GitLab Helm chart 10.0 upgrade notes
With the 19.0 release of GitLab, we have released version 10.0 of the GitLab Helm chart.
This document highlights the changes with the highest impact. For a comprehensive overview, see:
Summary of major changes
- NGINX Ingress is now disabled by default and replaced by Gateway API with Envoy Gateway.
- The bundled PostgreSQL, Redis, and MinIO have been removed from the GitLab chart.
- Support for PostgreSQL 16 has been removed. Make sure you are running PostgreSQL 17 before upgrading.
- Resource Owner Password Credentials (ROPC) OAuth grant removed.
For mitigation steps and full details, follow the linked deprecation notices.
Upgrade to 10.4.0
KAS advertises native gRPC to agents by default
The address in gitlab_kas.external_url, shown in the agent installation instructions, now
defaults to grpcs://kas.example.com instead of wss://kas.example.com when the chart routes
gRPC to KAS: with Gateway API and the chart-managed Envoy Gateway policies (the default), or
with the NGINX Ingress provider, for which the KAS gRPC Ingress is now rendered by default. Other Ingress controllers and installations with a
relative URL root keep wss://. Agents already connected over wss:// are not affected.
To keep advertising WebSocket, set global.appConfig.gitlab_kas.externalUrl. To skip the gRPC
Ingress, set global.kas.ingress.grpc.enabled: false. For details, see
agent connection protocol.
Upgrade to 10.3
Envoy Gateway upgrade requires new CRDs
The bundled Envoy Gateway chart is upgraded from 1.8.3 to 1.9.1. Helm does not upgrade CRDs, so
apply the Envoy Gateway and Gateway API CRDs for 1.9.1 before you upgrade GitLab. Otherwise the
upgrade fails on the GitLab Shell TCPRoute, and the API server prunes the new Host header
setting on the Webservice listeners. For the upgrade steps, see
Upgrade the Envoy Gateway CRDs.