mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
38dad209e3
Proves the CONFIG_TEMPLATE_DIRECTORY redirect works before Phase 2b adds any actual cross-site dependency. Content is byte-identical to the chart's current rendering (confirmed live) - this commit only tests the override plumbing itself: a new ConfigMap (praefect-ha-configmap.yaml) mounted at a different path than the chart's own /etc/gitaly/templates (can't reuse that path/volume name - Kubernetes rejects duplicates), with CONFIG_TEMPLATE_DIRECTORY overridden via extraEnv to point at it instead (last-wins env semantics, confirmed Kubernetes-documented behavior). Also removes gitlab.praefect.virtualStorages - confirmed live dead config, global.praefect.virtualStorages is what the chart's template actually reads. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
373 lines
11 KiB
YAML
373 lines
11 KiB
YAML
# values/gitlab.values.yaml
|
|
# GitLab with Authentik OIDC SSO Integration
|
|
|
|
global:
|
|
hosts:
|
|
domain: kube.huskypup.net
|
|
gitlab:
|
|
name: gitlab.kube.huskypup.net
|
|
registry:
|
|
name: registry.gitlab.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
minio:
|
|
name: minio.gitlab.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
kas:
|
|
name: kas.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
|
|
# Ingress disabled - Istio VirtualServices handle routing
|
|
ingress:
|
|
enabled: false
|
|
configureCertmanager: false # Use cluster-wide cert-manager, not GitLab's
|
|
|
|
# Edition: Community Edition
|
|
edition: ce
|
|
|
|
# Time zone
|
|
time_zone: UTC
|
|
|
|
# Email configuration (configure as needed)
|
|
email:
|
|
from: 'gitlab@kube.huskypup.net'
|
|
display_name: GitLab
|
|
reply_to: 'noreply@kube.huskypup.net'
|
|
|
|
# External PostgreSQL configuration
|
|
# NOTE: PgBouncer service currently has no endpoints (replicas=0),
|
|
# so GitLab is pointed directly at the CNPG primary service.
|
|
psql:
|
|
host: pg-gitlab-rw.gitlab.svc.cluster.local
|
|
port: 5432
|
|
database: gitlabhq_production
|
|
username: app
|
|
password:
|
|
secret: pg-gitlab-app
|
|
key: password
|
|
|
|
# Gitaly configuration - using Praefect for HA
|
|
gitaly:
|
|
enabled: true # Enabled to deploy Gitaly pods
|
|
internal:
|
|
names: [] # No internal Gitaly, using Praefect
|
|
external: [] # Praefect configured below
|
|
|
|
# Praefect configuration
|
|
praefect:
|
|
enabled: true
|
|
|
|
# Use CNPG database secret
|
|
dbSecret:
|
|
secret: pg-praefect-app
|
|
key: password
|
|
|
|
virtualStorages:
|
|
- name: default
|
|
gitalyReplicas: 3 # Production HA
|
|
maxUnavailable: 1
|
|
|
|
# Praefect PostgreSQL configuration
|
|
psql:
|
|
host: pg-praefect-rw.gitlab.svc.cluster.local
|
|
port: 5432
|
|
dbName: praefect_production
|
|
user: app
|
|
|
|
# External Redis configuration - using standalone Redis for writes
|
|
# (replicated Redis service causes READONLY errors from replicas)
|
|
redis:
|
|
host: redis-gitlab-standalone.gitlab.svc.cluster.local
|
|
port: 6379
|
|
auth:
|
|
enabled: true
|
|
secret: redis-gitlab-secret
|
|
key: password
|
|
|
|
# Application Configuration
|
|
appConfig:
|
|
# OmniAuth SSO Configuration
|
|
#
|
|
# CORRECTED 2026-08-21 (second time - see git history for the wrong
|
|
# 2026-08-20 fix that removed this list entirely). This IS the real,
|
|
# actually-processed OIDC config mechanism for the CNG webservice
|
|
# image (chart's gitlab.appConfig.omniauth.configuration template,
|
|
# infra/_omniauth.tpl) - GITLAB_OMNIBUS_CONFIG below is an
|
|
# omnibus-image-only convention this image never processes, so it
|
|
# was always a documentation-only no-op despite looking functional.
|
|
# gitlab-oidc-secret's `provider` key now holds a full YAML-encoded
|
|
# provider block (apps/gitlab/manifests/external-secret-oidc.yaml),
|
|
# loaded via Ruby's YAML.load_file at container start - not raw
|
|
# client_id/secret strings, which is why plain GITLAB_OIDC_CLIENT_ID/
|
|
# SECRET keys alone (yesterday's assumption) were never enough.
|
|
omniauth:
|
|
enabled: true
|
|
allowSingleSignOn: ['openid_connect']
|
|
blockAutoCreatedUsers: false
|
|
autoLinkUser: ['openid_connect']
|
|
syncProfileFromProvider: ['openid_connect']
|
|
syncProfileAttributes: ['email', 'name']
|
|
providers:
|
|
- secret: gitlab-oidc-secret
|
|
key: provider
|
|
|
|
# Settings for Let's Encrypt ACME Issuer - disabled, using cluster-wide cert-manager
|
|
certmanager-issuer:
|
|
email: admin@kube.huskypup.net
|
|
|
|
# Authentik OIDC Configuration via Rails omnibus config
|
|
# Note: Credentials are loaded from gitlab-oidc-secret via environment variables
|
|
|
|
# SAML Configuration via Rails omnibus config
|
|
# Note: SAML provider configuration is loaded from gitlab-saml-secret
|
|
|
|
# PostgreSQL (external via CloudNativePG)
|
|
postgresql:
|
|
install: false
|
|
|
|
# Redis (external)
|
|
redis:
|
|
install: false
|
|
|
|
# PgBouncer connection pooler
|
|
# NOTE: PgBouncer is deployed via CNPG Pooler CRD (see pgbouncer-pooler.yaml)
|
|
# This setting disables GitLab's bundled PgBouncer chart
|
|
pgbouncer:
|
|
enabled: false # Using external CNPG Pooler instead
|
|
|
|
# MinIO for object storage
|
|
minio:
|
|
persistence:
|
|
storageClass: rook-ceph-block
|
|
size: 100Gi # Production storage
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 2Gi
|
|
|
|
# Container Registry - enabled with S3 storage
|
|
registry:
|
|
enabled: true
|
|
hpa:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
# GitLab components
|
|
gitlab:
|
|
# GitLab Webservice - Main application
|
|
webservice:
|
|
minReplicas: 2
|
|
maxReplicas: 3
|
|
workerProcesses: 3
|
|
|
|
# Note: hostAliases for OIDC SSL validation are applied via helmfile postsync hook
|
|
# (GitLab chart doesn't support hostAliases in values.yaml)
|
|
|
|
extraEnvFrom:
|
|
GITLAB_OIDC_CLIENT_ID:
|
|
secretKeyRef:
|
|
name: gitlab-oidc-secret
|
|
key: GITLAB_OIDC_CLIENT_ID
|
|
GITLAB_OIDC_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: gitlab-oidc-secret
|
|
key: GITLAB_OIDC_CLIENT_SECRET
|
|
GITLAB_SAML_IDP_FINGERPRINT:
|
|
secretKeyRef:
|
|
name: gitlab-saml-secret
|
|
key: GITLAB_SAML_IDP_FINGERPRINT
|
|
GITLAB_SAML_IDP_SSO_URL:
|
|
secretKeyRef:
|
|
name: gitlab-saml-secret
|
|
key: GITLAB_SAML_IDP_SSO_URL
|
|
extraEnv:
|
|
GITLAB_OMNIBUS_CONFIG: |
|
|
# Authentik OIDC Configuration
|
|
gitlab_rails['omniauth_enabled'] = true
|
|
gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_block_auto_created_users'] = false
|
|
gitlab_rails['omniauth_auto_link_user'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_auto_sign_in_with_provider'] = nil
|
|
gitlab_rails['omniauth_sync_profile_from_provider'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_sync_profile_attributes'] = ['email', 'name']
|
|
|
|
gitlab_rails['omniauth_providers'] = [
|
|
{
|
|
'name' => 'openid_connect',
|
|
'label' => 'Authentik',
|
|
'args' => {
|
|
'name' => 'openid_connect',
|
|
'scope' => ['openid', 'profile', 'email'],
|
|
'response_type' => 'code',
|
|
'issuer' => 'https://auth.kube.huskypup.net/application/o/gitlab/',
|
|
'discovery' => true,
|
|
'client_auth_method' => 'query',
|
|
'uid_field' => 'sub',
|
|
'send_scope_to_token_endpoint' => true,
|
|
'pkce' => true,
|
|
'client_options' => {
|
|
'identifier' => ENV['GITLAB_OIDC_CLIENT_ID'],
|
|
'secret' => ENV['GITLAB_OIDC_CLIENT_SECRET'],
|
|
'redirect_uri' => 'https://gitlab.kube.huskypup.net/users/auth/openid_connect/callback'
|
|
}
|
|
}
|
|
},
|
|
{
|
|
'name' => 'saml',
|
|
'label' => 'Authentik SAML',
|
|
'args' => {
|
|
'assertion_consumer_service_url' => 'https://gitlab.kube.huskypup.net/users/auth/saml/callback',
|
|
'idp_cert_fingerprint' => ENV['GITLAB_SAML_IDP_FINGERPRINT'],
|
|
'idp_sso_target_url' => ENV['GITLAB_SAML_IDP_SSO_URL'],
|
|
'issuer' => 'https://gitlab.kube.huskypup.net',
|
|
'name_identifier_format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
|
|
'attribute_statements' => {
|
|
'email' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
|
|
'name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
|
|
'first_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'],
|
|
'last_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname']
|
|
}
|
|
}
|
|
}
|
|
]
|
|
# Homelab resource allocation
|
|
resources:
|
|
requests:
|
|
cpu: 300m
|
|
memory: 2Gi
|
|
limits:
|
|
memory: 4Gi
|
|
|
|
# GitLab KAS (Kubernetes Agent Server) - enabled for Kubernetes cluster integration
|
|
kas:
|
|
enabled: true
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Gitaly Cluster (Praefect) - High Availability Git storage
|
|
gitaly:
|
|
# Note: enabled is in global.gitaly
|
|
persistence:
|
|
storageClass: rook-ceph-block
|
|
size: 200Gi # Production storage
|
|
# Production resources
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
|
|
# GitLab Runner - enabled for CI/CD
|
|
gitlab-runner:
|
|
install: false # Will be installed separately
|
|
|
|
# Praefect - Gitaly Cluster routing and transaction manager
|
|
praefect:
|
|
enabled: true
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
|
|
# Note: Praefect PostgreSQL config is in global.praefect.psql
|
|
|
|
# Use CNPG-generated database secret
|
|
dbSecret:
|
|
secret: pg-praefect-app
|
|
key: password
|
|
|
|
# Resources
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
|
|
# (dead config removed 2026-08-22: this virtualStorages block never
|
|
# actually did anything - confirmed live the chart's Praefect
|
|
# ConfigMap template iterates global.praefect.virtualStorages, not
|
|
# this one, so gitalyReplicas: 3 up there always won regardless of
|
|
# what this said. See global.praefect.virtualStorages above for the
|
|
# real config.)
|
|
|
|
# GitLab cross-site replication Phase 2a (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - redirects
|
|
# Praefect's config template source so a hand-written config.toml.tpl
|
|
# (praefect-ha-configmap.yaml) can add a VPS-hosted Gitaly node the
|
|
# chart itself has no mechanism to register. The chart's own
|
|
# gitlab-praefect ConfigMap is already mounted at
|
|
# /etc/gitaly/templates (which CONFIG_TEMPLATE_DIRECTORY points at by
|
|
# default) - can't add a second volume at that same path/name
|
|
# (Kubernetes rejects duplicate volume names), so this mounts the
|
|
# override at a different path and points CONFIG_TEMPLATE_DIRECTORY
|
|
# there instead. Duplicate env var names in a container's env: list
|
|
# resolve last-wins (documented Kubernetes behavior) - this entry
|
|
# renders after the chart's own, so it's the one that takes effect.
|
|
extraEnv:
|
|
CONFIG_TEMPLATE_DIRECTORY: /etc/gitaly/templates-ha
|
|
extraVolumes:
|
|
- name: praefect-ha-config
|
|
configMap:
|
|
name: praefect-ha-config
|
|
extraVolumeMounts:
|
|
- name: praefect-ha-config
|
|
mountPath: /etc/gitaly/templates-ha
|
|
readOnly: true
|
|
maxUnavailable: 1
|
|
|
|
# GitLab Exporter for Prometheus metrics
|
|
gitlab-exporter:
|
|
enabled: true
|
|
metrics:
|
|
enabled: true
|
|
|
|
# Sidekiq background jobs
|
|
sidekiq:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
|
|
# Note: hostAliases applied via helmfile postsync hook
|
|
|
|
# Homelab resources
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 2Gi
|
|
|
|
# Disable components we already have in the cluster
|
|
certmanager:
|
|
install: false # Using cluster-wide cert-manager
|
|
installCRDs: false
|
|
|
|
prometheus:
|
|
install: false # Using existing Prometheus
|
|
|
|
nginx-ingress:
|
|
enabled: false # Istio handles ingress
|
|
|
|
# Disable GitLab Runner (configure separately if needed)
|
|
gitlab-runner:
|
|
install: false
|