values.yaml

# Values for gitlab/gitlab chart on GKE
global:
  edition: ce
  hosts:
    domain: ${DOMAIN}
    https: true
    gitlab: {}
    externalIP: ${INGRESS_IP}
    ssh: ~
    kas:
      name: ${KAS_DOMAIN}

  ## doc/charts/globals.md#configure-ingress-settings
  ingress:
    apiVersion: networking.k8s.io/v1
    configureCertmanager: true
    enabled: true
    tls:
      enabled: true

  ## doc/charts/globals.md#configure-postgresql-settings
  psql:
    password:
      secret: gitlab-postgres-secret
      key: password
    host: ${DB_PRIVATE_IP}
    port: 5432
    username: gitlab
    database: gitlabhq_production
    ssl:
      secret: gitlab-postgres-mtls
      clientCertificate: cert
      clientKey: private_key
      serverCA: server_ca_cert

  redis:
    password:
      enabled: false
    host: ${REDIS_PRIVATE_IP}

  ## doc/charts/globals.md#configure-minio-settings
  minio:
    enabled: false

  ## https://docs.gitlab.com/charts/charts/globals#configure-grafana-integration
  grafana:
    enabled: ${INSTALL_GRAFANA}

  ## doc/charts/globals.md#configure-appconfig-settings
  ## Rails based portions of this chart share many settings
  appConfig:
    ## doc/charts/globals.md#general-application-settings
    enableUsagePing: ${ENABLE_SERVICE_PING}

    ## https://docs.gitlab.com/charts/charts/globals#cron-jobs-related-settings
    cron_jobs: {}

     ## https://docs.gitlab.com/charts/charts/globals.html#incoming-email-settings
    incomingEmail:
      enabled: ${ENABLE_INCOMING_MAIL}
      address: "${INC_MAIL_ADDR}"
      host: "${INC_MAIL_IMAP_HOST}"
      port: ${INC_MAIL_IMAP_PORT}
      ssl: true
      startTls: false
      user: "${INC_MAIL_USER}"
      password:
        secret: "${INC_MAIL_K8S_SECRET}"
        key: password
    
    serviceDeskEmail:
      enabled: ${ENABLE_SERVICE_DESK}
      address: "${SERVICE_DESK_MAIL_ADDR}"
      host: "${SERVICE_DESK_IMAP_HOST}"
      port: "${SERVICE_DESK_IMAP_PORT}"
      ssl: true
      startTls: false
      user: "${SERVICE_DESK_MAIL_USER}"
      password:
        secret: "${SERVICE_DESK_K8S_SECRET}"
        key: password

    ## https://docs.gitlab.com/charts/charts/globals#lfs-artifacts-uploads-packages-external-mr-diffs-and-dependency-proxy
    object_store:
      enabled: true
      proxy_download: false
      storage_options:
        {}
        # server_side_encryption:
        # server_side_encryption_kms_key_id
      connection:
        secret: gitlab-rails-storage
        key: connection
    lfs:
      enabled: true
      bucket: ${LFS_BCKT}
    artifacts:
      enabled: true
      bucket: ${ARTIFACTS_BCKT}
    uploads:
      enabled: true
      bucket: ${UPLOADS_BCKT}
    packages:
      enabled: true
      bucket: ${PACKAGES_BCKT}
    externalDiffs:
      enabled: false
      bucket: ${EXT_DIFF_BCKT}
    terraformState:
      enabled: true
      bucket: ${TERRAFORM_BCKT}
    dependencyProxy:
      enabled: true
      bucket: ${DEP_PROXY_BCKT}

    backups:
      bucket: ${BACKUP_BCKT}
      tmpBucket: ${BACKUP_TMP_BCKT}

    ## https://docs.gitlab.com/charts/charts/globals#omniauth
    omniauth:
      enabled: ${ENABLE_OMNIAUTH}
      allowSingleSignOn: [""]
      allowBypassTwoFactor: null
      providers:
        - secret: gitlab-omniauth-secret
          key: provider

  ## https://docs.gitlab.com/charts/charts/gitlab/kas/
  kas:
    enabled: ${INSTALL_KAS}

  ## https://docs.gitlab.com/charts/charts/globals#configure-registry-settings
  ## If we do not set the legacy bucket name here, the registry is not included
  ## in the Gitlab backup archive.
  registry:
    enabled: ${ENABLE_REGISTRY}
    bucket: ${REGISTRY_BCKT}

  ## https://docs.gitlab.com/charts/installation/deployment#outgoing-email
  ## Outgoing email server settings
  smtp:
    enabled: ${ENABLE_SMTP}
    user_name: ${SMTP_USER}
    password:
      secret: gitlab-smtp-secret
      key: password
    starttls_auto: true

  ## GLOBAL Outgoing email server settings
  email:
    from: ${SMTP_USER}
    reply_to: ${SMTP_USER}

  ## Timezone for containers.
  time_zone: ${TIMEZONE}

  ## https://docs.gitlab.com/charts/charts/globals
  extraEnv:
    PGSSLCERT: "/etc/gitlab/postgres/ssl/client-certificate.pem"
    PGSSLKEY: "/etc/gitlab/postgres/ssl/client-key.pem"
    PGSSLROOTCERT: "/etc/gitlab/postgres/ssl/server-ca.pem"

## Settings to for the Let's Encrypt ACME Issuer
certmanager-issuer:
  email: ${CERT_MANAGER_EMAIL}

## Installation & configuration of jetstack/cert-manager
## See requirements.yaml for current version
certmanager:
  install: ${ENABLE_CERT_MANAGER}

## https://docs.gitlab.com/charts/charts/nginx/
## https://docs.gitlab.com/charts/architecture/decisions#nginx-ingress
## Installation & configuration of charts/ingress-nginx:
nginx-ingress:
  enabled: ${INSTALL_INGRESS_NGINX}
  controller:
    config:
      ssl-reject-handshake: "true"

## Installation & configuration of stable/prometheus
## See requirements.yaml for current version
prometheus:
  install: ${INSTALL_PROMETHEUS}

## Configuration of Redis
## https://docs.gitlab.com/charts/architecture/decisions#redis
## https://docs.gitlab.com/charts/installation/deployment.html#redis
redis:
  install: false

## Installation & configuration of stable/prostgresql
## See requirements.yaml for current version
postgresql:
  install: false

## Installation & configuration charts/registry
## https://docs.gitlab.com/charts/architecture/decisions#registry
## https://docs.gitlab.com/charts/charts/registry/
registry:
  enabled: ${ENABLE_REGISTRY}
  hpa:
    minReplicas: ${HPA_MIN_REPLICAS_REGISTRY}
    maxReplicas: ${HPA_MAX_REPLICAS_REGISTRY}
  storage:
    secret: gitlab-registry-storage
    key: storage
    extraKey: gcs.json

## Installation & configuration of gitlab/gitlab-runner
## See requirements.yaml for current version

gitlab-runner:
  install: ${INSTALL_RUNNER}
  rbac:
    create: true
  runners:
    locked: false
    cache:
      cacheType: gcs
      gcsBucketName: ${RUNNER_CACHE_BCKT}
      secretName: google-application-credentials
      cacheShared: true

## Settings for individual sub-charts under GitLab
## Note: Many of these settings are configurable via globals
gitlab:
  gitlab-shell:
    minReplicas: ${HPA_MIN_REPLICAS_SHELL}
    maxReplicas: ${HPA_MAX_REPLICAS_SHELL}
  kas:
    minReplicas: ${HPA_MIN_REPLICAS_KAS}
    maxReplicas: ${HPA_MAX_REPLICAS_KAS}
  webservice:
    minReplicas: ${HPA_MIN_REPLICAS_WEBSERVICE}
    maxReplicas: ${HPA_MAX_REPLICAS_WEBSERVICE}
    registry:
      enabled: ${ENABLE_REGISTRY}
%{ if length(MONITORING_ALLOWED_CIDRS) > 0 ~}
    monitoring:
      ipWhitelist:
%{ for cidr_block in MONITORING_ALLOWED_CIDRS ~}
        - ${cidr_block}
%{ endfor ~}
%{ endif ~}
  sidekiq:
    minReplicas: ${HPA_MIN_REPLICAS_SIDEKIQ}
    maxReplicas: ${HPA_MAX_REPLICAS_SIDEKIQ}
    registry:
      enabled: ${ENABLE_REGISTRY}
  migrations:
    enabled: ${ENABLE_MIGRATIONS}
  gitlab-exporter:
    enabled: ${ENABLE_PROM_EXPORTER}
  ## https://docs.gitlab.com/charts/charts/gitlab/toolbox
  toolbox:
    backups:
      cron:
        enabled: ${ENABLE_CRON_BACKUP}
        failedJobsHistoryLimit: 7
        successfulJobsHistoryLimit: 3
        schedule: "${SCHEDULE_CRON_BACKUP}"
        extraArgs: ${BACKUP_EXTRA}
        persistence:
          enabled: ${ENABLE_BACKUP_PV}
          storageClass: ${BACKUP_PV_SC}
          size: "${BACKUP_PV_SIZE}Gi"
      objectStorage:
        backend: gcs
        config:
          secret: google-application-credentials
          key: gcs-application-credentials-file
          gcpProject: ${PROJECT_ID}
    persistence:
      enabled: ${ENABLE_RESTORE_PV}
      storageClass: ${RESTORE_PV_SC}
      size: "${RESTORE_PV_SIZE}Gi"
  ## https://docs.gitlab.com/charts/charts/gitlab/gitaly
  gitaly:
    maxUnavailable: ${GITALY_MAX_UNAVAILABLE}
    persistence:
      size: "${GITALY_PV_SIZE}Gi"
      storageClass: ${PV_STORAGE_CLASS}
      matchLabels:
%{ for key, value in PV_MATCH_LABEL ~}
        ${key}: ${value}
%{ endfor ~}
    resources:
      requests:
        cpu: ${GITALY_REQUEST_CPU}
        memory: ${GITALY_REQUEST_MEMORY}