mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Opus 4.6
5163403e24
Reduce replicas to 1 for workloads that don't need HA in a homelab: - Prometheus 2→1, Alertmanager 2→1 (~4.4GB RAM saved) - cert-manager 3→1 - GitLab: registry 2→1, kas 2→1, sidekiq 2→1, praefect 2→1, pgbouncer-ro 3→1 - Guacamole + guacd 2→1 - Kiali 2→1, ArgoCD server 2→1 - Kyverno background-controller 2→1 - Scylla operator 2→1 - ext-authz-proxy 2→1, netbird-cluster-router 2→1 Kept multi-replica: coredns, envoy-gateway, kyverno admission, vault, argocd-repo-server, gitlab-webservice, istiod, rook-ceph CSI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
334 lines
9.1 KiB
YAML
334 lines
9.1 KiB
YAML
# values/gitlab.values.yaml
|
|
# GitLab with Authentik OIDC SSO Integration
|
|
|
|
global:
|
|
hosts:
|
|
domain: kube.huskypup.net
|
|
gitlab:
|
|
name: gitlab.kube.huskypup.net
|
|
registry:
|
|
name: registry.gitlab.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
minio:
|
|
name: minio.gitlab.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
kas:
|
|
name: kas.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
|
|
# Ingress disabled - Istio VirtualServices handle routing
|
|
ingress:
|
|
enabled: false
|
|
configureCertmanager: false # Use cluster-wide cert-manager, not GitLab's
|
|
|
|
# Edition: Community Edition
|
|
edition: ce
|
|
|
|
# Time zone
|
|
time_zone: UTC
|
|
|
|
# Email configuration (configure as needed)
|
|
email:
|
|
from: 'gitlab@kube.huskypup.net'
|
|
display_name: GitLab
|
|
reply_to: 'noreply@kube.huskypup.net'
|
|
|
|
# External PostgreSQL configuration
|
|
# NOTE: PgBouncer service currently has no endpoints (replicas=0),
|
|
# so GitLab is pointed directly at the CNPG primary service.
|
|
psql:
|
|
host: pg-gitlab-rw.gitlab.svc.cluster.local
|
|
port: 5432
|
|
database: gitlabhq_production
|
|
username: app
|
|
password:
|
|
secret: pg-gitlab-app
|
|
key: password
|
|
|
|
# Gitaly configuration - using Praefect for HA
|
|
gitaly:
|
|
enabled: true # Enabled to deploy Gitaly pods
|
|
internal:
|
|
names: [] # No internal Gitaly, using Praefect
|
|
external: [] # Praefect configured below
|
|
|
|
# Praefect configuration
|
|
praefect:
|
|
enabled: true
|
|
|
|
# Use CNPG database secret
|
|
dbSecret:
|
|
secret: pg-praefect-app
|
|
key: password
|
|
|
|
virtualStorages:
|
|
- name: default
|
|
gitalyReplicas: 3 # Production HA
|
|
maxUnavailable: 1
|
|
|
|
# Praefect PostgreSQL configuration
|
|
psql:
|
|
host: pg-praefect-rw.gitlab.svc.cluster.local
|
|
port: 5432
|
|
dbName: praefect_production
|
|
user: app
|
|
|
|
# External Redis configuration - using standalone Redis for writes
|
|
# (replicated Redis service causes READONLY errors from replicas)
|
|
redis:
|
|
host: redis-gitlab-standalone.gitlab.svc.cluster.local
|
|
port: 6379
|
|
auth:
|
|
enabled: true
|
|
secret: redis-gitlab-secret
|
|
key: password
|
|
|
|
# Application Configuration
|
|
appConfig:
|
|
# OmniAuth SSO Configuration
|
|
omniauth:
|
|
enabled: true
|
|
allowSingleSignOn: ['openid_connect']
|
|
blockAutoCreatedUsers: false
|
|
autoLinkUser: ['openid_connect']
|
|
syncProfileFromProvider: ['openid_connect']
|
|
syncProfileAttributes: ['email', 'name']
|
|
providers:
|
|
- secret: gitlab-oidc-secret
|
|
key: provider
|
|
|
|
# Settings for Let's Encrypt ACME Issuer - disabled, using cluster-wide cert-manager
|
|
certmanager-issuer:
|
|
email: admin@kube.huskypup.net
|
|
|
|
# Authentik OIDC Configuration via Rails omnibus config
|
|
# Note: Credentials are loaded from gitlab-oidc-secret via environment variables
|
|
|
|
# SAML Configuration via Rails omnibus config
|
|
# Note: SAML provider configuration is loaded from gitlab-saml-secret
|
|
|
|
# PostgreSQL (external via CloudNativePG)
|
|
postgresql:
|
|
install: false
|
|
|
|
# Redis (external)
|
|
redis:
|
|
install: false
|
|
|
|
# PgBouncer connection pooler
|
|
# NOTE: PgBouncer is deployed via CNPG Pooler CRD (see pgbouncer-pooler.yaml)
|
|
# This setting disables GitLab's bundled PgBouncer chart
|
|
pgbouncer:
|
|
enabled: false # Using external CNPG Pooler instead
|
|
|
|
# MinIO for object storage
|
|
minio:
|
|
persistence:
|
|
storageClass: rook-ceph-block
|
|
size: 100Gi # Production storage
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 2Gi
|
|
|
|
# Container Registry - enabled with S3 storage
|
|
registry:
|
|
enabled: true
|
|
hpa:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
# GitLab components
|
|
gitlab:
|
|
# GitLab Webservice - Main application
|
|
webservice:
|
|
minReplicas: 2
|
|
maxReplicas: 3
|
|
workerProcesses: 3
|
|
|
|
# Note: hostAliases for OIDC SSL validation are applied via helmfile postsync hook
|
|
# (GitLab chart doesn't support hostAliases in values.yaml)
|
|
|
|
extraEnvFrom:
|
|
GITLAB_OIDC_CLIENT_ID:
|
|
secretKeyRef:
|
|
name: gitlab-oidc-secret
|
|
key: GITLAB_OIDC_CLIENT_ID
|
|
GITLAB_OIDC_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: gitlab-oidc-secret
|
|
key: GITLAB_OIDC_CLIENT_SECRET
|
|
GITLAB_SAML_IDP_FINGERPRINT:
|
|
secretKeyRef:
|
|
name: gitlab-saml-secret
|
|
key: GITLAB_SAML_IDP_FINGERPRINT
|
|
GITLAB_SAML_IDP_SSO_URL:
|
|
secretKeyRef:
|
|
name: gitlab-saml-secret
|
|
key: GITLAB_SAML_IDP_SSO_URL
|
|
extraEnv:
|
|
GITLAB_OMNIBUS_CONFIG: |
|
|
# Authentik OIDC Configuration
|
|
gitlab_rails['omniauth_enabled'] = true
|
|
gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_block_auto_created_users'] = false
|
|
gitlab_rails['omniauth_auto_link_user'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_auto_sign_in_with_provider'] = nil
|
|
gitlab_rails['omniauth_sync_profile_from_provider'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_sync_profile_attributes'] = ['email', 'name']
|
|
|
|
gitlab_rails['omniauth_providers'] = [
|
|
{
|
|
'name' => 'openid_connect',
|
|
'label' => 'Authentik',
|
|
'args' => {
|
|
'name' => 'openid_connect',
|
|
'scope' => ['openid', 'profile', 'email'],
|
|
'response_type' => 'code',
|
|
'issuer' => 'https://auth.kube.huskypup.net/application/o/gitlab/',
|
|
'discovery' => true,
|
|
'client_auth_method' => 'query',
|
|
'uid_field' => 'sub',
|
|
'send_scope_to_token_endpoint' => true,
|
|
'pkce' => true,
|
|
'client_options' => {
|
|
'identifier' => ENV['GITLAB_OIDC_CLIENT_ID'],
|
|
'secret' => ENV['GITLAB_OIDC_CLIENT_SECRET'],
|
|
'redirect_uri' => 'https://gitlab.kube.huskypup.net/users/auth/openid_connect/callback'
|
|
}
|
|
}
|
|
},
|
|
{
|
|
'name' => 'saml',
|
|
'label' => 'Authentik SAML',
|
|
'args' => {
|
|
'assertion_consumer_service_url' => 'https://gitlab.kube.huskypup.net/users/auth/saml/callback',
|
|
'idp_cert_fingerprint' => ENV['GITLAB_SAML_IDP_FINGERPRINT'],
|
|
'idp_sso_target_url' => ENV['GITLAB_SAML_IDP_SSO_URL'],
|
|
'issuer' => 'https://gitlab.kube.huskypup.net',
|
|
'name_identifier_format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
|
|
'attribute_statements' => {
|
|
'email' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
|
|
'name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
|
|
'first_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'],
|
|
'last_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname']
|
|
}
|
|
}
|
|
}
|
|
]
|
|
# Homelab resource allocation
|
|
resources:
|
|
requests:
|
|
cpu: 300m
|
|
memory: 2Gi
|
|
limits:
|
|
memory: 4Gi
|
|
|
|
# GitLab KAS (Kubernetes Agent Server) - enabled for Kubernetes cluster integration
|
|
kas:
|
|
enabled: true
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Gitaly Cluster (Praefect) - High Availability Git storage
|
|
gitaly:
|
|
# Note: enabled is in global.gitaly
|
|
persistence:
|
|
storageClass: rook-ceph-block
|
|
size: 200Gi # Production storage
|
|
# Production resources
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
|
|
# GitLab Runner - enabled for CI/CD
|
|
gitlab-runner:
|
|
install: false # Will be installed separately
|
|
|
|
# Praefect - Gitaly Cluster routing and transaction manager
|
|
praefect:
|
|
enabled: true
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
|
|
# Note: Praefect PostgreSQL config is in global.praefect.psql
|
|
|
|
# Use CNPG-generated database secret
|
|
dbSecret:
|
|
secret: pg-praefect-app
|
|
key: password
|
|
|
|
# Resources
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
|
|
# Virtual storage configuration
|
|
virtualStorages:
|
|
- name: default
|
|
gitalyReplicas: 1 # Homelab sizing
|
|
maxUnavailable: 1
|
|
|
|
# GitLab Exporter for Prometheus metrics
|
|
gitlab-exporter:
|
|
enabled: true
|
|
metrics:
|
|
enabled: true
|
|
|
|
# Sidekiq background jobs
|
|
sidekiq:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
|
|
# Note: hostAliases applied via helmfile postsync hook
|
|
|
|
# Homelab resources
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 2Gi
|
|
|
|
# Disable components we already have in the cluster
|
|
certmanager:
|
|
install: false # Using cluster-wide cert-manager
|
|
installCRDs: false
|
|
|
|
prometheus:
|
|
install: false # Using existing Prometheus
|
|
|
|
nginx-ingress:
|
|
enabled: false # Istio handles ingress
|
|
|
|
# Disable GitLab Runner (configure separately if needed)
|
|
gitlab-runner:
|
|
install: false
|