gitlab-system/gitlab.yaml

apiVersion: apps.gitlab.com/v1beta1
kind: GitLab
metadata:
  name: gitlab
  namespace: gitlab-system
spec:
  chart:
    version: "10.5.4"
    values:
      global:
        appConfig:
          object_store:
            enabled: true
            proxy_download: true  # Garage is not exposed through the ingress.
            connection:
              secret: gitlab-object-storage
              key: config
          artifacts:
            bucket: gitlab-artifacts
          lfs:
            bucket: git-lfs
          uploads:
            bucket: gitlab-uploads
          packages:
            bucket: gitlab-packages
          externalDiffs:
            enabled: true
            bucket: gitlab-mr-diffs
          terraformState:
            enabled: true
            bucket: gitlab-terraform-state
          ciSecureFiles:
            enabled: true
            bucket: gitlab-ci-secure-files
          dependencyProxy:
            enabled: true
            bucket: gitlab-dependency-proxy
          incomingEmail:
            enabled: true
            address: gitlab@benkard.de
            user: gitlab@benkard.de
            host: mail.benkard.de
            startTls: true
            port: 143
            ssl: false
            #host: mailcow.mulk.svc.cluster.local.
            password:
              secret: gitlab-infrastructure
              key: email-password
          omniauth:
            enabled: true
            syncProfileAttributes: ['email']
            allowSingleSignOn: []
            blockAutoCreatedUsers: true
            autoLinkUser: ['openid_connect']
            externalProviders: ['github']
            allowBypassTwoFactor: []
            providers:
              - secret: gitlab-keycloak
              - secret: gitlab-github
        edition: ce
        #deployment:
        #  strategy:
        #    type: Recreate
        email:
          display_name: Benkard GitLab
          from: gitlab@benkard.de
          reply_to: gitlab@benkard.de
        smtp:
          enabled: true
          address: mail.benkard.de
          tls: false
          starttls_auto: true
          port: 587
          #address: mailcow.mulk.svc.cluster.local.
          #tls: false
          authentication: plain
          user_name: gitlab@benkard.de
          password:
            secret: gitlab-infrastructure
            key: email-password
        hosts:
          domain: gitlab.benkard.de
          gitlab:
            name: gitlab.benkard.de
          ssh: gitlab.benkard.de
        hpa:
          minReplicas: 1
          maxReplicas: 1
        # Chart 10 defaults to Gateway API with a bundled Envoy Gateway;
        # keep using the cluster's ingress-nginx instead.
        gatewayApi:
          enabled: false
          installEnvoy: false
        ingress:
          enabled: true
          configureCertmanager: false
          class: nginx
          annotations:
            kubernetes.io/tls-acme: true
            cert-manager.io/cluster-issuer: letsencrypt-prod
          tls:
            secretName: gitlab-wildcard-tls
        minio:
          enabled: false
        persistence:
          storageClass: local-path
        psql:
          host: postgresql.system
          port: 5432
          username: gitlab
          database: gitlab
          password:
            secret: gitlab-infrastructure
            key: postgresql-password
        redis:
          host: valkey.gitlab-system.svc.cluster.local
          auth:
            secret: valkey-auth
            key: default-password
        shell:
          port: 32222

      certmanager:
        install: false

      certmanager-issuer:
        email: id+acme@mulk.eu

      gitlab:
        gitaly:
          persistence:
            storageClass: local-path
        gitlab-shell:
          #replicaCount: 1
          minReplicas: 2
          maxReplicas: 2
          service:
            type: NodePort
            nodePort: 32222
        kas:
          ingress:
            tls:
              secretName: gitlab-kas-tls
          minReplicas: 1
          maxReplicas: 1
        mailroom:
          hpa:
            minReplicas: 1
            maxReplicas: 1
        sidekiq:
          #replicas: 1
          minReplicas: 1
          maxReplicas: 1
          # Sidekiq takes more than the default ~3 min to boot on ifirn, and
          # the default liveness probe kills it before it is up.
          livenessProbe:
            failureThreshold: 5
            initialDelaySeconds: 900
            timeoutSeconds: 120
        toolbox:
          backups:
            cron:
              persistence:
                storageClass: local-path
            objectStorage:
              config:
                secret: gitlab-object-storage-s3cmd
                key: config
          persistence:
            storageClass: local-path
        webservice:
          #replicaCount: 1
          workerProcesses: 1
          resources:
            requests:
              cpu: 1m
              memory: 100M
          hpa:
            minReplicas: 2
            maxReplicas: 2
          ingress:
            tls:
              secretName: gitlab-gitlab-tls
          deployment:
            livenessProbe:
              failureThreshold: 5
              initialDelaySeconds: 900
              timeoutSeconds: 120
#            strategy:
#              type: Recreate
#          deployments:
#            default:
#              hpa:
#                minReplicas: 1
#                maxReplicas: 1
#              workerProcesses: 1

      nginx-ingress:
        enabled: false

      postgresql:
        install: false

      prometheus:
        install: false

      redis:
        install: false

      registry:
        storage:
          secret: gitlab-registry-storage
          key: config
          redirect:
            disable: true  # Garage is not exposed through the ingress.
        ingress:
          tls:
            secretName: gitlab-registry-tls
        hpa:
          minReplicas: 1
          maxReplicas: 1