Operational settings for production environments¶

The package defaults are sized for development, demos, and CI. The Big Bang-tested production topology must be sized for its workload and use independently managed PostgreSQL, Redis or Valkey, and object storage. The package does not deploy these services. Also review the upstream installation requirements.

Existing users of the old bundled services must complete the GitLab 19 migration before upgrading.

External services¶

PostgreSQL¶

GitLab 19/chart 10 supports PostgreSQL 17.x only. Configure the main database and a Secret containing the application user’s password:

global:
  psql:
    host: postgresql.example.svc.cluster.local
    port: 5432
    username: gitlab
    database: gitlabhq_production
    password:
      secret: gitlab-database
      key: password

The database must include the GitLab-required extensions documented in the PostgreSQL requirements.

Redis or Valkey¶

Use a supported standalone Redis or Valkey deployment. Redis Cluster and serverless offerings are not supported.

global:
  redis:
    host: redis.example.svc.cluster.local
    port: 6379
    auth:
      enabled: true
      secret: gitlab-redis
      key: password

Object storage¶

Use consolidated object storage for Rails features, plus the separate formats required by Registry and Toolbox backup/restore:

global:
  appConfig:
    object_store:
      enabled: true
      proxy_download: true
      connection:
        secret: gitlab-object-storage
        key: rails

upstream:
  registry:
    storage:
      secret: gitlab-registry-storage
      key: config
      redirect:
        disable: true
  gitlab:
    toolbox:
      backups:
        objectStorage:
          backend: s3
          config:
            secret: gitlab-object-storage-s3cmd
            key: config

Each enabled GitLab object type needs a distinct bucket. Registry S3-compatible configuration must use a full endpoint URI and Signature V4 with GitLab 19.

Flux settings¶

Large installations should increase addons.gitlab.flux.timeout to roughly 30-45 minutes and tune install/upgrade retries for the environment. External service operators and workloads must be Ready before GitLab reconciles.

Resource sizing¶

Increase webservice, Sidekiq, Gitaly, Registry, database, and object-storage resources based on measured load. The examples in k8s-resources.md show the relevant value paths, but are not production recommendations.

Protect the Rails Secret¶

If the Rails Secret changes, GitLab can no longer decrypt protected database fields and logs can contain OpenSSL::Cipher::CipherError. Store the Secret in a protected external system and configure a stable name:

global:
  railsSecrets:
    secret: my-gitlab-rails-secret

Back it up separately from the cluster and include restoration of this Secret in disaster-recovery tests.