Using the GitLab-Sidekiq chart

The sidekiq sub-chart provides configurable deployment of Sidekiq workers, explicitly designed to provide separation of queues across multiple Deployments with individual scalability and configuration.

While this chart provides a default pods: declaration, if you provide an empty definition, you will have no workers.

Requirements

This chart depends on access to Redis, PostgreSQL, and Gitaly services, either as part of the complete GitLab chart or provided as external services reachable from the Kubernetes cluster this chart is deployed onto.

Design Choices

This chart creates multiple Deployments and associated ConfigMaps. It was decided that it would be clearer to make use of ConfigMap behaviours instead of using environment attributes or additional arguments to the command for the containers, in order to avoid any concerns about command length. This choice results in a large number of ConfigMaps, but provides very clear definitions of what each pod should be doing.

Configuration

The sidekiq chart is configured in three parts: chart-wide external services, chart-wide defaults, and per-pod definitions.

Installation command line options

The table below contains all the possible charts configurations that can be supplied to the helm install command using the --set flags:

ParameterDefaultDescription
annotations Pod annotations
podLabels Supplemental Pod labels. Will not be used for selectors.
common.labels Supplemental labels that are applied to all objects created by this chart.
concurrency25Sidekiq default concurrency
deployment.strategy{}Allows one to configure the update strategy utilized by the deployment
deployment.terminationGracePeriodSeconds30Optional duration in seconds the pod needs to terminate gracefully.
enabledtrueSidekiq enabled flag
extraContainers List of extra containers to include
extraInitContainers List of extra init containers to include
extraVolumeMounts String template of extra volume mounts to configure
extraVolumes String template of extra volumes to configure
extraEnv List of extra environment variables to expose
extraEnvFrom List of extra environment variables from other data sources to expose
gitaly.serviceNamegitalyGitaly service name
health_checks.port3808Health check server port
hpa.behaviour{scaleDown: {stabilizationWindowSeconds: 300 }}Behavior contains the specifications for up- and downscaling behavior (requires autoscaling/v2beta2 or higher)
hpa.customMetrics[]Custom metrics contains the specifications for which to use to calculate the desired replica count (overrides the default use of Average CPU Utilization configured in targetAverageUtilization)
hpa.cpu.targetTypeAverageValueSet the autoscaling CPU target type, must be either Utilization or AverageValue
hpa.cpu.targetAverageValue350mSet the autoscaling CPU target value
hpa.cpu.targetAverageUtilization Set the autoscaling CPU target utilization
hpa.memory.targetType Set the autoscaling memory target type, must be either Utilization or AverageValue
hpa.memory.targetAverageValue Set the autoscaling memory target value
hpa.memory.targetAverageUtilization Set the autoscaling memory target utilization
hpa.targetAverageValue  DEPRECATED Set the autoscaling CPU target value
minReplicas2Minimum number of replicas
maxReplicas10Maximum number of replicas
maxUnavailable1Limit of maximum number of Pods to be unavailable
image.pullPolicyAlwaysSidekiq image pull policy
image.pullSecrets Secrets for the image repository
image.repositoryregistry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-eeSidekiq image repository
image.tag Sidekiq image tag
init.image.repository initContainer image
init.image.tag initContainer image tag
logging.formatdefaultSet to json for JSON-structured logs
metrics.enabledtrueIf a metrics endpoint should be made available for scraping
metrics.port3807Metrics endpoint port
metrics.path/metricsMetrics endpoint path
metrics.podMonitor.enabledfalseIf a PodMonitor should be created to enable Prometheus Operator to manage the metrics scraping
metrics.podMonitor.additionalLabels{}Additional labels to add to the PodMonitor
metrics.podMonitor.endpointConfig{}Additional endpoint configuration for the PodMonitor
metrics.annotations  DEPRECATED Set explicit metrics annotations. Replaced by template content.
metrics.tls.enabledfalseTLS enabled for the metrics/sidekiq_exporter endpoint
metrics.tls.secretName{Release.Name}-sidekiq-metrics-tlsSecret for the metrics/sidekiq_exporter endpoint TLS cert and key
psql.password.keypsql-passwordkey to psql password in psql secret
psql.password.secretgitlab-postgrespsql password secret
psql.port Set PostgreSQL server port. Takes precedence over global.psql.port
redis.serviceNameredisRedis service name
resources.requests.cpu900mSidekiq minimum needed CPU
resources.requests.memory2GSidekiq minimum needed memory
resources.limits.memory Sidekiq maximum allowed memory
timeout25Sidekiq job timeout
tolerations[]Toleration labels for pod assignment
memoryKiller.daemonModetrueIf false, uses the legacy memory killer mode
memoryKiller.maxRss2000000Maximum RSS before delayed shutdown triggered expressed in kilobytes
memoryKiller.graceTime900Time to wait before a triggered shutdown expressed in seconds
memoryKiller.shutdownWait30Amount of time after triggered shutdown for existing jobs to finish expressed in seconds
memoryKiller.hardLimitRss Maximum RSS before immediate shutdown triggered expressed in kilobyte in daemon mode
memoryKiller.checkInterval3Amount of time between memory checks
livenessProbe.initialDelaySeconds20Delay before liveness probe is initiated
livenessProbe.periodSeconds60How often to perform the liveness probe
livenessProbe.timeoutSeconds30When the liveness probe times out
livenessProbe.successThreshold1Minimum consecutive successes for the liveness probe to be considered successful after having failed
livenessProbe.failureThreshold3Minimum consecutive failures for the liveness probe to be considered failed after having succeeded
readinessProbe.initialDelaySeconds0Delay before readiness probe is initiated
readinessProbe.periodSeconds10How often to perform the readiness probe
readinessProbe.timeoutSeconds2When the readiness probe times out
readinessProbe.successThreshold1Minimum consecutive successes for the readiness probe to be considered successful after having failed
readinessProbe.failureThreshold3Minimum consecutive failures for the readiness probe to be considered failed after having succeeded
securityContext.fsGroup1000Group ID under which the pod should be started
securityContext.runAsUser1000User ID under which the pod should be started
priorityClassName""Allow configuring pods priorityClassName, this is used to control pod priority in case of eviction

Chart configuration examples

resources

resources allows you to configure the minimum and maximum amount of resources (memory and CPU) a Sidekiq pod can consume.

Sidekiq pod workloads vary greatly between deployments. Generally speaking, it is understood that each Sidekiq process consumes approximately 1 vCPU and 2 GB of memory. Vertical scaling should generally align to this 1:2 ratio of vCPU:Memory.

Below is an example use of resources:

resources:
  limits:
    memory: 5G
  requests:
    memory: 2G
    cpu: 900m

extraEnv

extraEnv allows you to expose additional environment variables in the dependencies container.

Below is an example use of extraEnv:

extraEnv:
  SOME_KEY: some_value
  SOME_OTHER_KEY: some_other_value

When the container is started, you can confirm that the environment variables are exposed:

env | grep SOME
SOME_KEY=some_value
SOME_OTHER_KEY=some_other_value

You can also set extraEnv for a specific pod:

extraEnv:
  SOME_KEY: some_value
  SOME_OTHER_KEY: some_other_value
pods:
  - name: mailers
    queues: mailers
    extraEnv:
      SOME_POD_KEY: some_pod_value
  - name: catchall
    negateQueues: mailers

This will set SOME_POD_KEY only for application containers in the mailers pod. Pod-level extraEnv settings are not added to init containers.

extraEnvFrom

extraEnvFrom allows you to expose additional environment variables from other data sources in all containers in the pods.

Below is an example use of extraEnvFrom:

extraEnvFrom:
  MY_NODE_NAME:
    fieldRef:
      fieldPath: spec.nodeName
  MY_CPU_REQUEST:
    resourceFieldRef:
      containerName: test-container
      resource: requests.cpu
  SECRET_THING:
    secretKeyRef:
      name: special-secret
      key: special_token
      # optional: boolean
  CONFIG_STRING:
    configMapKeyRef:
      name: useful-config
      key: some-string
      # optional: boolean

extraVolumes

extraVolumes allows you to configure extra volumes chart-wide.

Below is an example use of extraVolumes:

extraVolumes: |
  - name: example-volume
    persistentVolumeClaim:
      claimName: example-pvc

extraVolumeMounts

extraVolumeMounts allows you to configure extra volumeMounts on all containers chart-wide.

Below is an example use of extraVolumeMounts:

extraVolumeMounts: |
  - name: example-volume-mount
    mountPath: /etc/example

image.pullSecrets

pullSecrets allows you to authenticate to a private registry to pull images for a pod.

Additional details about private registries and their authentication methods can be found in the Kubernetes documentation.

Below is an example use of pullSecrets:

image:
  repository: my.sidekiq.repository
  pullPolicy: Always
  pullSecrets:
  - name: my-secret-name
  - name: my-secondary-secret-name

tolerations

tolerations allow you schedule pods on tainted worker nodes

Below is an example use of tolerations:

tolerations:
- key: "node_label"
  operator: "Equal"
  value: "true"
  effect: "NoSchedule"
- key: "node_label"
  operator: "Equal"
  value: "true"
  effect: "NoExecute"

annotations

annotations allows you to add annotations to the Sidekiq pods.

Below is an example use of annotations:

annotations:
  kubernetes.io/example-annotation: annotation-value

Using the Community Edition of this chart

By default, the Helm charts use the Enterprise Edition of GitLab. If desired, you can use the Community Edition instead. Learn more about the differences between the two.

In order to use the Community Edition, set image.repository to registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce.

External Services

This chart should be attached to the same Redis, PostgreSQL, and Gitaly instances as the Webservice chart. The values of external services will be populated into a ConfigMap that is shared across all Sidekiq pods.

Redis

redis:
  host: rank-racoon-redis
  port: 6379
  sentinels:
    - host: sentinel1.example.com
      port: 26379
  password:
    secret: gitlab-redis
    key: redis-password
NameTypeDefaultDescription
hostString The hostname of the Redis server with the database to use. This can be omitted in lieu of serviceName. If using Redis Sentinels, the host attribute needs to be set to the cluster name as specified in the sentinel.conf.
password.keyString The password.key attribute for Redis defines the name of the key in the secret (below) that contains the password.
password.secretString The password.secret attribute for Redis defines the name of the Kubernetes Secret to pull from.
portInteger6379The port on which to connect to the Redis server.
serviceNameStringredisThe name of the service which is operating the Redis database. If this is present, and host is not, the chart will template the hostname of the service (and current .Release.Name) in place of the host value. This is convenient when using Redis as a part of the overall GitLab chart.
sentinels.[].hostString The hostname of Redis Sentinel server for a Redis HA setup.
sentinels.[].portInteger26379The port on which to connect to the Redis Sentinel server.
note
The current Redis Sentinel support only supports Sentinels that have been deployed separately from the GitLab chart. As a result, the Redis deployment through the GitLab chart should be disabled with redis.install=false. The Secret containing the Redis password needs to be manually created before deploying the GitLab chart.

PostgreSQL

psql:
  host: rank-racoon-psql
  serviceName: pgbouncer
  port: 5432
  database: gitlabhq_production
  username: gitlab
  preparedStatements: false
  password:
    secret: gitlab-postgres
    key: psql-password
NameTypeDefaultDescription
hostString The hostname of the PostgreSQL server with the database to use. This can be omitted if postgresql.install=true (default non-production).
serviceNameString The name of the service which is operating the PostgreSQL database. If this is present, and host is not, the chart will template the hostname of the service in place of the host value.
databaseStringgitlabhq_productionThe name of the database to use on the PostgreSQL server.
password.keyString The password.key attribute for PostgreSQL defines the name of the key in the secret (below) that contains the password.
password.secretString The password.secret attribute for PostgreSQL defines the name of the Kubernetes Secret to pull from.
portInteger5432The port on which to connect to the PostgreSQL server.
usernameStringgitlabThe username with which to authenticate to the database.
preparedStatementsBooleanfalseIf prepared statements should be used when communicating with the PostgreSQL server.

Gitaly

gitaly:
  internal:
    names:
      - default
      - default2
  external:
    - name: node1
      hostname: node1.example.com
      port: 8079
  authToken:
    secret: gitaly-secret
    key: token
NameTypeDefaultDescription
hostString The hostname of the Gitaly server to use. This can be omitted in lieu of serviceName.
serviceNameStringgitalyThe name of the service which is operating the Gitaly server. If this is present, and host is not, the chart will template the hostname of the service (and current .Release.Name) in place of the host value. This is convenient when using Gitaly as a part of the overall GitLab chart.
portInteger8075The port on which to connect to the Gitaly server.
authToken.keyString The name of the key in the secret below that contains the authToken.
authToken.secretString The name of the Kubernetes Secret to pull from.

Metrics

By default, a Prometheus metrics exporter is enabled per pod. Metrics are only available when GitLab Prometheus metrics are enabled in the Admin area. The exporter exposes a /metrics endpoint on port 3807. When metrics are enabled, annotations are added to each pod allowing a Prometheus server to discover and scrape the exposed metrics.

Chart-wide defaults

The following values will be used chart-wide, in the event that a value is not presented on a per-pod basis.

NameTypeDefaultDescription
concurrencyInteger25The number of tasks to process simultaneously.
timeoutInteger4The Sidekiq shutdown timeout. The number of seconds after Sidekiq gets the TERM signal before it forcefully shuts down its processes.
memoryKiller.checkIntervalInteger3Amount of time in seconds between memory checks
memoryKiller.maxRssInteger2000000Maximum RSS before delayed shutdown triggered expressed in kilobytes
memoryKiller.graceTimeInteger900Time to wait before a triggered shutdown expressed in seconds
memoryKiller.shutdownWaitInteger30Amount of time after triggered shutdown for existing jobs to finish expressed in seconds
minReplicasInteger2Minimum number of replicas
maxReplicasInteger10Maximum number of replicas
maxUnavailableInteger1Limit of maximum number of Pods to be unavailable

Per-pod Settings

The pods declaration provides for the declaration of all attributes for a worker pod. These will be templated to Deployments, with individual ConfigMaps for their Sidekiq instances.

note
The settings default to including a single pod that is set up to monitor all queues. Making changes to the pods section will overwrite the default pod with a different pod configuration. It will not add a new pod in addition to the default.
NameTypeDefaultDescription
concurrencyInteger The number of tasks to process simultaneously. If not provided, it will be pulled from the chart-wide default.
nameString Used to name the Deployment and ConfigMap for this pod. It should be kept short, and should not be duplicated between any two entries.
queuesString  See below.
negateQueuesString  See below.
queueSelectorBooleanfalseUse the queue selector.
timeoutInteger The Sidekiq shutdown timeout. The number of seconds after Sidekiq gets the TERM signal before it forcefully shuts down its processes. If not provided, it will be pulled from the chart-wide default. This value must be less than terminationGracePeriodSeconds.
resources  Each pod can present it’s own resources requirements, which will be added to the Deployment created for it, if present. These match the Kubernetes documentation.
nodeSelector  Each pod can be configured with a nodeSelector attribute, which will be added to the Deployment created for it, if present. These definitions match the Kubernetes documentation.
memoryKiller.checkIntervalInteger3Amount of time between memory checks
memoryKiller.maxRssInteger2000000Overrides the maximum RSS for a given pod.
memoryKiller.graceTimeInteger900Overrides the time to wait before a triggered shutdown for a given Pod
memoryKiller.shutdownWaitInteger30Overrides the amount of time after triggered shutdown for existing jobs to finish for a given Pod
minReplicasInteger2Minimum number of replicas
maxReplicasInteger10Maximum number of replicas
maxUnavailableInteger1Limit of maximum number of Pods to be unavailable
podLabelsMap{}Supplemental Pod labels. Will not be used for selectors.
strategy {}Allows one to configure the update strategy utilized by the deployment
extraVolumesString Configures extra volumes for the given pod.
extraVolumeMountsString Configures extra volume mounts for the given pod.
priorityClassNameString""Allow configuring pods priorityClassName, this is used to control pod priority in case of eviction
hpa.customMetricsArray[]Custom metrics contains the specifications for which to use to calculate the desired replica count (overrides the default use of Average CPU Utilization configured in targetAverageUtilization)
hpa.cpu.targetTypeStringAverageValueOverrides the autoscaling CPU target type, must be either Utilization or AverageValue
hpa.cpu.targetAverageValueString350mOverrides the autoscaling CPU target value
hpa.cpu.targetAverageUtilizationInteger Overrides the autoscaling CPU target utilization
hpa.memory.targetTypeString Overrides the autoscaling memory target type, must be either Utilization or AverageValue
hpa.memory.targetAverageValueString Overrides the autoscaling memory target value
hpa.memory.targetAverageUtilizationInteger Overrides the autoscaling memory target utilization
hpa.targetAverageValueString  DEPRECATED Overrides the autoscaling CPU target value
extraEnvMap List of extra environment variables to expose. The chart-wide value is merged into this, with values from the pod taking precedence
extraEnvFromMap List of extra environment variables from other data source to expose
terminationGracePeriodSecondsInteger30Optional duration in seconds the pod needs to terminate gracefully.

queues

The queues value is a string containing a comma-separated list of queues to be processed. By default, it is not set, meaning that all queues will be processed.

The string should not contain spaces: merge,post_receive,process_commit will work, but merge, post_receive, process_commit will not.

Any queue to which jobs are added but are not represented as a part of at least one pod item will not be processed. For a complete list of all queues, see these files in the GitLab source:

  1. app/workers/all_queues.yml
  2. ee/app/workers/all_queues.yml

negateQueues

negateQueues is in the same format as queues, but it represents queues to be ignored rather than processed.

The string should not contain spaces: merge,post_receive,process_commit will work, but merge, post_receive, process_commit will not.

This is useful if you have a pod processing important queues, and another pod processing other queues: they can use the same list of queues, with one being in queues and the other being in negateQueues.

note
negateQueues should not be provided alongside queues, as it will have no effect.

Example pod entry

pods:
  - name: immediate
    concurrency: 10
    minReplicas: 2  # defaults to inherited value
    maxReplicas: 10 # defaults to inherited value
    maxUnavailable: 5 # defaults to inherited value
    queues: merge,post_receive,process_commit
    extraVolumeMounts: |
      - name: example-volume-mount
        mountPath: /etc/example
    extraVolumes: |
      - name: example-volume
        persistentVolumeClaim:
          claimName: example-pvc
    resources:
      limits:
        cpu: 800m
        memory: 2Gi
    hpa:
      cpu:
        targetType: Value
        targetAverageValue: 350m

Configuring the networkpolicy

This section controls the NetworkPolicy. This configuration is optional and is used to limit Egress and Ingress of the Pods to specific endpoints.

NameTypeDefaultDescription
enabledBooleanfalseThis setting enables the network policy
ingress.enabledBooleanfalseWhen set to true, the Ingress network policy will be activated. This will block all Ingress connections unless rules are specified.
ingress.rulesArray[]Rules for the Ingress policy, for details see https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource and the example below
egress.enabledBooleanfalseWhen set to true, the Egress network policy will be activated. This will block all egress connections unless rules are specified.
egress.rulesArray[]Rules for the egress policy, these for details see https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource and the example below

Example Network Policy

The Sidekiq service requires Ingress connections for only the Prometheus exporter if enabled, and normally requires Egress connections to various places. This examples adds the following network policy:

  • All Ingress requests from the network on TCP 10.0.0.0/8 port 3807 are allowed for metrics exporting
  • All Egress requests to the network on UDP 10.0.0.0/8 port 53 are allowed for DNS
  • All Egress requests to the network on TCP 10.0.0.0/8 port 5432 are allowed for PostgreSQL
  • All Egress requests to the network on TCP 10.0.0.0/8 port 6379 are allowed for Redis
  • Other Egress requests to the local network on 10.0.0.0/8 are restricted
  • Egress requests outside of the 10.0.0.0/8 are allowed

Note the example provided is only an example and may not be complete

Note that the Sidekiq service requires outbound connectivity to the public internet for images on external object storage

networkpolicy:
  enabled: true
  ingress:
    enabled: true
    rules:
      - from:
        - ipBlock:
            cidr: 10.0.0.0/8
        ports:
        - port: 3807
  egress:
    enabled: true
    rules:
      - to:
        - ipBlock:
            cidr: 10.0.0.0/8
        ports:
        - port: 53
          protocol: UDP
      - to:
        - ipBlock:
            cidr: 10.0.0.0/8
        ports:
        - port: 5432
          protocol: TCP
      - to:
        - ipBlock:
            cidr: 10.0.0.0/8
        ports:
        - port: 6379
          protocol: TCP
      - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
            - 10.0.0.0/8