e21a9a5da4
Root cause: global.appConfig.terraformState was missing entirely from the GitLab Helm values, so the
chart rendered terraform_state.enabled=false + object_store disabled -> every /terraform/state API call
403'd ('Object Storage is not enabled for Terraform::StateUploader'), blocking terragrunt. State files
were intact in MinIO (foxhunt-gitlab-artifacts) the whole time. Added terraformState{enabled,bucket,
connection} mirroring artifacts/lfs/packages; helm upgrade -> revision 25 -> TF-state API now 200.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
207 lines
4.4 KiB
YAML
207 lines
4.4 KiB
YAML
# GitLab CE - Foxhunt deployment
|
|
# Runs on 'infra' node pool alongside platform services
|
|
# External Postgres + Redis on same pool
|
|
|
|
global:
|
|
edition: ce
|
|
kas:
|
|
enabled: false
|
|
hosts:
|
|
domain: fxhnt.ai
|
|
gitlab:
|
|
name: git.fxhnt.ai
|
|
https: true
|
|
registry:
|
|
name: git.fxhnt.ai
|
|
https: true
|
|
ingress:
|
|
enabled: false
|
|
configureCertmanager: false
|
|
shell:
|
|
port: 2222
|
|
psql:
|
|
host: postgres.foxhunt.svc.cluster.local
|
|
port: 5432
|
|
database: gitlab
|
|
username: gitlab
|
|
password:
|
|
secret: gitlab-secrets
|
|
key: db-password
|
|
redis:
|
|
host: redis.foxhunt.svc.cluster.local
|
|
port: 6379
|
|
auth:
|
|
enabled: false
|
|
minio:
|
|
enabled: false
|
|
registry:
|
|
bucket: foxhunt-gitlab-registry
|
|
appConfig:
|
|
lfs:
|
|
bucket: foxhunt-gitlab-artifacts
|
|
connection:
|
|
secret: gitlab-s3-credentials
|
|
key: connection
|
|
artifacts:
|
|
bucket: foxhunt-gitlab-artifacts
|
|
connection:
|
|
secret: gitlab-s3-credentials
|
|
key: connection
|
|
uploads:
|
|
bucket: foxhunt-gitlab-artifacts
|
|
connection:
|
|
secret: gitlab-s3-credentials
|
|
key: connection
|
|
packages:
|
|
bucket: foxhunt-gitlab-artifacts
|
|
connection:
|
|
secret: gitlab-s3-credentials
|
|
key: connection
|
|
# Terraform/OpenTofu state object storage. MUST be present — without it the
|
|
# Terraform::StateUploader has no object store and every TF-state API call 403s
|
|
# ("Object Storage is not enabled for Terraform::StateUploader"). State files already
|
|
# live in foxhunt-gitlab-artifacts (6b/86/<sha256(project_id)>/<state>/<ver>.tfstate).
|
|
terraformState:
|
|
enabled: true
|
|
bucket: foxhunt-gitlab-artifacts
|
|
connection:
|
|
secret: gitlab-s3-credentials
|
|
key: connection
|
|
gitlab_kas:
|
|
enabled: false
|
|
|
|
# Disable bundled databases — use external
|
|
postgresql:
|
|
install: false
|
|
redis:
|
|
install: false
|
|
|
|
# Disable components we don't need
|
|
installCertmanager: false
|
|
certmanager:
|
|
installCRDs: false
|
|
nginx-ingress:
|
|
enabled: false
|
|
prometheus:
|
|
install: true
|
|
rbac:
|
|
create: true
|
|
alertmanager:
|
|
enabled: false
|
|
server:
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
persistentVolume:
|
|
enabled: false
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
gitlab-runner:
|
|
install: false
|
|
|
|
# Registry — S3-backed, NodePort for kubelet image pulls
|
|
# Token auth disabled (cluster-internal only, secured by network policies)
|
|
# Pods pull via gitlab-registry.foxhunt.svc.cluster.local:5000 (internal DNS)
|
|
registry:
|
|
replicaCount: 1
|
|
hpa:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
service:
|
|
type: NodePort
|
|
nodePort: 30500
|
|
storage:
|
|
secret: gitlab-s3-credentials
|
|
key: registry
|
|
redirect:
|
|
disable: true
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
|
|
# GitLab core components — all on infra node pool
|
|
gitlab:
|
|
webservice:
|
|
replicaCount: 2
|
|
hpa:
|
|
minReplicas: 2
|
|
maxReplicas: 2
|
|
workerProcesses: 2
|
|
workhorse:
|
|
extraArgs: "-apiLimit 0 -apiQueueLimit 0"
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
resources:
|
|
requests:
|
|
cpu: 500m
|
|
memory: 2Gi
|
|
limits:
|
|
cpu: 2000m
|
|
memory: 4Gi
|
|
extraEnv:
|
|
REDIS_URL: "redis://redis.foxhunt.svc.cluster.local:6379/8"
|
|
|
|
sidekiq:
|
|
replicas: 1
|
|
hpa:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
concurrency: 10
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 1Gi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
extraEnv:
|
|
REDIS_URL: "redis://redis.foxhunt.svc.cluster.local:6379/8"
|
|
|
|
gitaly:
|
|
persistence:
|
|
enabled: true
|
|
size: 50Gi
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
gitlab-shell:
|
|
replicaCount: 1
|
|
hpa:
|
|
minReplicas: 1
|
|
maxReplicas: 1
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
service:
|
|
type: NodePort
|
|
nodePort: 32222
|
|
|
|
toolbox:
|
|
backups:
|
|
objectStorage:
|
|
config:
|
|
secret: gitlab-s3-credentials
|
|
key: connection
|
|
nodeSelector:
|
|
k8s.scaleway.com/pool-name: infra
|
|
|
|
kas:
|
|
enabled: false
|
|
hpa:
|
|
minReplicas: 0
|
|
maxReplicas: 0
|
|
|
|
gitlab-exporter:
|
|
enabled: false
|