gitlab: Move object storage to Garage and Redis to Valkey.
The bundled MinIO and Redis charts are removed in GitLab chart 10.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: I351c599ec803970c86d7b8a7c033144a00028edc
diff --git a/gitlab-system/gitlab.yaml b/gitlab-system/gitlab.yaml
index db1162b..0157934 100644
--- a/gitlab-system/gitlab.yaml
+++ b/gitlab-system/gitlab.yaml
@@ -9,6 +9,32 @@
values:
global:
appConfig:
+ object_store:
+ enabled: true
+ proxy_download: true # Garage is not exposed through the ingress.
+ connection:
+ secret: gitlab-object-storage
+ key: config
+ artifacts:
+ bucket: gitlab-artifacts
+ lfs:
+ bucket: git-lfs
+ uploads:
+ bucket: gitlab-uploads
+ packages:
+ bucket: gitlab-packages
+ externalDiffs:
+ enabled: true
+ bucket: gitlab-mr-diffs
+ terraformState:
+ enabled: true
+ bucket: gitlab-terraform-state
+ ciSecureFiles:
+ enabled: true
+ bucket: gitlab-ci-secure-files
+ dependencyProxy:
+ enabled: true
+ bucket: gitlab-dependency-proxy
incomingEmail:
enabled: true
address: gitlab@benkard.de
@@ -71,8 +97,8 @@
kubernetes.io/ingress.class: nginx
tls:
secretName: gitlab-wildcard-tls
- #object_store:
- # enabled: true
+ minio:
+ enabled: false
persistence:
storageClass: local-path
psql:
@@ -83,11 +109,11 @@
password:
secret: gitlab-infrastructure
key: postgresql-password
- #redis:
- #host: redis.system
- #password:
- # secret: gitlab-infrastructure
- # key: redis-password
+ redis:
+ host: valkey.gitlab-system.svc.cluster.local
+ auth:
+ secret: valkey-auth
+ key: default-password
shell:
port: 32222
@@ -123,6 +149,10 @@
cron:
persistence:
storageClass: local-path
+ objectStorage:
+ config:
+ secret: gitlab-object-storage-s3cmd
+ key: config
persistence:
storageClass: local-path
webservice:
@@ -152,24 +182,21 @@
# maxReplicas: 1
# workerProcesses: 1
- minio:
- persistence:
- storageClass: local-path
- replicas: 1
- ingress:
- tls:
- secretName: gitlab-minio-tls
-
nginx-ingress:
enabled: false
postgresql:
install: false
- #redis:
- # install: false
+ redis:
+ install: false
registry:
+ storage:
+ secret: gitlab-registry-storage
+ key: config
+ redirect:
+ disable: true # Garage is not exposed through the ingress.
ingress:
tls:
secretName: gitlab-registry-tls
diff --git a/gitlab-system/valkey-values.yaml b/gitlab-system/valkey-values.yaml
new file mode 100644
index 0000000..9d2810a
--- /dev/null
+++ b/gitlab-system/valkey-values.yaml
@@ -0,0 +1,26 @@
+# Helm values for the Valkey instance used by GitLab (replaces the
+# bundled Redis that was removed in GitLab chart 10).
+#
+# helm repo add valkey https://valkey.io/valkey-helm/
+# helm -n gitlab-system upgrade --install valkey valkey/valkey --version 0.12.0 -f valkey-values.yaml
+#
+# The password lives in the valkey-auth secret (key default-password),
+# which must exist before installing.
+#
+# local-path volumes are created owned by root, but Valkey runs as UID
+# 1000, so after the first install the PVC has to be chowned once:
+#
+# kubectl -n gitlab-system run valkey-chown --rm -i --restart=Never --image=busybox:1.36 \
+# --overrides='{"spec":{"containers":[{"name":"c","image":"busybox:1.36","command":["chown","-R","1000:1000","/data"],"volumeMounts":[{"name":"d","mountPath":"/data"}]}],"volumes":[{"name":"d","persistentVolumeClaim":{"claimName":"valkey"}}]}}'
+auth:
+ enabled: true
+ usersExistingSecret: valkey-auth
+ aclUsers:
+ default:
+ permissions: "~* &* +@all"
+ passwordKey: default-password
+dataStorage:
+ enabled: true
+ requestedSize: 2Gi
+ className: local-path
+ keepPvc: true