fix(gitlab): Helm values schema, Tailscale proxy, DNS record
- Fix certmanager: use installCertmanager top-level key (not certmanager.install) - Fix redis: global.redis.auth.enabled (not password.enabled) - Remove grafana (not in GitLab chart), remove top-level minio (use global.minio.enabled) - Add toolbox backup objectStorage config (required when minio disabled) - Set HPA minReplicas/maxReplicas=1 for single-node DEV1-L - Add Tailscale proxy (nginx + tailscale sidecar) for private access - DNS: git.fxhnt.ai → 100.90.76.85 (foxhunt-gitlab Tailscale IP) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
jgrusewski
147
infra/k8s/gitlab/tailscale-proxy.yaml
Normal file
147
infra/k8s/gitlab/tailscale-proxy.yaml
Normal file
@@ -0,0 +1,147 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: tailscale-gitlab
|
||||
namespace: foxhunt
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: tailscale-gitlab
|
||||
namespace: foxhunt
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["create", "get", "update", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: tailscale-gitlab
|
||||
namespace: foxhunt
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: tailscale-gitlab
|
||||
namespace: foxhunt
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: tailscale-gitlab
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-gitlab-proxy
|
||||
namespace: foxhunt
|
||||
labels:
|
||||
app.kubernetes.io/name: tailscale-gitlab-proxy
|
||||
app.kubernetes.io/part-of: foxhunt
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: tailscale-gitlab-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: tailscale-gitlab-proxy
|
||||
spec:
|
||||
serviceAccountName: tailscale-gitlab
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: gitlab
|
||||
tolerations:
|
||||
- key: gitlab
|
||||
operator: Equal
|
||||
value: "true"
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:alpine
|
||||
ports:
|
||||
- containerPort: 80
|
||||
- containerPort: 443
|
||||
- containerPort: 5050
|
||||
volumeMounts:
|
||||
- name: nginx-conf
|
||||
mountPath: /etc/nginx/conf.d
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
- name: tailscale
|
||||
image: ghcr.io/tailscale/tailscale:latest
|
||||
env:
|
||||
- name: TS_AUTHKEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: tailscale-auth
|
||||
key: TS_AUTHKEY
|
||||
- name: TS_KUBE_SECRET
|
||||
value: tailscale-gitlab-state
|
||||
- name: TS_USERSPACE
|
||||
value: "false"
|
||||
- name: TS_HOSTNAME
|
||||
value: "foxhunt-gitlab"
|
||||
- name: TS_ACCEPT_DNS
|
||||
value: "false"
|
||||
- name: TS_EXTRA_ARGS
|
||||
value: ""
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
volumes:
|
||||
- name: nginx-conf
|
||||
configMap:
|
||||
name: tailscale-gitlab-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: tailscale-gitlab-nginx
|
||||
namespace: foxhunt
|
||||
data:
|
||||
default.conf: |
|
||||
server {
|
||||
listen 80;
|
||||
server_name git.fxhnt.ai;
|
||||
|
||||
client_max_body_size 250m;
|
||||
|
||||
location / {
|
||||
proxy_pass http://gitlab-webservice-default.foxhunt.svc.cluster.local:8181;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 5050;
|
||||
server_name git.fxhnt.ai;
|
||||
|
||||
client_max_body_size 0;
|
||||
|
||||
location / {
|
||||
proxy_pass http://gitlab-registry.foxhunt.svc.cluster.local:5000;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
@@ -26,8 +26,10 @@ global:
|
||||
redis:
|
||||
host: redis.foxhunt.svc.cluster.local
|
||||
port: 6379
|
||||
password:
|
||||
auth:
|
||||
enabled: false
|
||||
minio:
|
||||
enabled: false
|
||||
registry:
|
||||
bucket: foxhunt-gitlab-registry
|
||||
appConfig:
|
||||
@@ -59,21 +61,22 @@ redis:
|
||||
install: false
|
||||
|
||||
# Disable components we don't need
|
||||
installCertmanager: false
|
||||
certmanager:
|
||||
install: false
|
||||
installCRDs: false
|
||||
nginx-ingress:
|
||||
enabled: false
|
||||
prometheus:
|
||||
install: false
|
||||
grafana:
|
||||
install: false
|
||||
gitlab-runner:
|
||||
install: false
|
||||
minio:
|
||||
install: false
|
||||
|
||||
# Registry — S3-backed
|
||||
registry:
|
||||
replicaCount: 1
|
||||
hpa:
|
||||
minReplicas: 1
|
||||
maxReplicas: 1
|
||||
storage:
|
||||
secret: gitlab-s3-credentials
|
||||
key: registry
|
||||
@@ -89,6 +92,9 @@ registry:
|
||||
gitlab:
|
||||
webservice:
|
||||
replicaCount: 1
|
||||
hpa:
|
||||
minReplicas: 1
|
||||
maxReplicas: 1
|
||||
workerProcesses: 2
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: gitlab
|
||||
@@ -109,6 +115,9 @@ gitlab:
|
||||
|
||||
sidekiq:
|
||||
replicas: 1
|
||||
hpa:
|
||||
minReplicas: 1
|
||||
maxReplicas: 1
|
||||
concurrency: 10
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: gitlab
|
||||
@@ -147,6 +156,10 @@ gitlab:
|
||||
memory: 2Gi
|
||||
|
||||
gitlab-shell:
|
||||
replicaCount: 1
|
||||
hpa:
|
||||
minReplicas: 1
|
||||
maxReplicas: 1
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: gitlab
|
||||
tolerations:
|
||||
@@ -159,6 +172,11 @@ gitlab:
|
||||
nodePort: 32222
|
||||
|
||||
toolbox:
|
||||
backups:
|
||||
objectStorage:
|
||||
config:
|
||||
secret: gitlab-s3-credentials
|
||||
key: connection
|
||||
nodeSelector:
|
||||
k8s.scaleway.com/pool-name: gitlab
|
||||
tolerations:
|
||||
@@ -169,6 +187,9 @@ gitlab:
|
||||
|
||||
kas:
|
||||
enabled: false
|
||||
hpa:
|
||||
minReplicas: 0
|
||||
maxReplicas: 0
|
||||
|
||||
gitlab-exporter:
|
||||
enabled: false
|
||||
|
||||
@@ -8,7 +8,6 @@ terraform {
|
||||
|
||||
inputs = {
|
||||
dns_zone = "fxhnt.ai"
|
||||
# Tailscale subnet router IP — GitLab CE is accessed via this
|
||||
# Update this after deploying GitLab and finding the routable IP
|
||||
git_ip = "PLACEHOLDER_UPDATE_AFTER_DEPLOY"
|
||||
# Tailscale IP of foxhunt-gitlab proxy pod
|
||||
git_ip = "100.90.76.85"
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user