Toolbox add-on

Status: Implemented Issue: none Parent: GitLab components

Goal

An administrator turns on the Toolbox of an instance, in the resource or in the Bridge UI, with the storage its backups go to, so that backup and restore work without writing chart values. For the design, see ADR 40.

Requirements

  • spec.components.toolbox.enabled turns the Toolbox on. Leaving the entry out keeps the Toolbox off, unless spec.chart.values turn it on.
  • spec.components.toolbox.backups.storage.secretRef references the Secret holding the configuration of the backup storage, in the format of its backend. backups is required while the Toolbox is on.
  • backups.storage.backend selects s3, gcs, or azure, and defaults to s3. gcpProject is required for gcs, and the API server rejects it for any other backend.
  • backups.schedule takes a cron schedule, and turns on scheduled backups. Leaving it unset takes no scheduled backups.
  • No storage configuration is stored in the resource.
  • The Operator creates no bucket.
  • The form shows the Toolbox as the Toolbox add-on. Its enable switch unlocks a backup storage group, all-or-nothing and reported before any request is sent, with the backend, and the GCP project for gcs only, and an optional schedule.

Out of scope

  • Provisioning the bucket.
  • Backing up the registry or OpenBao databases, persistence of the Toolbox, and every other Toolbox setting. They stay reachable through spec.chart.values.
  • Running a backup or a restore from the Bridge UI.

FAQ

  • Why is the Toolbox off by default? The requester asked for it, to match the registry. Without backup storage, its backups fail. An instance that had a Toolbox loses it, and with it gitlab-rails console, until spec.components.toolbox or spec.chart.values turn it on.
  • What happens to backups configured in spec.chart.values? They stop, with their CronJob, unless the free-form values also set gitlab.toolbox.enabled: true. Before, the chart default ran the Toolbox, so those values never set it.
  • Why does the Toolbox not use spec.objectStorage? The chart reads backup storage from a configuration of its own, in the format of the backup tool, not from the consolidated object storage connection.
  • Why is the Toolbox an add-on rather than a component switch? Backup and restore need settings of their own, like the registry.