gitlab-flux-values.yaml

application:
  name: gitlab
  createNamespace: ###ZARF_VAR_GITLAB_CREATE_NAMESPACE###
  namespace: gitlab
  path: chart
  repository: https://repo1.dso.mil/big-bang/product/packages/gitlab.git
  ref:
    # renovate: datasource=gitlab-tags depName=big-bang/product/packages/gitlab versioning=loose registryUrl=https://repo1.dso.mil
    tag: 7.8.1-bb.0
  dependsOn:
    ###ZARF_VAR_GITLAB_DEPENDS_ON###
  baseValues:
    hostname: ###ZARF_VAR_DOMAIN###
    domain: ###ZARF_VAR_DOMAIN###

    global:
      psql:
        host: gitlab-postgres
        port: 5432
        database: ###ZARF_VAR_GITLAB_DB_NAME###
        username: ###ZARF_VAR_GITLAB_DB_USERNAME###
        password:
          useSecret: true
          secret: gitlab-postgres
          key: password
      redis:
        scheme: ###ZARF_VAR_REDIS_SCHEME###
        host: ###ZARF_VAR_GITLAB_REDIS_ENDPOINT###
        port: 6379
        auth:
          enabled: true
          secret: gitlab-redis
          key: password
      minio:
        enabled: false
      # added to help with Gitlab sub-chart configuration
      image:
        pullPolicy: IfNotPresent
      istio:
        enabled: true
        injection: enabled
      hosts:
        domain: ###ZARF_VAR_DOMAIN###
        gitlab:
          name: gitlab.###ZARF_VAR_DOMAIN###
        registry:
          name: registry.###ZARF_VAR_DOMAIN###
        pages:
          name: pages.###ZARF_VAR_DOMAIN###
      registry:
        # Registry bucket is defined in the storage secret
        relativeurls: true
      pages:
        enabled: ###ZARF_VAR_GITLAB_PAGES_ENABLED###
        objectStore:
          bucket: uds-gitlab-pages###ZARF_VAR_BUCKET_SUFFIX###
      appConfig:
        lfs:
          bucket: uds-gitlab-lfs###ZARF_VAR_BUCKET_SUFFIX###
        artifacts:
          bucket: uds-gitlab-artifacts###ZARF_VAR_BUCKET_SUFFIX###
        uploads:
          bucket: uds-gitlab-uploads###ZARF_VAR_BUCKET_SUFFIX###
        packages:
          bucket: uds-gitlab-packages###ZARF_VAR_BUCKET_SUFFIX###
        externalDiffs:
          bucket: uds-gitlab-mr-diffs###ZARF_VAR_BUCKET_SUFFIX###
        terraformState:
          bucket: uds-gitlab-terraform-state###ZARF_VAR_BUCKET_SUFFIX###
        ciSecureFiles:
          bucket: uds-gitlab-ci-secure-files###ZARF_VAR_BUCKET_SUFFIX###
        dependencyProxy:
          bucket: uds-gitlab-dependency-proxy###ZARF_VAR_BUCKET_SUFFIX###
        backups:
          bucket: uds-gitlab-backups###ZARF_VAR_BUCKET_SUFFIX###
          tmpBucket: uds-gitlab-tmp###ZARF_VAR_BUCKET_SUFFIX###
        object_store:
          enabled: true
          proxy_download: true
          connection:
            secret: gitlab-object-store
            key: connection
        omniauth:
          enabled: ###ZARF_VAR_GITLAB_IDAM_ENABLED###
          allowSingleSignOn: ###ZARF_VAR_GITLAB_IDAM_ALLOWED_SSOS###
          blockAutoCreatedUsers: ###ZARF_VAR_GITLAB_IDAM_BLOCK_AUTO_USERS###
          autoLinkUser: ###ZARF_VAR_GITLAB_IDAM_AUTO_LINK_USER###
          autoSignInWithProvider: ###ZARF_VAR_GITLAB_IDAM_AUTO_SIGNIN###
          externalProviders: ###ZARF_VAR_GITLAB_IDAM_EXTERNAL_PROVIDERS###
          syncProfileAttributes: ###ZARF_VAR_GITLAB_IDAM_SYNC_ATTRIBUTES###
          syncProfileFromProvider: ###ZARF_VAR_GITLAB_IDAM_SYNC_PROVIDERS###

          providers:
            ###ZARF_VAR_GITLAB_IDAM_PROVIDERS###

        initialDefaults:
          signupEnabled: ###ZARF_VAR_GITLAB_SIGNUP_ENABLED###

      serviceAccount:
        enabled: false
    postgresql:
      install: false
    redis:
      install: false

    registry:
      annotations:
        bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
      storage:
        redirect:
          disable: ###ZARF_VAR_DISABLE_REGISTRY_REDIRECT###
        secret: gitlab-object-store
        key: registry
      metrics:
        serviceMonitor:
          endpointConfig:
            scheme: https
            tlsConfig:
              caFile: /etc/prom-certs/root-cert.pem
              certFile: /etc/prom-certs/cert-chain.pem
              keyFile: /etc/prom-certs/key.pem
              insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate

    gitlab:
      toolbox:
        resources:
          requests:
            cpu: 50m
            memory: 350M
          limits:
            cpu: 2
            memory: 3.5Gi
        persistence:
          enabled: true
          accessMode: ReadWriteOnce
          size: ###ZARF_VAR_GITLAB_TOOLBOX_PVC_SIZE###
        annotations:
          bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
        backups:
          objectStorage:
            config:
              secret: gitlab-object-store
              key: backups
          cron:
            enabled: ###ZARF_VAR_GITLAB_BACKUP_ENABLED###
            schedule: ###ZARF_VAR_GITLAB_BACKUP_SCHEDULE###
            # Example extraArgs to skip things. --skip registry,uploads,artifacts,external_diffs
            extraArgs: ###ZARF_VAR_GITLAB_BACKUP_EXTRA_ARGS###
            concurrencyPolicy: Replace
            persistence:
              enabled: true
              accessMode: ReadWriteOnce
              size: ###ZARF_VAR_GITLAB_BACKUP_PVC_SIZE###
            resources:
              requests:
                cpu: 50m
                memory: 350M
              limits:
                cpu: 2
                memory: 2G
      gitlab-exporter:
        enabled: true
        metrics:
          annotations:
            bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
          serviceMonitor:
            endpointConfig:
              scheme: https
              tlsConfig:
                caFile: /etc/prom-certs/root-cert.pem
                certFile: /etc/prom-certs/cert-chain.pem
                keyFile: /etc/prom-certs/key.pem
                insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
      webservice:
        annotations:
          bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
        metrics:
          serviceMonitor:
            endpointConfig:
              scheme: https
              tlsConfig:
                caFile: /etc/prom-certs/root-cert.pem
                certFile: /etc/prom-certs/cert-chain.pem
                keyFile: /etc/prom-certs/key.pem
                insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
        resources:
          limits:
            cpu: 600m
            memory: 4G
        workhorse:
          metrics:
            serviceMonitor:
              endpointConfig:
                scheme: https
                tlsConfig:
                  caFile: /etc/prom-certs/root-cert.pem
                  certFile: /etc/prom-certs/cert-chain.pem
                  keyFile: /etc/prom-certs/key.pem
                  insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
      sidekiq:
        annotations:
          bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
      migrations:
        annotations:
          bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
        resources:
          limits:
            cpu: 500m
            memory: 4G
          requests:
            cpu: 500m
            memory: 1G
      gitaly:
        annotations:
          bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
        metrics:
          serviceMonitor:
            endpointConfig:
              scheme: https
              tlsConfig:
                caFile: /etc/prom-certs/root-cert.pem
                certFile: /etc/prom-certs/cert-chain.pem
                keyFile: /etc/prom-certs/key.pem
                insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
      gitlab-shell:
        annotations:
          bigbang.dev/istioVersion: ###ZARF_VAR_ISTIO_VERSION###
        metrics:
          serviceMonitor:
            endpointConfig:
              scheme: https
              tlsConfig:
                caFile: /etc/prom-certs/root-cert.pem
                certFile: /etc/prom-certs/cert-chain.pem
                keyFile: /etc/prom-certs/key.pem
                insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate

    openshift: false

    istio:
      enabled: true
      injection: enabled
      gitlab:
        gateways:
        - istio-system/tenant
      registry:
        gateways:
        - istio-system/tenant
      pages:
        enabled: true
        port: 8090
        ingressLabels:
          app: tenant-ingressgateway
        gateways:
        - istio-system/tenant
        customDomains:
          enabled: false
        hosts:
        - '*.pages.###ZARF_VAR_DOMAIN###'


    monitoring:
      enabled: true

    networkPolicies:
      enabled: true
      ingressLabels:
        app: tenant-ingressgateway
      controlPlaneCidr: 0.0.0.0/0