mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Sonnet 5
989d42dd50
Real bug affecting both home and VPS GitLab, found live diagnosing why
VPS's webservice pod was stuck at Init:0/3 for 74+ minutes (surfacing as
404s - nothing was ever actually serving):
global.appConfig.omniauth.providers: [{secret: gitlab-oidc-secret, key:
provider}] requires that secret to have a 'provider' key (a full YAML
omniauth provider config) - gitlab-oidc-secret never has one, only
GITLAB_OIDC_CLIENT_ID/SECRET, which get consumed via extraEnvFrom +
GITLAB_OMNIBUS_CONFIG's gitlab_rails['omniauth_providers'] instead (the
actual, complete mechanism already configuring OIDC - this providers:
list was always redundant). Removed it from both values.yaml files.
Home's GitLab has run fine so far because Kubernetes doesn't re-validate
already-mounted volumes when a referenced Secret's shape changes -
webservice/sidekiq there just haven't restarted since gitlab-oidc-secret
was last (if ever) in a shape with that key. VPS's identical values
shape hit it immediately on first pod creation. This was a live landmine
for home too - fixed before it could bite on a future restart.
Also: global.kas.enabled: false added to the VPS values (gitlab.kas.enabled
alone doesn't stop KAS pods - found live, separate toggle).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
350 lines
10 KiB
YAML
350 lines
10 KiB
YAML
# values/gitlab.values.yaml
|
|
# GitLab with Authentik OIDC SSO Integration
|
|
|
|
global:
|
|
hosts:
|
|
domain: kube.huskypup.net
|
|
gitlab:
|
|
name: gitlab.kube.huskypup.net
|
|
registry:
|
|
name: registry.gitlab.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
minio:
|
|
name: minio.gitlab.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
kas:
|
|
name: kas.kube.huskypup.net
|
|
tls:
|
|
secretName: gitlab-tls
|
|
|
|
# Ingress disabled - Istio VirtualServices handle routing
|
|
ingress:
|
|
enabled: false
|
|
configureCertmanager: false # Use cluster-wide cert-manager, not GitLab's
|
|
|
|
# Edition: Community Edition
|
|
edition: ce
|
|
|
|
# Time zone
|
|
time_zone: UTC
|
|
|
|
# Email configuration (configure as needed)
|
|
email:
|
|
from: 'gitlab@kube.huskypup.net'
|
|
display_name: GitLab
|
|
reply_to: 'noreply@kube.huskypup.net'
|
|
|
|
# External PostgreSQL configuration
|
|
# NOTE: PgBouncer service currently has no endpoints (replicas=0),
|
|
# so GitLab is pointed directly at the CNPG primary service.
|
|
psql:
|
|
host: pg-gitlab-rw.gitlab.svc.cluster.local
|
|
port: 5432
|
|
database: gitlabhq_production
|
|
username: app
|
|
password:
|
|
secret: pg-gitlab-app
|
|
key: password
|
|
|
|
# Gitaly configuration - using Praefect for HA
|
|
gitaly:
|
|
enabled: true # Enabled to deploy Gitaly pods
|
|
internal:
|
|
names: [] # No internal Gitaly, using Praefect
|
|
external: [] # Praefect configured below
|
|
|
|
# Praefect configuration
|
|
praefect:
|
|
enabled: true
|
|
|
|
# Use CNPG database secret
|
|
dbSecret:
|
|
secret: pg-praefect-app
|
|
key: password
|
|
|
|
virtualStorages:
|
|
- name: default
|
|
gitalyReplicas: 3 # Production HA
|
|
maxUnavailable: 1
|
|
|
|
# Praefect PostgreSQL configuration
|
|
psql:
|
|
host: pg-praefect-rw.gitlab.svc.cluster.local
|
|
port: 5432
|
|
dbName: praefect_production
|
|
user: app
|
|
|
|
# External Redis configuration - using standalone Redis for writes
|
|
# (replicated Redis service causes READONLY errors from replicas)
|
|
redis:
|
|
host: redis-gitlab-standalone.gitlab.svc.cluster.local
|
|
port: 6379
|
|
auth:
|
|
enabled: true
|
|
secret: redis-gitlab-secret
|
|
key: password
|
|
|
|
# Application Configuration
|
|
appConfig:
|
|
# OmniAuth SSO Configuration
|
|
#
|
|
# NOTE: no `providers:` list here (was `- secret: gitlab-oidc-secret,
|
|
# key: provider`) - found live 2026-08-21 (diagnosing the VPS GitLab
|
|
# deployment, which shares this same values shape) that the chart
|
|
# requires that secret to actually HAVE a `provider` key (a full
|
|
# omniauth provider config block, YAML-encoded) when this list is
|
|
# set, and gitlab-oidc-secret never had one - it only has
|
|
# GITLAB_OIDC_CLIENT_ID/SECRET, consumed via extraEnvFrom below and
|
|
# gitlab.webservice.extraEnv's GITLAB_OMNIBUS_CONFIG instead, which
|
|
# is the ACTUAL mechanism configuring the OIDC provider (this
|
|
# global.appConfig.omniauth.providers list was always redundant/
|
|
# unused for our setup). Silently didn't matter here at home because
|
|
# this Deployment hasn't restarted since gitlab-oidc-secret was last
|
|
# in whatever shape included that key (if it ever did) - Kubernetes
|
|
# doesn't re-validate already-mounted volumes when a Secret's shape
|
|
# changes, only NEW pod creation does, which is exactly why the VPS
|
|
# deployment (fresh pods, same values shape) hit it immediately
|
|
# ("FailedMount: references non-existent secret key: provider") while
|
|
# this one didn't - until its next restart.
|
|
omniauth:
|
|
enabled: true
|
|
allowSingleSignOn: ['openid_connect']
|
|
blockAutoCreatedUsers: false
|
|
autoLinkUser: ['openid_connect']
|
|
syncProfileFromProvider: ['openid_connect']
|
|
syncProfileAttributes: ['email', 'name']
|
|
|
|
# Settings for Let's Encrypt ACME Issuer - disabled, using cluster-wide cert-manager
|
|
certmanager-issuer:
|
|
email: admin@kube.huskypup.net
|
|
|
|
# Authentik OIDC Configuration via Rails omnibus config
|
|
# Note: Credentials are loaded from gitlab-oidc-secret via environment variables
|
|
|
|
# SAML Configuration via Rails omnibus config
|
|
# Note: SAML provider configuration is loaded from gitlab-saml-secret
|
|
|
|
# PostgreSQL (external via CloudNativePG)
|
|
postgresql:
|
|
install: false
|
|
|
|
# Redis (external)
|
|
redis:
|
|
install: false
|
|
|
|
# PgBouncer connection pooler
|
|
# NOTE: PgBouncer is deployed via CNPG Pooler CRD (see pgbouncer-pooler.yaml)
|
|
# This setting disables GitLab's bundled PgBouncer chart
|
|
pgbouncer:
|
|
enabled: false # Using external CNPG Pooler instead
|
|
|
|
# MinIO for object storage
|
|
minio:
|
|
persistence:
|
|
storageClass: rook-ceph-block
|
|
size: 100Gi # Production storage
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 2Gi
|
|
|
|
# Container Registry - enabled with S3 storage
|
|
registry:
|
|
enabled: true
|
|
hpa:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 1Gi
|
|
|
|
# GitLab components
|
|
gitlab:
|
|
# GitLab Webservice - Main application
|
|
webservice:
|
|
minReplicas: 2
|
|
maxReplicas: 3
|
|
workerProcesses: 3
|
|
|
|
# Note: hostAliases for OIDC SSL validation are applied via helmfile postsync hook
|
|
# (GitLab chart doesn't support hostAliases in values.yaml)
|
|
|
|
extraEnvFrom:
|
|
GITLAB_OIDC_CLIENT_ID:
|
|
secretKeyRef:
|
|
name: gitlab-oidc-secret
|
|
key: GITLAB_OIDC_CLIENT_ID
|
|
GITLAB_OIDC_CLIENT_SECRET:
|
|
secretKeyRef:
|
|
name: gitlab-oidc-secret
|
|
key: GITLAB_OIDC_CLIENT_SECRET
|
|
GITLAB_SAML_IDP_FINGERPRINT:
|
|
secretKeyRef:
|
|
name: gitlab-saml-secret
|
|
key: GITLAB_SAML_IDP_FINGERPRINT
|
|
GITLAB_SAML_IDP_SSO_URL:
|
|
secretKeyRef:
|
|
name: gitlab-saml-secret
|
|
key: GITLAB_SAML_IDP_SSO_URL
|
|
extraEnv:
|
|
GITLAB_OMNIBUS_CONFIG: |
|
|
# Authentik OIDC Configuration
|
|
gitlab_rails['omniauth_enabled'] = true
|
|
gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_block_auto_created_users'] = false
|
|
gitlab_rails['omniauth_auto_link_user'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_auto_sign_in_with_provider'] = nil
|
|
gitlab_rails['omniauth_sync_profile_from_provider'] = ['openid_connect', 'saml']
|
|
gitlab_rails['omniauth_sync_profile_attributes'] = ['email', 'name']
|
|
|
|
gitlab_rails['omniauth_providers'] = [
|
|
{
|
|
'name' => 'openid_connect',
|
|
'label' => 'Authentik',
|
|
'args' => {
|
|
'name' => 'openid_connect',
|
|
'scope' => ['openid', 'profile', 'email'],
|
|
'response_type' => 'code',
|
|
'issuer' => 'https://auth.kube.huskypup.net/application/o/gitlab/',
|
|
'discovery' => true,
|
|
'client_auth_method' => 'query',
|
|
'uid_field' => 'sub',
|
|
'send_scope_to_token_endpoint' => true,
|
|
'pkce' => true,
|
|
'client_options' => {
|
|
'identifier' => ENV['GITLAB_OIDC_CLIENT_ID'],
|
|
'secret' => ENV['GITLAB_OIDC_CLIENT_SECRET'],
|
|
'redirect_uri' => 'https://gitlab.kube.huskypup.net/users/auth/openid_connect/callback'
|
|
}
|
|
}
|
|
},
|
|
{
|
|
'name' => 'saml',
|
|
'label' => 'Authentik SAML',
|
|
'args' => {
|
|
'assertion_consumer_service_url' => 'https://gitlab.kube.huskypup.net/users/auth/saml/callback',
|
|
'idp_cert_fingerprint' => ENV['GITLAB_SAML_IDP_FINGERPRINT'],
|
|
'idp_sso_target_url' => ENV['GITLAB_SAML_IDP_SSO_URL'],
|
|
'issuer' => 'https://gitlab.kube.huskypup.net',
|
|
'name_identifier_format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
|
|
'attribute_statements' => {
|
|
'email' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'],
|
|
'name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'],
|
|
'first_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'],
|
|
'last_name' => ['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname']
|
|
}
|
|
}
|
|
}
|
|
]
|
|
# Homelab resource allocation
|
|
resources:
|
|
requests:
|
|
cpu: 300m
|
|
memory: 2Gi
|
|
limits:
|
|
memory: 4Gi
|
|
|
|
# GitLab KAS (Kubernetes Agent Server) - enabled for Kubernetes cluster integration
|
|
kas:
|
|
enabled: true
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Gitaly Cluster (Praefect) - High Availability Git storage
|
|
gitaly:
|
|
# Note: enabled is in global.gitaly
|
|
persistence:
|
|
storageClass: rook-ceph-block
|
|
size: 200Gi # Production storage
|
|
# Production resources
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
|
|
# GitLab Runner - enabled for CI/CD
|
|
gitlab-runner:
|
|
install: false # Will be installed separately
|
|
|
|
# Praefect - Gitaly Cluster routing and transaction manager
|
|
praefect:
|
|
enabled: true
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
|
|
# Note: Praefect PostgreSQL config is in global.praefect.psql
|
|
|
|
# Use CNPG-generated database secret
|
|
dbSecret:
|
|
secret: pg-praefect-app
|
|
key: password
|
|
|
|
# Resources
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
|
|
# Virtual storage configuration
|
|
virtualStorages:
|
|
- name: default
|
|
gitalyReplicas: 1 # Homelab sizing
|
|
maxUnavailable: 1
|
|
|
|
# GitLab Exporter for Prometheus metrics
|
|
gitlab-exporter:
|
|
enabled: true
|
|
metrics:
|
|
enabled: true
|
|
|
|
# Sidekiq background jobs
|
|
sidekiq:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
|
|
# Note: hostAliases applied via helmfile postsync hook
|
|
|
|
# Homelab resources
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 2Gi
|
|
|
|
# Disable components we already have in the cluster
|
|
certmanager:
|
|
install: false # Using cluster-wide cert-manager
|
|
installCRDs: false
|
|
|
|
prometheus:
|
|
install: false # Using existing Prometheus
|
|
|
|
nginx-ingress:
|
|
enabled: false # Istio handles ingress
|
|
|
|
# Disable GitLab Runner (configure separately if needed)
|
|
gitlab-runner:
|
|
install: false
|