\u5728\u516c\u5f0f\u7684GitLab Helm Chart\u4e2d\uff0c\u5b58\u5728\u65e0\u6cd5\u4f7f\u7528\u76f8\u5bf9URL\u7684\u9650\u5236\u3002
\n\u672c\u6b21\u5c06\u5bf9Helm Chart\u7684\u5185\u5bb9\u8fdb\u884c\u90e8\u5206\u4fee\u6539\uff0c\u4ee5\u5b9e\u73b0\u76f8\u5bf9URL\u7684\u529f\u80fd\u3002
\n\u6211\u4eec\u5c06\u5728AWS\u73af\u5883\u4e2d\u8fdb\u884c\u9a8c\u8bc1\u3002<\/p>\n
EKS 1.16
\nHelm 2.14.3
\nHelmfile 0.122.0
\nGitLab Helm Chart 2.3.7
\nkube2iam Helm Chart 2.5.0
\nALB Ingress Controller Helm Chart 0.1.11
\nNGINX Ingress Controller Helm Chart 1.39.0<\/p>\n
EKS 1.16
\nHelm 2.14.3
\nHelmfile 0.122.0
\nGitLab Helm\u56fe2.3.7
\nkube2iam Helm\u56fe2.5.0
\nALB Ingress Controller Helm\u56fe0.1.11
\nNGINX Ingress Controller Helm\u56fe1.39.0<\/p>\n
\u5047\u8bbe\u5df2\u7ecf\u521b\u5efa\u4e86EKS\u3001S3\u3001RDS\u3001ALB Ingress Controller\u548c\u7528\u4e8eS3\u8bbf\u95ee\u7684IAM\u89d2\u8272\u3002\u6709\u5173GitLab\u548cS3\u7684\u534f\u4f5c\uff0c\u8bf7\u53c2\u8003\u6b64\u5904\u3002\u6709\u5173ALB Ingress Controller\u548cNGINX Ingress Controller\u7684\u7ec4\u5408\uff0c\u8bf7\u53c2\u8003\u6b64\u5904\u3002<\/p>\n
\u4f7f\u7528Helmfile\u90e8\u7f72kube2iam\u3001ALB Ingress Controller\u548cNGINX Ingress Controller\u3002
\n\u9009\u62e9\u4f7f\u7528NGINX Ingress Controller\u7684\u539f\u56e0\u662f\u4e3a\u4e86\u8fdb\u884c\u57fa\u4e8erewrite target\u7684\u91cd\u5b9a\u5411\u5904\u7406\u3002<\/p>\n
repositories<\/span>:<\/span>\r\n -<\/span> name<\/span>:<\/span> stable<\/span>\r\n url<\/span>:<\/span> https:\/\/kubernetes-charts.storage.googleapis.com<\/span>\r\n -<\/span> name<\/span>:<\/span> incubator<\/span>\r\n url<\/span>:<\/span> https:\/\/kubernetes-charts-incubator.storage.googleapis.com<\/span>\r\n\r\nreleases<\/span>:<\/span>\r\n -<\/span> name<\/span>:<\/span> kube2iam<\/span>\r\n namespace<\/span>:<\/span> kube-system<\/span>\r\n chart<\/span>:<\/span> stable\/kube2iam<\/span>\r\n version<\/span>:<\/span> 2.5.0<\/span>\r\n values<\/span>:<\/span>\r\n -<\/span> host<\/span>:<\/span>\r\n iptables<\/span>:<\/span> true<\/span>\r\n interface<\/span>:<\/span> eni+<\/span>\r\n extraArgs<\/span>:<\/span>\r\n auto-discover-base-arn<\/span>:<\/span> \"<\/span>\"<\/span>\r\n rbac<\/span>:<\/span>\r\n create<\/span>:<\/span> true<\/span>\r\n -<\/span> name<\/span>:<\/span> aws-alb-ingress-controller<\/span>\r\n namespace<\/span>:<\/span> kube-system<\/span>\r\n chart<\/span>:<\/span> incubator\/aws-alb-ingress-controller<\/span>\r\n version<\/span>:<\/span> 0.1.11<\/span>\r\n values<\/span>:<\/span>\r\n -<\/span> clusterName<\/span>:<\/span> test-cluster<\/span>\r\n autoDiscoverAwsRegion<\/span>:<\/span> true<\/span>\r\n autoDiscoverAwsVpcID<\/span>:<\/span> true<\/span>\r\n podAnnotations<\/span>:<\/span>\r\n iam.amazonaws.com\/role<\/span>:<\/span> aws-alb-ingress-controller<\/span>\r\n -<\/span> name<\/span>:<\/span> nginx-ingress<\/span>\r\n namespace<\/span>:<\/span> kube-system<\/span>\r\n chart<\/span>:<\/span> stable\/nginx-ingress<\/span>\r\n version<\/span>:<\/span> 1.39.0<\/span>\r\n values<\/span>:<\/span>\r\n -<\/span> controller<\/span>:<\/span>\r\n service<\/span>:<\/span>\r\n type<\/span>:<\/span> NodePort<\/span>\r\n<\/code><\/pre>\n$<\/span> helmfile apply -f<\/span> .\/helmfile.yaml\r\n<\/code><\/pre>\n\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u5c06\u521b\u5efa\u4e00\u4e2aIngress\uff0c\u4ee5\u5c06ALB\u8def\u7531\u5230NGINX Ingress Controller\u3002
\n\u786e\u4fdd\u6240\u6709\u8bf7\u6c42\u90fd\u901a\u8fc7\u8be5\u8def\u7531\u3002<\/p>\n
apiVersion<\/span>:<\/span> extensions\/v1beta1<\/span>\r\nkind<\/span>:<\/span> Ingress<\/span>\r\nmetadata<\/span>:<\/span>\r\n annotations<\/span>:<\/span>\r\n alb.ingress.kubernetes.io\/scheme<\/span>:<\/span> internet-facing<\/span>\r\n kubernetes.io\/ingress.class<\/span>:<\/span> alb<\/span>\r\n name<\/span>:<\/span> alb-ingress<\/span>\r\n namespace<\/span>:<\/span> kube-system<\/span>\r\nspec<\/span>:<\/span>\r\n rules<\/span>:<\/span>\r\n -<\/span> http<\/span>:<\/span>\r\n paths<\/span>:<\/span>\r\n -<\/span> backend<\/span>:<\/span>\r\n serviceName<\/span>:<\/span> nginx-ingress-controller<\/span>\r\n servicePort<\/span>:<\/span> 80<\/span>\r\n<\/code><\/pre>\n$<\/span> kubectl apply -f<\/span> .\/alb-ingress.yaml\r\n<\/code><\/pre>\n\u7f16\u8f91GitLab Helm Chart<\/h2>\n
\u56e0\u4e3a\u9700\u8981\u4fee\u6539templates\u6587\u4ef6\u7684\u5185\u5bb9\uff0c\u6240\u4ee5\u8bf7\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u5728\u672c\u5730\u51c6\u5907Helm Chart\u3002<\/p>\n
$<\/span> helm fetch gitlab\/gitlab --version<\/span> 2.3.7\r\n<\/code><\/pre>\n\u6a21\u677f<\/h3>\n
\u9996\u5148\uff0c\u6211\u5011\u9700\u8981\u7de8\u8f2f Ingress\u3002
\n\u7531\u65bc\u9700\u8981\u652f\u6301 assets\uff0c\u5426\u5247\u7121\u6cd5\u8f09\u5165 CSS \u7b49\u8cc7\u6e90\uff0c\u6211\u5011\u5c07\u901a\u904e Ingress \u7684\u91cd\u5beb\u76ee\u6a19\uff0c\u5c07 \/gitlab\/assets \u91cd\u65b0\u5c0e\u5411\u5230 \/assets\u3002<\/p>\n
{{-<\/span> if .Values.enabled -}}\r\n{{-<\/span> if eq (include \"gitlab.ingress.enabled\" $) \"true\" -}}\r\n{{-<\/span> $gitlabHostname := include \"gitlab.gitlab.hostname\" . -}}\r\n{{-<\/span> $tlsSecret := include \"unicorn.tlsSecret\" . -}}\r\napiVersion: extensions\/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n<\/span> name: {{ template \"fullname\" . }}\r\n namespace: {{ $.Release.Namespace }}\r\n labels:\r\n{{<\/span> include \"gitlab.standardLabels\" . | indent 4 }}\r\n annotations:\r\n kubernetes.io\/ingress.class: \"{{ template \"gitlab.ingressclass\" . }}\"\r\n kubernetes.io\/ingress.provider: nginx\r\n nginx.ingress.kubernetes.io\/proxy-body-size: {{ .Values.ingress.proxyBodySize | quote }}\r\n nginx.ingress.kubernetes.io\/proxy-read-timeout: {{ .Values.ingress.proxyReadTimeout | quote }}\r\n nginx.ingress.kubernetes.io\/proxy-connect-timeout: {{ .Values.ingress.proxyConnectTimeout | quote }}\r\n {{ include \"gitlab.certmanager_annotations\" . }}\r\n {{- range $key, $value := merge .Values.ingress.annotations .Values.global.ingress.annotations }}\r\n {{ $key }}: {{ $value | quote }}\r\n {{- end }}\r\nspec:\r\n<\/span> rules:\r\n - host: {{ $gitlabHostname }}\r\n http:\r\n paths:\r\n- - path: \/\r\n<\/span>+ - path: \/gitlab\r\n<\/span> backend:\r\n serviceName: {{ template \"fullname\" . }}\r\n servicePort: {{ .Values.service.workhorseExternalPort }}\r\n- - path: \/admin\/sidekiq\r\n<\/span>+ - path: \/gitlab\/admin\/sidekiq\r\n<\/span> backend:\r\n serviceName: {{ template \"fullname\" . }}\r\n servicePort: {{ .Values.service.externalPort }}\r\n+ - path: \/assets\r\n+ backend:\r\n+ serviceName: {{ template \"fullname\" . }}\r\n+ servicePort: {{ .Values.service.workhorseExternalPort }}\r\n<\/span> {{- if (and $tlsSecret (eq (include \"gitlab.ingress.tls.enabled\" $) \"true\" )) }}\r\n tls:\r\n - hosts:\r\n - {{ $gitlabHostname }}\r\n secretName: {{ $tlsSecret }}\r\n {{- else }}\r\n tls: []\r\n {{- end }}\r\n+ ---\r\n+ apiVersion: extensions\/v1beta1\r\n+ kind: Ingress\r\n+ metadata:\r\n+ name: {{ template \"fullname\" . }}-assets\r\n+ namespace: {{ $.Release.Namespace }}\r\n+ annotations:\r\n+ nginx.ingress.kubernetes.io\/rewrite-target: \/assets\/$1\r\n+ {{ include \"gitlab.certmanager_annotations\" . }}\r\n+ {{- range $key, $value := merge .Values.ingress.annotations .Values.global.ingress.annotations }}\r\n+ {{ $key }}: {{ $value | quote }}\r\n+ {{- end }}\r\n+ spec:\r\n+ rules:\r\n+ - host: {{ $gitlabHostname }}\r\n+ http:\r\n+ paths:\r\n+ - path: \/gitlab\/assets\/(.*)\r\n+ backend:\r\n+ serviceName: {{ template \"fullname\" . }}\r\n+ servicePort: {{ .Values.service.workhorseExternalPort }}\r\n<\/span>{{-<\/span> end -}}\r\n{{-<\/span> end -}}\r\n<\/code><\/pre>\n\u6211\u4f1a\u5728unicorn\u7684ConfigMap\u4e2d\u653e\u7f6e\u4e00\u4e2a\u7528\u4e8e\u5728GitLab\u4e0a\u8bbf\u95ee\u7684\u914d\u7f6e\u8bbe\u7f6e\u3002<\/p>\n
{{-<\/span> if .Values.enabled -}}\r\napiVersion: v1\r\nkind: ConfigMap\r\nmetadata:\r\n<\/span> name: {{ template \"fullname\" . }}\r\n namespace: {{ $.Release.Namespace }}\r\n labels:\r\n{{<\/span> include \"gitlab.standardLabels\" . | indent 4 }}\r\ndata:\r\n<\/span> installation_type: |\r\n gitlab-helm-chart\r\n database.yml.erb: |\r\n production:\r\n adapter: postgresql\r\n encoding: unicode\r\n database: {{ template \"gitlab.psql.database\" . }}\r\n pool: 10\r\n username: {{ template \"gitlab.psql.username\" . }}\r\n password: \"<%= File.read(\"\/etc\/gitlab\/postgres\/psql-password\").strip.dump[1..-2] %>\"\r\n host: {{ template \"gitlab.psql.host\" . }}\r\n port: {{ template \"gitlab.psql.port\" . }}\r\n prepared_statements: {{ template \"gitlab.psql.preparedStatements\" . }}\r\n # load_balancing:\r\n # hosts:\r\n # - host1.example.com\r\n # - host2.example.com\r\n{{-<\/span> include \"gitlab.psql.ssl.config\" . | indent 6 }}\r\n smtp_settings.rb: |\r\n{{<\/span> include \"gitlab.smtp_settings\" . | indent 4 }}\r\n resque.yml.erb: |\r\n production:\r\n # Redis (single instance)\r\n url: {{ template \"gitlab.redis.url\" . }}\r\n id:\r\n unicorn.rb: |\r\n # This file should be equivalent to `unicorn.rb` from:\r\n # * gitlab-foss: https:\/\/gitlab.com\/gitlab-org\/gitlab-foss\/blob\/master\/config\/unicorn.rb.example\r\n # * omnibus: https:\/\/gitlab.com\/gitlab-org\/omnibus-gitlab\/blob\/master\/files\/gitlab-cookbooks\/gitlab\/templates\/default\/unicorn.rb.erb\r\n worker_processes {{ .Values.workerProcesses }}\r\n working_directory \"\/srv\/gitlab\"\r\n listen \"0.0.0.0:{{ .Values.service.internalPort }}\", :tcp_nopush => true\r\n timeout {{ .Values.workerTimeout }}\r\n pid \"\/home\/git\/unicorn.pid\"\r\n preload_app true\r\n\r\n require_relative \"\/srv\/gitlab\/lib\/gitlab\/cluster\/lifecycle_events\"\r\n\r\n before_exec do |server|\r\n # Signal application hooks that we're about to restart\r\n Gitlab::Cluster::LifecycleEvents.do_master_restart\r\n end\r\n\r\n run_once = true\r\n before_fork do |server, worker|\r\n if run_once\r\n # There is a difference between Puma and Unicorn:\r\n # - Puma calls before_fork once when booting up master process\r\n # - Unicorn runs before_fork whenever new work is spawned\r\n # To unify this behavior we call before_fork only once (we use\r\n # this callback for deleting Prometheus files so for our purposes\r\n # it makes sense to align behavior with Puma)\r\n run_once = false\r\n\r\n # Signal application hooks that we're about to fork\r\n Gitlab::Cluster::LifecycleEvents.do_before_fork\r\n end\r\n\r\n # The following is only recommended for memory\/DB-constrained\r\n # installations. It is not needed if your system can house\r\n # twice as many worker_processes as you have configured.\r\n #\r\n # This allows a new master process to incrementally\r\n # phase out the old master process with SIGTTOU to avoid a\r\n # thundering herd (especially in the \"preload_app false\" case)\r\n # when doing a transparent upgrade. The last worker spawned\r\n # will then kill off the old master process with a SIGQUIT.\r\n old_pid = \"#{server.config[:pid]}.oldbin\"\r\n if old_pid != server.pid\r\n begin\r\n sig = (worker.nr + 1) >= server.worker_processes ? :QUIT : :TTOU\r\n Process.kill(sig, File.read(old_pid).to_i)\r\n rescue Errno::ENOENT, Errno::ESRCH\r\n end\r\n end\r\n #\r\n # Throttle the master from forking too quickly by sleeping. Due\r\n # to the implementation of standard Unix signal handlers, this\r\n # helps (but does not completely) prevent identical, repeated signals\r\n # from being lost when the receiving process is busy.\r\n # sleep 1\r\n end\r\n\r\n after_fork do |server, worker|\r\n # Signal application hooks of worker start\r\n Gitlab::Cluster::LifecycleEvents.do_worker_start\r\n\r\n # per-process listener ports for debugging\/admin\/migrations\r\n # addr = \"127.0.0.1:#{9293 + worker.nr}\"\r\n # server.listen(addr, :tries => -1, :delay => 5, :tcp_nopush => true)\r\n end\r\n\r\n ENV['GITLAB_UNICORN_MEMORY_MIN'] = ({{ int .Values.memory.min }} * 1 << 20).to_s\r\n ENV['GITLAB_UNICORN_MEMORY_MAX'] = ({{ int .Values.memory.max }} * 1 << 20).to_s\r\n+ ENV['RAILS_RELATIVE_URL_ROOT'] = \"\/gitlab\"\r\n<\/span>\r\n gitlab.yml.erb: |\r\n production: &base\r\n gitlab:\r\n host: {{ template \"gitlab.gitlab.hostname\" . }}\r\n https: {{ hasPrefix \"https:\/\/\" (include \"gitlab.gitlab.url\" .) }}\r\n+ relative_url_root: \/gitlab\r\n<\/span> {{- with .Values.global.hosts.ssh }}\r\n ssh_host: {{ . | quote }}\r\n {{- end }}\r\n {{- with .Values.global.appConfig }}\r\n impersonation_enabled: {{ .enableImpersonation }}\r\n usage_ping_enabled: {{ eq .enableUsagePing true }}\r\n default_can_create_group: {{ eq .defaultCanCreateGroup true }}\r\n username_changing_enabled: {{ eq .usernameChangingEnabled true }}\r\n issue_closing_pattern: {{ .issueClosingPattern | quote }}\r\n default_theme: {{ .defaultTheme }}\r\n {{- include \"gitlab.appConfig.defaultProjectsFeatures.configuration\" $ | nindent 8 }}\r\n webhook_timeout: {{ .webhookTimeout }}\r\n {{- end }}\r\n trusted_proxies:\r\n {{- if .Values.trusted_proxies }}\r\n{{<\/span> toYaml .Values.trusted_proxies | indent 10 }}\r\n {{- end }}\r\n time_zone: {{ .Values.global.time_zone | quote }}\r\n email_from: {{ template \"gitlab.email.from\" . }}\r\n email_display_name: {{ .Values.global.email.display_name | quote }}\r\n email_reply_to: {{ template \"gitlab.email.reply_to\" . }}\r\n email_subject_suffix: {{ .Values.global.email.subject_suffix | quote }}\r\n {{- with .Values.global.appConfig }}\r\n {{- if eq .incomingEmail.enabled true }}\r\n{{<\/span> include \"gitlab.appConfig.incoming_email\" . | indent 6 }}\r\n {{- end }}\r\n {{- include \"gitlab.appConfig.cronJobs\" . | nindent 6 }}\r\n gravatar:\r\n plain_url: {{ .gravatar.plainUrl }}\r\n ssl_url: {{ .gravatar.sslUrl }}\r\n{{<\/span> include \"gitlab.appConfig.extra\" . | indent 6 }}\r\n {{- end }}\r\n {{- include \"gitlab.appConfig.artifacts.configuration\" (dict \"config\" $.Values.global.appConfig.artifacts \"context\" $) | nindent 6 }}\r\n {{- include \"gitlab.appConfig.lfs.configuration\" (dict \"config\" $.Values.global.appConfig.lfs \"context\" $) | nindent 6 }}\r\n {{- include \"gitlab.appConfig.uploads.configuration\" (dict \"config\" $.Values.global.appConfig.uploads \"context\" $) | nindent 6 }}\r\n {{- include \"gitlab.appConfig.packages.configuration\" (dict \"config\" $.Values.global.appConfig.packages \"context\" $) | nindent 6 }}\r\n {{- include \"gitlab.appConfig.external_diffs.configuration\" (dict \"config\" $.Values.global.appConfig.externalDiffs \"context\" $) | nindent 6 }}\r\n pages:\r\n enabled: false\r\n mattermost:\r\n enabled: false\r\n gitlab_ci:\r\n {{- include \"gitlab.appConfig.ldap.configuration\" $ | nindent 6 }}\r\n {{- include \"gitlab.appConfig.omniauth.configuration\" $ | nindent 6 }}\r\n kerberos:\r\n enabled: false\r\n shared:\r\n{{<\/span> include \"gitlab.appConfig.gitaly\" . | indent 6 }}\r\n{{<\/span> include \"gitlab.appConfig.repositories\" . | indent 6 }}\r\n backup:\r\n path: \"tmp\/backups\" # Relative paths are relative to Rails.root (default: tmp\/backups\/)\r\n{{<\/span> include \"gitlab.appConfig.shell\" . | indent 6 }}\r\n{{<\/span> include \"gitlab.appConfig.shell.ssh_port\" . | indent 8 }}\r\n{{<\/span> include \"gitlab.appConfig.shell.secret_file\" . | indent 8 }}\r\n workhorse:\r\n secret_file: \/etc\/gitlab\/gitlab-workhorse\/secret\r\n git:\r\n bin_path: \/usr\/bin\/git\r\n webpack:\r\n monitoring:\r\n ip_whitelist:\r\n {{- if kindIs \"array\" .Values.monitoring.ipWhitelist }}\r\n {{ toYaml .Values.monitoring.ipWhitelist | nindent 10 | trim }}\r\n {{- end }}\r\n sidekiq_exporter:\r\n{{<\/span> include \"gitlab.appConfig.rackAttack\" . | indent 6 }}\r\n ## Registry Integration\r\n {{- include \"gitlab.appConfig.registry.configuration\" $ | nindent 6 }}\r\n configure: |\r\n {{- include \"gitlab.scripts.configure.secrets\" (dict) | nindent 4 -}}\r\n {{- include \"gitlab.psql.ssl.initScript\" . | nindent 4 }}\r\n+ relative_url.rb: |\r\n+ Rails.application.configure do\r\n+ config.relative_url_root = \"\/gitlab\"\r\n+ end\r\n<\/span>---\r\napiVersion: v1\r\nkind: ConfigMap\r\nmetadata:\r\n<\/span> name: {{.Release.Name }}-workhorse-config\r\n namespace: {{ $.Release.Namespace }}\r\n labels:\r\n{{<\/span> include \"gitlab.standardLabels\" . | indent 4 }}\r\ndata:\r\n<\/span> installation_type: |\r\n gitlab-helm-chart\r\n workhorse-config.toml.erb: |\r\n [redis]\r\n URL = \"{{ template \"gitlab.redis.scheme\" . }}:\/\/{{ template \"gitlab.redis.host\" . }}:{{ template \"gitlab.redis.port\" . }}\"\r\n {{- if .Values.global.redis.password.enabled }}\r\n Password = \"<%= File.read(\"\/etc\/gitlab\/redis\/password\").strip.dump[1..-2] %>\"\r\n {{- end }}\r\n configure: |\r\n set -e\r\n mkdir -p \/init-secrets-workhorse\/gitlab-workhorse\r\n cp -v -r -L \/init-config\/gitlab-workhorse\/secret \/init-secrets-workhorse\/gitlab-workhorse\/secret\r\n {{- if .Values.global.redis.password.enabled }}\r\n mkdir -p \/init-secrets-workhorse\/redis\r\n cp -v -r -L \/init-config\/redis\/password \/init-secrets-workhorse\/redis\/\r\n {{- end }}\r\n#<\/span> Leave this here - This line denotes end of block to the parser.\r\n{{-<\/span> end }}\r\n<\/code><\/pre>\n\u4e3a\u4e86\u5c06\u65b0\u6587\u4ef6\u6dfb\u52a0\u5230Unicorn Deployment\u4e2d\u8fdb\u884c\u6302\u8f7d\uff0c\u9700\u8981\u8fdb\u884c\u76f8\u5e94\u7684\u914d\u7f6e\u3002
\n\u540c\u65f6\uff0c\u901a\u8fc7\u4f7f\u7528\u76f8\u5bf9\u8def\u5f84\uff0c\u53ef\u4ee5\u5220\u9664\u76f8\u5173\u90e8\u5206\uff0c\u4ee5\u907f\u514dliveness\u548creadiness\u5931\u8d25\u3002
\n\u6dfb\u52a0\/tmp\u662f\u4e3a\u4e86\u5728GitLab CI\u6267\u884c\u65f6\uff0c\u786e\u4fddS3\u4e0a\u4f20artifacts\u4e0d\u4f1a\u5931\u8d25\u3002<\/p>\n
{{-<\/span> if .Values.enabled }}\r\napiVersion: apps\/v1\r\nkind: Deployment\r\nmetadata:\r\n<\/span> name: {{ template \"fullname\" . }}\r\n namespace: {{ $.Release.Namespace }}\r\n labels:\r\n{{<\/span> include \"gitlab.standardLabels\" . | indent 4 }}\r\nspec:\r\n<\/span> {{- if .Values.global.operator.enabled }}\r\n paused: true\r\n {{- end }}\r\n replicas: {{ .Values.replicaCount }}\r\n selector:\r\n matchLabels:\r\n app: {{ template \"name\" . }}\r\n release: {{ .Release.Name }}\r\n template:\r\n metadata:\r\n labels:\r\n app: {{ template \"name\" . }}\r\n release: {{ .Release.Name }}\r\n annotations:\r\n checksum\/config: {{ include (print $.Template.BasePath \"\/configmap.yml\") . | sha256sum }}\r\n cluster-autoscaler.kubernetes.io\/safe-to-evict: \"true\"\r\n {{- range $key, $value := .Values.annotations }}\r\n {{ $key }}: {{ $value | quote }}\r\n {{- end }}\r\n{{-<\/span> if .Values.metrics.enabled }}\r\n{{<\/span> toYaml .Values.metrics.annotations | indent 8 }}\r\n{{-<\/span> end }}\r\n spec:\r\n {{- if .Values.tolerations }}\r\n tolerations:\r\n{{<\/span> toYaml .Values.tolerations | indent 8 }}\r\n {{- end }}\r\n securityContext:\r\n runAsUser: 1000\r\n fsGroup: 1000\r\n {{- if eq (default .Values.global.antiAffinity .Values.antiAffinity) \"hard\" }}\r\n affinity:\r\n podAntiAffinity:\r\n requiredDuringSchedulingIgnoredDuringExecution:\r\n - topologyKey: \"kubernetes.io\/hostname\"\r\n labelSelector:\r\n matchLabels:\r\n app: {{ template \"name\" . }}\r\n release: {{ .Release.Name }}\r\n {{- else if eq (default .Values.global.antiAffinity .Values.antiAffinity) \"soft\" }}\r\n affinity:\r\n podAntiAffinity:\r\n preferredDuringSchedulingIgnoredDuringExecution:\r\n - weight: 1\r\n podAffinityTerm:\r\n topologyKey: kubernetes.io\/hostname\r\n labelSelector:\r\n matchLabels:\r\n app: {{ template \"name\" . }}\r\n release: {{ .Release.Name }}\r\n {{- end }}\r\n initContainers:\r\n{{<\/span> include \"gitlab.extraInitContainers\" . | indent 8 }}\r\n{{<\/span> include \"gitlab.certificates.initContainer\" . | indent 8 }}\r\n - name: configure\r\n command: ['sh']\r\n args: [ '-c', 'sh -x \/config-unicorn\/configure ; sh -x \/config-workhorse\/configure']\r\n image: {{ .Values.init.image }}:{{ .Values.init.tag }}\r\n volumeMounts:\r\n{{<\/span> include \"gitlab.extraVolumeMounts\" . | indent 10 }}\r\n{{<\/span> include \"gitlab.psql.ssl.volumeMount\" . | indent 10 }}\r\n - name: unicorn-config\r\n mountPath: \/config-unicorn\r\n readOnly: true\r\n - name: workhorse-config\r\n mountPath: \/config-workhorse\r\n readOnly: true\r\n - name: init-unicorn-secrets\r\n mountPath: \/init-config\r\n readOnly: true\r\n - name: unicorn-secrets\r\n mountPath: \/init-secrets\r\n readOnly: false\r\n - name: workhorse-secrets\r\n mountPath: \/init-secrets-workhorse\r\n readOnly: false\r\n resources:\r\n{{<\/span> toYaml .Values.init.resources | indent 12 }}\r\n - name: dependencies\r\n image: \"{{ coalesce .Values.image.repository (include \"image.repository\" .) }}:{{ coalesce .Values.image.tag (include \"gitlab.versionTag\" . ) }}\"\r\n {{ template \"gitlab.imagePullPolicy\" . }}\r\n args:\r\n - \/scripts\/wait-for-deps\r\n env:\r\n{{-<\/span> if .Values.global.operator.enabled }}\r\n - name: BYPASS_SCHEMA_VERSION\r\n value: 'true'\r\n{{-<\/span> end }}\r\n - name: GITALY_FEATURE_DEFAULT_ON\r\n value: \"1\"\r\n - name: CONFIG_TEMPLATE_DIRECTORY\r\n value: '\/var\/opt\/gitlab\/templates'\r\n - name: CONFIG_DIRECTORY\r\n value: '\/srv\/gitlab\/config'\r\n - name: WORKHORSE_ARCHIVE_CACHE_DISABLED\r\n value: \"1\"\r\n volumeMounts:\r\n{{<\/span> include \"gitlab.extraVolumeMounts\" . | indent 12 }}\r\n - name: unicorn-config\r\n mountPath: '\/var\/opt\/gitlab\/templates'\r\n - name: unicorn-secrets\r\n mountPath: '\/etc\/gitlab'\r\n readOnly: true\r\n resources:\r\n{{<\/span> toYaml .Values.init.resources | indent 12 }}\r\n{{-<\/span> include \"pullsecrets\" .Values.image | indent 6}}\r\n containers:\r\n{{<\/span> include \"gitlab.extraContainers\" . | indent 8 }}\r\n - name: {{ .Chart.Name }}\r\n image: \"{{ coalesce .Values.image.repository (include \"image.repository\" .) }}:{{ coalesce .Values.image.tag (include \"gitlab.versionTag\" . ) }}\"\r\n {{ template \"gitlab.imagePullPolicy\" . }}\r\n ports:\r\n - containerPort: {{ .Values.service.internalPort }}\r\n name: unicorn\r\n env:\r\n - name: GITALY_FEATURE_DEFAULT_ON\r\n value: \"1\"\r\n - name: CONFIG_TEMPLATE_DIRECTORY\r\n value: '\/var\/opt\/gitlab\/templates'\r\n - name: CONFIG_DIRECTORY\r\n value: '\/srv\/gitlab\/config'\r\n{{-<\/span> if .Values.metrics.enabled }}\r\n - name: prometheus_multiproc_dir\r\n value: \/metrics\r\n{{-<\/span> end }}\r\n{{-<\/span> if .Values.workhorse.sentryDSN }}\r\n - name: GITLAB_WORKHORSE_SENTRY_DSN\r\n value: {{ .Values.workhorse.sentryDSN }}\r\n{{-<\/span> end }}\r\n volumeMounts:\r\n{{-<\/span> if .Values.metrics.enabled }}\r\n - name: unicorn-metrics\r\n mountPath: '\/metrics'\r\n{{-<\/span> end }}\r\n - name: unicorn-config\r\n mountPath: '\/var\/opt\/gitlab\/templates'\r\n - name: unicorn-secrets\r\n mountPath: '\/etc\/gitlab'\r\n readOnly: true\r\n - name: unicorn-secrets\r\n mountPath: \/srv\/gitlab\/config\/secrets.yml\r\n subPath: rails-secrets\/secrets.yml\r\n - name: unicorn-config\r\n mountPath: '\/srv\/gitlab\/config\/initializers\/smtp_settings.rb'\r\n subPath: smtp_settings.rb\r\n+ - name: unicorn-config\r\n+ mountPath: '\/srv\/gitlab\/config\/initializers\/relative_url.rb'\r\n+ subPath: relative_url.rb\r\n<\/span> - name: unicorn-config\r\n mountPath: '\/srv\/gitlab\/INSTALLATION_TYPE'\r\n subPath: installation_type\r\n - name: shared-upload-directory\r\n mountPath: \/srv\/gitlab\/public\/uploads\/tmp\r\n readOnly: false\r\n - name: shared-artifact-directory\r\n mountPath: \/srv\/gitlab\/shared\r\n readOnly: false\r\n+ - name: shared-tmp\r\n+ mountPath: '\/tmp'\r\n+ readOnly: false\r\n<\/span>{{<\/span> include \"gitlab.certificates.volumeMount\" . | indent 12 }}\r\n{{<\/span> include \"gitlab.extraVolumeMounts\" . | indent 12 }}\r\n- livenessProbe:\r\n- exec:\r\n- command:\r\n- - \/scripts\/healthcheck\r\n- initialDelaySeconds: 20\r\n- timeoutSeconds: 30\r\n- periodSeconds: 60\r\n- readinessProbe:\r\n- exec:\r\n- command:\r\n- - \/scripts\/healthcheck\r\n- timeoutSeconds: 2\r\n<\/span> lifecycle:\r\n preStop:\r\n exec:\r\n command: [\"\/bin\/bash\", \"-c\", \"pkill -SIGQUIT -f 'unicorn master'\"]\r\n resources:\r\n{{<\/span> toYaml .Values.resources | indent 12 }}\r\n - name: gitlab-workhorse\r\n image: \"{{ coalesce .Values.workhorse.image (include \"workhorse.repository\" .) }}:{{ coalesce .Values.workhorse.tag (include \"gitlab.versionTag\" . ) }}\"\r\n {{ template \"gitlab.imagePullPolicy\" . }}\r\n ports:\r\n - containerPort: {{ .Values.service.workhorseInternalPort }}\r\n name: workhorse\r\n env:\r\n - name: GITLAB_WORKHORSE_EXTRA_ARGS\r\n value: {{ .Values.workhorse.extraArgs | quote }}\r\n - name: GITLAB_WORKHORSE_LISTEN_PORT\r\n value: {{ default 8181 .Values.service.workhorseInternalPort | int | quote }}\r\n - name: CONFIG_TEMPLATE_DIRECTORY\r\n value: '\/var\/opt\/gitlab\/templates'\r\n - name: CONFIG_DIRECTORY\r\n value: '\/srv\/gitlab\/config'\r\n volumeMounts:\r\n - name: workhorse-config\r\n mountPath: '\/var\/opt\/gitlab\/templates'\r\n - name: workhorse-secrets\r\n mountPath: '\/etc\/gitlab'\r\n readOnly: true\r\n - name: shared-upload-directory\r\n mountPath: \/srv\/gitlab\/public\/uploads\/tmp\r\n readOnly: false\r\n - name: shared-artifact-directory\r\n mountPath: \/srv\/gitlab\/shared\r\n readOnly: false\r\n+ - name: shared-tmp\r\n+ mountPath: '\/tmp'\r\n+ readOnly: false\r\n<\/span>{{<\/span> include \"gitlab.certificates.volumeMount\" . | indent 12 }}\r\n{{<\/span> include \"gitlab.extraVolumeMounts\" . | indent 12 }}\r\n- livenessProbe:\r\n- exec:\r\n- command:\r\n- - \/scripts\/healthcheck\r\n- initialDelaySeconds: 20\r\n- timeoutSeconds: 30\r\n- periodSeconds: 60\r\n- readinessProbe:\r\n- exec:\r\n- command:\r\n- - \/scripts\/healthcheck\r\n- timeoutSeconds: 2\r\n<\/span> resources:\r\n{{<\/span> toYaml .Values.workhorse.resources | indent 12 }}\r\n volumes:\r\n{{<\/span> include \"gitlab.extraVolumes\" . | indent 6 }}\r\n{{<\/span> include \"gitlab.psql.ssl.volume\" . | indent 6 }}\r\n{{-<\/span> if .Values.metrics.enabled }}\r\n - name: unicorn-metrics\r\n emptyDir:\r\n medium: \"Memory\"\r\n{{-<\/span> end }}\r\n - name: unicorn-config\r\n configMap:\r\n name: {{ template \"fullname\" . }}\r\n - name: workhorse-config\r\n configMap:\r\n name: {{ .Release.Name }}-workhorse-config\r\n - name: init-unicorn-secrets\r\n projected:\r\n defaultMode: 0400\r\n sources:\r\n - secret:\r\n name: {{ template \"gitlab.rails-secrets.secret\" . }}\r\n items:\r\n - key: secrets.yml\r\n path: rails-secrets\/secrets.yml\r\n - secret:\r\n name: {{ template \"gitlab.gitlab-shell.authToken.secret\" . }}\r\n items:\r\n - key: {{ template \"gitlab.gitlab-shell.authToken.key\" . }}\r\n path: shell\/.gitlab_shell_secret\r\n - secret:\r\n name: {{ template \"gitlab.gitaly.authToken.secret\" . }}\r\n items:\r\n - key: {{ template \"gitlab.gitaly.authToken.key\" . }}\r\n path: gitaly\/gitaly_token\r\n {{- if .Values.global.redis.password.enabled }}\r\n - secret:\r\n name: {{ template \"gitlab.redis.password.secret\" . }}\r\n items:\r\n - key: {{ template \"gitlab.redis.password.key\" . }}\r\n path: redis\/password\r\n {{- end }}\r\n - secret:\r\n name: {{ template \"gitlab.psql.password.secret\" . }}\r\n items:\r\n - key: {{ template \"gitlab.psql.password.key\" . }}\r\n path: postgres\/psql-password\r\n - secret:\r\n name: {{ template \"gitlab.registry.certificate.secret\" . }}\r\n items:\r\n - key: registry-auth.key\r\n path: registry\/gitlab-registry.key\r\n - secret:\r\n name: {{ template \"gitlab.workhorse.secret\" . }}\r\n items:\r\n - key: {{ template \"gitlab.workhorse.key\" . }}\r\n path: gitlab-workhorse\/secret\r\n {{- include \"gitlab.minio.mountSecrets\" $ | nindent 10 }}\r\n {{- include \"gitlab.appConfig.objectStorage.mountSecrets\" (dict \"name\" \"artifacts\" \"config\" $.Values.global.appConfig.artifacts) | nindent 10 }}\r\n {{- include \"gitlab.appConfig.objectStorage.mountSecrets\" (dict \"name\" \"lfs\" \"config\" $.Values.global.appConfig.lfs) | nindent 10 }}\r\n {{- include \"gitlab.appConfig.objectStorage.mountSecrets\" (dict \"name\" \"uploads\" \"config\" $.Values.global.appConfig.uploads) | nindent 10 }}\r\n {{- include \"gitlab.appConfig.objectStorage.mountSecrets\" (dict \"name\" \"packages\" \"config\" $.Values.global.appConfig.packages) | nindent 10 }}\r\n {{- include \"gitlab.appConfig.objectStorage.mountSecrets\" (dict \"name\" \"external_diffs\" \"config\" $.Values.global.appConfig.externalDiffs) | nindent 10 }}\r\n {{- include \"gitlab.appConfig.ldap.servers.mountSecrets\" $ | nindent 10 }}\r\n {{- include \"gitlab.appConfig.omniauth.mountSecrets\" $ | nindent 10 }}\r\n {{- if and $.Values.global.smtp.enabled $.Values.global.smtp.authentication }}\r\n - secret:\r\n name: {{ .Values.global.smtp.password.secret | required \"Missing required secret containing the SMTP password. Make sure to set `global.smtp.password.secret`\" }}\r\n items:\r\n - key: {{ .Values.global.smtp.password.key }}\r\n path: smtp\/smtp-password\r\n {{- end }}\r\n - name: unicorn-secrets\r\n emptyDir:\r\n medium: \"Memory\"\r\n - name: workhorse-secrets\r\n emptyDir:\r\n medium: \"Memory\"\r\n - name: shared-upload-directory\r\n emptyDir: {}\r\n - name: shared-artifact-directory\r\n emptyDir: {}\r\n+ - name: shared-tmp\r\n+ emptyDir: {}\r\n<\/span>{{<\/span> include \"gitlab.certificates.volumes\" . | indent 6 }}\r\n {{- if .Values.nodeSelector }}\r\n nodeSelector:\r\n{{<\/span> toYaml .Values.nodeSelector | indent 8 }}\r\n {{- end }}\r\n{{-<\/span> end }}\r\n<\/code><\/pre>\n\u5c06\u76f8\u540c\u7684\u76f8\u5bf9\u8def\u5f84\u914d\u7f6e\u653e\u5165sidekiq\u7684ConfigMap\u4e2d\u3002<\/p>\n
{{-<\/span> if .Values.enabled -}}\r\napiVersion: v1\r\nkind: ConfigMap\r\nmetadata:\r\n<\/span> name: {{ template \"fullname\" . }}\r\n namespace: {{ $.Release.Namespace }}\r\n labels:\r\n