chore(deps): update gitlab and gitlab runner by renovate[bot] · Pull Request #4958 · rxbn/k8s-gitops

renovate · 2026-08-12T12:40:05Z

This PR contains the following updates:

Package	Update	Change
gitlab (source)	minor	`10.2.1` → `10.3.0`
gitlab-runner	minor	`0.91.0` → `0.92.0`

Release Notes

gitlab-org/charts/gitlab (gitlab)

`v10.3.0`

Compare Source

Added (4 changes)

Fixed (2 changes)

Changed (12 changes)

`v10.2.4`

Compare Source

No changes.

`v10.2.2`

Compare Source

Fixed (2 changes)

gitlab-org/charts/gitlab-runner (gitlab-runner)

`v0.92.0`

Compare Source

New features

Update GitLab Runner version to v19.3.0
feat: add support for initContainers in deployment. !537 (David Steinkopff @zeitiger)

`v0.91.2`

Compare Source

New features

Update GitLab Runner version to v19.2.2

Configuration

📅 Schedule: (in timezone Europe/Zurich)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-08-12T12:40:32Z

Path: apps/gitlab/gitlab/gitlab/helmrelease.yaml
Version: 10.2.1 -> 10.3.0

@@ -374,7 +374,7 @@
 database.yml.erb: "\nproduction:\n main:\n adapter: postgresql\n encoding: unicode\n database: gitlabhq_production\n username: gitlab\n password: <%= File.read('/etc/gitlab/postgres/psql-password-main').strip.to_json %>\n host: \"gitlab-postgres-rw.gitlab.svc.cluster.local\"\n port: 5432\n connect_timeout: \n keepalives: \n keepalives_idle: \n keepalives_interval: \n keepalives_count: \n tcp_user_timeout: \n application_name: \n prepared_statements: false\n database_tasks: true\n \n \n ci:\n adapter: postgresql\n encoding: unicode\n database: gitlabhq_production\n username: gitlab\n password: <%= File.read('/etc/gitlab/postgres/psql-password-ci').strip.to_json %>\n host: \"gitlab-postgres-rw.gitlab.svc.cluster.local\"\n port: 5432\n connect_timeout: \n keepalives: \n keepalives_idle: \n keepalives_interval: \n keepalives_count: \n tcp_user_timeout: \n application_name: \n prepared_statements: false\n database_tasks: false\n \n \n"
 resque.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n"
 cable.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n adapter: redis\n"
- gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n dependency_proxy:\n enabled: true\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n gravatar:\n plain_url: \n ssl_url: \n \n"
+ gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n ci_catalog_bundles:\n enabled: false\n dependency_proxy:\n enabled: true\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n gravatar:\n plain_url: \n ssl_url: \n \n"
 configure: |
 # BEGIN gitlab.scripts.configure.secrets
 set -e
@@ -386,7 +386,7 @@
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
 done
 # optional
- for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
+ for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer amazon_ses_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
 if [ -e "${config_dir}/${secret}" ]; then
 mkdir -p "${secret_dir}/${secret}"
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
@@ -416,7 +416,7 @@
 smtp_settings.rb: "smtp_settings = {\n address: \"smtp.mailgun.org\",\n port: 587,\n ca_file: \"/etc/ssl/certs/ca-certificates.crt\",\n \n authentication: :login,\n user_name: \"mail@${BASE_DOMAIN}\",\n password: File.read(\"/etc/gitlab/smtp/smtp-password\").strip,\n enable_starttls_auto: true,\n openssl_verify_mode: \"peer\",\n open_timeout: 30,\n read_timeout: 60\n}\n\nRails.application.config.action_mailer.delivery_method = :smtp\nActionMailer::Base.delivery_method = :smtp\n\nActionMailer::Base.smtp_settings = smtp_settings\n"
 resque.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n"
 cable.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n adapter: redis\n"
- gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n action_cable_allowed_origins: []\n max_request_duration_seconds: 57\n impersonation_enabled: \n application_settings_cache_seconds: 60\n usage_ping_enabled: true\n seat_link_enabled: true\n username_changing_enabled: true\n issue_closing_pattern: \n default_theme: \n default_projects_features:\n issues: true\n merge_requests: true\n wiki: true\n snippets: true\n builds: true\n container_registry: true\n graphql_timeout: \n webhook_timeout: \n trusted_proxies:\n time_zone: \"Europe/Zurich\" \n email_from: \"git@${BASE_DOMAIN}\"\n email_display_name: \"GitLab@${BASE_DOMAIN}\"\n email_reply_to: \"git@${BASE_DOMAIN}\"\n email_subject_suffix: \"\"\n \n gravatar:\n plain_url: \n ssl_url: \n extra:\n \n \n \n \n \n \n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n dependency_proxy:\n enabled: true\n \n sentry:\n enabled: false\n dsn: \n clientside_dsn: \n environment: \n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n pages:\n enabled: false\n access_control: false\n artifacts_server: true\n path: /srv/gitlab/shared/pages\n host: pages.${BASE_DOMAIN}\n port: 443\n https: true\n secret_file: /etc/gitlab/pages/secret\n external_http: false\n external_https: false\n local_store:\n enabled: false\n path: \n namespace_in_path: false\n \n mattermost:\n enabled: false\n ## Registry Integration\n registry:\n enabled: true\n host: registry.${BASE_DOMAIN}\n api_url: http://gitlab-registry.default.svc:5000\n key: /etc/gitlab/registry/gitlab-registry.key\n issuer: gitlab-issuer\n notification_secret: <%= YAML.load_file(\"/etc/gitlab/registry/notificationSecret\").flatten.first %>\n gitlab_ci:\n ldap:\n enabled: false\n \n omniauth:\n enabled: true\n auto_sign_in_with_provider: \"openid_connect\"\n sync_profile_from_provider: [\"openid_connect\"]\n sync_profile_attributes: [\"email\"]\n allow_single_sign_on: [\"openid_connect\"]\n block_auto_created_users: false\n auto_link_ldap_user: false\n auto_link_saml_user: false\n auto_link_user: true\n external_providers: []\n providers:\n - <%= YAML.load_file(\"/etc/gitlab/omniauth/gitlab-oidc-sso/provider\").to_json() %>\n kerberos:\n enabled: false\n keytab: /etc/krb5.keytab\n use_dedicated_port: false\n port: 8443\n https: true\n simple_ldap_linking_allowed_realms: []\n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n shared:\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n backup:\n path: \"tmp/backups\" # Relative paths are relative to Rails.root (default: tmp/backups/)\n \n \n \n \n \n iam_auth_service:\n enabled: false\n secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret\n http:\n host: \"\"\n port: 0\n grpc:\n host: \"\"\n port: 0\n jwt_audience: \"gitlab-rails\"\n jwt_issuer: \"\"\n iam_data_access_service:\n enabled: false\n secret_file: /etc/gitlab/iam-data-access/.gitlab_iam_data_access_secret\n grpc:\n host: \"\"\n port: 0\n gitlab_shell:\n path: /home/git/gitlab-shell/\n hooks_path: /home/git/gitlab-shell/hooks/\n upload_pack: true\n receive_pack: true\n ssh_port: 22\n workhorse:\n git:\n bin_path: /usr/bin/git\n webpack:\n monitoring:\n ip_whitelist:\n - \"127.0.0.0/8\"\n - \"::1/128\"\n sidekiq_exporter:\n enabled: true\n address: \n port: 3807\n log_enabled: false\n sidekiq_health_checks:\n enabled: true\n address: \n port: 3808\n \n"
+ gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n action_cable_allowed_origins: []\n max_request_duration_seconds: 57\n impersonation_enabled: \n application_settings_cache_seconds: 60\n usage_ping_enabled: true\n seat_link_enabled: true\n username_changing_enabled: true\n issue_closing_pattern: \n default_theme: \n default_projects_features:\n issues: true\n merge_requests: true\n wiki: true\n snippets: true\n builds: true\n container_registry: true\n graphql_timeout: \n webhook_timeout: \n trusted_proxies:\n time_zone: \"Europe/Zurich\" \n email_from: \"git@${BASE_DOMAIN}\"\n email_display_name: \"GitLab@${BASE_DOMAIN}\"\n email_reply_to: \"git@${BASE_DOMAIN}\"\n email_subject_suffix: \"\"\n \n gravatar:\n plain_url: \n ssl_url: \n extra:\n \n \n \n \n \n \n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n ci_catalog_bundles:\n enabled: false\n dependency_proxy:\n enabled: true\n \n sentry:\n enabled: false\n dsn: \n clientside_dsn: \n environment: \n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n pages:\n enabled: false\n access_control: false\n artifacts_server: true\n path: /srv/gitlab/shared/pages\n host: pages.${BASE_DOMAIN}\n port: 443\n https: true\n secret_file: /etc/gitlab/pages/secret\n external_http: false\n external_https: false\n local_store:\n enabled: false\n path: \n namespace_in_path: false\n \n mattermost:\n enabled: false\n ## Registry Integration\n registry:\n enabled: true\n host: registry.${BASE_DOMAIN}\n api_url: http://gitlab-registry.default.svc:5000\n key: /etc/gitlab/registry/gitlab-registry.key\n issuer: gitlab-issuer\n notification_secret: <%= YAML.load_file(\"/etc/gitlab/registry/notificationSecret\").flatten.first %>\n gitlab_ci:\n ldap:\n enabled: false\n \n omniauth:\n enabled: true\n auto_sign_in_with_provider: \"openid_connect\"\n sync_profile_from_provider: [\"openid_connect\"]\n sync_profile_attributes: [\"email\"]\n allow_single_sign_on: [\"openid_connect\"]\n block_auto_created_users: false\n auto_link_ldap_user: false\n auto_link_saml_user: false\n auto_link_user: true\n external_providers: []\n providers:\n - <%= YAML.load_file(\"/etc/gitlab/omniauth/gitlab-oidc-sso/provider\").to_json() %>\n kerberos:\n enabled: false\n keytab: /etc/krb5.keytab\n use_dedicated_port: false\n port: 8443\n https: true\n simple_ldap_linking_allowed_realms: []\n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n shared:\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n backup:\n path: \"tmp/backups\" # Relative paths are relative to Rails.root (default: tmp/backups/)\n \n \n \n \n \n \n iam_auth_service:\n enabled: false\n secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret\n http:\n host: \"\"\n port: 0\n grpc:\n host: \"\"\n port: 0\n jwt_audience: \"gitlab-rails\"\n jwt_issuer: \"\"\n iam_data_access_service:\n enabled: false\n secret_file: /etc/gitlab/iam-data-access/.gitlab_iam_data_access_secret\n grpc:\n host: \"\"\n port: 0\n gitlab_shell:\n path: /home/git/gitlab-shell/\n hooks_path: /home/git/gitlab-shell/hooks/\n upload_pack: true\n receive_pack: true\n ssh_port: 22\n workhorse:\n git:\n bin_path: /usr/bin/git\n webpack:\n monitoring:\n ip_whitelist:\n - \"127.0.0.0/8\"\n - \"::1/128\"\n sidekiq_exporter:\n enabled: true\n address: \n port: 3807\n log_enabled: false\n sidekiq_health_checks:\n enabled: true\n address: \n port: 3808\n \n"
 configure: |
 # BEGIN gitlab.scripts.configure.secrets
 set -e
@@ -428,7 +428,7 @@
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
 done
 # optional
- for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
+ for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer amazon_ses_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
 if [ -e "${config_dir}/${secret}" ]; then
 mkdir -p "${secret_dir}/${secret}"
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
@@ -456,7 +456,7 @@
 smtp_settings.rb: "smtp_settings = {\n address: \"smtp.mailgun.org\",\n port: 587,\n ca_file: \"/etc/ssl/certs/ca-certificates.crt\",\n \n authentication: :login,\n user_name: \"mail@${BASE_DOMAIN}\",\n password: File.read(\"/etc/gitlab/smtp/smtp-password\").strip,\n enable_starttls_auto: true,\n openssl_verify_mode: \"peer\",\n open_timeout: 30,\n read_timeout: 60\n}\n\nRails.application.config.action_mailer.delivery_method = :smtp\nActionMailer::Base.delivery_method = :smtp\n\nActionMailer::Base.smtp_settings = smtp_settings\n"
 resque.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n"
 cable.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n adapter: redis\n"
- gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n max_request_duration_seconds: 57\n impersonation_enabled: \n application_settings_cache_seconds: 60\n usage_ping_enabled: true\n seat_link_enabled: true\n username_changing_enabled: true\n issue_closing_pattern: \n default_theme: \n default_projects_features:\n issues: true\n merge_requests: true\n wiki: true\n snippets: true\n builds: true\n container_registry: true\n graphql_timeout: \n webhook_timeout: \n trusted_proxies:\n time_zone: \"Europe/Zurich\" \n email_from: \"git@${BASE_DOMAIN}\"\n email_display_name: \"GitLab@${BASE_DOMAIN}\"\n email_reply_to: \"git@${BASE_DOMAIN}\"\n email_subject_suffix: \"\"\n \n gravatar:\n plain_url: \n ssl_url: \n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n dependency_proxy:\n enabled: true\n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n \n pages:\n enabled: false\n access_control: false\n artifacts_server: true\n path: /srv/gitlab/shared/pages\n host: pages.${BASE_DOMAIN}\n port: 443\n https: true\n secret_file: /etc/gitlab/pages/secret\n external_http: false\n external_https: false\n local_store:\n enabled: false\n path: \n namespace_in_path: false\n \n mattermost:\n enabled: false\n ## Registry Integration\n registry:\n enabled: true\n host: registry.${BASE_DOMAIN}\n api_url: http://gitlab-registry.default.svc:5000\n key: /etc/gitlab/registry/gitlab-registry.key\n issuer: gitlab-issuer\n notification_secret: <%= YAML.load_file(\"/etc/gitlab/registry/notificationSecret\").flatten.first %>\n gitlab_ci:\n ldap:\n enabled: false\n \n omniauth:\n enabled: true\n auto_sign_in_with_provider: \"openid_connect\"\n sync_profile_from_provider: [\"openid_connect\"]\n sync_profile_attributes: [\"email\"]\n allow_single_sign_on: [\"openid_connect\"]\n block_auto_created_users: false\n auto_link_ldap_user: false\n auto_link_saml_user: false\n auto_link_user: true\n external_providers: []\n providers:\n - <%= YAML.load_file(\"/etc/gitlab/omniauth/gitlab-oidc-sso/provider\").to_json() %>\n kerberos:\n enabled: false\n keytab: /etc/krb5.keytab\n use_dedicated_port: false\n port: 8443\n https: true\n simple_ldap_linking_allowed_realms: []\n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n shared:\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n backup:\n path: \"tmp/backups\" # Relative paths are relative to Rails.root (default: tmp/backups/)\n \n \n \n \n \n iam_auth_service:\n enabled: false\n secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret\n http:\n host: \"\"\n port: 0\n grpc:\n host: \"\"\n port: 0\n jwt_audience: \"gitlab-rails\"\n jwt_issuer: \"\"\n iam_data_access_service:\n enabled: false\n secret_file: /etc/gitlab/iam-data-access/.gitlab_iam_data_access_secret\n grpc:\n host: \"\"\n port: 0\n gitlab_shell:\n path: /home/git/gitlab-shell/\n hooks_path: /home/git/gitlab-shell/hooks/\n upload_pack: true\n receive_pack: true\n ssh_port: 22\n secret_file: /etc/gitlab/shell/.gitlab_shell_secret\n workhorse:\n git:\n bin_path: /usr/bin/git\n webpack:\n monitoring:\n ip_whitelist:\n - 127.0.0.0/8\n sidekiq_exporter:\n extra:\n \n"
+ gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n max_request_duration_seconds: 57\n impersonation_enabled: \n application_settings_cache_seconds: 60\n usage_ping_enabled: true\n seat_link_enabled: true\n username_changing_enabled: true\n issue_closing_pattern: \n default_theme: \n default_projects_features:\n issues: true\n merge_requests: true\n wiki: true\n snippets: true\n builds: true\n container_registry: true\n graphql_timeout: \n webhook_timeout: \n trusted_proxies:\n time_zone: \"Europe/Zurich\" \n email_from: \"git@${BASE_DOMAIN}\"\n email_display_name: \"GitLab@${BASE_DOMAIN}\"\n email_reply_to: \"git@${BASE_DOMAIN}\"\n email_subject_suffix: \"\"\n \n gravatar:\n plain_url: \n ssl_url: \n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n ci_catalog_bundles:\n enabled: false\n dependency_proxy:\n enabled: true\n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n \n pages:\n enabled: false\n access_control: false\n artifacts_server: true\n path: /srv/gitlab/shared/pages\n host: pages.${BASE_DOMAIN}\n port: 443\n https: true\n secret_file: /etc/gitlab/pages/secret\n external_http: false\n external_https: false\n local_store:\n enabled: false\n path: \n namespace_in_path: false\n \n mattermost:\n enabled: false\n ## Registry Integration\n registry:\n enabled: true\n host: registry.${BASE_DOMAIN}\n api_url: http://gitlab-registry.default.svc:5000\n key: /etc/gitlab/registry/gitlab-registry.key\n issuer: gitlab-issuer\n notification_secret: <%= YAML.load_file(\"/etc/gitlab/registry/notificationSecret\").flatten.first %>\n gitlab_ci:\n ldap:\n enabled: false\n \n omniauth:\n enabled: true\n auto_sign_in_with_provider: \"openid_connect\"\n sync_profile_from_provider: [\"openid_connect\"]\n sync_profile_attributes: [\"email\"]\n allow_single_sign_on: [\"openid_connect\"]\n block_auto_created_users: false\n auto_link_ldap_user: false\n auto_link_saml_user: false\n auto_link_user: true\n external_providers: []\n providers:\n - <%= YAML.load_file(\"/etc/gitlab/omniauth/gitlab-oidc-sso/provider\").to_json() %>\n kerberos:\n enabled: false\n keytab: /etc/krb5.keytab\n use_dedicated_port: false\n port: 8443\n https: true\n simple_ldap_linking_allowed_realms: []\n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n shared:\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n backup:\n path: \"tmp/backups\" # Relative paths are relative to Rails.root (default: tmp/backups/)\n \n \n \n \n \n \n iam_auth_service:\n enabled: false\n secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret\n http:\n host: \"\"\n port: 0\n grpc:\n host: \"\"\n port: 0\n jwt_audience: \"gitlab-rails\"\n jwt_issuer: \"\"\n iam_data_access_service:\n enabled: false\n secret_file: /etc/gitlab/iam-data-access/.gitlab_iam_data_access_secret\n grpc:\n host: \"\"\n port: 0\n gitlab_shell:\n path: /home/git/gitlab-shell/\n hooks_path: /home/git/gitlab-shell/hooks/\n upload_pack: true\n receive_pack: true\n ssh_port: 22\n secret_file: /etc/gitlab/shell/.gitlab_shell_secret\n workhorse:\n git:\n bin_path: /usr/bin/git\n webpack:\n monitoring:\n ip_whitelist:\n - 127.0.0.0/8\n sidekiq_exporter:\n extra:\n \n"
 configure: |
 # BEGIN gitlab.scripts.configure.secrets
 set -e
@@ -468,7 +468,7 @@
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
 done
 # optional
- for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
+ for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer amazon_ses_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
 if [ -e "${config_dir}/${secret}" ]; then
 mkdir -p "${secret_dir}/${secret}"
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
@@ -536,7 +536,7 @@
 smtp_settings.rb: "smtp_settings = {\n address: \"smtp.mailgun.org\",\n port: 587,\n ca_file: \"/etc/ssl/certs/ca-certificates.crt\",\n \n authentication: :login,\n user_name: \"mail@${BASE_DOMAIN}\",\n password: File.read(\"/etc/gitlab/smtp/smtp-password\").strip,\n enable_starttls_auto: true,\n openssl_verify_mode: \"peer\",\n open_timeout: 30,\n read_timeout: 60\n}\n\nRails.application.config.action_mailer.delivery_method = :smtp\nActionMailer::Base.delivery_method = :smtp\n\nActionMailer::Base.smtp_settings = smtp_settings\n"
 resque.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n"
 cable.yml.erb: "production:\n url: redis://gitlab-valkey.gitlab.svc.cluster.local:6379/0\n \n \n id:\n adapter: redis\n"
- gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n action_cable_allowed_origins: []\n max_request_duration_seconds: 57\n impersonation_enabled: \n application_settings_cache_seconds: 60\n usage_ping_enabled: true\n seat_link_enabled: true\n username_changing_enabled: true\n issue_closing_pattern: \n default_theme: \n default_color_mode: \n default_syntax_highlighting_theme: \n default_projects_features:\n issues: true\n merge_requests: true\n wiki: true\n snippets: true\n builds: true\n container_registry: true\n graphql_timeout: \n webhook_timeout: \n trusted_proxies:\n time_zone: \"Europe/Zurich\" \n email_from: \"git@${BASE_DOMAIN}\"\n email_display_name: \"GitLab@${BASE_DOMAIN}\"\n email_reply_to: \"git@${BASE_DOMAIN}\"\n email_subject_suffix: \"\"\n \n gravatar:\n plain_url: \n ssl_url: \n extra:\n \n \n \n \n \n \n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n dependency_proxy:\n enabled: true\n \n sentry:\n enabled: false\n dsn: \n clientside_dsn: \n environment: \n gitlab_docs:\n enabled: false\n host: \"\"\n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n pages:\n enabled: false\n access_control: false\n artifacts_server: true\n path: /srv/gitlab/shared/pages\n host: pages.${BASE_DOMAIN}\n port: 443\n https: true\n secret_file: /etc/gitlab/pages/secret\n external_http: false\n external_https: false\n local_store:\n enabled: false\n path: \n namespace_in_path: false\n \n mattermost:\n enabled: false\n gitlab_ci:\n ldap:\n enabled: false\n \n omniauth:\n enabled: true\n auto_sign_in_with_provider: \"openid_connect\"\n sync_profile_from_provider: [\"openid_connect\"]\n sync_profile_attributes: [\"email\"]\n allow_single_sign_on: [\"openid_connect\"]\n block_auto_created_users: false\n auto_link_ldap_user: false\n auto_link_saml_user: false\n auto_link_user: true\n external_providers: []\n providers:\n - <%= YAML.load_file(\"/etc/gitlab/omniauth/gitlab-oidc-sso/provider\").to_json() %>\n kerberos:\n enabled: false\n keytab: /etc/krb5.keytab\n use_dedicated_port: false\n port: 8443\n https: true\n simple_ldap_linking_allowed_realms: []\n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n shared:\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n backup:\n path: \"tmp/backups\" # Relative paths are relative to Rails.root (default: tmp/backups/)\n \n \n \n \n \n iam_auth_service:\n enabled: false\n secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret\n http:\n host: \"\"\n port: 0\n grpc:\n host: \"\"\n port: 0\n jwt_audience: \"gitlab-rails\"\n jwt_issuer: \"\"\n iam_data_access_service:\n enabled: false\n secret_file: /etc/gitlab/iam-data-access/.gitlab_iam_data_access_secret\n grpc:\n host: \"\"\n port: 0\n gitlab_shell:\n path: /home/git/gitlab-shell/\n hooks_path: /home/git/gitlab-shell/hooks/\n upload_pack: true\n receive_pack: true\n ssh_port: 22\n secret_file: /etc/gitlab/shell/.gitlab_shell_secret\n workhorse:\n secret_file: /etc/gitlab/gitlab-workhorse/secret\n git:\n bin_path: /usr/bin/git\n webpack:\n monitoring:\n ip_whitelist:\n - \"0.0.0.0/0\"\n - \"::/0\"\n web_exporter:\n enabled: true\n address: \n port: 8083\n sidekiq_exporter:\n shutdown:\n blackout_seconds: <%= ENV[\"SHUTDOWN_BLACKOUT_SECONDS\"] %>\n rack_attack:\n git_basic_auth:\n ## Registry Integration\n registry:\n enabled: true\n host: registry.${BASE_DOMAIN}\n api_url: http://gitlab-registry.default.svc:5000\n key: /etc/gitlab/registry/gitlab-registry.key\n issuer: gitlab-issuer\n notification_secret: <%= YAML.load_file(\"/etc/gitlab/registry/notificationSecret\").flatten.first %>\n smartcard:\n enabled: false\n ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt'\n client_certificate_required_host: smartcard.${BASE_DOMAIN}\n client_certificate_required_port: 443\n san_extensions: false\n required_for_git_access: false\n \n"
+ gitlab.yml.erb: "production: &base\n gitlab:\n host: git.${BASE_DOMAIN}\n https: true\n action_cable_allowed_origins: []\n max_request_duration_seconds: 57\n impersonation_enabled: \n application_settings_cache_seconds: 60\n usage_ping_enabled: true\n seat_link_enabled: true\n username_changing_enabled: true\n issue_closing_pattern: \n default_theme: \n default_color_mode: \n default_syntax_highlighting_theme: \n default_projects_features:\n issues: true\n merge_requests: true\n wiki: true\n snippets: true\n builds: true\n container_registry: true\n graphql_timeout: \n webhook_timeout: \n trusted_proxies:\n time_zone: \"Europe/Zurich\" \n email_from: \"git@${BASE_DOMAIN}\"\n email_display_name: \"GitLab@${BASE_DOMAIN}\"\n email_reply_to: \"git@${BASE_DOMAIN}\"\n email_subject_suffix: \"\"\n \n gravatar:\n plain_url: \n ssl_url: \n extra:\n \n \n \n \n \n \n # Consolidated object storage configuration\n ## property local configuration will override object_store\n object_store:\n enabled: true\n proxy_download: true\n connection: <%= YAML.load_file(\"/etc/gitlab/objectstorage/object_store\").to_json() %>\n objects:\n artifacts:\n bucket: gitlab-artifacts\n proxy_download: true\n lfs:\n bucket: git-lfs\n proxy_download: true\n uploads:\n bucket: gitlab-uploads\n proxy_download: true\n packages:\n bucket: gitlab-packages\n proxy_download: true\n \n terraform_state:\n bucket: gitlab-terraform-state\n dependency_proxy:\n bucket: gitlab-dependency-proxy\n proxy_download: true\n \n \n \n pages:\n bucket: gitlab-pages\n artifacts:\n enabled: true\n lfs:\n enabled: true\n uploads:\n enabled: true\n packages:\n enabled: true\n external_diffs:\n enabled: false\n when: \n terraform_state:\n enabled: true\n ci_secure_files:\n enabled: false\n agent_plan_content:\n enabled: false\n ci_catalog_bundles:\n enabled: false\n dependency_proxy:\n enabled: true\n \n sentry:\n enabled: false\n dsn: \n clientside_dsn: \n environment: \n gitlab_docs:\n enabled: false\n host: \"\"\n \n sidekiq:\n log_format: json\n oidc_provider:\n openid_id_token_expire_in_seconds: 120\n \n pages:\n enabled: false\n access_control: false\n artifacts_server: true\n path: /srv/gitlab/shared/pages\n host: pages.${BASE_DOMAIN}\n port: 443\n https: true\n secret_file: /etc/gitlab/pages/secret\n external_http: false\n external_https: false\n local_store:\n enabled: false\n path: \n namespace_in_path: false\n \n mattermost:\n enabled: false\n gitlab_ci:\n ldap:\n enabled: false\n \n omniauth:\n enabled: true\n auto_sign_in_with_provider: \"openid_connect\"\n sync_profile_from_provider: [\"openid_connect\"]\n sync_profile_attributes: [\"email\"]\n allow_single_sign_on: [\"openid_connect\"]\n block_auto_created_users: false\n auto_link_ldap_user: false\n auto_link_saml_user: false\n auto_link_user: true\n external_providers: []\n providers:\n - <%= YAML.load_file(\"/etc/gitlab/omniauth/gitlab-oidc-sso/provider\").to_json() %>\n kerberos:\n enabled: false\n keytab: /etc/krb5.keytab\n use_dedicated_port: false\n port: 8443\n https: true\n simple_ldap_linking_allowed_realms: []\n \n duo_auth:\n enabled: false\n hostname: \n integration_key: \n secret_key: \n shared:\n gitaly:\n client_path: /home/git/gitaly/bin\n client_max_attempts: 4\n client_max_backoff: \"1.4s\"\n token: <%= File.read('/etc/gitlab/gitaly/gitaly_token').strip.to_json %>\n repositories:\n storages: # You must have at least a `default` storage path.\n default:\n path: /var/opt/gitlab/repo\n gitaly_address: tcp://gitlab-gitaly-0.gitlab-gitaly.default.svc:8075\n \n backup:\n path: \"tmp/backups\" # Relative paths are relative to Rails.root (default: tmp/backups/)\n \n \n \n \n \n \n iam_auth_service:\n enabled: false\n secret_file: /etc/gitlab/iam-auth/.gitlab_iam_auth_secret\n http:\n host: \"\"\n port: 0\n grpc:\n host: \"\"\n port: 0\n jwt_audience: \"gitlab-rails\"\n jwt_issuer: \"\"\n iam_data_access_service:\n enabled: false\n secret_file: /etc/gitlab/iam-data-access/.gitlab_iam_data_access_secret\n grpc:\n host: \"\"\n port: 0\n gitlab_shell:\n path: /home/git/gitlab-shell/\n hooks_path: /home/git/gitlab-shell/hooks/\n upload_pack: true\n receive_pack: true\n ssh_port: 22\n secret_file: /etc/gitlab/shell/.gitlab_shell_secret\n workhorse:\n secret_file: /etc/gitlab/gitlab-workhorse/secret\n git:\n bin_path: /usr/bin/git\n webpack:\n monitoring:\n ip_whitelist:\n - \"0.0.0.0/0\"\n - \"::/0\"\n web_exporter:\n enabled: true\n address: \n port: 8083\n sidekiq_exporter:\n shutdown:\n blackout_seconds: <%= ENV[\"SHUTDOWN_BLACKOUT_SECONDS\"] %>\n rack_attack:\n git_basic_auth:\n ## Registry Integration\n registry:\n enabled: true\n host: registry.${BASE_DOMAIN}\n api_url: http://gitlab-registry.default.svc:5000\n key: /etc/gitlab/registry/gitlab-registry.key\n issuer: gitlab-issuer\n notification_secret: <%= YAML.load_file(\"/etc/gitlab/registry/notificationSecret\").flatten.first %>\n smartcard:\n enabled: false\n ca_file: '/etc/gitlab/rails-secrets/smartcard-ca.crt'\n client_certificate_required_host: smartcard.${BASE_DOMAIN}\n client_certificate_required_port: 443\n san_extensions: false\n required_for_git_access: false\n \n"
 configure: |
 # BEGIN gitlab.scripts.configure.secrets
 set -e
@@ -548,7 +548,7 @@
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
 done
 # optional
- for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
+ for secret in redis redis-sentinel objectstorage postgres ldap duo omniauth smtp kas pages oauth-secrets mailroom gitlab-exporter microsoft_graph_mailer amazon_ses_mailer zoekt clickhouse openbao knowledge_graph iam-auth iam-data-access ; do
 if [ -e "${config_dir}/${secret}" ]; then
 mkdir -p "${secret_dir}/${secret}"
 cp -f -v -r -L "${config_dir}/${secret}/." "${secret_dir}/${secret}/"
@@ -849,8 +849,8 @@
 release: gitlab
 heritage: Helm
 data:
- gitlabVersion: "19.2.1"
- gitlabChartVersion: "10.2.1"
+ gitlabVersion: "19.3.0"
+ gitlabChartVersion: "10.3.0"
 ---
 # Source: gitlab/charts/gitlab/charts/gitaly/templates/service.yaml
 apiVersion: v1
@@ -980,13 +980,13 @@
 heritage: Helm
 app.kubernetes.io/name: gitlab
 annotations:
- checksum/config: 2f2490b5b336d5c6a17cf0b7c58b89e32937bdc8e92294c501976e6ecc830d22
- checksum/config-sshd: 940b89189a348e29496be10dba80f7c1277fb85ddb436b2714172e63b9036dbe
+ checksum/config: c68c701bc2e4312be6a2c688fae7225f6365d39de341a61f45093654faf1e2c6
+ checksum/config-sshd: 3865bb978cf7a6885ecea87f2232d20edbe7f514f5a422dc01f0ebbe831dfb7e
 cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
 spec:
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1011,7 +1011,7 @@
 cpu: 50m
 - name: configure
 command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1183,7 +1183,7 @@
 app.kubernetes.io/name: gitlab
 queue-pod-name: all-in-1
 annotations:
- checksum/configmap: 24db1427e490bce43da7e226d5293516323270626f9b5e6dff2c7b9c94631a05
+ checksum/configmap: 30463a1fabb9230e6bf4e979f72b3dcc26afa0a66a6d20d6db83080514a27946
 cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
 gitlab.com/prometheus_scrape: "true"
 gitlab.com/prometheus_port: "3807"
@@ -1211,7 +1211,7 @@
 terminationGracePeriodSeconds: 30
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1237,7 +1237,7 @@
 cpu: 50m
 - name: configure
 command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1262,7 +1262,7 @@
 requests:
 cpu: 50m
 - name: dependencies
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1307,7 +1307,7 @@
 cpu: 50m
 containers:
 - name: sidekiq
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1462,10 +1462,12 @@
 # mount secret for terraform_state
 # mount secret for ci_secure_files
 # mount secret for agent_plan_content
+ # mount secret for ci_catalog_bundles
 # mount secret for dependency_proxy
 # mount secret for pages
 # mount secrets for LDAP
 # mount secrets for microsoftGraphMailer
+ # mount secrets for amazonSesMailer
 # mount secrets for SMTP
 - secret:
 name: gitlab-mail-password
@@ -1517,7 +1519,7 @@
 heritage: Helm
 app.kubernetes.io/name: gitlab
 annotations:
- checksum/config: b3b117958914f8816127956f674515fb4ce8e6c910cbf8f4a002a139082eca3d
+ checksum/config: fd724b3d0ffcb5ef954ebcbdfd4bd303115339023fb4f92658ce8b262401ec04
 cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
 spec:
 securityContext:
@@ -1553,7 +1555,7 @@
 - name: toolbox-secrets
 mountPath: /init-secrets
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1579,7 +1581,7 @@
 cpu: 50m
 - name: configure
 command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1619,7 +1621,7 @@
 - /bin/bash
 - -c
 - cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done # alpine sleep has no infinity
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1646,6 +1648,8 @@
 value: gitlab-ci-secure-files
 - name: AGENT_PLAN_CONTENT_BUCKET_NAME
 value: gitlab-agent-plan-content
+ - name: CI_CATALOG_BUNDLES_BUCKET_NAME
+ value: gitlab-ci-catalog-bundles
 - name: BACKUP_BUCKET_NAME
 value: gitlab
 - name: BACKUP_BACKEND
@@ -1819,10 +1823,12 @@
 # mount secret for terraform_state
 # mount secret for ci_secure_files
 # mount secret for agent_plan_content
+ # mount secret for ci_catalog_bundles
 # mount secret for dependency_proxy
 # mount secret for pages
 # mount secrets for LDAP
 # mount secrets for microsoftGraphMailer
+ # mount secrets for amazonSesMailer
 # mount secrets for SMTP
 - secret:
 name: gitlab-mail-password
@@ -1877,7 +1883,7 @@
 app.kubernetes.io/name: gitlab
 gitlab.com/webservice-name: default
 annotations:
- checksum/config: 876f24980a4d7c233ceb16497634c77b17ef5528343c3b79d15c25fcecac0e22
+ checksum/config: 5534937bd62e135c3b78930ec41d16130c1abcf7c17326899919db71edd54899
 cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
 gitlab.com/prometheus_scrape: "true"
 gitlab.com/prometheus_port: "8083"
@@ -1905,7 +1911,7 @@
 automountServiceAccountToken: false
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1932,7 +1938,7 @@
 - name: configure
 command: ['sh']
 args: ['-c', 'sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -1966,7 +1972,7 @@
 requests:
 cpu: 50m
 - name: dependencies
- image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2008,7 +2014,7 @@
 cpu: 50m
 containers:
 - name: webservice
- image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2051,7 +2057,7 @@
 - name: DISABLE_PUMA_WORKER_KILLER
 value: "true"
 - name: BIND_IP6
- value: "false"
+ value: "true"
 - name: PUMA_CONTROL_PORT
 value: "9293"
 - name: SHUTDOWN_BLACKOUT_SECONDS
@@ -2117,7 +2123,7 @@
 cpu: 300m
 memory: 2.5G
 - name: gitlab-workhorse
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2225,6 +2231,7 @@
 - key: "secret"
 path: shell/.gitlab_shell_secret
 # mount secrets for microsoftGraphMailer
+ # mount secrets for amazonSesMailer
 # mount secrets for incomingEmail
 # mount secrets for serviceDeskEmail
 - secret:
@@ -2276,6 +2283,7 @@
 # mount secret for terraform_state
 # mount secret for ci_secure_files
 # mount secret for agent_plan_content
+ # mount secret for ci_catalog_bundles
 # mount secret for dependency_proxy
 # mount secret for pages
 # mount secrets for LDAP
@@ -2354,7 +2362,7 @@
 automountServiceAccountToken: false
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2379,7 +2387,7 @@
 requests:
 cpu: 50m
 - name: configure
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2654,7 +2662,7 @@
 heritage: Helm
 app.kubernetes.io/name: gitlab
 annotations:
- checksum/config: d42e50b94079dd49ac227fc4143f53e53feabbfe98b575d72f9fa3cff7a1a3f6
+ checksum/config: 9edcdc3543637ca6f663591e6a4cd8cfc09b87d167ceca2fdc087eaaa9f075a0
 gitlab.com/prometheus_scrape: "true"
 gitlab.com/prometheus_port: "9236"
 gitlab.com/prometheus_path: /metrics
@@ -2665,7 +2673,7 @@
 terminationGracePeriodSeconds: 30
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2690,7 +2698,7 @@
 cpu: 50m
 - name: configure
 command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2729,7 +2737,7 @@
 automountServiceAccountToken: false
 containers:
 - name: gitaly
- image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2849,12 +2857,13 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
- name: gitlab-migrations-0f66da1
+ name: gitlab-migrations-c15dd42
 namespace: default
 labels:
 app: migrations
 release: gitlab
 heritage: Helm
+ gitlab.com/target-version: "v19.3.0"
 spec:
 activeDeadlineSeconds: 3600
 backoffLimit: 6
@@ -2873,7 +2882,7 @@
 automountServiceAccountToken: false
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2898,7 +2907,7 @@
 cpu: 50m
 - name: configure
 command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -2924,7 +2933,7 @@
 restartPolicy: OnFailure
 containers:
 - name: migrations
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v19.3.0"
 args:
 - /bin/bash
 - -c
@@ -3015,6 +3024,7 @@
 # mount secret for terraform_state
 # mount secret for ci_secure_files
 # mount secret for agent_plan_content
+ # mount secret for ci_catalog_bundles
 # mount secret for dependency_proxy
 # mount secret for pages
 # Object storage secrets - end
@@ -3049,7 +3059,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
- name: gitlab-registry-migrations-9e5f26a
+ name: gitlab-registry-migrations-4389631
 namespace: default
 labels:
 app: registry-migrations
@@ -3072,7 +3082,7 @@
 type: RuntimeDefault
 initContainers:
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -3097,7 +3107,7 @@
 requests:
 cpu: 50m
 - name: configure
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -3215,11 +3225,11 @@
 metadata:
 labels:
 app: toolbox
- chart: toolbox-10.2.1
+ chart: toolbox-10.3.0
 release: gitlab
 heritage: Helm
 annotations:
- checksum/config: b3b117958914f8816127956f674515fb4ce8e6c910cbf8f4a002a139082eca3d
+ checksum/config: fd724b3d0ffcb5ef954ebcbdfd4bd303115339023fb4f92658ce8b262401ec04
 cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
 spec:
 restartPolicy: OnFailure
@@ -3255,7 +3265,7 @@
 - name: toolbox-secrets
 mountPath: /init-secrets
 - name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.2.1
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v19.3.0
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -3281,7 +3291,7 @@
 cpu: 50m
 - name: configure
 command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -3311,7 +3321,7 @@
 - /bin/bash
 - -c
 - cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility --backend-data s3 --backend-backup s3 --s3tool-data s3cmd --s3tool-backup s3cmd --s3config /etc/gitlab/backup-object-storage.s3cfg --maximum-backups 3 # alpine sleep has no infinity
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v19.2.1"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v19.3.0"
 securityContext:
 allowPrivilegeEscalation: false
 capabilities:
@@ -3338,6 +3348,8 @@
 value: gitlab-ci-secure-files
 - name: AGENT_PLAN_CONTENT_BUCKET_NAME
 value: gitlab-agent-plan-content
+ - name: CI_CATALOG_BUNDLES_BUCKET_NAME
+ value: gitlab-ci-catalog-bundles
 - name: BACKUP_BUCKET_NAME
 value: gitlab
 - name: BACKUP_BACKEND
@@ -3496,6 +3508,7 @@
 - key: provider
 path: "omniauth/gitlab-oidc-sso/provider"
 # mount secrets for microsoftGraphMailer
+ # mount secrets for amazonSesMailer
 # mount secret for artifacts
 # mount secret for lfs
 # mount secret for uploads
@@ -3504,6 +3517,7 @@
 # mount secret for terraform_state
 # mount secret for ci_secure_files
 # mount secret for agent_plan_content
+ # mount secret for ci_catalog_bundles
 # mount secret for dependency_proxy
 # mount secret for pages
 # mount secrets for LDAP
@@ -3553,7 +3567,7 @@
 "helm.sh/hook-weight": "-3"
 "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
 data:
- generate-secrets: "# vim: set filetype=sh:\n\n# Fail fast on errors.\nset -e\nset -o pipefail\n\nnamespace=default\nrelease=gitlab\nenv=production\n\npushd $(mktemp -d)\n\n# Args pattern, length\nfunction gen_random(){\n head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2\n}\n\n# Args: length\nfunction gen_random_base64(){\n local len=\"$1\"\n gen_random_bytes \"$len\" | base64 -w0\n}\n\n# Args: length\nfunction gen_random_bytes(){\n local len=\"$1\"\n head -c \"$len\" /dev/urandom\n}\n\n# Args: yaml file, search path\nfunction fetch_rails_value(){\n local value=$(yq --prettyPrint --no-colors \".${2}\" $1)\n\n # Don't return null values\n if [ \"${value}\" != \"null\" ]; then echo \"${value}\"; fi\n}\n\n# Args: secretname\nfunction label_secret(){\n local secret_name=$1\n# Remove application labels if they exist\n kubectl --namespace=$namespace label \\\n secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\n\n kubectl --namespace=$namespace label \\\n --overwrite \\\n secret $secret_name app=gitlab chart=gitlab-10.2.1 release=gitlab heritage=Helm \n}\n\n# Args: secretname, args\nfunction generate_secret_if_needed(){\n local secret_args=( \"${@:2}\")\n local secret_name=$1\n\n if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then\n kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}\n else\n echo \"secret \\\"$secret_name\\\" already exists.\"\n\n for arg in \"${secret_args[@]}\"; do\n local from=$(echo -n ${arg} | cut -d '=' -f1)\n\n if [ -z \"${from##*literal*}\" ]; then\n local key=$(echo -n ${arg} | cut -d '=' -f2)\n local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)\n local flags=\"--namespace=$namespace --allow-missing-template-keys=false\"\n\n if ! $(kubectl $flags get secret $secret_name -ojsonpath=\"{.data.${key}}\" > /dev/null 2>&1); then\n echo \"key \\\"${key}\\\" does not exist. patching it in.\"\n\n if [ \"${desiredValue}\" != \"\" ]; then\n desiredValue=$(echo -n \"${desiredValue}\" | base64 -w 0)\n fi\n\n kubectl --namespace=$namespace patch secret ${secret_name} -p \"{\\\"data\\\":{\\\"$key\\\":\\\"${desiredValue}\\\"}}\"\n fi\n fi\n done\n fi\n\n label_secret $secret_name\n}\n\n# Initial root password\ngenerate_secret_if_needed \"gitlab-gitlab-initial-root-password\" --from-literal=\"password\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitlab shell\ngenerate_secret_if_needed \"gitlab-gitlab-shell-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitaly secret\ngenerate_secret_if_needed \"gitlab-gitaly-secret\" --from-literal=\"token\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitlab runner secret\ngenerate_secret_if_needed \"gitlab-gitlab-runner-secret\" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=\"\"\n\n# GitLab Pages API secret\n\n\n# GitLab Pages auth secret for hashing cookie store when using access control\n\n\n# GitLab Pages OAuth secret\n\n\n\n\n\n\n\n\n# Registry certificates\nmkdir -p certs\nopenssl req -new -newkey rsa:4096 -subj \"/CN=gitlab-issuer\" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650\ngenerate_secret_if_needed \"gitlab-registry-secret\" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt\n\n# config/secrets.yaml\nif [ -n \"$env\" ]; then\n rails_secret=\"gitlab-rails-secret\"\n\n # Fetch the values from the existing secret if it exists\n if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then\n kubectl --namespace=$namespace get secret $rails_secret -o jsonpath=\"{.data.secrets\\.yml}\" | base64 --decode > secrets.yml\n secret_key_base=$(fetch_rails_value secrets.yml \"${env}.secret_key_base\")\n otp_key_base=$(fetch_rails_value secrets.yml \"${env}.otp_key_base\")\n db_key_base=$(fetch_rails_value secrets.yml \"${env}.db_key_base\")\n openid_connect_signing_key=$(fetch_rails_value secrets.yml \"${env}.openid_connect_signing_key\")\n encrypted_settings_key_base=$(fetch_rails_value secrets.yml \"${env}.encrypted_settings_key_base\")\n\n active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_primary_key\")\n active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_deterministic_key\")\n active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_key_derivation_salt\")\n fi;\n\n # Generate defaults for any unset secrets\n secret_key_base=\"${secret_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n otp_key_base=\"${otp_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n db_key_base=\"${db_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n openid_connect_signing_key=\"${openid_connect_signing_key:-$(openssl genrsa 2048)}\"\n encrypted_settings_key_base=\"${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n\n # 1. We set the following two keys as an array to support keys rotation.\n # The last key in the array is always used to encrypt data:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21\n # while all the keys are used (in the order they're defined) to decrypt data:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.\n # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that\n # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976\n # 2. We use the same method and length as Rails' defaults:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540\n active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-\"- $(gen_random 'a-zA-Z0-9' 32)\"}\n active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-\"- $(gen_random 'a-zA-Z0-9' 32)\"}\n active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}\n\n # Update the existing secret\n cat << EOF > rails-secrets.yml\napiVersion: v1\nkind: Secret\nmetadata:\n name: $rails_secret\ntype: Opaque\nstringData:\n secrets.yml: |-\n $env:\n secret_key_base: $secret_key_base\n otp_key_base: $otp_key_base\n db_key_base: $db_key_base\n encrypted_settings_key_base: $encrypted_settings_key_base\n openid_connect_signing_key: |\n$(echo \"${openid_connect_signing_key}\" | awk '{print \" \" $0}')\n active_record_encryption_primary_key:\n $active_record_encryption_primary_keys\n active_record_encryption_deterministic_key:\n $active_record_encryption_deterministic_keys\n active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt\nEOF\n kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml\n label_secret $rails_secret\nfi\n\n# Shell ssh host keys\nssh-keygen -A\nmkdir -p host_keys\ncp /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub host_keys/\ngenerate_secret_if_needed \"gitlab-gitlab-shell-host-keys\" --from-file host_keys\n\n# Gitlab-workhorse secret\ngenerate_secret_if_needed \"gitlab-gitlab-workhorse-secret\" --from-literal=\"shared_secret\"=$(gen_random 'a-zA-Z0-9' 32 | base64)\n\n# Registry http.secret secret\ngenerate_secret_if_needed \"gitlab-registry-httpsecret\" --from-literal=\"secret\"=$(gen_random 'a-z0-9' 128 | base64 -w 0)\n\n# Container Registry notification_secret\ngenerate_secret_if_needed \"gitlab-registry-notification\" --from-literal=\"secret\"=[\\\"$(gen_random 'a-zA-Z0-9' 32)\\\"]\n"
+ generate-secrets: "# vim: set filetype=sh:\n\n# Fail fast on errors.\nset -e\nset -o pipefail\n\nnamespace=default\nrelease=gitlab\nenv=production\n\npushd $(mktemp -d)\n\n# Args pattern, length\nfunction gen_random(){\n head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2\n}\n\n# Args: length\nfunction gen_random_base64(){\n local len=\"$1\"\n gen_random_bytes \"$len\" | base64 -w0\n}\n\n# Args: length\nfunction gen_random_bytes(){\n local len=\"$1\"\n head -c \"$len\" /dev/urandom\n}\n\n# Args: yaml file, search path\nfunction fetch_rails_value(){\n local value=$(yq --prettyPrint --no-colors \".${2}\" $1)\n\n # Don't return null values\n if [ \"${value}\" != \"null\" ]; then echo \"${value}\"; fi\n}\n\n# Args: secretname\nfunction label_secret(){\n local secret_name=$1\n# Remove application labels if they exist\n kubectl --namespace=$namespace label \\\n secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\n\n kubectl --namespace=$namespace label \\\n --overwrite \\\n secret $secret_name app=gitlab chart=gitlab-10.3.0 release=gitlab heritage=Helm \n}\n\n# Args: secretname, args\nfunction generate_secret_if_needed(){\n local secret_args=( \"${@:2}\")\n local secret_name=$1\n\n if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then\n kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}\n else\n echo \"secret \\\"$secret_name\\\" already exists.\"\n\n for arg in \"${secret_args[@]}\"; do\n local from=$(echo -n ${arg} | cut -d '=' -f1)\n\n if [ -z \"${from##*literal*}\" ]; then\n local key=$(echo -n ${arg} | cut -d '=' -f2)\n local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)\n local flags=\"--namespace=$namespace --allow-missing-template-keys=false\"\n\n if ! $(kubectl $flags get secret $secret_name -ojsonpath=\"{.data.${key}}\" > /dev/null 2>&1); then\n echo \"key \\\"${key}\\\" does not exist. patching it in.\"\n\n if [ \"${desiredValue}\" != \"\" ]; then\n desiredValue=$(echo -n \"${desiredValue}\" | base64 -w 0)\n fi\n\n kubectl --namespace=$namespace patch secret ${secret_name} -p \"{\\\"data\\\":{\\\"$key\\\":\\\"${desiredValue}\\\"}}\"\n fi\n fi\n done\n fi\n\n label_secret $secret_name\n}\n\n# Initial root password\ngenerate_secret_if_needed \"gitlab-gitlab-initial-root-password\" --from-literal=\"password\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitlab shell\ngenerate_secret_if_needed \"gitlab-gitlab-shell-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitaly secret\ngenerate_secret_if_needed \"gitlab-gitaly-secret\" --from-literal=\"token\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitlab runner secret\ngenerate_secret_if_needed \"gitlab-gitlab-runner-secret\" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=\"\"\n\n# GitLab Pages API secret\n\n\n# GitLab Pages auth secret for hashing cookie store when using access control\n\n\n# GitLab Pages OAuth secret\n\n\n\n\n\n\n\n\n# Registry certificates\nmkdir -p certs\nopenssl req -new -newkey rsa:4096 -subj \"/CN=gitlab-issuer\" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650\ngenerate_secret_if_needed \"gitlab-registry-secret\" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt\n\n# config/secrets.yaml\nif [ -n \"$env\" ]; then\n rails_secret=\"gitlab-rails-secret\"\n\n # Fetch the values from the existing secret if it exists\n if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then\n kubectl --namespace=$namespace get secret $rails_secret -o jsonpath=\"{.data.secrets\\.yml}\" | base64 --decode > secrets.yml\n secret_key_base=$(fetch_rails_value secrets.yml \"${env}.secret_key_base\")\n otp_key_base=$(fetch_rails_value secrets.yml \"${env}.otp_key_base\")\n db_key_base=$(fetch_rails_value secrets.yml \"${env}.db_key_base\")\n openid_connect_signing_key=$(fetch_rails_value secrets.yml \"${env}.openid_connect_signing_key\")\n encrypted_settings_key_base=$(fetch_rails_value secrets.yml \"${env}.encrypted_settings_key_base\")\n\n active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_primary_key\")\n active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_deterministic_key\")\n active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_key_derivation_salt\")\n fi;\n\n # Generate defaults for any unset secrets\n secret_key_base=\"${secret_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom....*[Comment body truncated]*

github-actions · 2026-08-13T20:11:23Z

Path: apps/gitlab/gitlab-runner/helmrelease.yaml
Version: 0.91.0 -> 0.92.0

@@ -205,7 +205,7 @@
 release: "gitlab-runner"
 heritage: "Helm"
 annotations:
- checksum/configmap: f0f9b0eea5916d553a0d8eabf5c9fb8d7b0b0c99181f4d1d8fe1c1a0f1d79137
+ checksum/configmap: a70feda591a3ed01a63c56e422d1d3000a3454eeefcb499050aa5c0f61892f79
 spec:
 securityContext:
 fsGroup: 65533
@@ -214,7 +214,7 @@
 serviceAccountName: "gitlab-runner"
 containers:
 - name: gitlab-runner
- image: registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.2.0
+ image: registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.3.0
 imagePullPolicy: "IfNotPresent"
 securityContext:
 allowPrivilegeEscalation: false

renovate Bot added dep/patch renovate/helm labels Aug 12, 2026

renovate Bot assigned rxbn Aug 12, 2026

renovate Bot force-pushed the renovate/gitlab-and-gitlab-runner branch from 95dca6a to eb9ce9c Compare August 13, 2026 20:10

renovate Bot changed the title ~~chore(deps): update helm release gitlab to v10.2.2~~ chore(deps): update gitlab and gitlab runner Aug 13, 2026

renovate Bot force-pushed the renovate/gitlab-and-gitlab-runner branch 2 times, most recently from ad628e4 to 0aa86a8 Compare August 19, 2026 23:45

chore(deps): update gitlab and gitlab runner

0e07cbc

renovate Bot added the dep/minor label Aug 20, 2026

renovate Bot force-pushed the renovate/gitlab-and-gitlab-runner branch from 0aa86a8 to 0e07cbc Compare August 20, 2026 16:16

renovate Bot removed the dep/patch label Aug 20, 2026

Navigation Menu

chore(deps): update gitlab and gitlab runner - #4958

chore(deps): update gitlab and gitlab runner#4958
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/gitlab-and-gitlab-runner

renovate Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v10.3.0

Added (4 changes)

Fixed (2 changes)

Changed (12 changes)

v10.2.4

v10.2.2

Fixed (2 changes)

v0.92.0

New features

v0.91.2

New features

Configuration

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 12, 2026 •

edited

Loading

`v10.3.0`

`v10.2.4`

`v10.2.2`

`v0.92.0`

`v0.91.2`

github-actions Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 13, 2026 •

edited

Loading