GitLab¶
Big Bang packages the upstream GitLab Helm chart
with Verified Publisher and Iron Bank images, hardened defaults, DoD trust-chain
integration, bb-common network and Istio resources, OpenShift support, and
package tests. The upstream chart and GitLab documentation own general GitLab
operation and the complete configuration surface.
Configuration¶
In Big Bang, enable and configure GitLab under addons.gitlab. Package values
are passed to the upstream chart under addons.gitlab.values; use the
upstream chart values for GitLab chart 10.4.1
for the supported upstream settings. Big Bang-specific defaults and overrides
are defined in this package’s chart/values.yaml.
GitLab requires independently managed PostgreSQL 17, Redis or Valkey, and object storage. The package does not deploy or operate those services. Supply connection and credential references through the upstream values and Secrets; plan service lifecycle, capacity, backup, restore, and disaster recovery with the service owners. See operational production settings and the upstream guides for external PostgreSQL, external Redis, and external object storage.
Git repository storage, including Gitaly and optional Praefect configuration, remains upstream-managed configuration. Size and operate it according to the GitLab reference architectures and Gitaly documentation.
Big Bang integration¶
The umbrella release deploys GitLab in the gitlab namespace and supplies the
GitLab and Registry hostnames, package source and reconciliation settings,
credentials, SSO values, and external-service dependency ordering. When
configured, the wrapper creates Istio routes for GitLab and can expose Registry,
KAS, and Pages according to the corresponding upstream settings.
The wrapper integrates bb-common NetworkPolicies and Istio resources. It
configures monitoring resources when monitoring is enabled and adjusts
ServiceMonitor TLS settings for sidecar mode. Validate network reachability for
GitLab components and every external service in the target environment.
OIDC SSO is enabled through addons.gitlab.sso; the umbrella renders the
provider Secret and can include the configured SSO certificate authority in
GitLab’s trusted CAs. Treat group mappings, automatically created users, and
administrator mappings as security-sensitive. See Keycloak SSO integration
and GitLab’s OpenID Connect documentation.
GitLab Runner is a separate Big Bang package and repository. Its enablement, configuration, credentials, and documentation are not part of this GitLab package guide, even when an umbrella deployment enables both packages.
Operations and upgrades¶
The defaults target development, demonstration, and CI use. Production operators must size GitLab workloads and their external services from measured load, verify backups and restores, and preserve the Rails Secret because it protects encrypted database fields. See operational production settings for Big Bang-specific boundaries and the upstream GitLab installation requirements.
GitLab 19/chart 10 removed bundled PostgreSQL, Redis, and MinIO. Deployments
using any former bundled service must migrate while on the supported GitLab 18
release before moving to chart 10. Follow the package GitLab 19 upgrade guide
and the upstream bundled chart migration guide.
Do not use Helm --reuse-values for that transition.