GitLab components

Status: Implemented Issue: none Parent: none

Goal

An administrator chooses which components a GitLab instance runs, in one place of the resource or in the Bridge UI, without knowing which chart value gates each one. For the design, see ADR 40.

Child specs:

• Container registry add-on: the settings of the registry.
• Toolbox add-on: the settings of the Toolbox and its backups.
• Components in the form: the switches and add-ons of the Bridge form.

Requirements

• spec.components holds one entry for each of Webservice, Sidekiq, Gitaly, GitLab Shell, KAS, GitLab Exporter, Mailroom, GitLab Pages, the container registry, the Toolbox, and OpenBao. Each entry takes a required enabled switch.
• A component that spec.components leaves out keeps its default: on for the first seven, and off for GitLab Pages, the registry, the Toolbox, and OpenBao.
• A component switched off renders none of its workloads. One switched on renders them.
• The registry, the Toolbox, and OpenBao carry settings beside enabled. While enabled is true, the API server rejects an entry without them. An entry switched off keeps its settings, and the Operator derives nothing from them.
• spec.chart.values win over spec.components on the same chart value.
• The Bridge form shows the first eight components in a Core Components section, and the registry, the Toolbox, and OpenBao as add-ons.

Out of scope

• Components other than the eleven above, such as Praefect, Spamcheck, or the Geo log cursor. They stay reachable through spec.chart.values.
• Replicas, resources, or any other setting of a core component.
• Migrating a resource that sets the earlier spec.openbao. No instance carries one.

FAQ

• Why a typed field rather than switches over spec.chart.values? Every other structured setting is a field, and a field gives kubectl users the same switches as the form. The chart keys differ per component (gitlab.webservice.enabled, global.kas.enabled), which a field hides.
• Why are the add-ons under spec.components too? The requester asked for one structure. The registry, the Toolbox, and OpenBao are charts gated by a switch like the others, and only carry more settings.
• Why do the free-form values still win? ADR 26 keeps them a working escape hatch.
• Why does switching an add-on off keep its settings? So switching it back on restores them. The resource still holds only Secret references.
• Does switching Mailroom on start it? Only with incoming email configured in spec.chart.values. The chart renders Mailroom for incoming email only.
• What does turning off Gitaly need? An external Gitaly, configured in spec.chart.values. Without it, GitLab has no repository storage.