Skip to content

Big Bang changes📜

The upstream GitLab chart is vendored without patches. Big Bang-specific behavior is implemented in the outer chart and includes Istio integration, NetworkPolicies, OpenShift compatibility, hardened defaults, Big Bang testing, and Verified Publisher CNG UBI image configuration.

Big Bang disables GitLab Service Ping and event-level product usage collection by default. The webservice and Sidekiq runtime override applies consistently to new installations and upgrades while remaining configurable by consumers.

The optional upstream AI Gateway remains disabled by default. When enabled, Big Bang intentionally overrides the AI Gateway 0.12.0 chart’s older application version with the Verified Publisher self-hosted-v19.1.3-ee Model Gateway image, consistent with GitLab’s requirement for a 19.1.x or later AI Gateway image. Big Bang also supplies the certificate init-container resources required by the upstream templates and applies hardened workload defaults. The upstream Helm test is disabled because it does not support private-registry pull credentials; its BusyBox image and the optional gRPC TLS proxy image are nevertheless routed through Iron Bank.

GitLab 19 removed its bundled PostgreSQL, Redis, and MinIO charts. This package does not add replacement subcharts, operators, or custom resources. Consumers must configure externally managed PostgreSQL 17, Redis or Valkey, and GitLab-supported external object storage through the upstream GitLab values and Secrets.

The independent CloudNativePG, PostgreSQL, Redis, and Garage HelmReleases used by Big Bang CI are rendered through the umbrella generic-package mechanism. Their definitions are present only in package/umbrella test overrides; they are not GitLab chart resources, consumer defaults, or a supported consumer development or production persistence topology.

Redis and CloudNativePG own generated source Secrets in their respective namespaces. A test-only Kyverno policy synchronizes those credentials and transforms Garage’s source Secret into the three formats consumed by GitLab. Garage currently requires fixed ephemeral credentials in test overrides because the maintained chart does not yet support generation or an existing Secret.