gitlab19.2.0在kubernetes helm安装

注意：GitLab 19.0 彻底移除了内置的 PostgreSQL、Redis 和 MinIO 支持，这些组件必须自己事先安装 GitLab 19.0 版本要求： PostgreSQL 17以上。 Gateway API,不再支持nginx-ingress 支持valkey

1. 添加 GitLab Helm 仓库

#添加GitLab官方仓库

helm repo add gitlab https://charts.gitlab.io/
helm repo update
helm search repo gitlab/gitlab --versions | head -n 5

#创建GitLab命名空间

kubectl create namespace gitlab

2. PostgreSQL 配置（创建 GitLab 专属用户 / 库 + 读写分离赋权）

— 进入PostgreSQL主库（pg-test-r）执行

kubectl exec -it -n postgresql $(kubectl get pods -n postgresql -l role=primary -o name | cut -d '/' -f2) -- psql -U postgres
``
删除原有gitlabhq_production库
``
DROP DATABASE IF EXISTS gitlabhq_production WITH (FORCE);

或者

-- 1. 撤销所有连接权限，防止新连接进来
REVOKE CONNECT ON DATABASE gitlabhq_production FROM public;

-- 2. 强制终止残留进程
SELECT pg_terminate_backend(pid) 
FROM pg_stat_activity 
WHERE datname = 'gitlabhq_production' AND pid <> pg_backend_pid();

-- 3. 查看是否有记录
SELECT gid, prepared, owner, database FROM pg_prepared_xacts;

-- 4. 如果有，手动回滚它们（替换下面的 
<gid>）
ROLLBACK PREPARED '
<gid>';

-- 5. 执行删除
DROP DATABASE gitlabhq_production;

— 创建GitLab专用数据库

-- 1. 创建GitLab专用数据库（英文本地化）

CREATE DATABASE gitlabhq_production 
  ENCODING 'UTF8' 
  LC_COLLATE 'en_US.UTF-8' 
  LC_CTYPE 'en_US.UTF-8' 
  TEMPLATE template0;

-- 2. 创建GitLab专用用户（密码gitlab2026）
CREATE USER gitlab WITH PASSWORD 'gitlab2026';

-- 3. 赋权（全权限）
GRANT ALL PRIVILEGES ON DATABASE gitlabhq_production TO gitlab;
ALTER ROLE gitlab SET client_encoding TO 'utf8';
ALTER ROLE gitlab SET default_transaction_isolation TO 'read committed';
ALTER ROLE gitlab SET timezone TO 'UTC';

\c gitlabhq_production
GRANT ALL ON SCHEMA public TO gitlab;
ALTER SCHEMA public OWNER TO gitlab;
ALTER USER gitlab SUPERUSER;

-- 4. 验证配置
\c gitlabhq_production;
SHOW server_encoding;  -- 输出：UTF8
SELECT datname, datcollate, datctype 
FROM pg_database;    -- 输出：en_US.UTF-8

-- 5. 退出
\q

执行完后，可再次进入 PostgreSQL 验证：

kubectl exec -it -n postgresql $(kubectl get pods -n postgresql -l role=primary -o name | cut -d '/' -f2) -- psql -U postgres
\l  -- 能看到 gitlabhq_production 数据库
\du -- 能看到 gitlab 用户（属性为 Create DB, Create Role 等）
\c gitlabhq_production;
SELECT current_user;  -- 输出：gitlab（切换用户后验证）

执行以下命令创建数据库密码 Secret，确保 GitLab Helm 部署时能正确连接 PostgreSQL：

kubectl create secret generic gitlab-postgres-password -n gitlab \
  --from-literal=password=gitlab2026

建立s3 bucket链接参数

kubectl create secret generic object-storage -n gitlab \
  --from-literal=connection='{
    "provider":"AWS",
    "region":"us-east-1",
    "endpoint":"http://rook-ceph-rgw-s3-store.rook-ceph.svc:80",
    "path_style":true,
    "aws_access_key_id":"5XQ8OBGZWG8MNO6M52Y2",
    "aws_secret_access_key":"3negGAxSrskJ0OediH3osHLEAhs36AAoE8sD9nRt"
  }'

3. 部署 GitLab（指定版本）

如果之前部署过gitlab,需要清除redis/valkey

redis-cli -h valkey-0.valkey-headless.valkey-replica.svc.cluster.local -p 

查看 helm chart版本

helm search repo gitlab/gitlab --versions

helm upgrade --install gitlab gitlab/gitlab -n gitlab \
  -f gitlab-values.yaml 

helm upgrade --install gitlab gitlab/gitlab -n gitlab   -f gitlab-values.yaml --skip-crds

#等待部署完成（约5-10分钟）

kubectl -n gitlab wait --for=condition=Ready pods --all --timeout=600s

查看root密码

kubectl -n gitlab get secret gitlab-gitlab-initial-root-password -o jsonpath="{.data.password}" | base64 --decode; echo

建立httproute,注意是8181端口，不是常用的8080端口

cat httproute.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: gitlab
  namespace: gitlab
spec:
  parentRefs:
  - name: gateway
    namespace: istio-ingress
  hostnames: 
  - "gitlab.infraserviceonline.com"
  - "ide.infraserviceonline.com"  # <--- 用于安全用途，需要在gitlab web界面修改参数配合
  rules:
  - filters:
    - type: RequestHeaderModifier
      requestHeaderModifier:
        set:
          - name: X-Forwarded-Proto
            value: https
    backendRefs:
    - name: gitlab-webservice-default
      port: 8181  # 保持 8181 端口
    matches:
    - path:
        type: PathPrefix
        value: /

建立servicemonitor

cat <<EOF | kubectl apply -f -
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: gitlab-components-monitor
  namespace: gitlab
  labels:
    release: prometheus-operator # 匹配你 Prometheus 的 Selector
spec:
  selector:
    matchLabels:
      release: gitlab # 匹配你刚才查到的 Service 共同标签
  namespaceSelector:
    matchNames:
      - gitlab
  endpoints:
  # 1. 匹配 Webservice
  # 你之前查到它的端口名是 http-metrics-ws
  - port: http-metrics-ws
    path: /metrics
    interval: 30s
    honorLabels: true

  #2. 匹配 Gitaly 和 GitLab-Exporter
  #查到这两个 Service 的监控端口名都叫 http-metrics
  - port: http-metrics
    path: /metrics
    interval: 30s
    honorLabels: true
EOF

s3写法如下：proxy_download: true表示用户通过gitlab访问s3

#对象存储配置 (Artifacts, LFS 等)

  appConfig:
    # 全局通用的对象存储连接配置（只写一次，所有模块复用）
    object_store:
      enabled: true  # 必须开启
      proxy_download: true
      connection:
        secret: object-storage
        key: connection
    # 各模块需指定 bucket + remote_directory + 显式启用 object_store
    lfs:
      enabled: true  # 显式启用
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    artifacts:
      enabled: true
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    uploads:
      enabled: true
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    packages:
      enabled: true
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    externalDiffs:
      enabled: false
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    terraformState:
      enabled: false
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    dependencyProxy:
      enabled: false
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    ciSecureFiles:
      enabled: false
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
    backups:
      bucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead
      tmpBucket: ceph-bkt-aad0791f-76df-43d3-9313-cca489d46ead

    microsoft_graph_mailer:
      enabled: false
    incomingEmail:
      enabled: false
    serviceDeskEmail:
      enabled: false

参考：https://docs.gitlab.com/charts/releases/9.10.3/

下载 gitlab-values.yaml

---