_whitelist:
            - "0.0.0.0/0"
            - "::/0"
          web_exporter:
            enabled: true
            address: "0.0.0.0"
            port: 8083
          sidekiq_exporter:
        shutdown:
          blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %>
        rack_attack:
          git_basic_auth:
        ## Registry Integration
        registry:
          enabled: true
          host: c.code.nogweii.net
          api_url: http://gitlab-registry.gitlab.svc:5000
          key: /etc/gitlab/registry/gitlab-registry.key
          issuer: gitlab-issuer
          notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %>
        smartcard:
          enabled: false
          ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt'
          client_certificate_required_host: smartcard.code.nogweii.net
          client_certificate_required_port: 443
          san_extensions: false
          required_for_git_access: false
        
      
    installation_type: |
      gitlab-helm-chart
      
    krb5.conf: 
    redis.action_cable.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    resque.yml.erb: |
      production:
        url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0
        
        id:
      
    session_store.yml.erb: |
      production:
          session_cookie_token_prefix: ""
      
    smtp_settings.rb: |
      smtp_settings = {
        address: "mail-relay.email.svc.cluster.local",
        port: 587,
        ca_file: "/etc/ssl/certs/ca-certificates.crt",
        
        enable_starttls_auto: false,
        tls: false,
        openssl_verify_mode: "peer",
        open_timeout: 30,
        read_timeout: 60
      }
      
      Rails.application.config.action_mailer.delivery_method = :smtp
      ActionMailer::Base.delivery_method = :smtp
      
      ActionMailer::Base.smtp_settings = smtp_settings
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-workhorse-default)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-workhorse-default
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    configure: |
      set -e
      mkdir -p /init-secrets-workhorse/gitlab-workhorse
      cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret
      mkdir -p /init-secrets-workhorse/redis
      cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/
      if [ -f /init-config/objectstorage/object_store ]; then
        mkdir -p /init-secrets-workhorse/objectstorage
        cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/
      fi
      
    installation_type: |
      gitlab-helm-chart
      
    workhorse-config.toml.tpl: |
      shutdown_timeout = "61s"
      [redis]
      DB = 0
      URL = "redis://gitlab-redis-master.gitlab.svc:6379"
      Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %}
      {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%}
      {%- $connection := coll.Dict "provider" "" -%}
      {%- if file.Exists "/etc/gitlab/minio/accesskey" %}
        {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%}
        {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%}
        {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%}
      {%- end %}
      {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %}
        {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%}
      {%- end %}
      {%- if has $supported_providers $connection.provider %}
      [object_storage]
      provider = "{% $connection.provider %}"
      {%-   if eq $connection.provider "AWS" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %}
      # AWS / S3 object storage configuration.
      [object_storage.s3]
      # access/secret can be blank!
      aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %}
      aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "AzureRM" %}
      {%-     $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %}
      # Azure Blob storage configuration.
      [object_storage.azurerm]
      azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %}
      azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %}
      {%-   else if eq $connection.provider "Google" %}
      # Google storage configuration.
      [object_storage.google]
      {% $connection | coll.Omit "provider" | data.ToTOML %}
      {%-   end %}
      {%- end %}
      [image_resizer]
      max_scaler_procs = 2
      max_filesize = 250000
      [[listeners]]
      network = "tcp"
      addr = ":8181"
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-webservice-tests)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-webservice-tests
    namespace: gitlab
    labels:
      app: webservice
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    test_login: |
      set -e
      echo 'Start Test'
      endpoint="https://code.nogweii.net"
      cookie_read="-c /tmp/test_login.cookie"
      cookie_readwrite="$cookie_read -b /tmp/test_login.cookie"
      
      signin_url="$endpoint/users/sign_in"
      echo "Login to create a session: $signin_url"
      csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*')
      curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)"
      
      profile_url="$endpoint/-/profile"
      echo "Confirm session valid: $profile_url"
      profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url)
      
      if [ "$profile_status" != "200" ]; then
        echo "Error: Session Invalid"
        cat /tmp/profile_output
        exit 1
      fi
      
      echo 'Test Passed'
      exit 0
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-redis-configuration)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-configuration
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    master.conf: |
      dir /data
      # User-supplied master configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of master configuration
    redis.conf: |
      # User-supplied common configuration:
      # Enable AOF https://redis.io/topics/persistence#append-only-file
      appendonly yes
      # Disable RDB persistence, AOF persistence already enabled.
      save ""
      # End of common configuration
    replica.conf: |
      dir /data
      # User-supplied replica configuration:
      rename-command FLUSHDB ""
      rename-command FLUSHALL ""
      # End of replica configuration

(root level)  (v1/ConfigMap/gitlab/gitlab-redis-health)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-health
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    ping_liveness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then
        echo "$response"
        exit 1
      fi
    ping_liveness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_liveness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_liveness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_liveness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}')
      if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h localhost \
          -p $REDIS_PORT \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
    ping_readiness_local_and_master.sh: |
      script_dir="$(dirname "$0")"
      exit_status=0
      "$script_dir/ping_readiness_local.sh" $1 || exit_status=$?
      "$script_dir/ping_readiness_master.sh" $1 || exit_status=$?
      exit $exit_status
    ping_readiness_master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")"
      [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD"
      response=$(
        timeout -s 15 $1 \
        redis-cli \
          -h $REDIS_MASTER_HOST \
          -p $REDIS_MASTER_PORT_NUMBER \
          ping
      )
      if [ "$?" -eq "124" ]; then
        echo "Timed out"
        exit 1
      fi
      if [ "$response" != "PONG" ]; then
        echo "$response"
        exit 1
      fi
  


(root level)  (v1/ConfigMap/gitlab/gitlab-redis-scripts)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-redis-scripts
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  data:
    start-master.sh: |
      #!/bin/bash
      
      [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
      if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf
      fi
      if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then
          cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf
      fi
      ARGS=("--port" "${REDIS_PORT}")
      ARGS+=("--requirepass" "${REDIS_PASSWORD}")
      ARGS+=("--masterauth" "${REDIS_PASSWORD}")
      ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf")
      ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf")
      exec redis-server "${ARGS[@]}"
  


(root level)  (v1/ConfigMap/gitlab/gitlab-registry)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      http:
        addr: :5000
        # `host` is not configurable
        # `prefix` is not configurable
        debug:
          addr: :5001
          prometheus:
            enabled: false
            path: /metrics
        draintimeout: 0
        headers:
          X-Content-Type-Options: [nosniff]
        secret: "HTTP_SECRET"
        relativeurls: false
      health:
        storagedriver:
          enabled: false
          interval: 10s
          threshold: 3
      auth:
        token:
          realm: https://code.nogweii.net/jwt/auth
          service: container_registry
          issuer: gitlab-issuer
          # This is provided from the initContainer execution, at a known path.
          rootcertbundle: /etc/docker/registry/certificate.crt
          autoredirect: false
      validation:
        disabled: true
        manifests:
          referencelimit: 0
          payloadsizelimit: 0
          urls:
            allow:
            deny:
      
      notifications:
      reporting:
      profiling:
      storage:
        maintenance:
          readonly:
            enabled: false
          uploadpurging:
            enabled: true
            age: 168h
            interval: 24h
            dryrun: false
        redirect:
          disable: true
          exceptions:
      middleware:
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
      gc:
        disabled: false
      redis:
      rate_limiter:
        enabled: false
      
    configure: |
      if [ -e /config/accesskey ] ; then
        sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml
      fi
      # Place the `http.secret` value from the kubernetes secret
      sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml
      # Populate sensitive registry notification secrets in the config file
      if [ -d /config/notifications ]; then
        for i in /config/notifications/*; do
          filename=$(basename $i);
          sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml;
        done
      fi
      # Insert any provided `storage` block from kubernetes secret
      if [ -d /config/storage ]; then
        # Copy contents of storage secret(s)
        mkdir -p /registry/storage
        cp -v -r -L /config/storage/* /registry/storage/
        # Ensure there is a new line in the end
        echo '' >> /registry/storage/config
        # Default `delete.enabled: true` if not present.
        ## Note: busybox grep doesn't support multiline, so we chain `egrep`.
        if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then
          echo 'delete:' >> /registry/storage/config
          echo '  enabled: true' >> /registry/storage/config
        fi
        # Indent /registry/storage/config 2 spaces before inserting into config.yml
        sed -i 's/^/  /' /registry/storage/config
        # Insert into /registry/config.yml after `storage:`
        sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml
        # Remove the now extraneous `config` file
        rm /registry/storage/config
      fi
      # Copy any middleware.storage if present
      if [ -d /config/middleware.storage ]; then
        cp -v -r -L /config/middleware.storage  /registry/middleware.storage
      fi
      # Set to known path, to used ConfigMap
      cat /config/certificate.crt > /registry/certificate.crt
      # Copy the optional profiling keyfile to the expected location
      if [ -f /config/profiling-key.json ]; then
        cp /config/profiling-key.json /registry/profiling-key.json
      fi
      # Insert Database password, if enabled
      if [ -f /config/database_password ] ; then
        sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml
      fi
      # Insert Redis(cache) password, if enabled
      if [ -f /config/registry/redis-password ] ; then
        sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml
      fi
      # Insert Redis(rate-limiter) password, if enabled
      if [ -f /config/registry/redis-rateLimiting-password ] ; then
        sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml
      fi
      # Insert Redis(load balancing) password, if enabled
      if [ -f /config/registry/redis-loadBalancing-password ] ; then
        sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml
      fi
      # Copy the database TLS connection files to the expected location and set permissions
      if [ -d /config/ssl ]; then
        cp -r /config/ssl/ /registry/ssl
        chmod 700 /registry/ssl
        chmod 600 /registry/ssl/*.pem
      fi
      # Copy TLS certificates if present
      if [ -d /config/tls ]; then
        cp -r /config/tls/ /registry/tls
        chmod 700 /registry/tls
        chmod 600 /registry/tls/*
      fi
    migrations-config.yml.tpl: |
      version: 0.1
      log:
        fields:
          service: registry
        level: info
      
      database:
        enabled: true
        host: "db-gitlab-rw.gitlab.svc"
        port: 5432
        user: registry
        password: "DB_PASSWORD_FILE"
        dbname: gl-registry
        sslmode: disable
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-chart-info
    namespace: gitlab
    labels:
      app: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  data:
    gitlabChartVersion: "9.8.2"
    gitlabVersion: "18.8.2"

(root level)  (rbac.authorization.k8s.io/v1/ClusterRole/gitlab-gitlab-runner)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - events
    apiGroups:
    -
    verbs:
    - list
    - watch
  - resources:
    - namespaces
    apiGroups:
    -
    verbs:
    - create
    - delete
  - resources:
    - pods
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - list
    - watch
  - resources:
    - pods/attach
    - pods/exec
    apiGroups:
    -
    verbs:
    - get
    - create
    - patch
    - delete
  - resources:
    - pods/log
    apiGroups:
    -
    verbs:
    - get
    - list
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - create
    - delete
    - get
    - update
  - resources:
    - serviceaccounts
    apiGroups:
    -
    verbs:
    - get
  - resources:
    - services
    apiGroups:
    -
    verbs:
    - create
    - get

(root level)  (rbac.authorization.k8s.io/v1/ClusterRoleBinding/gitlab-gitlab-runner)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name: gitlab-gitlab-runner
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-gitlab-runner
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
  subjects:
  - name: gitlab-runner-access
    kind: ServiceAccount
    namespace: gitlab

(root level)  (v1/Service/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app: gitaly
      release: gitlab
    ports:
    - name: tcp-gitaly
      port: 8075
      targetPort: grpc-gitaly
    - name: http-metrics
      port: 9236
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-exporter
      release: gitlab
    ports:
    - name: http-metrics
      port: 9168
      protocol: TCP
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    annotations:
      tailscale.com/expose: "true"
      tailscale.com/hostname: gitlab-shell
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: gitlab-shell
      release: gitlab
    ports:
    - name: ssh
      port: 22222
      protocol: TCP
      targetPort: 2222

(root level)  (v1/Service/gitlab/gitlab-kas)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: kas
      release: gitlab
    ports:
    - name: tcp-kas-external-api
      port: 8150
      protocol: TCP
      targetPort: 8150
    - name: tcp-kas-internal-api
      port: 8153
      protocol: TCP
      targetPort: 8153
    - name: tcp-kas-k8s-api
      port: 8154
      protocol: TCP
      targetPort: 8154
    - name: http-metrics
      port: 8151
      protocol: TCP
      targetPort: http-metrics

(root level)  (v1/Service/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: webservice
      gitlab.com/webservice-name: default
      release: gitlab
    ports:
    - name: http-webservice
      port: 8080
      protocol: TCP
      targetPort: http-webservice
    - name: http-workhorse
      port: 8181
      protocol: TCP
      targetPort: http-workhorse
    - name: http-metrics-ws
      port: 8083
      protocol: TCP
      targetPort: http-metrics-ws

(root level)  (v1/Service/gitlab/gitlab-redis-headless)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-headless
    namespace: gitlab
    labels:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    clusterIP: None
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      port: 6379
      targetPort: redis

(root level)  (v1/Service/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    internalTrafficPolicy: Cluster
    sessionAffinity: None
    selector:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: tcp-redis
      nodePort: null
      port: 6379
      targetPort: redis

(root level)  (v1/Service/gitlab/gitlab-redis-metrics)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-redis-metrics
    namespace: gitlab
    labels:
      app.kubernetes.io/component: metrics
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    type: ClusterIP
    selector:
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/name: redis
    ports:
    - name: http-metrics
      port: 9121
      protocol: TCP
      targetPort: metrics

(root level)  (v1/Service/gitlab/gitlab-registry)
- one document removed:
  apiVersion: v1
  kind: Service
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    type: ClusterIP
    selector:
      app: registry
      release: gitlab
    ports:
    - name: http-registry
      port: 5000
      protocol: TCP
      targetPort: http

(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-runner)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-runner
    namespace: gitlab
    labels:
      app: gitlab-gitlab-runner
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        app: gitlab-gitlab-runner
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_port: "9252"
          gitlab.com/prometheus_scrape: "true"
        labels:
          app: gitlab-gitlab-runner
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab-gitlab-runner
          image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2"
          imagePullPolicy: IfNotPresent
          resources: {}
          command:
          - /usr/bin/dumb-init
          - "--"
          - /bin/bash
          - /configmaps/entrypoint
          ports:
          - name: metrics
            containerPort: 9252
          volumeMounts:
          - name: projected-secrets
            mountPath: /secrets
          - name: etc-gitlab-runner
            mountPath: /home/gitlab-runner/.gitlab-runner
          - name: configmaps
            mountPath: /configmaps
          livenessProbe:
            exec:
              command:
              - /bin/bash
              - /configmaps/check-live
              - "3"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          readinessProbe:
            exec:
              command:
              - /usr/bin/pgrep
              - "gitlab.*runner"
            failureThreshold: 3
            initialDelaySeconds: 60
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 4
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            privileged: false
            readOnlyRootFilesystem: false
            runAsNonRoot: true
          env:
          - name: CI_SERVER_URL
            value: "https://code.nogweii.net"
          - name: RUNNER_EXECUTOR
            value: kubernetes
          - name: REGISTER_LOCKED
            value: "false"
          - name: RUNNER_TAG_LIST
            value:
          - name: KUBERNETES_NAMESPACE
            value: gitlab
          - name: CACHE_S3_ACCESS_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_access_key_id
          - name: CACHE_S3_SECRET_KEY
            valueFrom:
              secretKeyRef:
                name: gitlab-object-store-configs
                key: runner_secret_access_key
          - name: SESSION_SERVER_ADDRESS
            value: null
          lifecycle:
            preStop:
              exec:
                command:
                - /entrypoint
                - unregister
                - "--all-runners"
        securityContext:
          fsGroup: 65533
          runAsUser: 100
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-runner-access
        terminationGracePeriodSeconds: 3600
        volumes:
        - name: runner-secrets
          emptyDir:
            medium: Memory
        - name: etc-gitlab-runner
          emptyDir:
            medium: Memory
        - name: projected-secrets
          projected:
            sources:
            - secret:
                name: gitlab-gitlab-runner-secret
                items:
                - key: runner-registration-token
                  path: runner-registration-token
                - key: runner-token
                  path: runner-token
        - name: configmaps
          configMap:
            name: gitlab-gitlab-runner

(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-exporter
    namespace: gitlab
    labels:
      app: gitlab-exporter
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: gitlab-exporter
        release: gitlab
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9168"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9168"
          prometheus.io/scrape: "true"
        labels:
          app: gitlab-exporter
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-exporter
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-exporter
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0"
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab-exporter/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitlab-exporter
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          ports:
          - name: http-metrics
            containerPort: 9168
          resources:
            requests:
              cpu: 75m
              memory: 100M
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb
            subPath: gitlab-exporter.yml.erb
          - name: gitlab-exporter-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          readinessProbe:
            exec:
              command:
              - pgrep
              - "-f"
              - gitlab-exporter
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'gitlab-exporter'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          - name: MALLOC_CONF
            value: "dirty_decay_ms:0,muzzy_decay_ms:0"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO
            value: "0.111"
          - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO
            value: "0.055"
          - name: RUBY_GC_HEAP_INIT_SLOTS
            value: "80000"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitlab-exporter-config
            mountPath: /config
            readOnly: true
          - name: init-gitlab-exporter-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitlab-exporter-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: gitlab-exporter-config
          configMap:
            name: gitlab-gitlab-exporter
        - name: init-gitlab-exporter-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
        - name: gitlab-exporter-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: gitlab-shell
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: gitlab-shell
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitlab-shell
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitlab-shell
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitlab-shell
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab-shell
          - name: KEYS_DIRECTORY
            value: /etc/gitlab-secrets/ssh
          - name: SSH_DAEMON
            value: openssh
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          ports:
          - name: ssh
            containerPort: 2222
          readinessProbe:
            failureThreshold: 2
            initialDelaySeconds: 10
            periodSeconds: 5
            successThreshold: 1
            tcpSocket:
              port: 2222
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 0
              memory: 6M
          volumeMounts:
          - name: shell-config
            mountPath: /etc/gitlab-shell
          - name: shell-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: shell-config
            mountPath: /etc/krb5.conf
            readOnly: true
            subPath: krb5.conf
          - name: sshd-config
            mountPath: /etc/ssh/sshd_config
            readOnly: true
            subPath: sshd_config
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: shell-config
            mountPath: /config
            readOnly: true
          - name: shell-init-secrets
            mountPath: /init-config
            readOnly: true
          - name: shell-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: shell-config
          configMap:
            name: gitlab-gitlab-shell
        - name: sshd-config
          configMap:
            name: gitlab-gitlab-shell-sshd
        - name: shell-init-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitlab-shell-host-keys
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
        - name: shell-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-kas)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: kas
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8151"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8151"
          prometheus.io/scrape: "true"
        labels:
          app: kas
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: kas
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: kas
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2"
          args:
          - "--configuration-file=/etc/kas/config.yaml"
          env:
          - name: OWN_PRIVATE_API_HOST
            value: gitlab-kas.gitlab.svc
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            httpGet:
              path: /liveness
              port: 8151
            initialDelaySeconds: 15
            periodSeconds: 20
          ports:
          - name: kas
            containerPort: 8150
          - name: kas-k8s-api
            containerPort: 8154
          - name: kas-private-api
            containerPort: 8155
          - name: http-metrics
            containerPort: 8151
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8151
            initialDelaySeconds: 5
            periodSeconds: 10
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
          - name: init-etc-kas
            mountPath: /etc/kas
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65532
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 65532
          runAsGroup: 65532
          runAsUser: 65532
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 300
        volumes:
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
        - name: init-etc-kas
          projected:
            defaultMode: 288
            sources:
            - configMap:
                name: gitlab-kas
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: .gitlab_kas_secret
            - secret:
                name: gitlab-kas-private-api
                items:
                - key: kas_private_api_secret
                  path: .gitlab_kas_private_api_secret
            - secret:
                name: gitlab-kas-websocket-token
                items:
                - key: kas_websocket_token_secret
                  path: .gitlab_kas_websocket_token_secret
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password

(root level)  (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      queue-pod-name: all-in-1
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: sidekiq
        queue-pod-name: all-in-1
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "3807"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "3807"
          prometheus.io/scrape: "true"
        labels:
          app: sidekiq
          app.kubernetes.io/name: gitlab
          heritage: Helm
          queue-pod-name: all-in-1
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: sidekiq
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: sidekiq
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2"
          env:
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: SIDEKIQ_QUEUES
            value: null
          - name: SIDEKIQ_DAEMON_MEMORY_KILLER
            value: "1"
          - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL
            value: "3"
          - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS
            value: "2000000"
          - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME
            value: "900"
          - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT
            value: "30"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /liveness
              port: 3808
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-metrics
            containerPort: 3807
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readiness
              port: 3808
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 900m
              memory: 2G
          volumeMounts:
          - name: sidekiq-metrics
            mountPath: /metrics
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: sidekiq-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: sidekiq-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: sidekiq-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -f 'sidekiq'"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: sidekiq-config
            mountPath: /config
            readOnly: true
          - name: init-sidekiq-secrets
            mountPath: /init-config
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2"
          args:
          - /scripts/wait-for-deps
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SIDEKIQ_CONCURRENCY
            value: "20"
          - name: SIDEKIQ_TIMEOUT
            value: "25"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: sidekiq-config
            mountPath: /var/opt/gitlab/templates
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: sidekiq-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: sidekiq-metrics
          emptyDir:
            medium: Memory
        - name: sidekiq-config
          projected:
            sources:
            - configMap:
                name: gitlab-sidekiq
        - name: init-sidekiq-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: sidekiq-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-toolbox)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-toolbox
    namespace: gitlab
    labels:
      app: toolbox
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    replicas: 1
    selector:
      matchLabels:
        app: toolbox
        release: gitlab
    strategy:
      type: Recreate
      rollingUpdate: null
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: toolbox
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: toolbox
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done"
          env:
          - name: ARTIFACTS_BUCKET_NAME
            value: gitlab-artifacts
          - name: REGISTRY_BUCKET_NAME
            value: gitlab-container-registry
          - name: LFS_BUCKET_NAME
            value: gitlab-lfs
          - name: UPLOADS_BUCKET_NAME
            value: gitlab-uploads
          - name: PACKAGES_BUCKET_NAME
            value: gitlab-packages
          - name: EXTERNAL_DIFFS_BUCKET_NAME
            value: gitlab-external-diffs
          - name: TERRAFORM_STATE_BUCKET_NAME
            value: gitlab-terraform-state
          - name: CI_SECURE_FILES_BUCKET_NAME
            value: gitlab-ci-secure-files
          - name: BACKUP_BUCKET_NAME
            value: gitlab-backup
          - name: BACKUP_BACKEND
            value: s3
          - name: TMP_BUCKET_NAME
            value: gitlab-tmp-storage
          - name: PAGES_BUCKET_NAME
            value: gitlab-pages
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
              memory: 350M
          volumeMounts:
          - name: toolbox-config
            mountPath: /var/opt/gitlab/templates
          - name: toolbox-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: toolbox-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: toolbox-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: toolbox-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: toolbox-tmp
            mountPath: /srv/gitlab/tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: toolbox-config
            mountPath: /config
            readOnly: true
          - name: init-toolbox-secrets
            mountPath: /init-config
            readOnly: true
          - name: toolbox-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: toolbox-config
          projected:
            sources:
            - configMap:
                name: gitlab-toolbox
        - name: toolbox-tmp
          emptyDir: {}
        - name: init-toolbox-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: s3cmd.cfg
                  path: objectstorage/.s3cfg
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: toolbox-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      app.kubernetes.io/name: gitlab
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: webservice
        gitlab.com/webservice-name: default
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "8083"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "8083"
          prometheus.io/scrape: "true"
        labels:
          app: webservice
          app.kubernetes.io/name: gitlab
          gitlab.com/webservice-name: default
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: webservice
                    gitlab.com/webservice-name: default
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: webservice
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: GITLAB_WEBSERVER
            value: puma
          - name: TMPDIR
            value: /tmp/gitlab
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: prometheus_multiproc_dir
            value: /metrics
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: WORKER_PROCESSES
            value: "2"
          - name: WORKER_TIMEOUT
            value: "60"
          - name: INTERNAL_PORT
            value: "8080"
          - name: PUMA_THREADS_MIN
            value: "4"
          - name: PUMA_THREADS_MAX
            value: "4"
          - name: PUMA_WORKER_MAX_MEMORY
            value: 
          - name: DISABLE_PUMA_WORKER_KILLER
            value: "true"
          - name: BIND_IP6
            value: "false"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "true"
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /-/liveness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          ports:
          - name: http-webservice
            containerPort: 8080
          - name: http-metrics-ws
            containerPort: 8083
          readinessProbe:
            failureThreshold: 2
            httpGet:
              path: /-/readiness
              port: 8080
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          resources:
            requests:
              cpu: 300m
              memory: 2.5G
          volumeMounts:
          - name: webservice-metrics
            mountPath: /metrics
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: webservice-config
            mountPath: /etc/krb5.conf
            subPath: krb5.conf
          - name: webservice-config
            mountPath: /srv/gitlab/config/initializers/smtp_settings.rb
            subPath: smtp_settings.rb
          - name: webservice-config
            mountPath: /srv/gitlab/INSTALLATION_TYPE
            subPath: installation_type
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "pkill -SIGINT -o ruby"
        - name: gitlab-workhorse
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2"
          env:
          - name: TZ
            value: UTC
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TMPDIR
            value: /tmp/gitlab
          - name: GITLAB_WORKHORSE_AUTH_BACKEND
            value: "http://localhost:8080"
          - name: GITLAB_WORKHORSE_EXTRA_ARGS
            value: 
          - name: GITLAB_WORKHORSE_LISTEN_PORT
            value: "8181"
          - name: GITLAB_WORKHORSE_LOG_FORMAT
            value: json
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: SHUTDOWN_BLACKOUT_SECONDS
            value: "10"
          - name: PUMA_CONTROL_PORT
            value: "9293"
          ports:
          - name: http-workhorse
            containerPort: 8181
          resources:
            requests:
              cpu: 100m
              memory: 100M
          volumeMounts:
          - name: workhorse-config
            mountPath: /var/opt/gitlab/templates
          - name: workhorse-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: shared-upload-directory
            mountPath: /srv/gitlab/public/uploads/tmp
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          livenessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 20
            periodSeconds: 60
            successThreshold: 1
            timeoutSeconds: 30
          readinessProbe:
            exec:
              command:
              - /scripts/healthcheck
            failureThreshold: 3
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep $SHUTDOWN_BLACKOUT_SECONDS"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - "-c"
          - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab"
          command:
          - sh
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: webservice-config
            mountPath: /config-webservice
            readOnly: true
          - name: workhorse-config
            mountPath: /config-workhorse
            readOnly: true
          - name: init-webservice-secrets
            mountPath: /init-config
            readOnly: true
          - name: webservice-secrets
            mountPath: /init-secrets
            readOnly: false
          - name: workhorse-secrets
            mountPath: /init-secrets-workhorse
            readOnly: false
          - name: shared-tmp
            mountPath: /tmp
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2"
          args:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: WORKHORSE_ARCHIVE_CACHE_DISABLED
            value: "1"
          - name: ENABLE_BOOTSNAP
            value: "1"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: webservice-config
            mountPath: /var/opt/gitlab/templates
          - name: webservice-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: webservice-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            readOnly: true
            subPath: rails-secrets/secrets.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: shared-tmp
          emptyDir: {}
        - name: webservice-metrics
          emptyDir:
            medium: Memory
        - name: webservice-config
          configMap:
            name: gitlab-webservice
        - name: workhorse-config
          configMap:
            name: gitlab-workhorse-default
        - name: init-webservice-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: shell/.gitlab_shell_secret
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.key
                  path: registry/gitlab-registry.key
            - secret:
                name: gitlab-registry-notification
                items:
                - key: secret
                  path: registry/notificationSecret
            - secret:
                name: gitlab-gitlab-workhorse-secret
                items:
                - key: shared_secret
                  path: gitlab-workhorse/secret
            - secret:
                name: gitlab-gitlab-kas-secret
                items:
                - key: kas_shared_secret
                  path: kas/.gitlab_kas_secret
            - secret:
                name: gitlab-zoekt-basicauth
                optional: true
                items:
                - key: gitlab_username
                  path: zoekt/.gitlab_zoekt_username
                - key: gitlab_password
                  path: zoekt/.gitlab_zoekt_password
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: authentik-oidc
                items:
                - key: config.yaml
                  path: omniauth/authentik-oidc/config.yaml
        - name: webservice-secrets
          emptyDir:
            medium: Memory
        - name: workhorse-secrets
          emptyDir:
            medium: Memory
        - name: shared-upload-directory
          emptyDir: {}
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (apps/v1/Deployment/gitlab/gitlab-registry)
- one document removed:
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    selector:
      matchLabels:
        app: registry
        release: gitlab
    template:
      metadata:
        annotations:
          cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
        labels:
          app: registry
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: registry
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: registry
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          env:
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          ports:
          - name: http
            containerPort: 5000
          - name: debug
            containerPort: 5001
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /debug/health
              port: debug
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
          lifecycle:
            preStop:
              exec:
                command:
                - /bin/bash
                - "-c"
                - "sleep 5"
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: dependencies
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          command:
          - /scripts/wait-for-deps
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        terminationGracePeriodSeconds: 30
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
            - secret:
                name: gitlab-registry-secret
                items:
                - key: registry-auth.crt
                  path: certificate.crt
            - secret:
                name: gitlab-registry-httpsecret
                items:
                - key: secret
                  path: httpSecret
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: registry.yaml
                  path: storage/config
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-gitlab-shell)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-gitlab-shell
    namespace: gitlab
    labels:
      app: gitlab-shell
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-gitlab-shell

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-kas)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-kas
    namespace: gitlab
    labels:
      app: kas
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 100m
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-kas

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-sidekiq-all-in-1-v2)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-sidekiq-all-in-1-v2
    namespace: gitlab
    labels:
      app: sidekiq
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 350m
    minReplicas: 1
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-sidekiq-all-in-1-v2

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-webservice-default)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-webservice-default
    namespace: gitlab
    labels:
      app: webservice
      gitlab.com/webservice-name: default
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageValue: 1
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-webservice-default

(root level)  (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-registry)
- one document removed:
  apiVersion: autoscaling/v2beta1
  kind: HorizontalPodAutoscaler
  metadata:
    name: gitlab-registry
    namespace: gitlab
    labels:
      app: registry
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    maxReplicas: 10
    metrics:
    - type: Resource
      resource:
        name: cpu
        targetAverageUtilization: 75
    minReplicas: 2
    scaleTargetRef:
      apiVersion: apps/v1
      kind: Deployment
      name: gitlab-registry

(root level)  (apps/v1/StatefulSet/gitlab/gitlab-gitaly)
- one document removed:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-gitaly
    namespace: gitlab
    labels:
      app: gitaly
      app.kubernetes.io/name: gitlab
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    podManagementPolicy: Parallel
    replicas: 1
    selector:
      matchLabels:
        app: gitaly
        release: gitlab
    serviceName: gitlab-gitaly
    template:
      metadata:
        annotations:
          gitlab.com/prometheus_path: /metrics
          gitlab.com/prometheus_port: "9236"
          gitlab.com/prometheus_scrape: "true"
          prometheus.io/path: /metrics
          prometheus.io/port: "9236"
          prometheus.io/scrape: "true"
        labels:
          app: gitaly
          app.kubernetes.io/name: gitlab
          heritage: Helm
          release: gitlab
      spec:
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: gitaly
                    release: gitlab
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: gitaly
          image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2"
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /etc/gitaly/templates
          - name: CONFIG_DIRECTORY
            value: /etc/gitaly
          - name: GITALY_CONFIG_FILE
            value: /etc/gitaly/config.toml
          - name: SSL_CERT_DIR
            value: /etc/ssl/certs
          - name: GODEBUG
            value: "tlsmlkem=0,tlskyber=0"
          - name: TZ
            value: UTC
          livenessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 3
          ports:
          - name: grpc-gitaly
            containerPort: 8075
          - name: http-metrics
            containerPort: 9236
          readinessProbe:
            failureThreshold: 3
            grpc:
              port: 8075
            initialDelaySeconds: 0
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 3
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          startupProbe:
            failureThreshold: 60
            grpc:
              port: 8075
            initialDelaySeconds: 1
            periodSeconds: 1
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          - name: gitaly-config
            mountPath: /etc/gitaly/templates
          - name: gitaly-secrets
            mountPath: /etc/gitlab-secrets
            readOnly: true
          - name: repo-data
            mountPath: /home/git/repositories
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: gitaly-config
            mountPath: /config
            readOnly: true
          - name: init-gitaly-secrets
            mountPath: /init-config
            readOnly: true
          - name: gitaly-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
        terminationGracePeriodSeconds: 30
        volumes:
        - name: gitaly-config
          configMap:
            name: gitlab-gitaly
        - name: gitaly-secrets
          emptyDir:
            medium: Memory
        - name: init-gitaly-secrets
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly_token
            - secret:
                name: gitlab-gitlab-shell-secret
                items:
                - key: secret
                  path: .gitlab_shell_secret
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
    volumeClaimTemplates:
    - metadata:
        name: repo-data
        annotations: null
        labels:
          app: gitaly
          release: gitlab
      spec:
        resources:
          requests:
            storage: 50Gi
        selector: null
        storageClassName: nfs-subdir
        accessModes:
        - ReadWriteOnce

(root level)  (apps/v1/StatefulSet/gitlab/gitlab-redis-master)
- one document removed:
  apiVersion: apps/v1
  kind: StatefulSet
  metadata:
    name: gitlab-redis-master
    namespace: gitlab
    labels:
      app.kubernetes.io/component: master
      app.kubernetes.io/instance: gitlab
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/name: redis
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/component: master
        app.kubernetes.io/instance: gitlab
        app.kubernetes.io/name: redis
    serviceName: gitlab-redis-headless
    template:
      metadata:
        annotations:
          prometheus.io/port: "9121"
          prometheus.io/scrape: "true"
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/managed-by: Helm
          app.kubernetes.io/name: redis
      spec:
        affinity:
          nodeAffinity: null
          podAffinity: null
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app.kubernetes.io/component: master
                    app.kubernetes.io/instance: gitlab
                    app.kubernetes.io/name: redis
                topologyKey: kubernetes.io/hostname
              weight: 1
        automountServiceAccountToken: false
        containers:
        - name: redis
          image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9"
          imagePullPolicy: IfNotPresent
          args:
          - "-c"
          - /opt/bitnami/scripts/start-scripts/start-master.sh
          command:
          - /bin/bash
          env:
          - name: BITNAMI_DEBUG
            value: "false"
          - name: REDIS_REPLICATION_MODE
            value: master
          - name: ALLOW_EMPTY_PASSWORD
            value: no
          - name: REDIS_PASSWORD_FILE
            value: /opt/bitnami/redis/secrets/redis-password
          - name: REDIS_TLS_ENABLED
            value: no
          - name: REDIS_PORT
            value: "6379"
          ports:
          - name: redis
            containerPort: 6379
          volumeMounts:
          - name: start-scripts
            mountPath: /opt/bitnami/scripts/start-scripts
          - name: health
            mountPath: /health
          - name: redis-password
            mountPath: /opt/bitnami/redis/secrets/
          - name: redis-data
            mountPath: /data
          - name: config
            mountPath: /opt/bitnami/redis/mounted-etc
          - name: empty-dir
            mountPath: /opt/bitnami/redis/etc/
            subPath: app-conf-dir
          - name: empty-dir
            mountPath: /tmp
            subPath: tmp-dir
          livenessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_liveness_local.sh 5"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 6
          readinessProbe:
            exec:
              command:
              - sh
              - "-c"
              - "/health/ping_readiness_local.sh 1"
            failureThreshold: 5
            initialDelaySeconds: 20
            periodSeconds: 5
            successThreshold: 1
            timeoutSeconds: 2
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        - name: metrics
          image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4"
          imagePullPolicy: IfNotPresent
          command:
          - /bin/bash
          - "-c"
          - |
            if [[ -f '/secrets/redis-password' ]]; then
            export REDIS_PASSWORD=$(cat /secrets/redis-password)
            fi
            redis_exporter

          env:
          - name: REDIS_ALIAS
            value: gitlab-redis
          - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
            value: ":9121"
          - name: REDIS_USER
            value: default
          livenessProbe:
            failureThreshold: 5
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: metrics
            timeoutSeconds: 5
          ports:
          - name: metrics
            containerPort: 9121
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /
              port: metrics
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          volumeMounts:
          - name: empty-dir
            mountPath: /tmp
            subPath: app-tmp-dir
          - name: redis-password
            mountPath: /secrets/
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            readOnlyRootFilesystem: false
            runAsGroup: 0
            runAsNonRoot: true
            runAsUser: 1001
            seLinuxOptions: null
            seccompProfile:
              type: RuntimeDefault
        enableServiceLinks: true
        securityContext:
          fsGroup: 1001
          fsGroupChangePolicy: Always
          supplementalGroups: []
          sysctls: []
        serviceAccountName: gitlab-redis-master
        terminationGracePeriodSeconds: 30
        volumes:
        - name: start-scripts
          configMap:
            name: gitlab-redis-scripts
            defaultMode: 493
        - name: health
          configMap:
            name: gitlab-redis-health
            defaultMode: 493
        - name: redis-password
          secret:
            items:
            - key: secret
              path: redis-password
            secretName: gitlab-redis-secret
        - name: config
          configMap:
            name: gitlab-redis-configuration
        - name: empty-dir
          emptyDir: {}
    updateStrategy:
      type: RollingUpdate
    volumeClaimTemplates:
    - apiVersion: v1
      kind: PersistentVolumeClaim
      metadata:
        name: redis-data
        labels:
          app.kubernetes.io/component: master
          app.kubernetes.io/instance: gitlab
          app.kubernetes.io/name: redis
      spec:
        resources:
          requests:
            storage: 8Gi
        storageClassName: longhorn
        accessModes:
        - ReadWriteOnce

(root level)  (batch/v1/Job/gitlab/gitlab-migrations-c0164a8)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-migrations-c0164a8
    namespace: gitlab
    labels:
      app: migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: migrations
          heritage: Helm
          release: gitlab
      spec:
        automountServiceAccountToken: false
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
          args:
          - /bin/bash
          - "-c"
          - |
            set -e;
            /scripts/wait-for-deps;
            /scripts/db-migrate;
                                
            
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /var/opt/gitlab/templates
          - name: CONFIG_DIRECTORY
            value: /srv/gitlab/config
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          - name: ENABLE_BOOTSNAP
            value: "1"
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 250m
              memory: 200Mi
          volumeMounts:
          - name: migrations-config
            mountPath: /var/opt/gitlab/templates
          - name: migrations-secrets
            mountPath: /etc/gitlab
            readOnly: true
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/secrets.yml
            subPath: rails-secrets/secrets.yml
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/initial_root_password
            subPath: migrations/initial_root_password
          - name: migrations-secrets
            mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token
            subPath: migrations/gitlab_shared_runners_registration_token
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - sh
          - /config/configure
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: migrations-config
            mountPath: /config
            readOnly: true
          - name: init-migrations-secrets
            mountPath: /init-config
            readOnly: true
          - name: migrations-secrets
            mountPath: /init-secrets
            readOnly: false
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: migrations-config
          configMap:
            name: gitlab-migrations
        - name: init-migrations-secrets
          projected:
            defaultMode: 256
            sources:
            - secret:
                name: gitlab-rails-secret
                items:
                - key: secrets.yml
                  path: rails-secrets/secrets.yml
            - secret:
                name: gitlab-gitaly-secret
                items:
                - key: token
                  path: gitaly/gitaly_token
            - secret:
                name: gitlab-redis-secret
                items:
                - key: secret
                  path: redis/redis-password
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-ci
            - secret:
                name: db-gitlab-app
                items:
                - key: password
                  path: postgres/psql-password-main
            - secret:
                name: gitlab-object-store-configs
                items:
                - key: connection.yaml
                  path: objectstorage/object_store
            - secret:
                name: gitlab-gitlab-initial-root-password
                items:
                - key: password
                  path: migrations/initial_root_password
            - secret:
                name: gitlab-gitlab-runner-secret
                optional: true
                items:
                - key: runner-registration-token
                  path: migrations/gitlab_shared_runners_registration_token
        - name: migrations-secrets
          emptyDir:
            medium: Memory
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-registry-migrations-8e2a9a9
    namespace: gitlab
    labels:
      app: registry-migrations
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    activeDeadlineSeconds: 3600
    backoffLimit: 6
    template:
      metadata:
        labels:
          app: registry-migrations
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: migrations
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab"
          args:
          - /scripts/wait-for-deps
          - /scripts/db-migrate
          env:
          - name: BYPASS_SCHEMA_VERSION
            value: "true"
          resources:
            requests:
              cpu: 50m
              memory: 32Mi
          volumeMounts:
          - name: registry-server-config
            mountPath: /etc/docker/registry/
            readOnly: true
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs/
            readOnly: true
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        initContainers:
        - name: certificates
          image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
          env:
          - name: TZ
            value: UTC
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: etc-ssl-certs
            mountPath: /etc/ssl/certs
            readOnly: false
          - name: etc-pki-ca-trust-extracted-pem
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: false
          - name: custom-ca-certificates
            mountPath: /usr/local/share/ca-certificates
            readOnly: true
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        - name: configure
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          args:
          - sh
          - /config/configure
          env:
          - name: CONFIG_TEMPLATE_DIRECTORY
            value: /templates
          - name: CONFIG_DIRECTORY
            value: /registry
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: registry-secrets
            mountPath: /config
          - name: registry-server-config-templates
            mountPath: /templates
            readOnly: true
          - name: registry-server-config
            mountPath: /registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 1000
        restartPolicy: OnFailure
        securityContext:
          fsGroup: 1000
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: registry-server-config-templates
          configMap:
            name: gitlab-registry
            items:
            - key: migrations-config.yml.tpl
              path: config.yml.tpl
        - name: registry-server-config
          emptyDir:
            medium: Memory
        - name: registry-secrets
          projected:
            sources:
            - configMap:
                name: gitlab-registry
                items:
                - key: configure
                  path: configure
            - secret:
                name: gitlab-registry-db-pass
                items:
                - key: password
                  path: database_password
        - name: etc-ssl-certs
          emptyDir:
            medium: Memory
        - name: etc-pki-ca-trust-extracted-pem
          emptyDir:
            medium: Memory
        - name: custom-ca-certificates
          projected:
            defaultMode: 288
            sources:
            - secret:
                name: aethernet.crt
            - secret:
                name: gitlab-wildcard-tls-ca
  


(root level)  (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup)
- one document removed:
  apiVersion: batch/v1beta1
  kind: CronJob
  metadata:
    name: gitlab-toolbox-backup
    namespace: gitlab
    labels:
      app: toolbox
      helm.toolkit.fluxcd.io/name: gitlab
      helm.toolkit.fluxcd.io/namespace: flux-system
      heritage: Helm
      release: gitlab
  spec:
    concurrencyPolicy: Replace
    failedJobsHistoryLimit: 1
    jobTemplate:
      spec:
        backoffLimit: 6
        template:
          metadata:
            annotations:
              cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
            labels:
              app: toolbox
              heritage: Helm
              release: gitlab
          spec:
            containers:
            - name: toolbox-backup
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2"
              args:
              - /bin/bash
              - "-c"
              - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts"
              env:
              - name: ARTIFACTS_BUCKET_NAME
                value: gitlab-artifacts
              - name: REGISTRY_BUCKET_NAME
                value: gitlab-container-registry
              - name: LFS_BUCKET_NAME
                value: gitlab-lfs
              - name: UPLOADS_BUCKET_NAME
                value: gitlab-uploads
              - name: PACKAGES_BUCKET_NAME
                value: gitlab-packages
              - name: EXTERNAL_DIFFS_BUCKET_NAME
                value: gitlab-external-diffs
              - name: TERRAFORM_STATE_BUCKET_NAME
                value: gitlab-terraform-state
              - name: CI_SECURE_FILES_BUCKET_NAME
                value: gitlab-ci-secure-files
              - name: BACKUP_BUCKET_NAME
                value: gitlab-backup
              - name: BACKUP_BACKEND
                value: s3
              - name: TMP_BUCKET_NAME
                value: gitlab-tmp-storage
              - name: PAGES_BUCKET_NAME
                value: gitlab-pages
              - name: CONFIG_TEMPLATE_DIRECTORY
                value: /var/opt/gitlab/templates
              - name: CONFIG_DIRECTORY
                value: /srv/gitlab/config
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
                  memory: 350M
              volumeMounts:
              - name: toolbox-config
                mountPath: /var/opt/gitlab/templates
              - name: toolbox-secrets
                mountPath: /etc/gitlab
                readOnly: true
              - name: toolbox-secrets
                mountPath: /srv/gitlab/config/secrets.yml
                subPath: rails-secrets/secrets.yml
              - name: toolbox-tmp
                mountPath: /srv/gitlab/tmp
                readOnly: false
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs/
                readOnly: true
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            initContainers:
            - name: certificates
              image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2"
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: etc-ssl-certs
                mountPath: /etc/ssl/certs
                readOnly: false
              - name: etc-pki-ca-trust-extracted-pem
                mountPath: /etc/pki/ca-trust/extracted/pem
                readOnly: false
              - name: custom-ca-certificates
                mountPath: /usr/local/share/ca-certificates
                readOnly: true
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            - name: configure
              image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
              command:
              - sh
              - /config/configure
              env:
              - name: TZ
                value: UTC
              resources:
                requests:
                  cpu: 50m
              volumeMounts:
              - name: toolbox-config
                mountPath: /config
                readOnly: true
              - name: init-toolbox-secrets
                mountPath: /init-config
                readOnly: true
              - name: toolbox-secrets
                mountPath: /init-secrets
                readOnly: false
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop:
                  - ALL
                runAsNonRoot: true
                runAsUser: 1000
            restartPolicy: OnFailure
            securityContext:
              fsGroup: 1000
              runAsGroup: 1000
              runAsUser: 1000
              seccompProfile:
                type: RuntimeDefault
            volumes:
            - name: toolbox-config
              projected:
                sources:
                - configMap:
                    name: gitlab-toolbox
            - name: toolbox-tmp
              emptyDir: {}
            - name: init-toolbox-secrets
              projected:
                defaultMode: 256
                sources:
                - secret:
                    name: gitlab-rails-secret
                    items:
                    - key: secrets.yml
                      path: rails-secrets/secrets.yml
                - secret:
                    name: gitlab-gitlab-shell-secret
                    items:
                    - key: secret
                      path: shell/.gitlab_shell_secret
                - secret:
                    name: gitlab-gitaly-secret
                    items:
                    - key: token
                      path: gitaly/gitaly_token
                - secret:
                    name: gitlab-redis-secret
                    items:
                    - key: secret
                      path: redis/redis-password
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-ci
                - secret:
                    name: db-gitlab-app
                    items:
                    - key: password
                      path: postgres/psql-password-main
                - secret:
                    name: gitlab-registry-secret
                    items:
                    - key: registry-auth.key
                      path: registry/gitlab-registry.key
                - secret:
                    name: gitlab-registry-notification
                    items:
                    - key: secret
                      path: registry/notificationSecret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: s3cmd.cfg
                      path: objectstorage/.s3cfg
                - secret:
                    name: gitlab-gitlab-kas-secret
                    items:
                    - key: kas_shared_secret
                      path: kas/.gitlab_kas_secret
                - secret:
                    name: gitlab-object-store-configs
                    items:
                    - key: connection.yaml
                      path: objectstorage/object_store
                - secret:
                    name: authentik-oidc
                    items:
                    - key: config.yaml
                      path: omniauth/authentik-oidc/config.yaml
            - name: toolbox-secrets
              emptyDir:
                medium: Memory
            - name: etc-ssl-certs
              emptyDir:
                medium: Memory
            - name: etc-pki-ca-trust-extracted-pem
              emptyDir:
                medium: Memory
            - name: custom-ca-certificates
              projected:
                defaultMode: 288
                sources:
                - secret:
                    name: aethernet.crt
                - secret:
                    name: gitlab-wildcard-tls-ca
    schedule: @daily
    startingDeadlineSeconds: null
    successfulJobsHistoryLimit: 3
    suspend: false
  


(root level)  (v1/ServiceAccount/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab

(root level)  (v1/ConfigMap/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-3"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    generate-secrets: |
      # vim: set filetype=sh:
      
      namespace=gitlab
      release=gitlab
      env=production
      
      pushd $(mktemp -d)
      
      # Args pattern, length
      function gen_random(){
        head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2
      }
      
      # Args: length
      function gen_random_base64(){
        local len="$1"
        gen_random_bytes "$len" | base64 -w0
      }
      
      # Args: length
      function gen_random_bytes(){
        local len="$1"
        head -c "$len" /dev/urandom
      }
      
      # Args: yaml file, search path
      function fetch_rails_value(){
        local value=$(yq --prettyPrint --no-colors ".${2}" $1)
      
        # Don't return null values
        if [ "${value}" != "null" ]; then echo "${value}"; fi
      }
      
      # Args: secretname
      function label_secret(){
        local secret_name=$1
      # Remove application labels if they exist
        kubectl --namespace=$namespace label \
          secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
      
        kubectl --namespace=$namespace label \
          --overwrite \
          secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
      }
      
      # Args: secretname, args
      function generate_secret_if_needed(){
        local secret_args=( "${@:2}")
        local secret_name=$1
      
        if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then
          kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}
        else
          echo "secret \"$secret_name\" already exists."
      
          for arg in "${secret_args[@]}"; do
            local from=$(echo -n ${arg} | cut -d '=' -f1)
      
            if [ -z "${from##*literal*}" ]; then
              local key=$(echo -n ${arg} | cut -d '=' -f2)
              local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)
              local flags="--namespace=$namespace --allow-missing-template-keys=false"
      
              if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then
                echo "key \"${key}\" does not exist. patching it in."
      
                if [ "${desiredValue}" != "" ]; then
                  desiredValue=$(echo -n "${desiredValue}" | base64 -w 0)
                fi
      
                kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}"
              fi
            fi
          done
        fi
      
        label_secret $secret_name
      }
      
      # Initial root password
      generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      # Redis password
      generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      
      # Gitlab shell
      generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64)
      
      # Gitaly secret
      generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64)
      
      
      
      # Gitlab runner secret
      generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=""
      
      # GitLab Pages API secret
      
      
      # GitLab Pages auth secret for hashing cookie store when using access control
      
      
      # GitLab Pages OAuth secret
      
      
      # Gitlab-kas secret
      generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas private API secret
      generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Gitlab-kas WebSocket Token secret
      generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72)
      
      
      
      
      
      
      
      
      # Registry certificates
      mkdir -p certs
      openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650
      generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt
      
      # config/secrets.yaml
      if [ -n "$env" ]; then
        rails_secret="gitlab-rails-secret"
      
        # Fetch the values from the existing secret if it exists
        if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then
          kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml
          secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base")
          otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base")
          db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base")
          openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key")
          encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base")
      
          active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key")
          active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key")
          active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt")
        fi;
      
        # Generate defaults for any unset secrets
        secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
        openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}"
        encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64)
      
        # 1. We set the following two keys as an array to support keys rotation.
        #    The last key in the array is always used to encrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21
        #    while all the keys are used (in the order they're defined) to decrypt data:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.
        #    This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that
        #    runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976
        # 2. We use the same method and length as Rails' defaults:
        #    https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540
        active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"}
        active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}
      
        # Update the existing secret
        cat << EOF > rails-secrets.yml
      apiVersion: v1
      kind: Secret
      metadata:
        name: $rails_secret
      type: Opaque
      stringData:
        secrets.yml: |-
          $env:
            secret_key_base: $secret_key_base
            otp_key_base: $otp_key_base
            db_key_base: $db_key_base
            encrypted_settings_key_base: $encrypted_settings_key_base
            openid_connect_signing_key: |
      $(echo "${openid_connect_signing_key}" | awk '{print "        " $0}')
            active_record_encryption_primary_key:
              $active_record_encryption_primary_keys
            active_record_encryption_deterministic_key:
              $active_record_encryption_deterministic_keys
            active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt
      EOF
        kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml
        label_secret $rails_secret
      fi
      
      # Shell ssh host keys
      ssh-keygen -A
      mkdir -p host_keys
      cp /etc/ssh/ssh_host_* host_keys/
      generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys
      
      # Gitlab-workhorse secret
      generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64)
      
      # Registry http.secret secret
      generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0)
      
      # Container Registry notification_secret
      generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"]
      
  


(root level)  (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check)
- one document removed:
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: before-hook-creation
      helm.sh/hook-weight: "-11"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  data:
    runcheck: |
      #!/bin/sh
      
      set -e
      
      notify() {
        echo "$1"
        echo -n "$1 " >> /dev/termination-log
      }
      
      greater_version()
      {
        test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1";
      }
      
      is_semver()
      {
        printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"
        return "$?"
      }
      
      # For the PostgreSQL upgrade, you either need both secrets, or no secrets.
      # If there are no secrets, we will create them for you.
      # If the secrets aren't in either of these states, we assume you are upgrading from an older version
      # This is running ahead of version checks to ensure this always runs. This is to account for
      # installations outside of the official helm repo.
      secrets_dir="/etc/secrets/postgresql"
      if [ -d "${secrets_dir}" ]; then
        if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then
          if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then
            notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart"
            notify "There are some manual steps which need to be performed in order to upgrade the database"
            notify "Please see the upgrade documentation for instructions on how to proceed:"
            notify "https://docs.gitlab.com/charts/installation/upgrade.html"
            exit 1
          fi
        fi
      fi
      MIN_VERSION=18.5
      CHART_MIN_VERSION=9.5
      
      # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions)
      GITLAB_VERSION=${GITLAB_VERSION#v}
      
      # Only run check for semver releases
      if ! is_semver "$GITLAB_VERSION"; then
        exit 0
      fi
      
      NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}')
      NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}')
      
      NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}')
      NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}')
      
      if [ ! -f /chart-info/gitlabVersion ]; then
        notify "It seems you are attempting an unsupported upgrade path."
        notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths"
        exit 1
      fi
      
      OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion)
      OLD_VERSION_STRING=${OLD_VERSION_STRING#v}
      OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion)
      
      # Skip check if old version wasn't semver
      if ! is_semver "$OLD_VERSION_STRING"; then
        exit 0
      fi
      
      OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}')
      OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}')
      OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}')
      OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}')
      
      # Checking Version
      if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then
        notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})."
        notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding."
        # Link to upgrade docs if it is a major version jump
        if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then
          notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html"
          notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}."
        fi
        exit 1
      fi
  


(root level)  (rbac.authorization.k8s.io/v1/Role/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: Role
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  rules:
  - resources:
    - secrets
    apiGroups:
    -
    verbs:
    - get
    - list
    - create
    - patch

(root level)  (rbac.authorization.k8s.io/v1/RoleBinding/gitlab/gitlab-shared-secrets)
- one document removed:
  apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name: gitlab-shared-secrets
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-5"
    labels:
      app: shared-secrets
      heritage: Helm
      release: gitlab
  roleRef:
    name: gitlab-shared-secrets
    apiGroup: rbac.authorization.k8s.io
    kind: Role
  subjects:
  - name: gitlab-shared-secrets
    kind: ServiceAccount
    namespace: gitlab

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: gitlab
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - /scripts/generate-secrets
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: scripts
            mountPath: /scripts
          - name: ssh
            mountPath: /etc/ssh
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: scripts
          configMap:
            name: gitlab-shared-secrets
        - name: ssh
          emptyDir: {}

(root level)  (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-shared-secrets-6fff130-selfsign
    namespace: gitlab
    annotations:
      helm.sh/hook: "pre-install,pre-upgrade"
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    template:
      metadata:
        annotations: null
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: kubectl
          image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2"
          command:
          - /bin/bash
          - "-exc"
          - |
            certname=gitlab-wildcard-tls
            # create wildcard certificate secret
            kubectl create secret tls $certname \
              --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true
            kubectl --namespace=$namespace label \
              secret $certname  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create CA certificate secret
            kubectl create secret generic ${certname}-ca \
              --from-file=cfssl_ca=/output/ca.pem || true
            kubectl --namespace=$namespace label \
              secret ${certname}-ca  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            # create certificate chain for GitLab Runner
            cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt
            kubectl create secret generic ${certname}-chain \
              --from-file=/tmp/code.nogweii.net.crt || true
            kubectl --namespace=$namespace label \
              secret ${certname}-chain  $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')
            kubectl --namespace=$namespace label --overwrite \
              secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm 
            
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        initContainers:
        - name: cfssl-self-sign
          image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2"
          env:
          - name: CA_SUBJECT
            value: "GitLab Helm Chart"
          - name: CA_ORG
            value: gitlab
          - name: CA_ORG_UNIT
            value: gitlab
          - name: CERT_SUBJECT
            value: code.nogweii.net
          - name: CERT_DOMAIN
            value: code.nogweii.net
          - name: EXPIRY
            value: 3650d
          - name: ALGORITHM
            value: rsa
          - name: KEY_SIZE
            value: "4096"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: certs-path
            mountPath: /output
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
        serviceAccountName: gitlab-shared-secrets
        volumes:
        - name: certs-path
          emptyDir: {}
  


(root level)  (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check)
- one document removed:
  apiVersion: batch/v1
  kind: Job
  metadata:
    name: gitlab-gitlab-upgrade-check
    namespace: gitlab
    annotations:
      helm.sh/hook: pre-upgrade
      helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation"
      helm.sh/hook-weight: "-10"
    labels:
      app: gitlab
      heritage: Helm
      release: gitlab
  spec:
    backoffLimit: 2
    template:
      metadata:
        labels:
          app: gitlab
          heritage: Helm
          release: gitlab
      spec:
        containers:
        - name: run-check
          image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2"
          command:
          - /bin/sh
          - /scripts/runcheck
          env:
          - name: GITLAB_VERSION
            value: "18.8.2"
          - name: CHART_VERSION
            value: "9.8.2"
          resources:
            requests:
              cpu: 50m
          volumeMounts:
          - name: chart-info
            mountPath: /chart-info
          - name: scripts
            mountPath: /scripts
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
              - ALL
            runAsNonRoot: true
            runAsUser: 65534
        restartPolicy: Never
        securityContext:
          fsGroup: 65534
          runAsUser: 65534
          seccompProfile:
            type: RuntimeDefault
        volumes:
        - name: chart-info
          configMap:
            name: gitlab-gitlab-chart-info
            optional: true
        - name: scripts
          configMap:
            name: gitlab-gitlab-upgrade-check

flate error: current snapshot: reconcile completed with 1 failure(s):
  HelmRelease/flux-system/gitlab: helm template flux-system/gitlab: execution error at (gitlab/templates/NOTES.txt:239:3): 
CONFIGURATION CHECKS:

redis:
  You must configure an Redis connetion. Please set `global.redis.host`. Since chart v10.0.0,
  external Redis became required. If you were using the bundled Redis chart refer to
  https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/.

Pipeline

## flate diff ``` rules (rbac.authorization.k8s.io/v1/ClusterRole/kube-prometheus-stack-operator) - six list entries removed: + three list entries added: - resources: - resources: - alertmanagers - alertmanagers - prometheusagents - alertmanagers/finalizers - prometheuses - alertmanagers/status - thanosrulers - alertmanagerconfigs apiGroups: - prometheuses - monitoring.coreos.com - prometheuses/finalizers verbs: - prometheuses/status - patch - prometheusagents - resources: - prometheusagents/finalizers - alertmanagers/status - prometheusagents/status - podmonitors/status - thanosrulers - probes/status - thanosrulers/finalizers - prometheuses/status - thanosrulers/status - prometheusagents/status - scrapeconfigs - prometheusrules/status - scrapeconfigs/status - scrapeconfigs/status - servicemonitors - servicemonitors/status - servicemonitors/status - thanosrulers/status - podmonitors apiGroups: - podmonitors/status - monitoring.coreos.com - probes verbs: - probes/status - create - prometheusrules - update - prometheusrules/status - patch apiGroups: - delete - monitoring.coreos.com - resources: verbs: - alertmanagers/finalizers - "*" - prometheusagents/finalizers - resources: - prometheuses/finalizers - statefulsets - thanosrulers/finalizers apiGroups: apiGroups: - apps - monitoring.coreos.com verbs: verbs: - "*" - update - resources: - resources: - configmaps - alertmanagers - secrets - alertmanagerconfigs apiGroups: - podmonitors - - probes verbs: - prometheusagents - "*" - prometheuses - prometheusrules - servicemonitors - scrapeconfigs - thanosrulers apiGroups: - monitoring.coreos.com verbs: - get - list - watch - resources: - statefulsets apiGroups: - apps verbs: - get - list - watch - create - update - patch - delete - resources: - configmaps - secrets apiGroups: - verbs: - get - list - watch - create - update - delete metadata (v1/Service/kube-privileged/node-exporter) + one map entry added: annotations: prometheus.io/scrape: "true" spec.template.spec.containers.kube-state-metrics.image (apps/v1/Deployment/monitoring/kube-state-metrics) ± value change - registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 + registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1 spec.template.spec (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.template.spec.containers.kube-prometheus-stack.args (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) - three list entries removed: - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.94.1" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.4" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=helm.sh/release.v1" + three list entries added: - "--prometheus-config-reloader=quay.io/prometheus-operator/prometheus-config-reloader:v0.92.1" - "--thanos-default-base-image=quay.io/thanos/thanos:v0.42.2" - "--secret-field-selector=type!=kubernetes.io/dockercfg,type!=kubernetes.io/service-account-token,type!=helm.sh/release.v1" spec.template.spec.containers.kube-prometheus-stack.image (apps/v1/Deployment/monitoring/kube-prometheus-stack-operator) ± value change - quay.io/prometheus-operator/prometheus-operator:v0.94.1 + quay.io/prometheus-operator/prometheus-operator:v0.92.1 spec (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) - one map entry removed: + one map entry added: nodeSelector: hostNetwork: false kubernetes.io/os: linux spec.image (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) ± value change - quay.io/prometheus/alertmanager:v0.34.1 + quay.io/prometheus/alertmanager:v0.33.1 spec.version (monitoring.coreos.com/v1/Alertmanager/monitoring/kube-prometheus-stack) ± value change - v0.34.1 + v0.33.1 spec (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.image (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) ± value change - quay.io/prometheus/prometheus:v3.15.0-distroless + quay.io/prometheus/prometheus:v3.13.1-distroless spec.version (monitoring.coreos.com/v1/Prometheus/monitoring/kube-prometheus-stack) ± value change - v3.15.0-distroless + v3.13.1-distroless spec.groups.kube-apiserver-burnrate.rules.rules (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kube-apiserver-burnrate.rules) - eleven list entries removed: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) labels: verb: read record: "cluster_verb:apiserver_request_sli_bad_events:rate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) labels: verb: write record: "cluster_verb:apiserver_request_sli_bad_events:rate5m" - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"LIST|GET\"}[5m]))" labels: verb: read record: "cluster_verb:apiserver_request_sli_events:rate5m" - expr: "sum by (cluster) (rate(apiserver_request_total{job=\"apiserver\",verb=~\"POST|PUT|PATCH|DELETE\"}[5m]))" labels: verb: write record: "cluster_verb:apiserver_request_sli_events:rate5m" - expr: | cluster_verb:apiserver_request_sli_bad_events:rate5m / cluster_verb:apiserver_request_sli_events:rate5m record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" - expr: | avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[1d]) / avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[1d]) record: "apiserver_request:burnrate1d" - expr: | avg_over_time(cluster_verb:apiserver_request_sli_bad_events:rate5m[3d]) / avg_over_time(cluster_verb:apiserver_request_sli_events:rate5m[3d]) record: "apiserver_request:burnrate3d" + ten list entries added: - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[1d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[1d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[1d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[1d])) labels: verb: read record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[3d])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[3d])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[3d])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[3d])) labels: verb: read record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - ( ( sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope=~"resource|",le=~"1(\\.0)?"}[5m])) or vector(0) ) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="namespace",le=~"5(\\.0)?"}[5m])) + sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"LIST|GET",subresource!~"proxy|attach|log|exec|portforward",scope="cluster",le=~"30(\\.0)?"}[5m])) ) ) + # errors sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"LIST|GET"}[5m])) labels: verb: read record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1d])) labels: verb: write record: "apiserver_request:burnrate1d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[1h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[1h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[1h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[1h])) labels: verb: write record: "apiserver_request:burnrate1h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[2h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[2h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[2h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[2h])) labels: verb: write record: "apiserver_request:burnrate2h" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[30m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[30m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[30m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[30m])) labels: verb: write record: "apiserver_request:burnrate30m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[3d])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[3d])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[3d])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[3d])) labels: verb: write record: "apiserver_request:burnrate3d" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[5m])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[5m])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[5m])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[5m])) labels: verb: write record: "apiserver_request:burnrate5m" - expr: | ( ( # too slow sum by (cluster) (rate(apiserver_request_sli_duration_seconds_count{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward"}[6h])) - sum by (cluster) (rate(apiserver_request_sli_duration_seconds_bucket{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",subresource!~"proxy|attach|log|exec|portforward",le=~"1(\\.0)?"}[6h])) ) + sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE",code=~"5.."}[6h])) ) / sum by (cluster) (rate(apiserver_request_total{job="apiserver",verb=~"POST|PUT|PATCH|DELETE"}[6h])) labels: verb: write record: "apiserver_request:burnrate6h" spec.groups.kubernetes-apps.rules.KubeJobNotCompleted.expr (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps) ± value change in multiline text (one insert, one deletion) time() - max by (namespace, job_name, cluster) (kube_job_status_start_time{job="kube-state-metrics", namespace=~".*"} and - kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 - unless on (namespace, job_name, cluster) - max by (namespace, job_name, cluster) (kube_job_labels{job="kube-state-metrics", namespace=~".*",label_excluded_from_alerts="true"} == 1) + kube_job_status_active{job="kube-state-metrics", namespace=~".*"} > 0) > 43200 spec.groups.kubernetes-apps.rules.KubePdbNotEnoughHealthyPods.expr (monitoring.coreos.com/v1/PrometheusRule/monitoring/kube-prometheus-stack-kubernetes-apps) ± value change in multiline text (no inserts, one deletion) ( kube_poddisruptionbudget_status_desired_healthy{job="kube-state-metrics", namespace=~".*"} - kube_poddisruptionbudget_status_current_healthy{job="kube-state-metrics", namespace=~".*"} ) - > 0 - and - kube_poddisruptionbudget_status_expected_pods{job="kube-state-metrics", namespace=~".*"} > 0 spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-coredns) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-apiserver) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-controller-manager) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-etcd) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0 (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler) - one map entry removed: authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token + one map entry added: bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token spec.endpoints.0.tlsConfig (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kube-scheduler) - one map entry removed: ca: configMap: name: kube-root-ca.crt key: ca.crt + one map entry added: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt spec.endpoints (monitoring.coreos.com/v1/ServiceMonitor/monitoring/kube-prometheus-stack-kubelet) - three list entries removed: - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - authorization: type: Bearer credentials: name: kube-prometheus-stack-prometheus-token key: token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: ca: configMap: name: kube-root-ca.crt key: ca.crt insecureSkipVerify: true + three list entries added: - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true metricRelabelings: - action: drop regex: (csi_operations|storage_operation_duration)_seconds_bucket;(0.25|2.5|15|25|120|600)(\.0)? sourceLabels: - __name__ - le port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true interval: 10s metricRelabelings: - action: drop regex: container_cpu_(cfs_throttled_seconds_total|load_average_10s|system_seconds_total|user_seconds_total) sourceLabels: - __name__ - action: drop regex: container_fs_(io_current|io_time_seconds_total|io_time_weighted_seconds_total|reads_merged_total|sector_reads_total|sector_writes_total|writes_merged_total) sourceLabels: - __name__ - action: drop regex: container_memory_(mapped_file|swap) sourceLabels: - __name__ - action: drop regex: container_(file_descriptors|tasks_state|threads_max) sourceLabels: - __name__ - action: drop regex: container_memory_failures_total;hierarchy sourceLabels: - __name__ - scope - action: drop regex: "container_network_.*;(cali|cilium|cni|lxc|nodelocaldns|tunl).*" sourceLabels: - __name__ - interface - action: drop regex: "container_spec.*" sourceLabels: - __name__ - action: drop regex: .+; sourceLabels: - id - pod path: /metrics/cadvisor port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true trackTimestampsStaleness: true - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token honorLabels: true honorTimestamps: true path: /metrics/probes port: https-metrics relabelings: - action: replace sourceLabels: - __metrics_path__ targetLabel: metrics_path scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true spec.template.spec (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.template.spec.containers.create.image (batch/v1/Job/monitoring/kube-prometheus-stack-admission-create) ± value change - ghcr.io/jkroepke/kube-webhook-certgen:1.11.0 + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 spec.template.spec (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch) - one map entry removed: nodeSelector: kubernetes.io/os: linux spec.template.spec.containers.patch.image (batch/v1/Job/monitoring/kube-prometheus-stack-admission-patch) ± value change - ghcr.io/jkroepke/kube-webhook-certgen:1.11.0 + ghcr.io/jkroepke/kube-webhook-certgen:1.8.4 (root level) (networking.k8s.io/v1/NetworkPolicy/gitlab/gitlab-redis) - one document removed: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: gitlab-redis namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: egress: - ingress: - ports: - port: 6379 - ports: - port: 9121 podSelector: matchLabels: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis policyTypes: - Ingress - Egress (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitaly) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitaly release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: gitlab-shell release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-kas) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: kas release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-sidekiq-all-in-1-v1) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-sidekiq-all-in-1-v1 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-webservice-default) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab (root level) (policy/v1beta1/PodDisruptionBudget/gitlab/gitlab-registry-v1) - one document removed: apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: name: gitlab-registry-v1 namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxUnavailable: 1 selector: matchLabels: app: registry release: gitlab (root level) (v1/ServiceAccount/gitlab/gitlab-runner-access) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-runner-access namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab (root level) (v1/ServiceAccount/gitlab/gitlab-redis-master) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system automountServiceAccountToken: false (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-runner) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: check-live: | #!/bin/bash set -eou pipefail # default timeout is 3 seconds, can be overriden VERIFY_TIMEOUT=${1:-${VERIFY_TIMEOUT:-3}} if ! /usr/bin/pgrep -f ".*register-the-runner" > /dev/null && ! /usr/bin/pgrep -f "gitlab.*runner" > /dev/null ; then exit 1 fi status=0 # empty --url= helps `gitlab-runner verify` select all configured runners (otherwise filters for $CI_SERVER_URL) verify_output=$(timeout "${VERIFY_TIMEOUT}" gitlab-runner verify --url= 2>&1) || status=$? # timeout exit code is 143 with busybox, and 124 with coreutils if (( status == 143 )) || (( status == 124 )) ; then echo "'gitlab-runner verify' terminated by timeout, not a conclusive failure" >&2 exit 0 elif (( status > 0 )) ; then exit ${status} fi grep -qE "is (alive|valid)" <<<"${verify_output}" config.template.toml: | [[runners]] [runners.kubernetes] image = "archlinux/archlinux:latest" namespace_per_job = true node_selector_overwrite_allowed = "kubernetes.io/arch=.*" pull_policy = ["always", "always"] [runners.kubernetes.node_selector] "kubernetes.io/arch" = "amd64" [runners.cache] Type = "s3" Path = "gitlab-runner" Shared = true [runners.cache.s3] ServerAddress = "brickyard.home.arpa:3900" BucketName = "gitlab-runner-cache" BucketLocation = "apartment" Insecure = true AuthenticationType = "access-key" PathStyle = true config.toml: | shutdown_timeout = 0 concurrent = 10 check_interval = 3 log_level = "info" entrypoint: | #!/bin/bash set -e export CONFIG_PATH_FOR_INIT="/home/gitlab-runner/.gitlab-runner/" mkdir -p ${CONFIG_PATH_FOR_INIT} cp /configmaps/config.toml ${CONFIG_PATH_FOR_INIT} # Set up environment variables for cache if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey) export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey) fi if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file" elif [[ -f /secrets/gcs-application-credentials-file ]]; then export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file" else if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id) # echo -e used to make private key multiline (in google json auth key private key is oneline with \n) export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key)) fi fi if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name) export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key) fi if [[ -f /secrets/runner-registration-token ]]; then export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token) fi if [[ -f /secrets/runner-token ]]; then export CI_SERVER_TOKEN=$(cat /secrets/runner-token) fi # Register the runner if ! sh /configmaps/register-the-runner; then exit 1 fi # Run pre-entrypoint-script if ! bash /configmaps/pre-entrypoint-script; then exit 1 fi # Start the runner exec /entrypoint run \ --working-directory=/home/gitlab-runner pre-entrypoint-script: register-the-runner: | #!/bin/sh signal_handler() { if [ ! -d "/proc/$register_pid" ]; then wait $register_pid fi exit } trap 'signal_handler' QUIT INT MAX_REGISTER_ATTEMPTS=30 # Reset/unset the not needed flags when an authentication token RUN_UNTAGGED="" ACCESS_LEVEL="" if [ -n "$CI_SERVER_TOKEN" ] && [ "${CI_SERVER_TOKEN#glrt-}" != "$CI_SERVER_TOKEN" ]; then RUN_UNTAGGED="" ACCESS_LEVEL="" unset REGISTER_LOCKED unset RUNNER_TAG_LIST fi for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}" /entrypoint register \ ${RUN_UNTAGGED} \ ${ACCESS_LEVEL} \ --template-config /configmaps/config.template.toml \ --non-interactive & register_pid=$! wait $register_pid retval=$? if [ ${retval} = 0 ]; then break elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then exit 1 fi sleep 5 done (root level) (v1/ConfigMap/gitlab/gitlab-gitaly) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.toml.tpl: | # The directory where Gitaly's executables are stored bin_dir = "/usr/local/bin" # listen on a TCP socket. This is insecure (no authentication) listen_addr = ":8075" # Directory where internal sockets reside # note: no value will result in a `/tmp/gitlab-internal-*` path # internal_socket_dir = "/home/git" # If metrics collection is enabled, inform gitaly about that prometheus_listen_addr = ":9236" # Graceful shutdown timeout, how long to wait for in-flight requests to complete graceful_restart_timeout = "25s" # Storage configuration {% $storages := coll.Slice "default" %} {% $hostid := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 %} {% $index := 0 %} {% if regexp.Match "^[0-9]+$" $hostid %} {% $index = conv.ToInt64 $hostid %} {% end %} {% if len $storages | lt $index %} [[storage]] name = "{% index $storages $index %}" path = "/home/git/repositories" {% else %} {% printf "Storage for node %d is not present in the storageNames array. Did you use kubectl to scale up? You need to solely use helm for this purpose." $index | fail %} {% end %} [logging] format = "json" dir = "/var/log/gitaly" [auth] token = {% file.Read "/etc/gitlab-secrets/gitaly/gitaly_token" | strings.TrimSpace | data.ToJSON %} [git] use_bundled_binaries = true ignore_gitconfig = true [gitlab-shell] # The directory where gitlab-shell is installed dir = "/srv/gitlab-shell" [gitlab] # location of shared secret for GitLab Shell / API interaction secret_file = "/etc/gitlab-secrets/shell/.gitlab_shell_secret" # URL of API url = "http://gitlab-webservice-default.gitlab.svc:8181/" [gitlab.http-settings] # read_timeout = 300 # user = someone # password = somepass # ca_file = /etc/ssl/cert.pem # ca_path = /etc/pki/tls/certs [hooks] # directory containing custom hooks custom_hooks_dir = "/home/git/custom_hooks" configure: | set -e mkdir -p /init-secrets/gitaly /init-secrets/shell cp -v -r -L /init-config/.gitlab_shell_secret /init-secrets/shell/.gitlab_shell_secret cp -v -r -L /init-config/gitaly_token /init-secrets/gitaly/gitaly_token (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # optional for secret in redis redis-sentinel postgres gitlab-exporter ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets gitlab-exporter.yml.erb: | server: name: webrick listen_address: "*" listen_port: 9168 probes: db_common: &db_common methods: - probe_db opts: connection_string: dbname=gitlab-prod user=gitlab host=db-gitlab-rw.gitlab.svc port=5432 password='<%= File.read('/etc/gitlab/postgres/psql-password-main').strip.gsub(/[\'\\]/) { |esc| '\\' + esc } %>' database: multiple: true ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common database_bloat: class_name: Database::BloatProber <<: *db_common sidekiq: &sidekiq methods: - probe_queues - probe_workers - probe_retries - probe_stats opts: redis_url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 redis_enable_client: false probe_non_namespaced: true ruby: &ruby methods: - probe_gc opts: quantiles: false metrics: multiple: true ruby: <<: *ruby sidekiq: <<: *sidekiq ci_builds: class_name: Database::CiBuildsProber <<: *db_common tuple_stats: class_name: Database::TuplesProber <<: *db_common rows_count: class_name: Database::RowCountProber <<: *db_common pg_sequences: class_name: Database::PgSequencesProber <<: *db_common (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-shell-sshd) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell-sshd namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: sshd_config: | # $OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options override the # default value. Port 2222 #AddressFamily any #ListenAddress 0.0.0.0 #ListenAddress :: #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key #HostKey /etc/ssh/ssh_host_ecdsa_key #HostKey /etc/ssh/ssh_host_ed25519_key # Ciphers and keying #RekeyLimit default none # Logging #SyslogFacility AUTH LogLevel ERROR # Authentication: PermitRootLogin no #StrictModes yes #MaxAuthTries 6 #MaxSessions 10 #PubkeyAuthentication yes #AuthorizedPrincipalsFile none # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes #PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication no #KerberosOrLocalPasswd yes #KerberosTicketCleanup yes #KerberosGetAFSToken no # GSSAPI options #GSSAPIAuthentication no #GSSAPICleanupCredentials yes # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will # be allowed through the ChallengeResponseAuthentication and # PasswordAuthentication. Depending on your PAM configuration, # PAM authentication via ChallengeResponseAuthentication may bypass # the setting of "PermitRootLogin without-password". # If you just want the PAM account and session checks to run without # PAM authentication, then enable this but set PasswordAuthentication # and ChallengeResponseAuthentication to 'no'. #UsePAM no #AllowAgentForwarding yes #AllowTcpForwarding yes #GatewayPorts no #X11Forwarding no #X11DisplayOffset 10 #X11UseLocalhost yes #PermitTTY yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #PermitUserEnvironment no #Compression delayed ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS no PidFile /srv/sshd/sshd.pid #PermitTunnel no #ChrootDirectory none #VersionAddendum none # no default banner path #Banner none # override default of no subsystems # Subsystem sftp /usr/lib/ssh/sftp-server # the following are HPN related configuration options # tcp receive buffer polling. disable in non autotuning kernels #TcpRcvBufPoll yes # disable hpn performance boosts #HPNDisabled no # buffer size for hpn to non-hpn connections #HPNBufferSize 2048 # Example of overriding settings on a per-user basis #Match User anoncvs # X11Forwarding no # AllowTcpForwarding no # PermitTTY no # ForceCommand cvs server # The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 # but this is overridden so installations will only check .ssh/authorized_keys AuthorizedKeysFile .ssh/authorized_keys AuthorizedKeysCommand /authorized_keys %u %k AuthorizedKeysCommandUser git PasswordAuthentication no AllowUsers git # Enable the use of Git protcol v2 AcceptEnv GIT_PROTOCOL # Hard disable all forwarding DisableForwarding yes # Specifies the maximum number of concurrent unauthenticated connections to the SSH daemon. # See `man sshd_config(5)` MaxStartups 10:30:100 # Specifies amount of time athat the server will disconnect after if the user has not successfully logged in LoginGraceTime 60 # Includes Include /etc/ssh/sshd_config.d/*.conf (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | # GitLab user. git by default user: git # Url to gitlab instance. Used for api calls. Should end with a slash. gitlab_url: "http://gitlab-webservice-default.gitlab.svc:8181/" secret_file: /etc/gitlab-secrets/shell/.gitlab_shell_secret # File used as authorized_keys for gitlab user auth_file: "/home/git/.ssh/authorized_keys" # Log file. # Default is gitlab-shell.log in the root directory. log_file: "/var/log/gitlab-shell/gitlab-shell.log" log_format: json # Audit usernames. # Set to true to see real usernames in the logs instead of key ids, which is easier to follow, but # incurs an extra API call on every gitlab-shell command. audit_usernames: false lfs: pure_ssh_protocol: false pat: enabled: true allowed_scopes: [] configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # END gitlab.scripts.configure.secrets mkdir -p /${secret_dir}/ssh cp -v -r -L /${config_dir}/ssh_host_* /${secret_dir}/ssh/ chmod 0400 /${secret_dir}/ssh/ssh_host_* krb5.conf: (root level) (v1/ConfigMap/gitlab/gitlab-nginx-ingress-tcp) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-nginx-ingress-tcp namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: 22222: "gitlab/gitlab-gitlab-shell:22222:PROXY:" (root level) (v1/ConfigMap/gitlab/gitlab-kas) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yaml: | agent: kubernetes_api: listen: address: :8154 url_path_prefix: /k8s-proxy websocket_token_secret_file: /etc/kas/.gitlab_kas_websocket_token_secret listen: address: :8150 websocket: true api: listen: address: :8153 authentication_secret_file: /etc/kas/.gitlab_kas_secret gitlab: address: http://gitlab-webservice-default.gitlab.svc:8181 authentication_secret_file: /etc/kas/.gitlab_kas_secret external_url: https://code.nogweii.net observability: listen: address: :8151 liveness_probe: url_path: /liveness readiness_probe: url_path: /readiness private_api: listen: address: :8155 authentication_secret_file: /etc/kas/.gitlab_kas_private_api_secret redis: database_index: 0 password_file: /etc/kas/redis/redis-password server: address: gitlab-redis-master.gitlab.svc:6379 (root level) (v1/ConfigMap/gitlab/gitlab-migrations) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-migrations namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in rails-secrets migrations gitaly ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true signup_enabled: false # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 installation_type: | gitlab-helm-chart pages_redirect_uri: "https://projects.aether.page/auth" redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: (root level) (v1/ConfigMap/gitlab/gitlab-sidekiq) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-sidekiq namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "127.0.0.0/8" - "::1/128" sidekiq_exporter: enabled: true address: "*" port: 3807 log_enabled: false sidekiq_health_checks: enabled: true address: "*" port: 3808 installation_type: | gitlab-helm-chart krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-toolbox) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets if [ ! -f "/${secret_dir}/objectstorage/.s3cfg" ]; then cat <<EOF > "/${secret_dir}/.s3cfg" [default] access_key = $(cat /init-secrets/minio/accesskey) secret_key = $(cat /init-secrets/minio/secretkey) bucket_location = us-east-1 host_base = minio.code.nogweii.net host_bucket = minio.code.nogweii.net/%(bucket) default_mime_type = binary/octet-stream enable_multipart = True multipart_max_chunks = 10000 multipart_chunk_size_mb = 128 recursive = True recv_chunk = 65536 send_chunk = 65536 server_side_encryption = False signature_v2 = True socket_timeout = 300 use_mime_magic = False verbosity = WARNING website_endpoint = https://minio.code.nogweii.net EOF else mv "/${secret_dir}/objectstorage/.s3cfg" "/${secret_dir}/.s3cfg" fi configure-gsutil: | if [ -e "$GOOGLE_APPLICATION_CREDENTIALS" ]; then # The following script is used to configure gsutil when creating backups # It provides inputs to the `gsutil config -e` prompt as follows: # 1) Path to service account JSON key file # 2) Do not set permissions for key file # 3) GCP Project ID # 4) Decline anonymous usage statistics printf "$GOOGLE_APPLICATION_CREDENTIALS\nN\n\nN\n" | gsutil config -e else # If the backup config is not configured, assume that # Application Default Credentials are used with a service account. # This enables GKE Workload Identity Federation to work. echo '[GoogleCompute]\nservice_account = default' > ~/.boto fi database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - 127.0.0.0/8 sidekiq_exporter: extra: krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-webservice) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: adapter: redis configure: | # BEGIN gitlab.scripts.configure.secrets set -e config_dir="/init-config" secret_dir="/init-secrets" # required for secret in shell gitaly registry rails-secrets gitlab-workhorse ; do mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" done # optional for secret in redis redis-sentinel minio objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao ; do if [ -e "${config_dir}/${secret}" ]; then mkdir -p "${secret_dir}/${secret}" cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/" fi done # END gitlab.scripts.configure.secrets database.yml.erb: | production: main: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: true ci: adapter: postgresql encoding: unicode database: gitlab-prod username: gitlab password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %> host: "db-gitlab-rw.gitlab.svc" port: 5432 connect_timeout: keepalives: keepalives_idle: keepalives_interval: keepalives_count: tcp_user_timeout: application_name: prepared_statements: false database_tasks: false gitlab.yml.erb: | production: &base gitlab: host: code.nogweii.net https: true ssh_host: "code.nogweii.net" action_cable_allowed_origins: [] max_request_duration_seconds: 57 impersonation_enabled: application_settings_cache_seconds: 60 usage_ping_enabled: true seat_link_enabled: true username_changing_enabled: true issue_closing_pattern: default_theme: default_color_mode: default_syntax_highlighting_theme: default_projects_features: issues: true merge_requests: true wiki: true snippets: true builds: true container_registry: true signup_enabled: false graphql_timeout: webhook_timeout: trusted_proxies: time_zone: "UTC" email_from: "gitlab@aether.earth" email_display_name: "GitLab" email_reply_to: "gitlab+noreply@aether.earth" email_subject_suffix: "" gravatar: plain_url: ssl_url: extra: # Consolidated object storage configuration ## property local configuration will override object_store object_store: enabled: true proxy_download: true connection: <%= YAML.load_file("/etc/gitlab/objectstorage/object_store").to_json() %> objects: artifacts: bucket: gitlab-artifacts proxy_download: true lfs: bucket: gitlab-lfs proxy_download: true uploads: bucket: gitlab-uploads proxy_download: true packages: bucket: gitlab-packages proxy_download: true external_diffs: bucket: gitlab-external-diffs proxy_download: true terraform_state: bucket: gitlab-terraform-state dependency_proxy: bucket: gitlab-dependency-proxy proxy_download: true ci_secure_files: bucket: gitlab-ci-secure-files pages: bucket: gitlab-pages artifacts: enabled: true lfs: enabled: true uploads: enabled: true packages: enabled: true external_diffs: enabled: true when: terraform_state: enabled: true ci_secure_files: enabled: true dependency_proxy: enabled: true sentry: enabled: false dsn: clientside_dsn: environment: gitlab_docs: enabled: false host: "" sidekiq: log_format: json oidc_provider: openid_id_token_expire_in_seconds: 120 pages: enabled: false access_control: false artifacts_server: true path: /srv/gitlab/shared/pages host: aether.page port: 443 https: true secret_file: /etc/gitlab/pages/secret external_http: false external_https: false local_store: enabled: false path: namespace_in_path: false mattermost: enabled: false gitlab_ci: ldap: enabled: false omniauth: enabled: true sync_profile_from_provider: ["openid_connect"] sync_profile_attributes: ["email","name"] allow_single_sign_on: ["openid_connect"] block_auto_created_users: false auto_link_ldap_user: false auto_link_saml_user: false auto_link_user: ["openid_connect"] external_providers: [] providers: - <%= YAML.load_file("/etc/gitlab/omniauth/authentik-oidc/config.yaml").to_json() %> kerberos: enabled: false keytab: /etc/krb5.keytab use_dedicated_port: false port: 8443 https: true simple_ldap_linking_allowed_realms: [] duo_auth: enabled: false hostname: integration_key: secret_key: shared: gitaly: client_path: /home/git/gitaly/bin token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %> repositories: storages: # You must have at least a `default` storage path. default: path: /var/opt/gitlab/repo gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 backup: path: "tmp/backups" # Relative paths are relative to Rails.root (default: tmp/backups/) gitlab_kas: enabled: true secret_file: /etc/gitlab/kas/.gitlab_kas_secret external_url: "wss://k.code.nogweii.net" internal_url: "grpc://gitlab-kas.gitlab.svc:8153" # Zoekt secrets are present, load them. zoekt: username_file: /etc/gitlab/zoekt/.gitlab_zoekt_username password_file: /etc/gitlab/zoekt/.gitlab_zoekt_password gitlab_shell: path: /home/git/gitlab-shell/ hooks_path: /home/git/gitlab-shell/hooks/ upload_pack: true receive_pack: true ssh_port: 22222 secret_file: /etc/gitlab/shell/.gitlab_shell_secret workhorse: secret_file: /etc/gitlab/gitlab-workhorse/secret git: bin_path: /usr/bin/git webpack: monitoring: ip_whitelist: - "0.0.0.0/0" - "::/0" web_exporter: enabled: true address: "0.0.0.0" port: 8083 sidekiq_exporter: shutdown: blackout_seconds: <%= ENV["SHUTDOWN_BLACKOUT_SECONDS"] %> rack_attack: git_basic_auth: ## Registry Integration registry: enabled: true host: c.code.nogweii.net api_url: http://gitlab-registry.gitlab.svc:5000 key: /etc/gitlab/registry/gitlab-registry.key issuer: gitlab-issuer notification_secret: <%= YAML.load_file("/etc/gitlab/registry/notificationSecret").flatten.first %> smartcard: enabled: false ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt' client_certificate_required_host: smartcard.code.nogweii.net client_certificate_required_port: 443 san_extensions: false required_for_git_access: false installation_type: | gitlab-helm-chart krb5.conf: redis.action_cable.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: resque.yml.erb: | production: url: redis://:<%= ERB::Util::url_encode(File.read("/etc/gitlab/redis/redis-password").strip) %>@gitlab-redis-master.gitlab.svc:6379/0 id: session_store.yml.erb: | production: session_cookie_token_prefix: "" smtp_settings.rb: | smtp_settings = { address: "mail-relay.email.svc.cluster.local", port: 587, ca_file: "/etc/ssl/certs/ca-certificates.crt", enable_starttls_auto: false, tls: false, openssl_verify_mode: "peer", open_timeout: 30, read_timeout: 60 } Rails.application.config.action_mailer.delivery_method = :smtp ActionMailer::Base.delivery_method = :smtp ActionMailer::Base.smtp_settings = smtp_settings (root level) (v1/ConfigMap/gitlab/gitlab-workhorse-default) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-workhorse-default namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: configure: | set -e mkdir -p /init-secrets-workhorse/gitlab-workhorse cp -v -r -L /init-config/gitlab-workhorse/secret /init-secrets-workhorse/gitlab-workhorse/secret mkdir -p /init-secrets-workhorse/redis cp -v -r -L /init-config/redis/redis-password /init-secrets-workhorse/redis/ if [ -f /init-config/objectstorage/object_store ]; then mkdir -p /init-secrets-workhorse/objectstorage cp -v -r -L /init-config/objectstorage/object_store /init-secrets-workhorse/objectstorage/ fi installation_type: | gitlab-helm-chart workhorse-config.toml.tpl: | shutdown_timeout = "61s" [redis] DB = 0 URL = "redis://gitlab-redis-master.gitlab.svc:6379" Password = {% file.Read "/etc/gitlab/redis/redis-password" | strings.TrimSpace | data.ToJSON %} {%- $supported_providers := slice "AWS" "AzureRM" "Google" -%} {%- $connection := coll.Dict "provider" "" -%} {%- if file.Exists "/etc/gitlab/minio/accesskey" %} {%- $aws_access_key_id := file.Read "/etc/gitlab/minio/accesskey" | strings.TrimSpace -%} {%- $aws_secret_access_key := file.Read "/etc/gitlab/minio/secretkey" | strings.TrimSpace -%} {%- $connection = coll.Dict "provider" "AWS" "aws_access_key_id" $aws_access_key_id "aws_secret_access_key" $aws_secret_access_key -%} {%- end %} {%- if file.Exists "/etc/gitlab/objectstorage/object_store" %} {%- $connection = file.Read "/etc/gitlab/objectstorage/object_store" | strings.TrimSpace | data.YAML -%} {%- end %} {%- if has $supported_providers $connection.provider %} [object_storage] provider = "{% $connection.provider %}" {%- if eq $connection.provider "AWS" %} {%- $connection = coll.Merge $connection (coll.Dict "aws_access_key_id" "" "aws_secret_access_key" "" ) %} # AWS / S3 object storage configuration. [object_storage.s3] # access/secret can be blank! aws_access_key_id = {% $connection.aws_access_key_id | strings.TrimSpace | data.ToJSON %} aws_secret_access_key = {% $connection.aws_secret_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "AzureRM" %} {%- $connection = coll.Merge $connection (coll.Dict "azure_storage_account_name" "" "azure_storage_access_key" "") %} # Azure Blob storage configuration. [object_storage.azurerm] azure_storage_account_name = {% $connection.azure_storage_account_name | strings.TrimSpace | data.ToJSON %} azure_storage_access_key = {% $connection.azure_storage_access_key | strings.TrimSpace | data.ToJSON %} {%- else if eq $connection.provider "Google" %} # Google storage configuration. [object_storage.google] {% $connection | coll.Omit "provider" | data.ToTOML %} {%- end %} {%- end %} [image_resizer] max_scaler_procs = 2 max_filesize = 250000 [[listeners]] network = "tcp" addr = ":8181" (root level) (v1/ConfigMap/gitlab/gitlab-webservice-tests) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-webservice-tests namespace: gitlab labels: app: webservice helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: test_login: | set -e echo 'Start Test' endpoint="https://code.nogweii.net" cookie_read="-c /tmp/test_login.cookie" cookie_readwrite="$cookie_read -b /tmp/test_login.cookie" signin_url="$endpoint/users/sign_in" echo "Login to create a session: $signin_url" csrf=$(curl -L $signin_url --fail -s $cookie_read | grep -Po '<meta.*name="csrf-token".*content="\K[a-zA-Z0-9\+=\-\/]*') curl -X POST $signin_url -s $cookie_readwrite -F "authenticity_token=$csrf" -F 'user[login]=root' -F "user[password]=$(cat /initial_root_password)" profile_url="$endpoint/-/profile" echo "Confirm session valid: $profile_url" profile_status=$(curl -L -s -o /tmp/profile_output -w "%{http_code}" $cookie_readwrite $profile_url) if [ "$profile_status" != "200" ]; then echo "Error: Session Invalid" cat /tmp/profile_output exit 1 fi echo 'Test Passed' exit 0 (root level) (v1/ConfigMap/gitlab/gitlab-redis-configuration) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-configuration namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: master.conf: | dir /data # User-supplied master configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of master configuration redis.conf: | # User-supplied common configuration: # Enable AOF https://redis.io/topics/persistence#append-only-file appendonly yes # Disable RDB persistence, AOF persistence already enabled. save "" # End of common configuration replica.conf: | dir /data # User-supplied replica configuration: rename-command FLUSHDB "" rename-command FLUSHALL "" # End of replica configuration (root level) (v1/ConfigMap/gitlab/gitlab-redis-health) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-health namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: ping_liveness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ] && [ "$responseFirstWord" != "MASTERDOWN" ]; then echo "$response" exit 1 fi ping_liveness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_liveness_local.sh" $1 || exit_status=$? "$script_dir/ping_liveness_master.sh" $1 || exit_status=$? exit $exit_status ping_liveness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi responseFirstWord=$(echo $response | head -n1 | awk '{print $1;}') if [ "$response" != "PONG" ] && [ "$responseFirstWord" != "LOADING" ]; then echo "$response" exit 1 fi ping_readiness_local.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h localhost \ -p $REDIS_PORT \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi ping_readiness_local_and_master.sh: | script_dir="$(dirname "$0")" exit_status=0 "$script_dir/ping_readiness_local.sh" $1 || exit_status=$? "$script_dir/ping_readiness_master.sh" $1 || exit_status=$? exit $exit_status ping_readiness_master.sh: | #!/bin/bash [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" [[ -n "$REDIS_MASTER_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 15 $1 \ redis-cli \ -h $REDIS_MASTER_HOST \ -p $REDIS_MASTER_PORT_NUMBER \ ping ) if [ "$?" -eq "124" ]; then echo "Timed out" exit 1 fi if [ "$response" != "PONG" ]; then echo "$response" exit 1 fi (root level) (v1/ConfigMap/gitlab/gitlab-redis-scripts) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-redis-scripts namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system data: start-master.sh: | #!/bin/bash [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" if [[ -f /opt/bitnami/redis/mounted-etc/master.conf ]];then cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf fi if [[ -f /opt/bitnami/redis/mounted-etc/redis.conf ]];then cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf fi ARGS=("--port" "${REDIS_PORT}") ARGS+=("--requirepass" "${REDIS_PASSWORD}") ARGS+=("--masterauth" "${REDIS_PASSWORD}") ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") exec redis-server "${ARGS[@]}" (root level) (v1/ConfigMap/gitlab/gitlab-registry) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: config.yml.tpl: | version: 0.1 log: fields: service: registry level: info http: addr: :5000 # `host` is not configurable # `prefix` is not configurable debug: addr: :5001 prometheus: enabled: false path: /metrics draintimeout: 0 headers: X-Content-Type-Options: [nosniff] secret: "HTTP_SECRET" relativeurls: false health: storagedriver: enabled: false interval: 10s threshold: 3 auth: token: realm: https://code.nogweii.net/jwt/auth service: container_registry issuer: gitlab-issuer # This is provided from the initContainer execution, at a known path. rootcertbundle: /etc/docker/registry/certificate.crt autoredirect: false validation: disabled: true manifests: referencelimit: 0 payloadsizelimit: 0 urls: allow: deny: notifications: reporting: profiling: storage: maintenance: readonly: enabled: false uploadpurging: enabled: true age: 168h interval: 24h dryrun: false redirect: disable: true exceptions: middleware: database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable gc: disabled: false redis: rate_limiter: enabled: false configure: | if [ -e /config/accesskey ] ; then sed -i -e 's@ACCESS_KEY@'"$(cat /config/accesskey)"'@' -e 's@SECRET_KEY@'"$(cat /config/secretkey)"'@' /registry/config.yml fi # Place the `http.secret` value from the kubernetes secret sed -i -e 's@HTTP_SECRET@'"$(cat /config/httpSecret)"'@' /registry/config.yml # Populate sensitive registry notification secrets in the config file if [ -d /config/notifications ]; then for i in /config/notifications/*; do filename=$(basename $i); sed -i -e 's@'"${filename}"'@'"$(cat $i)"'@' /registry/config.yml; done fi # Insert any provided `storage` block from kubernetes secret if [ -d /config/storage ]; then # Copy contents of storage secret(s) mkdir -p /registry/storage cp -v -r -L /config/storage/* /registry/storage/ # Ensure there is a new line in the end echo '' >> /registry/storage/config # Default `delete.enabled: true` if not present. ## Note: busybox grep doesn't support multiline, so we chain `egrep`. if ! $(egrep -A1 '^delete:\s*$' /registry/storage/config | egrep -q '\s{2,4}enabled:') ; then echo 'delete:' >> /registry/storage/config echo ' enabled: true' >> /registry/storage/config fi # Indent /registry/storage/config 2 spaces before inserting into config.yml sed -i 's/^/ /' /registry/storage/config # Insert into /registry/config.yml after `storage:` sed -i '/^storage:/ r /registry/storage/config' /registry/config.yml # Remove the now extraneous `config` file rm /registry/storage/config fi # Copy any middleware.storage if present if [ -d /config/middleware.storage ]; then cp -v -r -L /config/middleware.storage /registry/middleware.storage fi # Set to known path, to used ConfigMap cat /config/certificate.crt > /registry/certificate.crt # Copy the optional profiling keyfile to the expected location if [ -f /config/profiling-key.json ]; then cp /config/profiling-key.json /registry/profiling-key.json fi # Insert Database password, if enabled if [ -f /config/database_password ] ; then sed -i -e 's@DB_PASSWORD_FILE@'"$(cat /config/database_password)"'@' /registry/config.yml fi # Insert Redis(cache) password, if enabled if [ -f /config/registry/redis-password ] ; then sed -i -e 's@REDIS_CACHE_PASSWORD@'"$(cat /config/registry/redis-password)"'@' /registry/config.yml fi # Insert Redis(rate-limiter) password, if enabled if [ -f /config/registry/redis-rateLimiting-password ] ; then sed -i -e 's@REDIS_RATE_LIMITING_PASSWORD@'"$(cat /config/registry/redis-rateLimiting-password)"'@' /registry/config.yml fi # Insert Redis(load balancing) password, if enabled if [ -f /config/registry/redis-loadBalancing-password ] ; then sed -i -e 's@REDIS_LOAD_BALANCING_PASSWORD@'"$(cat /config/registry/redis-loadBalancing-password)"'@' /registry/config.yml fi # Copy the database TLS connection files to the expected location and set permissions if [ -d /config/ssl ]; then cp -r /config/ssl/ /registry/ssl chmod 700 /registry/ssl chmod 600 /registry/ssl/*.pem fi # Copy TLS certificates if present if [ -d /config/tls ]; then cp -r /config/tls/ /registry/tls chmod 700 /registry/tls chmod 600 /registry/tls/* fi migrations-config.yml.tpl: | version: 0.1 log: fields: service: registry level: info database: enabled: true host: "db-gitlab-rw.gitlab.svc" port: 5432 user: registry password: "DB_PASSWORD_FILE" dbname: gl-registry sslmode: disable (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-chart-info) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-chart-info namespace: gitlab labels: app: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab data: gitlabChartVersion: "9.8.2" gitlabVersion: "18.8.2" (root level) (rbac.authorization.k8s.io/v1/ClusterRole/gitlab-gitlab-runner) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab rules: - resources: - events apiGroups: - verbs: - list - watch - resources: - namespaces apiGroups: - verbs: - create - delete - resources: - pods apiGroups: - verbs: - create - delete - get - list - watch - resources: - pods/attach - pods/exec apiGroups: - verbs: - get - create - patch - delete - resources: - pods/log apiGroups: - verbs: - get - list - resources: - secrets apiGroups: - verbs: - create - delete - get - update - resources: - serviceaccounts apiGroups: - verbs: - get - resources: - services apiGroups: - verbs: - create - get (root level) (rbac.authorization.k8s.io/v1/ClusterRoleBinding/gitlab-gitlab-runner) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: gitlab-gitlab-runner labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab roleRef: name: gitlab-gitlab-runner apiGroup: rbac.authorization.k8s.io kind: ClusterRole subjects: - name: gitlab-runner-access kind: ServiceAccount namespace: gitlab (root level) (v1/Service/gitlab/gitlab-gitaly) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP clusterIP: None selector: app: gitaly release: gitlab ports: - name: tcp-gitaly port: 8075 targetPort: grpc-gitaly - name: http-metrics port: 9236 targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-exporter release: gitlab ports: - name: http-metrics port: 9168 protocol: TCP targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-gitlab-shell namespace: gitlab annotations: tailscale.com/expose: "true" tailscale.com/hostname: gitlab-shell labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: gitlab-shell release: gitlab ports: - name: ssh port: 22222 protocol: TCP targetPort: 2222 (root level) (v1/Service/gitlab/gitlab-kas) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: kas release: gitlab ports: - name: tcp-kas-external-api port: 8150 protocol: TCP targetPort: 8150 - name: tcp-kas-internal-api port: 8153 protocol: TCP targetPort: 8153 - name: tcp-kas-k8s-api port: 8154 protocol: TCP targetPort: 8154 - name: http-metrics port: 8151 protocol: TCP targetPort: http-metrics (root level) (v1/Service/gitlab/gitlab-webservice-default) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: webservice gitlab.com/webservice-name: default release: gitlab ports: - name: http-webservice port: 8080 protocol: TCP targetPort: http-webservice - name: http-workhorse port: 8181 protocol: TCP targetPort: http-workhorse - name: http-metrics-ws port: 8083 protocol: TCP targetPort: http-metrics-ws (root level) (v1/Service/gitlab/gitlab-redis-headless) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-headless namespace: gitlab labels: app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP clusterIP: None selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis port: 6379 targetPort: redis (root level) (v1/Service/gitlab/gitlab-redis-master) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP internalTrafficPolicy: Cluster sessionAffinity: None selector: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: tcp-redis nodePort: null port: 6379 targetPort: redis (root level) (v1/Service/gitlab/gitlab-redis-metrics) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-redis-metrics namespace: gitlab labels: app.kubernetes.io/component: metrics app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: type: ClusterIP selector: app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis ports: - name: http-metrics port: 9121 protocol: TCP targetPort: metrics (root level) (v1/Service/gitlab/gitlab-registry) - one document removed: apiVersion: v1 kind: Service metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: type: ClusterIP selector: app: registry release: gitlab ports: - name: http-registry port: 5000 protocol: TCP targetPort: http (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-runner) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-runner namespace: gitlab labels: app: gitlab-gitlab-runner helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: revisionHistoryLimit: 10 selector: matchLabels: app: gitlab-gitlab-runner template: metadata: annotations: gitlab.com/prometheus_port: "9252" gitlab.com/prometheus_scrape: "true" labels: app: gitlab-gitlab-runner heritage: Helm release: gitlab spec: containers: - name: gitlab-gitlab-runner image: "registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v18.7.2" imagePullPolicy: IfNotPresent resources: {} command: - /usr/bin/dumb-init - "--" - /bin/bash - /configmaps/entrypoint ports: - name: metrics containerPort: 9252 volumeMounts: - name: projected-secrets mountPath: /secrets - name: etc-gitlab-runner mountPath: /home/gitlab-runner/.gitlab-runner - name: configmaps mountPath: /configmaps livenessProbe: exec: command: - /bin/bash - /configmaps/check-live - "3" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 readinessProbe: exec: command: - /usr/bin/pgrep - "gitlab.*runner" failureThreshold: 3 initialDelaySeconds: 60 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 4 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: false runAsNonRoot: true env: - name: CI_SERVER_URL value: "https://code.nogweii.net" - name: RUNNER_EXECUTOR value: kubernetes - name: REGISTER_LOCKED value: "false" - name: RUNNER_TAG_LIST value: - name: KUBERNETES_NAMESPACE value: gitlab - name: CACHE_S3_ACCESS_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_access_key_id - name: CACHE_S3_SECRET_KEY valueFrom: secretKeyRef: name: gitlab-object-store-configs key: runner_secret_access_key - name: SESSION_SERVER_ADDRESS value: null lifecycle: preStop: exec: command: - /entrypoint - unregister - "--all-runners" securityContext: fsGroup: 65533 runAsUser: 100 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-runner-access terminationGracePeriodSeconds: 3600 volumes: - name: runner-secrets emptyDir: medium: Memory - name: etc-gitlab-runner emptyDir: medium: Memory - name: projected-secrets projected: sources: - secret: name: gitlab-gitlab-runner-secret items: - key: runner-registration-token path: runner-registration-token - key: runner-token path: runner-token - name: configmaps configMap: name: gitlab-gitlab-runner (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-exporter) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-exporter namespace: gitlab labels: app: gitlab-exporter app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: gitlab-exporter release: gitlab template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9168" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9168" prometheus.io/scrape: "true" labels: app: gitlab-exporter app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-exporter release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-exporter image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:16.2.0" env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab-exporter/templates - name: CONFIG_DIRECTORY value: /etc/gitlab-exporter - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" ports: - name: http-metrics containerPort: 9168 resources: requests: cpu: 75m memory: 100M volumeMounts: - name: gitlab-exporter-config mountPath: /var/opt/gitlab-exporter/templates/gitlab-exporter.yml.erb subPath: gitlab-exporter.yml.erb - name: gitlab-exporter-secrets mountPath: /etc/gitlab readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - pgrep - "-f" - gitlab-exporter readinessProbe: exec: command: - pgrep - "-f" - gitlab-exporter securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'gitlab-exporter'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC - name: MALLOC_CONF value: "dirty_decay_ms:0,muzzy_decay_ms:0" - name: RUBY_GC_HEAP_FREE_SLOTS_MAX_RATIO value: "0.111" - name: RUBY_GC_HEAP_FREE_SLOTS_MIN_RATIO value: "0.055" - name: RUBY_GC_HEAP_INIT_SLOTS value: "80000" resources: requests: cpu: 50m volumeMounts: - name: gitlab-exporter-config mountPath: /config readOnly: true - name: init-gitlab-exporter-secrets mountPath: /init-config readOnly: true - name: gitlab-exporter-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: gitlab-exporter-config configMap: name: gitlab-gitlab-exporter - name: init-gitlab-exporter-secrets projected: defaultMode: 256 sources: - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - name: gitlab-exporter-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: gitlab-shell release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: gitlab-shell app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitlab-shell release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitlab-shell image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.45.5" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitlab-shell - name: CONFIG_DIRECTORY value: /srv/gitlab-shell - name: KEYS_DIRECTORY value: /etc/gitlab-secrets/ssh - name: SSH_DAEMON value: openssh - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC ports: - name: ssh containerPort: 2222 readinessProbe: failureThreshold: 2 initialDelaySeconds: 10 periodSeconds: 5 successThreshold: 1 tcpSocket: port: 2222 timeoutSeconds: 3 resources: requests: cpu: 0 memory: 6M volumeMounts: - name: shell-config mountPath: /etc/gitlab-shell - name: shell-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: shell-config mountPath: /etc/krb5.conf readOnly: true subPath: krb5.conf - name: sshd-config mountPath: /etc/ssh/sshd_config readOnly: true subPath: sshd_config - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: shell-config mountPath: /config readOnly: true - name: shell-init-secrets mountPath: /init-config readOnly: true - name: shell-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: shell-config configMap: name: gitlab-gitlab-shell - name: sshd-config configMap: name: gitlab-gitlab-shell-sshd - name: shell-init-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitlab-shell-host-keys - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - name: shell-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-kas) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-kas namespace: gitlab labels: app: kas app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: kas release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8151" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8151" prometheus.io/scrape: "true" labels: app: kas app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: kas release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: kas image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:v18.8.2" args: - "--configuration-file=/etc/kas/config.yaml" env: - name: OWN_PRIVATE_API_HOST value: gitlab-kas.gitlab.svc - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: httpGet: path: /liveness port: 8151 initialDelaySeconds: 15 periodSeconds: 20 ports: - name: kas containerPort: 8150 - name: kas-k8s-api containerPort: 8154 - name: kas-private-api containerPort: 8155 - name: http-metrics containerPort: 8151 readinessProbe: httpGet: path: /readiness port: 8151 initialDelaySeconds: 5 periodSeconds: 10 resources: requests: cpu: 100m memory: 256Mi volumeMounts: - name: init-etc-kas mountPath: /etc/kas readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65532 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 65532 runAsGroup: 65532 runAsUser: 65532 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 300 volumes: - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca - name: init-etc-kas projected: defaultMode: 288 sources: - configMap: name: gitlab-kas - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: .gitlab_kas_secret - secret: name: gitlab-kas-private-api items: - key: kas_private_api_secret path: .gitlab_kas_private_api_secret - secret: name: gitlab-kas-websocket-token items: - key: kas_websocket_token_secret path: .gitlab_kas_websocket_token_secret - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password (root level) (apps/v1/Deployment/gitlab/gitlab-sidekiq-all-in-1-v2) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: selector: matchLabels: app: sidekiq queue-pod-name: all-in-1 release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "3807" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "3807" prometheus.io/scrape: "true" labels: app: sidekiq app.kubernetes.io/name: gitlab heritage: Helm queue-pod-name: all-in-1 release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: sidekiq release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: sidekiq image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2" env: - name: prometheus_multiproc_dir value: /metrics - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: SIDEKIQ_QUEUES value: null - name: SIDEKIQ_DAEMON_MEMORY_KILLER value: "1" - name: SIDEKIQ_MEMORY_KILLER_CHECK_INTERVAL value: "3" - name: SIDEKIQ_MEMORY_KILLER_MAX_RSS value: "2000000" - name: SIDEKIQ_MEMORY_KILLER_GRACE_TIME value: "900" - name: SIDEKIQ_MEMORY_KILLER_SHUTDOWN_WAIT value: "30" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /liveness port: 3808 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-metrics containerPort: 3807 readinessProbe: failureThreshold: 3 httpGet: path: /readiness port: 3808 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 900m memory: 2G volumeMounts: - name: sidekiq-metrics mountPath: /metrics - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: sidekiq-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: sidekiq-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: sidekiq-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -f 'sidekiq'" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: sidekiq-config mountPath: /config readOnly: true - name: init-sidekiq-secrets mountPath: /init-config readOnly: true - name: sidekiq-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v18.8.2" args: - /scripts/wait-for-deps env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SIDEKIQ_CONCURRENCY value: "20" - name: SIDEKIQ_TIMEOUT value: "25" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: sidekiq-config mountPath: /var/opt/gitlab/templates readOnly: true - name: sidekiq-secrets mountPath: /etc/gitlab readOnly: true - name: sidekiq-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: sidekiq-metrics emptyDir: medium: Memory - name: sidekiq-config projected: sources: - configMap: name: gitlab-sidekiq - name: init-sidekiq-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: sidekiq-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-toolbox) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-toolbox namespace: gitlab labels: app: toolbox app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: replicas: 1 selector: matchLabels: app: toolbox release: gitlab strategy: type: Recreate rollingUpdate: null template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: toolbox app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: toolbox image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - "cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: ENABLE_BOOTSNAP value: "1" - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: toolbox-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-webservice-default) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "8083" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "8083" prometheus.io/scrape: "true" labels: app: webservice app.kubernetes.io/name: gitlab gitlab.com/webservice-name: default heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: webservice gitlab.com/webservice-name: default release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: webservice image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2" env: - name: TZ value: UTC - name: GITLAB_WEBSERVER value: puma - name: TMPDIR value: /tmp/gitlab - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: prometheus_multiproc_dir value: /metrics - name: ENABLE_BOOTSNAP value: "1" - name: WORKER_PROCESSES value: "2" - name: WORKER_TIMEOUT value: "60" - name: INTERNAL_PORT value: "8080" - name: PUMA_THREADS_MIN value: "4" - name: PUMA_THREADS_MAX value: "4" - name: PUMA_WORKER_MAX_MEMORY value: - name: DISABLE_PUMA_WORKER_KILLER value: "true" - name: BIND_IP6 value: "false" - name: PUMA_CONTROL_PORT value: "9293" - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "true" livenessProbe: failureThreshold: 3 httpGet: path: /-/liveness port: 8080 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 ports: - name: http-webservice containerPort: 8080 - name: http-metrics-ws containerPort: 8083 readinessProbe: failureThreshold: 2 httpGet: path: /-/readiness port: 8080 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 resources: requests: cpu: 300m memory: 2.5G volumeMounts: - name: webservice-metrics mountPath: /metrics - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: webservice-config mountPath: /etc/krb5.conf subPath: krb5.conf - name: webservice-config mountPath: /srv/gitlab/config/initializers/smtp_settings.rb subPath: smtp_settings.rb - name: webservice-config mountPath: /srv/gitlab/INSTALLATION_TYPE subPath: installation_type - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "pkill -SIGINT -o ruby" - name: gitlab-workhorse image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v18.8.2" env: - name: TZ value: UTC - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TMPDIR value: /tmp/gitlab - name: GITLAB_WORKHORSE_AUTH_BACKEND value: "http://localhost:8080" - name: GITLAB_WORKHORSE_EXTRA_ARGS value: - name: GITLAB_WORKHORSE_LISTEN_PORT value: "8181" - name: GITLAB_WORKHORSE_LOG_FORMAT value: json - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: SHUTDOWN_BLACKOUT_SECONDS value: "10" - name: PUMA_CONTROL_PORT value: "9293" ports: - name: http-workhorse containerPort: 8181 resources: requests: cpu: 100m memory: 100M volumeMounts: - name: workhorse-config mountPath: /var/opt/gitlab/templates - name: workhorse-secrets mountPath: /etc/gitlab readOnly: true - name: shared-upload-directory mountPath: /srv/gitlab/public/uploads/tmp readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true livenessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 20 periodSeconds: 60 successThreshold: 1 timeoutSeconds: 30 readinessProbe: exec: command: - /scripts/healthcheck failureThreshold: 3 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep $SHUTDOWN_BLACKOUT_SECONDS" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - "-c" - "sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab" command: - sh env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: webservice-config mountPath: /config-webservice readOnly: true - name: workhorse-config mountPath: /config-workhorse readOnly: true - name: init-webservice-secrets mountPath: /init-config readOnly: true - name: webservice-secrets mountPath: /init-secrets readOnly: false - name: workhorse-secrets mountPath: /init-secrets-workhorse readOnly: false - name: shared-tmp mountPath: /tmp readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v18.8.2" args: - /scripts/wait-for-deps env: - name: TZ value: UTC - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: WORKHORSE_ARCHIVE_CACHE_DISABLED value: "1" - name: ENABLE_BOOTSNAP value: "1" resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: webservice-config mountPath: /var/opt/gitlab/templates - name: webservice-secrets mountPath: /etc/gitlab readOnly: true - name: webservice-secrets mountPath: /srv/gitlab/config/secrets.yml readOnly: true subPath: rails-secrets/secrets.yml securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: shared-tmp emptyDir: {} - name: webservice-metrics emptyDir: medium: Memory - name: webservice-config configMap: name: gitlab-webservice - name: workhorse-config configMap: name: gitlab-workhorse-default - name: init-webservice-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-gitlab-workhorse-secret items: - key: shared_secret path: gitlab-workhorse/secret - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-zoekt-basicauth optional: true items: - key: gitlab_username path: zoekt/.gitlab_zoekt_username - key: gitlab_password path: zoekt/.gitlab_zoekt_password - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: webservice-secrets emptyDir: medium: Memory - name: workhorse-secrets emptyDir: medium: Memory - name: shared-upload-directory emptyDir: {} - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (apps/v1/Deployment/gitlab/gitlab-registry) - one document removed: apiVersion: apps/v1 kind: Deployment metadata: name: gitlab-registry namespace: gitlab labels: app: registry app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: selector: matchLabels: app: registry release: gitlab template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "true" labels: app: registry app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: registry release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: registry image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" env: - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 ports: - name: http containerPort: 5000 - name: debug containerPort: 5001 readinessProbe: failureThreshold: 3 httpGet: path: /debug/health port: debug scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 lifecycle: preStop: exec: command: - /bin/bash - "-c" - "sleep 5" initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: dependencies image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" command: - /scripts/wait-for-deps env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry - secret: name: gitlab-registry-secret items: - key: registry-auth.crt path: certificate.crt - secret: name: gitlab-registry-httpsecret items: - key: secret path: httpSecret - secret: name: gitlab-object-store-configs items: - key: registry.yaml path: storage/config - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-gitlab-shell) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-gitlab-shell namespace: gitlab labels: app: gitlab-shell helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-gitlab-shell (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-kas) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-kas namespace: gitlab labels: app: kas helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 100m minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-kas (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-sidekiq-all-in-1-v2) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-sidekiq-all-in-1-v2 namespace: gitlab labels: app: sidekiq helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 350m minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-sidekiq-all-in-1-v2 (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-webservice-default) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-webservice-default namespace: gitlab labels: app: webservice gitlab.com/webservice-name: default helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageValue: 1 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-webservice-default (root level) (autoscaling/v2beta1/HorizontalPodAutoscaler/gitlab/gitlab-registry) - one document removed: apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: gitlab-registry namespace: gitlab labels: app: registry helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: maxReplicas: 10 metrics: - type: Resource resource: name: cpu targetAverageUtilization: 75 minReplicas: 2 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: gitlab-registry (root level) (apps/v1/StatefulSet/gitlab/gitlab-gitaly) - one document removed: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-gitaly namespace: gitlab labels: app: gitaly app.kubernetes.io/name: gitlab helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: podManagementPolicy: Parallel replicas: 1 selector: matchLabels: app: gitaly release: gitlab serviceName: gitlab-gitaly template: metadata: annotations: gitlab.com/prometheus_path: /metrics gitlab.com/prometheus_port: "9236" gitlab.com/prometheus_scrape: "true" prometheus.io/path: /metrics prometheus.io/port: "9236" prometheus.io/scrape: "true" labels: app: gitaly app.kubernetes.io/name: gitlab heritage: Helm release: gitlab spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app: gitaly release: gitlab topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: gitaly image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v18.8.2" env: - name: CONFIG_TEMPLATE_DIRECTORY value: /etc/gitaly/templates - name: CONFIG_DIRECTORY value: /etc/gitaly - name: GITALY_CONFIG_FILE value: /etc/gitaly/config.toml - name: SSL_CERT_DIR value: /etc/ssl/certs - name: GODEBUG value: "tlsmlkem=0,tlskyber=0" - name: TZ value: UTC livenessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 3 ports: - name: grpc-gitaly containerPort: 8075 - name: http-metrics containerPort: 9236 readinessProbe: failureThreshold: 3 grpc: port: 8075 initialDelaySeconds: 0 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 3 resources: requests: cpu: 100m memory: 200Mi startupProbe: failureThreshold: 60 grpc: port: 8075 initialDelaySeconds: 1 periodSeconds: 1 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true - name: gitaly-config mountPath: /etc/gitaly/templates - name: gitaly-secrets mountPath: /etc/gitlab-secrets readOnly: true - name: repo-data mountPath: /home/git/repositories securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: gitaly-config mountPath: /config readOnly: true - name: init-gitaly-secrets mountPath: /init-config readOnly: true - name: gitaly-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true securityContext: fsGroup: 1000 runAsUser: 1000 terminationGracePeriodSeconds: 30 volumes: - name: gitaly-config configMap: name: gitlab-gitaly - name: gitaly-secrets emptyDir: medium: Memory - name: init-gitaly-secrets projected: defaultMode: 288 sources: - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly_token - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: .gitlab_shell_secret - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca volumeClaimTemplates: - metadata: name: repo-data annotations: null labels: app: gitaly release: gitlab spec: resources: requests: storage: 50Gi selector: null storageClassName: nfs-subdir accessModes: - ReadWriteOnce (root level) (apps/v1/StatefulSet/gitlab/gitlab-redis-master) - one document removed: apiVersion: apps/v1 kind: StatefulSet metadata: name: gitlab-redis-master namespace: gitlab labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis serviceName: gitlab-redis-headless template: metadata: annotations: prometheus.io/port: "9121" prometheus.io/scrape: "true" labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: redis spec: affinity: nodeAffinity: null podAffinity: null podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: false containers: - name: redis image: "docker.io/bitnamilegacy/redis:7.2.4-debian-12-r9" imagePullPolicy: IfNotPresent args: - "-c" - /opt/bitnami/scripts/start-scripts/start-master.sh command: - /bin/bash env: - name: BITNAMI_DEBUG value: "false" - name: REDIS_REPLICATION_MODE value: master - name: ALLOW_EMPTY_PASSWORD value: no - name: REDIS_PASSWORD_FILE value: /opt/bitnami/redis/secrets/redis-password - name: REDIS_TLS_ENABLED value: no - name: REDIS_PORT value: "6379" ports: - name: redis containerPort: 6379 volumeMounts: - name: start-scripts mountPath: /opt/bitnami/scripts/start-scripts - name: health mountPath: /health - name: redis-password mountPath: /opt/bitnami/redis/secrets/ - name: redis-data mountPath: /data - name: config mountPath: /opt/bitnami/redis/mounted-etc - name: empty-dir mountPath: /opt/bitnami/redis/etc/ subPath: app-conf-dir - name: empty-dir mountPath: /tmp subPath: tmp-dir livenessProbe: exec: command: - sh - "-c" - "/health/ping_liveness_local.sh 5" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 6 readinessProbe: exec: command: - sh - "-c" - "/health/ping_readiness_local.sh 1" failureThreshold: 5 initialDelaySeconds: 20 periodSeconds: 5 successThreshold: 1 timeoutSeconds: 2 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault - name: metrics image: "docker.io/bitnamilegacy/redis-exporter:1.58.0-debian-12-r4" imagePullPolicy: IfNotPresent command: - /bin/bash - "-c" - | if [[ -f '/secrets/redis-password' ]]; then export REDIS_PASSWORD=$(cat /secrets/redis-password) fi redis_exporter env: - name: REDIS_ALIAS value: gitlab-redis - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS value: ":9121" - name: REDIS_USER value: default livenessProbe: failureThreshold: 5 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 tcpSocket: port: metrics timeoutSeconds: 5 ports: - name: metrics containerPort: 9121 readinessProbe: failureThreshold: 3 httpGet: path: / port: metrics initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 volumeMounts: - name: empty-dir mountPath: /tmp subPath: app-tmp-dir - name: redis-password mountPath: /secrets/ securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: false runAsGroup: 0 runAsNonRoot: true runAsUser: 1001 seLinuxOptions: null seccompProfile: type: RuntimeDefault enableServiceLinks: true securityContext: fsGroup: 1001 fsGroupChangePolicy: Always supplementalGroups: [] sysctls: [] serviceAccountName: gitlab-redis-master terminationGracePeriodSeconds: 30 volumes: - name: start-scripts configMap: name: gitlab-redis-scripts defaultMode: 493 - name: health configMap: name: gitlab-redis-health defaultMode: 493 - name: redis-password secret: items: - key: secret path: redis-password secretName: gitlab-redis-secret - name: config configMap: name: gitlab-redis-configuration - name: empty-dir emptyDir: {} updateStrategy: type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redis-data labels: app.kubernetes.io/component: master app.kubernetes.io/instance: gitlab app.kubernetes.io/name: redis spec: resources: requests: storage: 8Gi storageClassName: longhorn accessModes: - ReadWriteOnce (root level) (batch/v1/Job/gitlab/gitlab-migrations-c0164a8) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-migrations-c0164a8 namespace: gitlab labels: app: migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: migrations heritage: Helm release: gitlab spec: automountServiceAccountToken: false containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - | set -e; /scripts/wait-for-deps; /scripts/db-migrate; env: - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: BYPASS_SCHEMA_VERSION value: "true" - name: ENABLE_BOOTSNAP value: "1" - name: TZ value: UTC resources: requests: cpu: 250m memory: 200Mi volumeMounts: - name: migrations-config mountPath: /var/opt/gitlab/templates - name: migrations-secrets mountPath: /etc/gitlab readOnly: true - name: migrations-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: migrations-secrets mountPath: /srv/gitlab/config/initial_root_password subPath: migrations/initial_root_password - name: migrations-secrets mountPath: /srv/gitlab/config/gitlab_shared_runners_registration_token subPath: migrations/gitlab_shared_runners_registration_token - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: migrations-config mountPath: /config readOnly: true - name: init-migrations-secrets mountPath: /init-config readOnly: true - name: migrations-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: migrations-config configMap: name: gitlab-migrations - name: init-migrations-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: gitlab-gitlab-initial-root-password items: - key: password path: migrations/initial_root_password - secret: name: gitlab-gitlab-runner-secret optional: true items: - key: runner-registration-token path: migrations/gitlab_shared_runners_registration_token - name: migrations-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1/Job/gitlab/gitlab-registry-migrations-8e2a9a9) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-registry-migrations-8e2a9a9 namespace: gitlab labels: app: registry-migrations helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: activeDeadlineSeconds: 3600 backoffLimit: 6 template: metadata: labels: app: registry-migrations heritage: Helm release: gitlab spec: containers: - name: migrations image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.33.0-gitlab" args: - /scripts/wait-for-deps - /scripts/db-migrate env: - name: BYPASS_SCHEMA_VERSION value: "true" resources: requests: cpu: 50m memory: 32Mi volumeMounts: - name: registry-server-config mountPath: /etc/docker/registry/ readOnly: true - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" args: - sh - /config/configure env: - name: CONFIG_TEMPLATE_DIRECTORY value: /templates - name: CONFIG_DIRECTORY value: /registry resources: requests: cpu: 50m volumeMounts: - name: registry-secrets mountPath: /config - name: registry-server-config-templates mountPath: /templates readOnly: true - name: registry-server-config mountPath: /registry securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: registry-server-config-templates configMap: name: gitlab-registry items: - key: migrations-config.yml.tpl path: config.yml.tpl - name: registry-server-config emptyDir: medium: Memory - name: registry-secrets projected: sources: - configMap: name: gitlab-registry items: - key: configure path: configure - secret: name: gitlab-registry-db-pass items: - key: password path: database_password - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca (root level) (batch/v1beta1/CronJob/gitlab/gitlab-toolbox-backup) - one document removed: apiVersion: batch/v1beta1 kind: CronJob metadata: name: gitlab-toolbox-backup namespace: gitlab labels: app: toolbox helm.toolkit.fluxcd.io/name: gitlab helm.toolkit.fluxcd.io/namespace: flux-system heritage: Helm release: gitlab spec: concurrencyPolicy: Replace failedJobsHistoryLimit: 1 jobTemplate: spec: backoffLimit: 6 template: metadata: annotations: cluster-autoscaler.kubernetes.io/safe-to-evict: "false" labels: app: toolbox heritage: Helm release: gitlab spec: containers: - name: toolbox-backup image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v18.8.2" args: - /bin/bash - "-c" - "cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --skip registry --skip packages --skip pages --skip artifacts" env: - name: ARTIFACTS_BUCKET_NAME value: gitlab-artifacts - name: REGISTRY_BUCKET_NAME value: gitlab-container-registry - name: LFS_BUCKET_NAME value: gitlab-lfs - name: UPLOADS_BUCKET_NAME value: gitlab-uploads - name: PACKAGES_BUCKET_NAME value: gitlab-packages - name: EXTERNAL_DIFFS_BUCKET_NAME value: gitlab-external-diffs - name: TERRAFORM_STATE_BUCKET_NAME value: gitlab-terraform-state - name: CI_SECURE_FILES_BUCKET_NAME value: gitlab-ci-secure-files - name: BACKUP_BUCKET_NAME value: gitlab-backup - name: BACKUP_BACKEND value: s3 - name: TMP_BUCKET_NAME value: gitlab-tmp-storage - name: PAGES_BUCKET_NAME value: gitlab-pages - name: CONFIG_TEMPLATE_DIRECTORY value: /var/opt/gitlab/templates - name: CONFIG_DIRECTORY value: /srv/gitlab/config - name: TZ value: UTC resources: requests: cpu: 50m memory: 350M volumeMounts: - name: toolbox-config mountPath: /var/opt/gitlab/templates - name: toolbox-secrets mountPath: /etc/gitlab readOnly: true - name: toolbox-secrets mountPath: /srv/gitlab/config/secrets.yml subPath: rails-secrets/secrets.yml - name: toolbox-tmp mountPath: /srv/gitlab/tmp readOnly: false - name: etc-ssl-certs mountPath: /etc/ssl/certs/ readOnly: true - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 initContainers: - name: certificates image: "registry.gitlab.com/gitlab-org/build/cng/certificates:v18.8.2" env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: etc-ssl-certs mountPath: /etc/ssl/certs readOnly: false - name: etc-pki-ca-trust-extracted-pem mountPath: /etc/pki/ca-trust/extracted/pem readOnly: false - name: custom-ca-certificates mountPath: /usr/local/share/ca-certificates readOnly: true securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 - name: configure image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - sh - /config/configure env: - name: TZ value: UTC resources: requests: cpu: 50m volumeMounts: - name: toolbox-config mountPath: /config readOnly: true - name: init-toolbox-secrets mountPath: /init-config readOnly: true - name: toolbox-secrets mountPath: /init-secrets readOnly: false securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 1000 restartPolicy: OnFailure securityContext: fsGroup: 1000 runAsGroup: 1000 runAsUser: 1000 seccompProfile: type: RuntimeDefault volumes: - name: toolbox-config projected: sources: - configMap: name: gitlab-toolbox - name: toolbox-tmp emptyDir: {} - name: init-toolbox-secrets projected: defaultMode: 256 sources: - secret: name: gitlab-rails-secret items: - key: secrets.yml path: rails-secrets/secrets.yml - secret: name: gitlab-gitlab-shell-secret items: - key: secret path: shell/.gitlab_shell_secret - secret: name: gitlab-gitaly-secret items: - key: token path: gitaly/gitaly_token - secret: name: gitlab-redis-secret items: - key: secret path: redis/redis-password - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-ci - secret: name: db-gitlab-app items: - key: password path: postgres/psql-password-main - secret: name: gitlab-registry-secret items: - key: registry-auth.key path: registry/gitlab-registry.key - secret: name: gitlab-registry-notification items: - key: secret path: registry/notificationSecret - secret: name: gitlab-object-store-configs items: - key: s3cmd.cfg path: objectstorage/.s3cfg - secret: name: gitlab-gitlab-kas-secret items: - key: kas_shared_secret path: kas/.gitlab_kas_secret - secret: name: gitlab-object-store-configs items: - key: connection.yaml path: objectstorage/object_store - secret: name: authentik-oidc items: - key: config.yaml path: omniauth/authentik-oidc/config.yaml - name: toolbox-secrets emptyDir: medium: Memory - name: etc-ssl-certs emptyDir: medium: Memory - name: etc-pki-ca-trust-extracted-pem emptyDir: medium: Memory - name: custom-ca-certificates projected: defaultMode: 288 sources: - secret: name: aethernet.crt - secret: name: gitlab-wildcard-tls-ca schedule: @daily startingDeadlineSeconds: null successfulJobsHistoryLimit: 3 suspend: false (root level) (v1/ServiceAccount/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: v1 kind: ServiceAccount metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: gitlab heritage: Helm release: gitlab (root level) (v1/ConfigMap/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-3" labels: app: gitlab heritage: Helm release: gitlab data: generate-secrets: | # vim: set filetype=sh: namespace=gitlab release=gitlab env=production pushd $(mktemp -d) # Args pattern, length function gen_random(){ head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2 } # Args: length function gen_random_base64(){ local len="$1" gen_random_bytes "$len" | base64 -w0 } # Args: length function gen_random_bytes(){ local len="$1" head -c "$len" /dev/urandom } # Args: yaml file, search path function fetch_rails_value(){ local value=$(yq --prettyPrint --no-colors ".${2}" $1) # Don't return null values if [ "${value}" != "null" ]; then echo "${value}"; fi } # Args: secretname function label_secret(){ local secret_name=$1 # Remove application labels if they exist kubectl --namespace=$namespace label \ secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label \ --overwrite \ secret $secret_name app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm } # Args: secretname, args function generate_secret_if_needed(){ local secret_args=( "${@:2}") local secret_name=$1 if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]} else echo "secret \"$secret_name\" already exists." for arg in "${secret_args[@]}"; do local from=$(echo -n ${arg} | cut -d '=' -f1) if [ -z "${from##*literal*}" ]; then local key=$(echo -n ${arg} | cut -d '=' -f2) local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-) local flags="--namespace=$namespace --allow-missing-template-keys=false" if ! $(kubectl $flags get secret $secret_name -ojsonpath="{.data.${key}}" > /dev/null 2>&1); then echo "key \"${key}\" does not exist. patching it in." if [ "${desiredValue}" != "" ]; then desiredValue=$(echo -n "${desiredValue}" | base64 -w 0) fi kubectl --namespace=$namespace patch secret ${secret_name} -p "{\"data\":{\"$key\":\"${desiredValue}\"}}" fi fi done fi label_secret $secret_name } # Initial root password generate_secret_if_needed "gitlab-gitlab-initial-root-password" --from-literal="password"=$(gen_random 'a-zA-Z0-9' 64) # Redis password generate_secret_if_needed "gitlab-redis-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab shell generate_secret_if_needed "gitlab-gitlab-shell-secret" --from-literal="secret"=$(gen_random 'a-zA-Z0-9' 64) # Gitaly secret generate_secret_if_needed "gitlab-gitaly-secret" --from-literal="token"=$(gen_random 'a-zA-Z0-9' 64) # Gitlab runner secret generate_secret_if_needed "gitlab-gitlab-runner-secret" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token="" # GitLab Pages API secret # GitLab Pages auth secret for hashing cookie store when using access control # GitLab Pages OAuth secret # Gitlab-kas secret generate_secret_if_needed "gitlab-gitlab-kas-secret" --from-literal="kas_shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas private API secret generate_secret_if_needed "gitlab-kas-private-api" --from-literal="kas_private_api_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Gitlab-kas WebSocket Token secret generate_secret_if_needed "gitlab-kas-websocket-token" --from-literal="kas_websocket_token_secret"=$(gen_random_base64 72) # Registry certificates mkdir -p certs openssl req -new -newkey rsa:4096 -subj "/CN=gitlab-issuer" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650 generate_secret_if_needed "gitlab-registry-secret" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt # config/secrets.yaml if [ -n "$env" ]; then rails_secret="gitlab-rails-secret" # Fetch the values from the existing secret if it exists if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then kubectl --namespace=$namespace get secret $rails_secret -o jsonpath="{.data.secrets\.yml}" | base64 --decode > secrets.yml secret_key_base=$(fetch_rails_value secrets.yml "${env}.secret_key_base") otp_key_base=$(fetch_rails_value secrets.yml "${env}.otp_key_base") db_key_base=$(fetch_rails_value secrets.yml "${env}.db_key_base") openid_connect_signing_key=$(fetch_rails_value secrets.yml "${env}.openid_connect_signing_key") encrypted_settings_key_base=$(fetch_rails_value secrets.yml "${env}.encrypted_settings_key_base") active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_primary_key") active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_deterministic_key") active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml "${env}.active_record_encryption_key_derivation_salt") fi; # Generate defaults for any unset secrets secret_key_base="${secret_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) otp_key_base="${otp_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) db_key_base="${db_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) openid_connect_signing_key="${openid_connect_signing_key:-$(openssl genrsa 2048)}" encrypted_settings_key_base="${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}" # equivalent to secureRandom.hex(64) # 1. We set the following two keys as an array to support keys rotation. # The last key in the array is always used to encrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21 # while all the keys are used (in the order they're defined) to decrypt data: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26. # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976 # 2. We use the same method and length as Rails' defaults: # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540 active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-"- $(gen_random 'a-zA-Z0-9' 32)"} active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)} # Update the existing secret cat << EOF > rails-secrets.yml apiVersion: v1 kind: Secret metadata: name: $rails_secret type: Opaque stringData: secrets.yml: |- $env: secret_key_base: $secret_key_base otp_key_base: $otp_key_base db_key_base: $db_key_base encrypted_settings_key_base: $encrypted_settings_key_base openid_connect_signing_key: | $(echo "${openid_connect_signing_key}" | awk '{print " " $0}') active_record_encryption_primary_key: $active_record_encryption_primary_keys active_record_encryption_deterministic_key: $active_record_encryption_deterministic_keys active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt EOF kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml label_secret $rails_secret fi # Shell ssh host keys ssh-keygen -A mkdir -p host_keys cp /etc/ssh/ssh_host_* host_keys/ generate_secret_if_needed "gitlab-gitlab-shell-host-keys" --from-file host_keys # Gitlab-workhorse secret generate_secret_if_needed "gitlab-gitlab-workhorse-secret" --from-literal="shared_secret"=$(gen_random 'a-zA-Z0-9' 32 | base64) # Registry http.secret secret generate_secret_if_needed "gitlab-registry-httpsecret" --from-literal="secret"=$(gen_random 'a-z0-9' 128 | base64 -w 0) # Container Registry notification_secret generate_secret_if_needed "gitlab-registry-notification" --from-literal="secret"=[\"$(gen_random 'a-zA-Z0-9' 32)\"] (root level) (v1/ConfigMap/gitlab/gitlab-gitlab-upgrade-check) - one document removed: apiVersion: v1 kind: ConfigMap metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: before-hook-creation helm.sh/hook-weight: "-11" labels: app: gitlab heritage: Helm release: gitlab data: runcheck: | #!/bin/sh set -e notify() { echo "$1" echo -n "$1 " >> /dev/termination-log } greater_version() { test "$(printf '%s\n' "$@" | sort -V | tail -n 1)" = "$1"; } is_semver() { printf '%s' "$1" | grep -Eq "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" return "$?" } # For the PostgreSQL upgrade, you either need both secrets, or no secrets. # If there are no secrets, we will create them for you. # If the secrets aren't in either of these states, we assume you are upgrading from an older version # This is running ahead of version checks to ensure this always runs. This is to account for # installations outside of the official helm repo. secrets_dir="/etc/secrets/postgresql" if [ -d "${secrets_dir}" ]; then if [ ! "$(ls -A ${secrets_dir}/..data/)" = "" ]; then if [ ! -f "${secrets_dir}/postgresql-postgres-password" ] || [ ! -f "${secrets_dir}/password" ]; then notify "You seem to be upgrading from a previous version of GitLab using the bundled PostgreSQL chart" notify "There are some manual steps which need to be performed in order to upgrade the database" notify "Please see the upgrade documentation for instructions on how to proceed:" notify "https://docs.gitlab.com/charts/installation/upgrade.html" exit 1 fi fi fi MIN_VERSION=18.5 CHART_MIN_VERSION=9.5 # Remove 'v' prefix from GitLab version if present (set in Chart.yaml appVersions) GITLAB_VERSION=${GITLAB_VERSION#v} # Only run check for semver releases if ! is_semver "$GITLAB_VERSION"; then exit 0 fi NEW_MAJOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1}') NEW_MINOR_VERSION=$(echo $GITLAB_VERSION | awk -F "." '{print $1"."$2}') NEW_CHART_MAJOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1}') NEW_CHART_MINOR_VERSION=$(echo $CHART_VERSION | awk -F "." '{print $1"."$2}') if [ ! -f /chart-info/gitlabVersion ]; then notify "It seems you are attempting an unsupported upgrade path." notify "Please follow the upgrade documentation at https://docs.gitlab.com/update/#upgrade-paths" exit 1 fi OLD_VERSION_STRING=$(cat /chart-info/gitlabVersion) OLD_VERSION_STRING=${OLD_VERSION_STRING#v} OLD_CHART_VERSION_STRING=$(cat /chart-info/gitlabChartVersion) # Skip check if old version wasn't semver if ! is_semver "$OLD_VERSION_STRING"; then exit 0 fi OLD_MAJOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1}') OLD_MINOR_VERSION=$(echo $OLD_VERSION_STRING | awk -F "." '{print $1"."$2}') OLD_CHART_MAJOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1}') OLD_CHART_MINOR_VERSION=$(echo $OLD_CHART_VERSION_STRING | awk -F "." '{print $1"."$2}') # Checking Version if ( ! greater_version "$OLD_MINOR_VERSION" "$MIN_VERSION" ) || ( ! greater_version "$OLD_CHART_MINOR_VERSION" "$CHART_MIN_VERSION" ); then notify "It seems you are upgrading the GitLab Helm Chart from ${OLD_CHART_VERSION_STRING} (GitLab ${OLD_VERSION_STRING}) to ${CHART_VERSION} (GitLab ${GITLAB_VERSION})." notify "It is required to upgrade to the latest ${CHART_MIN_VERSION}.x version first before proceeding." # Link to upgrade docs if it is a major version jump if [ "${OLD_MAJOR_VERSION}" -lt "${NEW_MAJOR_VERSION}" ] || [ "${OLD_CHART_MAJOR_VERSION}" -lt "${NEW_CHART_MAJOR_VERSION}" ]; then notify "Please follow the upgrade documentation at https://docs.gitlab.com/charts/releases/8_0.html" notify "and upgrade to GitLab Helm Chart version ${CHART_MIN_VERSION}.x before upgrading to ${CHART_VERSION}." fi exit 1 fi (root level) (rbac.authorization.k8s.io/v1/Role/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab rules: - resources: - secrets apiGroups: - verbs: - get - list - create - patch (root level) (rbac.authorization.k8s.io/v1/RoleBinding/gitlab/gitlab-shared-secrets) - one document removed: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: gitlab-shared-secrets namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-5" labels: app: shared-secrets heritage: Helm release: gitlab roleRef: name: gitlab-shared-secrets apiGroup: rbac.authorization.k8s.io kind: Role subjects: - name: gitlab-shared-secrets kind: ServiceAccount namespace: gitlab (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130 namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: gitlab image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - /scripts/generate-secrets resources: requests: cpu: 50m volumeMounts: - name: scripts mountPath: /scripts - name: ssh mountPath: /etc/ssh securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault serviceAccountName: gitlab-shared-secrets volumes: - name: scripts configMap: name: gitlab-shared-secrets - name: ssh emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-shared-secrets-6fff130-selfsign) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-shared-secrets-6fff130-selfsign namespace: gitlab annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" labels: app: gitlab heritage: Helm release: gitlab spec: template: metadata: annotations: null labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: kubectl image: "registry.gitlab.com/gitlab-org/build/cng/kubectl:v18.8.2" command: - /bin/bash - "-exc" - | certname=gitlab-wildcard-tls # create wildcard certificate secret kubectl create secret tls $certname \ --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true kubectl --namespace=$namespace label \ secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret $certname app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create CA certificate secret kubectl create secret generic ${certname}-ca \ --from-file=cfssl_ca=/output/ca.pem || true kubectl --namespace=$namespace label \ secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-ca app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm # create certificate chain for GitLab Runner cat /output/ca.pem /output/wildcard.pem > /tmp/code.nogweii.net.crt kubectl create secret generic ${certname}-chain \ --from-file=/tmp/code.nogweii.net.crt || true kubectl --namespace=$namespace label \ secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g') kubectl --namespace=$namespace label --overwrite \ secret ${certname}-chain app=gitlab chart=gitlab-9.8.2 release=gitlab heritage=Helm resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output initContainers: - name: cfssl-self-sign image: "registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v18.8.2" env: - name: CA_SUBJECT value: "GitLab Helm Chart" - name: CA_ORG value: gitlab - name: CA_ORG_UNIT value: gitlab - name: CERT_SUBJECT value: code.nogweii.net - name: CERT_DOMAIN value: code.nogweii.net - name: EXPIRY value: 3650d - name: ALGORITHM value: rsa - name: KEY_SIZE value: "4096" resources: requests: cpu: 50m volumeMounts: - name: certs-path mountPath: /output restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 serviceAccountName: gitlab-shared-secrets volumes: - name: certs-path emptyDir: {} (root level) (batch/v1/Job/gitlab/gitlab-gitlab-upgrade-check) - one document removed: apiVersion: batch/v1 kind: Job metadata: name: gitlab-gitlab-upgrade-check namespace: gitlab annotations: helm.sh/hook: pre-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "-10" labels: app: gitlab heritage: Helm release: gitlab spec: backoffLimit: 2 template: metadata: labels: app: gitlab heritage: Helm release: gitlab spec: containers: - name: run-check image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v18.8.2" command: - /bin/sh - /scripts/runcheck env: - name: GITLAB_VERSION value: "18.8.2" - name: CHART_VERSION value: "9.8.2" resources: requests: cpu: 50m volumeMounts: - name: chart-info mountPath: /chart-info - name: scripts mountPath: /scripts securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL runAsNonRoot: true runAsUser: 65534 restartPolicy: Never securityContext: fsGroup: 65534 runAsUser: 65534 seccompProfile: type: RuntimeDefault volumes: - name: chart-info configMap: name: gitlab-gitlab-chart-info optional: true - name: scripts configMap: name: gitlab-gitlab-upgrade-check flate error: current snapshot: reconcile completed with 1 failure(s): HelmRelease/flux-system/gitlab: helm template flux-system/gitlab: execution error at (gitlab/templates/NOTES.txt:239:3): CONFIGURATION CHECKS: redis: You must configure an Redis connetion. Please set `global.redis.host`. Since chart v10.0.0, external Redis became required. If you were using the bundled Redis chart refer to https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/. ``` [Pipeline](https://ci.aether.earth/repos/4/pipeline/592)

renovate-bot force-pushed renovate/gitlab-10.x from 976834ff71

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-test Pipeline was successful

Details

ci/crow/pr/tanka-diff Pipeline was successful

Details

to f457206383

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-diff Pipeline failed

Details

2026-10-21 16:15:04 +00:00

Compare

ci/crow/push/dns-test Pipeline was successful

Details

ci/crow/pr/dns-test Pipeline was successful

Details

ci/crow/push/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-test Pipeline failed

Details

ci/crow/pr/tanka-diff Pipeline failed

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/gitlab-10.x:renovate/gitlab-10.x

git switch renovate/gitlab-10.x

Merge

Merge the changes and update on Forgejo.

git switch main

git merge --no-ff renovate/gitlab-10.x

git switch renovate/gitlab-10.x

git rebase main

git switch main

git merge --ff-only renovate/gitlab-10.x

git switch renovate/gitlab-10.x

git rebase main

git switch main

git merge --no-ff renovate/gitlab-10.x

git switch main

git merge --squash renovate/gitlab-10.x

git switch main

git merge --ff-only renovate/gitlab-10.x

git switch main

git merge renovate/gitlab-10.x

git push origin main

Rows
Columns

chore(deps): update helm release gitlab to v10 #66

Release Notes

Added (3 changes)

Fixed (6 changes)

Changed (13 changes)

Other (2 changes)

Changed (1 change)

Changed (1 change)

Added (6 changes)

Fixed (4 changes)

Changed (12 changes)

Changed (1 change)

Changed (1 change)

Changed (1 change)

Changed (1 change)

Added (4 changes)

Fixed (2 changes)

Changed (12 changes)

Changed (1 change)

Fixed (2 changes)

Changed (1 change)

Fixed (4 changes)

Changed (8 changes)

Fixed (2 changes)

Fixed (1 change)

Fixed (1 change)

Changed (1 change)

Fixed (1 change)

Added (2 changes)

Fixed (1 change)

Changed (9 changes)

Fixed (2 changes)

Fixed (1 change)

Fixed (1 change)

Fixed (1 change)

Changed (1 change)

Fixed (1 change)

fixes (1 change)

Added (4 changes)

Fixed (2 changes)

Changed (13 changes)

Removed (3 changes)

Fixed (2 changes)

Added (1 change)

Fixed (1 change)

Changed (2 changes)

Changed (1 change)

Added (3 changes)

Fixed (3 changes)

Changed (9 changes)

Fixed (2 changes)

Changed (1 change)

Changed (1 change)

Fixed (1 change)

Fixed (1 change)

Changed (1 change)

Added (4 changes)

Fixed (2 changes)

Changed (10 changes)

Changed (1 change)

Fixed (1 change)

Fixed (1 change)

Added (2 changes)

Fixed (1 change)

Changed (9 changes)

Fixed (1 change)

Fixed (1 change)

Changed (1 change)