This document was prepared by Mehmet Samet Duman under the auspices of Project Tick HQ and is a documented account of a real-life event. This document is licensed under CC-BY-SA 4.0.
Hi everyone! Today I'm going to show you how to set up GitLab with K8s
Helm Chart. Let's get started. We'll start by dumping the default values
and then deploy PostgreSQL with the first CNPG and Redis with Bitnami.
Firstly, init your first repository and create namespace from GitLab
mkdir gitlabhq-production && cd gitlabhq-production
git init
kubectl create namespace gitlab
Then, add helm repositories and dump Redis values with this commands;
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm show values bitnami/redis > redis-all-values.yaml
And we'll copy the values so you can edit them and reference the defaults.
cp redis-all-values.yaml redis-values.yaml
Afterwards, you can edit it as you wish using any editing tool you prefer.
This is what my values file looks like now.
# redis-values.yaml
architecture: replication
auth:
existingSecret: gitlab-redis
existingSecretPasswordKey: redis-password
fullnameOverride: gitlab-redis
master:
nodeSelector:
kubernetes.io/hostname: mail.projecttick.org
persistence:
size: 8Gi
replica:
nodeSelector:
kubernetes.io/hostname: mail.projecttick.org
persistence:
size: 8Gi
replicaCount: 3
sentinel:
enabled: true
masterSet: gitlab-redis
nodeSelector:
kubernetes.io/hostname: mail.projecttick.org
But before deploying it, we need to create its secret. For this, I prefer YAML. The following YAML file will help me define my secret.
# gitlab-redis-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: gitlab-redis
namespace: gitlab
type: Opaque
stringData:
redis-password: <YOURREDISPASSWORD>
And install with this command.
kubectl apply -f gitlab-redis-secret.yaml
If you saved the password, please delete this YAML file, otherwise your secret and passwords will be corrupted in your Git commit.
rm gitlab-redis-secret.yaml
And we install it with Helm install using the following command:
helm upgrade gitlab-redis bitnami/redis -f ./redis-values.yaml -n gitlab --timeout 600s --install
Now we will deploy PostgreSQL with CNPG. Because GitLab itself created these dependencies, it fell to us to deploy them.
The operator will not create the secret. Therefore, we will create the secret ourselves. Creating it with YAML is easier,
but remember to save these secrets in hidden locations. Otherwise, your data will disappear and you won't be able to access it.
For CNPG, we'll be deploying manually instead of using an operator and helm chart. I'm using this and it's working perfectly for me.
# gitlab-prod-cnpg.yaml
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: gitlab-prod-cnpg
namespace: gitlab
spec:
postgresql:
parameters:
max_connections: "200"
instances: 1
imageName: ghcr.io/cloudnative-pg/postgresql:17.6
primaryUpdateStrategy: unsupervised
enableSuperuserAccess: true
bootstrap:
initdb:
database: gitlabhq_production
owner: gitlab
secret:
name: gitlab-prod-cnpg-app
storage:
size: 150Gi
storageClass: local-path
affinity:
nodeSelector:
kubernetes.io/hostname: mail.projecttick.org
resources:
requests:
cpu: 500m
memory: 1Gi
limits:
cpu: "2"
memory: 4Gi
# gitlab-prod-cnpg-app-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: gitlab-prod-cnpg-app
namespace: gitlab
type: kubernetes.io/basic-auth
stringData:
username: gitlab
password: <YOURPGSQLPASSWORD>
You can deploy this with the following command.
kubectl apply -f gitlab-prod-cnpg-app-secret.yaml
kubectl apply -f gitlab-prod-cnpg.yaml
I'm saying this again and again: if you saved the password, please delete this YAML file, otherwise your secret and passwords will get mixed up in your Git commit.
rm gitlab-prod-cnpg-app-secret.yaml
Now, if you don't have an ingress provider in the cluster, you need to set one up. I recommend Nginx Ingress. If you don't have a provider, let's set one up immediately. But we need to import our TLS certificates as secrets, otherwise recognition might not work, and you'll end up with a stub certificate that won't be able to pass through anywhere. I used to use omnibus gitlab, but I generated my certificates with certbot. First, let's check the certificate directory with certbot. This is the result I got:
[root@mail k8s-migration]# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: projecttick.org
Serial Number: ************************
Key Type: ECDSA
Identifiers: projecttick.org *.pages.projecttick.net *.projecttick.com *.projecttick.net *.projecttick.org projecttick.com projecttick.net
Expiry Date: 2026-09-12 14:19:06+00:00 (VALID: 82 days)
Certificate Path: /etc/letsencrypt/live/projecttick.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/projecttick.org/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[root@mail k8s-migration]#
Now, we import our TLS certificate using this command.
kubectl -n gitlab create secret tls gitlab-wildcard-tls --cert="/etc/letsencrypt/live/projecttick.org/fullchain.pem" --key="/etc/letsencrypt/live/projecttick.org/privkey.pem" --dry-run=client -o yaml | kubectl apply -f -
Now let's add the ingress-nginx repository, update the repositories, and dump all the values.
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm show values ingress-nginx/ingress-nginx > ingress-nginx-all-values.yaml
And we'll copy the values again so you can edit them and reference the defaults.
cp ingress-nginx-all-values.yaml ingress-nginx-values.yaml
I'll install it after I've edited it, but first let me show you mine as a real usage reference.
# ingress-nginx-values.yaml
controller:
ingressClass: gitlab-nginx
ingressClassByName: true
ingressClassResource:
name: gitlab-nginx
enabled: true
controllerValue: k8s.io/ingress-nginx
default: false
watchIngressWithoutClass: false
nodeSelector:
kubernetes.io/hostname: mail.projecttick.org
replicaCount: 1
hostPort:
enabled: true
ports:
http: 80
https: 443
containerPort:
http: 80
https: 443
updateStrategy:
type: Recreate
service:
enabled: false
extraArgs:
default-ssl-certificate: gitlab/gitlab-wildcard-tls
ingress-class-by-name: "true"
admissionWebhooks:
enabled: false
allowSnippetAnnotations: true
config:
annotations-risk-level: Critical
As you may have noticed, I've assigned the same certificate we just added as the default. Now we can proceed with the installation.
helm upgrade ingress-nginx ingress-nginx/ingress-nginx --version 4.15.1 --namespace ingress-nginx -f ./ingress-nginx-values.yaml --timeout 600s --install --create-namespace
If you're wondering why we put this in a separate namespace, it's so that it's easier if you ever want to delete GitLab and install another service. And we don't need to carry a secret here because we're reading directly from the GitLab namespace.
Now, I have a question for you. If you want to use advanced search, you should install Elasticsearch or Opensearch. If you don't want to install them, please skip this part. I prefer Elasticsearch. Therefore, we'll first add the Elasticsearch repository, then take a dump and edit it. The process is the same. After that, we'll install MinIO and finally install GitLab to finish.
helm repo add elastic https://helm.elastic.co
helm repo update
helm show values elastic/elasticsearch > elasticsearch-all-values.yaml
cp elasticsearch-all-values.yaml elasticsearch-values.yaml
This is what my values file looks like:
# elasticsearch-values.yaml
createCert: false
esConfig:
elasticsearch.yml: 'xpack.security.enabled: false'
minimumMasterNodes: 1
protocol: http
replicas: 1
volumeClaimTemplate:
resources:
requests:
storage: 50Gi
Now let's set this up with Helm.
helm upgrade elasticsearch elastic/elasticsearch -n gitlab -f ./elasticsearch-values.yaml --timeout 600s --install
Now we can move on to the main event. We will deploy MinIO, but we won't be using Helm; instead, we'll deploy it with a YAML file using kubectl. However, for this, we first need to create a namespace called "storage", write a YAML file, and deploy it using apply. I chose the minio/minio:latest image from quay.io. We will also write environment values and create a secret when deploying this.
I wrote a YAML file. It contains a statefulset, a service, and a secret. We'll also write a YAML file for the ingress layer, but that'll come later.
# minio.yaml
apiVersion: v1
kind: Namespace
metadata:
name: storage
---
apiVersion: v1
kind: Secret
metadata:
name: minio-secret
namespace: storage
type: Opaque
stringData:
root-user: "YOURUSER"
root-password: "YOURPASSWORD"
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: minio
namespace: storage
spec:
serviceName: minio
replicas: 1
selector:
matchLabels:
app: minio
template:
metadata:
labels:
app: minio
spec:
containers:
- name: minio
image: quay.io/minio/minio:latest
args:
- server
- /data
- --console-address
- ":9001"
env:
- name: MINIO_ROOT_USER
valueFrom:
secretKeyRef:
name: minio-secret
key: root-user
- name: MINIO_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: minio-secret
key: root-password
- name: MINIO_SERVER_URL
value: https://s3.projecttick.net
- name: MINIO_BROWSER_REDIRECT_URL
value: https://minio.projecttick.net
- name: MINIO_DOMAIN
value: s3.projecttick.net
ports:
- containerPort: 9000
name: s3
- containerPort: 9001
name: console
volumeMounts:
- name: data
mountPath: /data
volumeClaimTemplates:
- metadata:
name: data
spec:
storageClassName: local-path
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 120Gi
---
apiVersion: v1
kind: Service
metadata:
name: minio
namespace: storage
spec:
type: NodePort
selector:
app: minio
ports:
- name: s3
port: 9000
targetPort: 9000
nodePort: 30900
- name: console
port: 9001
targetPort: 9001
nodePort: 30901
CAUTION!
Do not assign https:// to the MINIO_DOMAIN value! Otherwise, you will get a 403 error and the S3 system will be corrupted for external use.
Let's deploy it now.
kubectl create namespace storage
kubectl apply -f minio.yaml
Now we'll write the ingress layer for this. If you're wondering why I've given it a separate entry, it's so you can have a reference for subsequent ingress YAML files.
# minio-ingress.yaml
# === s3.projecttick.net -> minio 9000 (S3 API) ===
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: minio-s3
namespace: storage
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
nginx.ingress.kubernetes.io/proxy-buffering: "off"
spec:
ingressClassName: gitlab-nginx
tls:
- hosts: [s3.projecttick.net]
secretName: gitlab-wildcard-tls
rules:
- host: s3.projecttick.net
http:
paths:
- path: /
pathType: Prefix
backend: {service: {name: minio, port: {number: 9000}}}
---
# === minio.projecttick.net -> minio 9001 (Console, websocket) ===
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: minio-console
namespace: storage
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: "0"
spec:
ingressClassName: gitlab-nginx
tls:
- hosts: [minio.projecttick.net]
secretName: gitlab-wildcard-tls
rules:
- host: minio.projecttick.net
http:
paths:
- path: /
pathType: Prefix
backend: {service: {name: minio, port: {number: 9001}}}
But before we deploy this, we need to move our TLS to the storage namespace. We deploy it directly after transporting it.
kubectl -n storage create secret tls gitlab-wildcard-tls --cert="/etc/letsencrypt/live/projecttick.org/fullchain.pem" --key="/etc/letsencrypt/live/projecttick.org/privkey.pem" --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -f minio-ingress.yaml
MinIO has now been deployed. Now let's get to the final boss, GitLab. While its values aren't overly complex, I'd say they're extremely detailed.
helm repo add gitlab https://charts.gitlab.io/
helm repo update
helm show values gitlab/gitlab > gitlab-all-values.yaml
cp gitlab-all-values.yaml gitlab-values.yaml
My values file looks like this. But remember, almost everything is open in it. And don't forget, the GitLab example you're currently reading this document from is running with this YAML values file.
global:
edition: ee
hosts:
ssh: git.projecttick.org
domain: projecttick.org
https: true
pages:
name: pages.projecttick.net
gitlab:
name: git.projecttick.org
registry:
name: registry.projecttick.org
kas:
name: kas.projecttick.org
minio:
name: minio.projecttick.org
shell:
port: 22
gatewayApi:
enabled: false
installEnvoy: false
configureCertmanager: false
ingress:
enabled: true
provider: nginx
class: gitlab-nginx
configureCertmanager: false
tls:
enabled: true
secretName: gitlab-wildcard-tls
keda:
enabled: true
monitoring:
enabled: true
minio:
enabled: false
praefect:
enabled: false
gitaly:
enabled: true
internal:
names: [default]
service:
name: gitaly
type: ClusterIP
externalPort: 8075
internalPort: 8075
tls:
externalPort: 8076
internalPort: 8076
client:
maxAttempts: 4
initialBackoff: '0.4s'
maxBackoff: '1.4s'
appConfig:
omniauth:
enabled: true
allowSingleSignOn: ['openid_connect','github','gitlab','google_oauth2','azure_activedirectory_v2']
blockAutoCreatedUsers: true
autoLinkUser: ['openid_connect','github','gitlab','google_oauth2','azure_activedirectory_v2']
providers:
- secret: gitlab-omniauth-github
key: provider
- secret: gitlab-omniauth-gitlab
key: provider
- secret: gitlab-omniauth-google
key: provider
- secret: gitlab-omniauth-azure
key: provider
- secret: gitlab-omniauth-openid
key: provider
- secret: gitlab-omniauth-group
key: provider
enableUsagePing: false
enableSeatLink: false
usernameChangingEnabled: true
incomingEmail:
enabled: true
address: "pt-gitlab-incoming+%{key}@projecttick.org"
host: "mail.projecttick.org"
port: 993
ssl: true
startTls: false
user: "pt-gitlab-incoming@projecttick.org"
password:
secret: gitlab-incoming-email-password
key: password
mailbox: "inbox"
inboxMethod: "imap"
deliveryMethod: webhook
serviceDeskEmail:
enabled: true
address: "desk+%{key}@projecttick.org"
host: "mail.projecttick.org"
port: 993
ssl: true
startTls: false
user: "desk@projecttick.org"
password:
secret: gitlab-service-desk-email-password
key: password
mailbox: "inbox"
inboxMethod: "imap"
deliveryMethod: webhook
defaultTheme: 4
defaultColorMode: 1
issueClosingPattern: "\\b((?:[Cc]los(?:e[sd]?|ing)|\\b[Ff]ix(?:e[sd]|ing)?|\\b[Rr]esolv(?:e[sd]?|ing)|\\b[Ii]mplement(?:s|ed|ing)?)(:?) +(?:(?:issues? +)?%{issue_ref}(?:(?:, *| +and +)?)|([A-Z][A-Z0-9_]+-\\d+))+)"
enableImpersonation: false
defaultProjectsFeatures:
issues: true
mergeRequests: true
wiki: true
snippets: true
builds: true
extra:
googleAnalyticsId: "G-91XWT2Q4LY"
ldap:
enabled: true
preventSignin: false
servers:
main:
label: 'Project Tick LDAP'
host: 'ldap.projecttick.net'
port: 636
uid: 'uid'
base: 'ou=people,dc=projecttick,dc=net'
encryption: 'simple_tls'
verify_certificates: true
bind_dn: 'cn=Directory Manager'
password:
secret: gitlab-ldap-password
key: password
user_filter: '(objectClass=nsPerson)'
active_directory: false
object_store:
enabled: true
connection:
secret: gitlab-object-storage
key: connection
lfs:
enabled: true
proxy_download: true
bucket: gitlab-lfs
artifacts:
enabled: true
proxy_download: true
bucket: gitlab-artifacts
uploads:
enabled: true
proxy_download: true
bucket: gitlab-uploads
packages:
enabled: true
proxy_download: true
bucket: gitlab-packages
externalDiffs:
enabled: true
proxy_download: true
bucket: gitlab-mr-diffs
terraformState:
enabled: true
bucket: gitlab-terraform
ciSecureFiles:
enabled: true
bucket: gitlab-secure-files
dependencyProxy:
enabled: true
bucket: gitlab-dependency-proxy
backups:
bucket: gitlab-backups
tmpBucket: tmp
smtp:
enabled: true
address: "152.53.231.231"
port: 587
authentication: "login"
domain: "projecttick.org"
starttls_auto: true
openssl_verify_mode: "none"
password:
secret: gitlab-smtp-password
key: password
user_name: "noreply@projecttick.org"
pages:
enabled: true
accessControl: false
artifactsServer: true
objectStore:
enabled: true
bucket: gitlab-pages
connection:
secret: gitlab-pages-storage
key: connection
namespaceInPath: false
email:
from: "noreply@projecttick.org"
display_name: "Project Tick GitLab"
reply_to: "support@projecttick.org"
psql:
host: gitlab-prod-cnpg-rw.gitlab.svc.cluster.local
port: 5432
username: gitlab
database: gitlabhq_production
password:
secret: gitlab-prod-cnpg-app
key: password
redis:
host: gitlab-redis
sentinels:
- host: gitlab-redis-node-0.gitlab-redis-headless.gitlab.svc.cluster.local
port: 26379
- host: gitlab-redis-node-1.gitlab-redis-headless.gitlab.svc.cluster.local
port: 26379
- host: gitlab-redis-node-2.gitlab-redis-headless.gitlab.svc.cluster.local
port: 26379
sentinelAuth:
enabled: true
secret: gitlab-redis
key: redis-password
auth:
enabled: true
secret: gitlab-redis
key: redis-password
time_zone: UTC
serviceAccount:
enabled: true
create: true
automountServiceAccountToken: true
certmanager-issuer:
install: false
email: projecttick@projecttick.org
registry:
storage:
secret: gitlab-registry
key: config
installCertmanager: false
nginx-ingress:
enabled: false
certmanager:
installCRDs: false
redis:
install: false
postgresql:
install: false
minio:
install: false
prometheus:
install: true
rbac:
create: true
alertmanager:
enabled: true
kube-state-metrics:
enabled: true
prometheus-node-exporter:
enabled: true
prometheus-pushgateway:
enabled: true
scrapeConfigs: null
server:
retention: 15d
strategy:
type: Recreate
containerSecurityContext:
runAsUser: 1000
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop: [ "ALL" ]
seccompProfile:
type: "RuntimeDefault"
podSecurityPolicy:
enabled: false
configmapReload:
prometheus:
containerSecurityContext:
runAsUser: 1000
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop: [ "ALL" ]
seccompProfile:
type: "RuntimeDefault"
serverFiles:
prometheus.yml:
scrape_configs:
- job_name: prometheus
static_configs:
- targets:
- localhost:9090
- job_name: kubernetes-apiservers
kubernetes_sd_configs:
- role: endpoints
scheme: https
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
insecure_skip_verify: true
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: default;kubernetes;https
- job_name: kubernetes-pods
kubernetes_sd_configs:
- role: pod
relabel_configs:
- source_labels:
[__meta_kubernetes_pod_annotation_gitlab_com_prometheus_scrape]
action: keep
regex: true
- source_labels:
[__meta_kubernetes_pod_annotation_gitlab_com_prometheus_scheme]
action: replace
regex: (https?)
target_label: __scheme__
- source_labels:
[__meta_kubernetes_pod_annotation_gitlab_com_prometheus_path]
action: replace
target_label: __metrics_path__
regex: (.+)
- source_labels:
[
__address__,
__meta_kubernetes_pod_annotation_gitlab_com_prometheus_port,
]
action: replace
regex: ([^:]+)(?::\d+)?;(\d+)
replacement: $1:$2
target_label: __address__
- action: labelmap
regex: __meta_kubernetes_pod_label_(.+)
- source_labels: [__meta_kubernetes_namespace]
action: replace
target_label: kubernetes_namespace
- source_labels: [__meta_kubernetes_pod_name]
action: replace
target_label: kubernetes_pod_name
- job_name: kubernetes-service-endpoints
kubernetes_sd_configs:
- role: endpoints
relabel_configs:
- action: keep
regex: true
source_labels:
- __meta_kubernetes_service_annotation_gitlab_com_prometheus_scrape
- action: replace
regex: (https?)
source_labels:
- __meta_kubernetes_service_annotation_gitlab_com_prometheus_scheme
target_label: __scheme__
- action: replace
regex: (.+)
source_labels:
- __meta_kubernetes_service_annotation_gitlab_com_prometheus_path
target_label: __metrics_path__
- action: replace
regex: ([^:]+)(?::\d+)?;(\d+)
replacement: $1:$2
source_labels:
- __address__
- __meta_kubernetes_service_annotation_gitlab_com_prometheus_port
target_label: __address__
- action: labelmap
regex: __meta_kubernetes_service_label_(.+)
- action: replace
source_labels:
- __meta_kubernetes_namespace
target_label: kubernetes_namespace
- action: replace
source_labels:
- __meta_kubernetes_service_name
target_label: kubernetes_name
- action: replace
source_labels:
- __meta_kubernetes_pod_node_name
target_label: kubernetes_node
- job_name: kubernetes-services
metrics_path: /probe
params:
module: [http_2xx]
kubernetes_sd_configs:
- role: service
relabel_configs:
- source_labels:
[
__meta_kubernetes_service_annotation_gitlab_com_prometheus_probe,
]
action: keep
regex: true
- source_labels: [__address__]
target_label: __param_target
- target_label: __address__
replacement: blackbox
- source_labels: [__param_target]
target_label: instance
- action: labelmap
regex: __meta_kubernetes_service_label_(.+)
- source_labels: [__meta_kubernetes_namespace]
target_label: kubernetes_namespace
- source_labels: [__meta_kubernetes_service_name]
target_label: kubernetes_name
upgradeCheck:
enabled: true
securityContext:
runAsUser: 65534
fsGroup: 65534
seccompProfile:
type: "RuntimeDefault"
containerSecurityContext:
runAsUser: 65534
allowPrivilegeEscalation: false
runAsNonRoot: true
shared-secrets:
enabled: true
rbac:
create: true
ai-gateway:
install: false
ingress:
enabled: false
gitlab-runner:
install: true
nodeSelector:
region: us
tolerations:
- key: dedicated
operator: Equal
value: canary
effect: NoSchedule
replicas: 4
runners:
config: |
concurrent = 40
check_interval = 3
[[runners]]
[runners.kubernetes]
namespace = "gitlab"
image = "alpine:latest"
memory_request = "2Gi"
memory_limit = "2Gi"
cpu_request = "300m"
[runners.kubernetes.node_selector]
"region" = "us"
"kubernetes.io/arch" = "arm64"
[runners.kubernetes.node_tolerations]
"dedicated=canary" = "NoSchedule"
gitlab-zoekt:
install: true
gateway:
basicAuth:
enabled: true
secretName: gitlab-zoekt-gateway-basic-auth
zoekt:
indexer:
replicas: 1
webserver:
replicas: 1
persistence:
size: 150Gi
gitlab:
webservice:
deployment:
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1
minReplicas: 2
maxReplicas: 4
sidekiq:
minReplicas: 2
maxReplicas: 4
routingRules:
- ["*", ""]
pods:
- name: all-in-1
queues: ""
gitlab-shell:
enabled: true
service:
type: NodePort
nodePort: 22
toolbox:
replicas: 1
antiAffinityLabels:
matchLabels:
app: gitaly
backups:
objectStorage:
config:
secret: gitlab-backup-storage
key: config
migrations:
enabled: true
IMPORTANT!
I used a separate node selector for the runner, but please use your own selector to avoid it getting stuck in pending mode.
But we can't deploy it as is because there are no buckets or secrets yet.
First, let's create the secrets, and then we'll create the buckets. First, we create our most important secret to enable S3 to connect with GitLab, and we apply this for two separate purposes.
# gitlab-object-storage-connection.yaml
provider: AWS
region: us-east-1
aws_access_key_id: 'YOURUSER'
aws_secret_access_key: 'YOURPASSWORD'
aws_signature_version: 4
host: minio.storage.svc.cluster.local
endpoint: 'http://minio.storage.svc.cluster.local:9000'
path_style: true
kubectl create secret generic gitlab-object-storage --from-file=connection=gitlab-object-storage-connection.yaml -n gitlab
kubectl create secret generic gitlab-pages-storage --from-file=connection=gitlab-object-storage-connection.yaml -n gitlab
# gitlab-backup-storage.yaml
[default]
access_key = YOURUSER
secret_key = YOURPASSWORD
host_base = minio.storage.svc.cluster.local:9000
host_bucket = minio.storage.svc.cluster.local:9000
use_https = False
kubectl create secret generic gitlab-backup-storage --from-file=config=gitlab-backup-storage.yaml -n gitlab
# gitlab-registry.yaml
s3:
bucket: gitlab-registry
accesskey: YOURUSER
secretkey: 'YOURPASSWORD'
region: us-east-1
regionendpoint: 'http://minio.storage.svc.cluster.local:9000'
v4auth: true
pathstyle: true
checksum_disabled: true
redirect:
disable: true
kubectl create secret generic gitlab-registry --from-file=config=gitlab-registry.yaml -n gitlab
# gitlab-mail-ldap-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: gitlab-incoming-email-password
namespace: gitlab
type: Opaque
stringData:
password: <INCOMING_EMAIL_PASSWORD>
---
apiVersion: v1
kind: Secret
metadata:
name: gitlab-service-desk-email-password
namespace: gitlab
type: Opaque
stringData:
password: <SERVICE_DESK_PASSWORD>
---
apiVersion: v1
kind: Secret
metadata:
name: gitlab-smtp-password
namespace: gitlab
type: Opaque
stringData:
password: <SMTP_PASSWORD>
---
apiVersion: v1
kind: Secret
metadata:
name: gitlab-ldap-password
namespace: gitlab
type: Opaque
stringData:
password: <LDAP_BIND_PASSWORD>
kubectl create secret generic gitlab-zoekt-gateway-basic-auth --from-literal=gitlab_username=gitlab --from-literal=gitlab_password=<ZOEKT_PASSWORD> -n gitlab
kubectl apply -f gitlab-mail-ldap-secrets.yaml
# azure-omniauth.yaml
name: azure_activedirectory_v2
label: "Azure AD v2"
args:
client_id: "CLIENT_ID"
client_secret: "CLIENT_SECRET"
tenant_id: "TENANT_ID"
# github-omniauth.yaml
name: github
label: "GitHub"
app_id: "APP_ID"
app_secret: "APP_SECRET"
args:
scope: 'user:email'
# gitlab-omniauth.yaml
name: gitlab
label: "GitLab SaaS"
app_id: "APP_ID"
app_secret: "APP_SECRET"
args:
scope: 'read_user'
# google-omniauth.yaml
name: google_oauth2
label: "Google"
app_id: "APP_ID"
app_secret: "APP_SECRET"
# group-omniauth.yaml
name: group_saml
# openid-omniauth.yaml
name: openid_connect
label: "Project Tick SSO"
args:
name: openid_connect
scope: ['openid','profile','email']
response_type: code
issuer: "https://id.projecttick.net/realms/projecttick"
discovery: true
client_auth_method: query
uid_field: preferred_username
pkce: true
client_options:
identifier: "gitlab"
secret: "SECRET"
redirect_uri: "https://git.projecttick.org/users/auth/openid_connect/callback"
kubectl create secret generic gitlab-omniauth-azure --from-file=provider=azure-omniauth.yaml -n gitlab
kubectl create secret generic gitlab-omniauth-github --from-file=provider=github-omniauth.yaml -n gitlab
kubectl create secret generic gitlab-omniauth-gitlab --from-file=provider=gitlab-omniauth.yaml -n gitlab
kubectl create secret generic gitlab-omniauth-google --from-file=provider=google-omniauth.yaml -n gitlab
kubectl create secret generic gitlab-omniauth-group --from-file=provider=group-omniauth.yaml -n gitlab
kubectl create secret generic gitlab-omniauth-openid --from-file=provider=openid-omniauth.yaml -n gitlab
Now that the secrets are ready, we need to create the buckets. GitLab won't create them for us; each bucket referenced in our values must already exist, otherwise the relevant property will initially fail with access errors.
We will be using the MinIO client (mc). First, let's register an alias pointing to our MinIO instance with the root credentials we defined earlier:
IMPORTANT!
If you are creating the buckets from a different location, please enter the full IP address instead of localhost.
mc alias set direct http://127.0.0.1:30900 YOURUSER YOURPASSWORD
Now create every bucket GitLab expects. These names come directly from our values file:
for b in gitlab-lfs gitlab-artifacts gitlab-uploads gitlab-packages \
gitlab-mr-diffs gitlab-terraform gitlab-secure-files \
gitlab-dependency-proxy gitlab-backups tmp \
gitlab-pages gitlab-registry; do
mc mb direct/$b
done
Verify they were all created:
mc ls direct
Yes! Everything is ready now. There are no more obstacles to deploying GitLab. You can now deploy by pinning the release.
helm upgrade gitlab gitlab/gitlab --version 10.1.0 --namespace gitlab -f ./gitlab-values.yaml --timeout 1200s --install
The deployment may take a while, please wait patiently. You can easily track it afterwards with a command like kubectl get pods -n gitlab. Now, let's get to the main point: the first login with the root password! But remember, Helm may autonomously delete the secret containing the first root password in the next deployment or after 24 hours for security reasons. Therefore, change your password immediately after logging in. Learn your root password with the following command.
kubectl get secret gitlab-gitlab-initial-root-password \
-n gitlab \
-o jsonpath='{.data.password}' | base64 -d ; echo
After logging in as root, obtain the Elasticsearch URL, username, and password from the admin panel and enter them. The Elasticsearch Helm installation instructions clearly explain how to obtain them. Then, immediately create an instance runner and use the secret you obtained to create the following secret.
# gitlab-runner-secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: gitlab-runner-secret
namespace: gitlab
type: Opaque
stringData:
runner-registration-token: ""
runner-token: "YOURRUNNERSECRET"
kubectl apply -f gitlab-runner-secret.yaml
CAUTION!
Please remember to delete the secrets where you entered your passwords. Otherwise, you may encounter serious problems.
That's it! Your GitLab EE instance is now running on Kubernetes with external PostgreSQL (CNPG), Redis Sentinel, MinIO object storage, Elasticsearch, and Zoekt. Happy DevOps-ing!
Top comments (0)