Documentation

Description and Architecture

This module was created to simplify deploying Gitlab into the EKS with storage on AWS S3, AWS Aurora for PostreSQL, and AWS ElastiCache Redis.

In the above diagram, you can see the components and their relations (PostgreSQL and Redis are not deployed with this module).

Lean backup CronJob

The chart deploys a single nightly full backup (blobs included) via the toolbox backups.cron. The optional lean_backup input adds a second, toggleable tier: an intraday "lean full" backup that runs backup-utility with all object-storage/blob components skipped, so only db and repositories are captured. This is useful when the blob data already lives durably in S3 and only the database and Git repositories need a more frequent off-instance copy.

It is disabled by default. Enabling it takes a single flag:

lean_backup = {
  enabled = true
}

Everything else has sensible defaults (schedule 0 6,12,18 * * *, concurrencyPolicy: Forbid, activeDeadlineSeconds: 2700, gitlab-base node placement, and the full blob --skip list). See the lean_backup input below for the complete set of overridable fields.

The CronJob is rendered from templates/lean-backup-cronjob.yaml.tpl and applied with the kubectl provider. The template is a faithful clone of the chart-managed toolbox backup pod spec (init containers, projected secrets, volumes and env), with only scheduling, resources and the --skip arguments parameterized. Container/init image repositories are taken from values, and the image tag is resolved automatically from the deployed release's GitLab application version (the chart's appVersion / global.gitlabVersion) — so no version needs to be maintained here.

Chart upgrades: because the template mirrors the chart's rendered toolbox backup pod spec, it must be re-synced after major GitLab chart upgrades that change the toolbox secret/volume topology. Regenerate it from the live CronJob: kubectl -n <ns> get cronjob <release>-toolbox-backup -o yaml.

Requirements

Name	Version
terraform	>= 1.5.7
aws	>= 6.0
helm	2.11.0
kubectl	~> 2.0
kubernetes	>= 2.20
time	>= 0.9

Providers

Name	Version
aws	6.55.0
helm	2.11.0
kubectl	2.4.1
kubernetes	3.2.1

Modules

Name	Source	Version
gitlab_policy	terraform-aws-modules/iam/aws//modules/iam-policy	v6.4.0
gitlab_role	terraform-aws-modules/iam/aws//modules/iam-role	v6.4.0
s3_bucket	terraform-aws-modules/s3-bucket/aws	5.10.0

Resources

Name	Type
helm_release.gitlab	resource
kubectl_manifest.lean_backup	resource
kubernetes_namespace_v1.gitlab	resource
kubernetes_secret_v1.gitlab_omniauth_providers	resource
kubernetes_secret_v1.gitlab_rails_storage	resource
kubernetes_secret_v1.gitlab_registry_storage	resource
kubernetes_secret_v1.ldap	resource
kubernetes_secret_v1.postgres	resource
kubernetes_secret_v1.redis	resource
kubernetes_secret_v1.registry_postgres	resource
kubernetes_secret_v1.smtp	resource
aws_eks_cluster.eks	data source
aws_iam_policy_document.s3_bucket_policy	data source
aws_region.current	data source

Inputs

Name	Description	Type	Default	Required
bucket_prefix	Prefix used for S3 buckets	string	""	no
buckets_lifecycles	Lifecycle rules for buckets	map(string)	{}	no
buckets_versioning	Versioning for buckets	map(bool)	{}	no
cluster_name	EKS cluster name where you want to deploy the release	string	n/a	yes
database_password	Password to access PostgreSQL database	string	n/a	yes
gitlab_chart_version	Version of the gitlab chart	string	"7.8.1"	no
ldap_password	LDAP password	string	""	no
lean_backup	Optional intraday "lean full" backup CronJob (db + repositories only; object-storage/blob components skipped). Rendered as a clone of the chart's toolbox backup CronJob with only the scheduling, resources and --skip arguments changed, so env/secrets/volumes stay faithful to the chart. Disabled by default; set enabled = true to create it. Images default to the toolbox/certificates/gitlab-base repositories taken from values, tagged with the GitLab application version resolved from the deployed Helm release (the chart's appVersion, or global.gitlabVersion if set) — so there is no image version to maintain here. Supply the full *_image fields only to override. name defaults to "<release_name>-toolbox-backup-lean" and service_account_name to "<release_name>-toolbox".	object({ enabled = optional(bool, false) schedule = optional(string, "0 6,12,18 * * *") name = optional(string, null) toolbox_image = optional(string, null) certificates_image = optional(string, null) configure_image = optional(string, null) service_account_name = optional(string, null) rails_secret_name = optional(string, null) concurrency_policy = optional(string, "Forbid") restart_policy = optional(string, "Never") active_deadline_seconds = optional(number, 2700) backoff_limit = optional(number, 0) successful_jobs_history_limit = optional(number, 1) failed_jobs_history_limit = optional(number, 3) ttl_seconds_after_finished = optional(number, 86400) tmp_storage_size = optional(string, "30Gi") skip = optional(list(string), [ "registry", "uploads", "pages", "packages", "external_diffs", "ci_secure_files", "lfs", "artifacts", "terraform_state", ]) node_selector = optional(map(string), { provisioner = "gitlab-base" nodetype = "gitlab-base" }) tolerations = optional(list(object({ key = string value = optional(string) effect = string operator = optional(string) })), [{ key = "gitlab-base", value = "true", effect = "NoSchedule" }]) pod_annotations = optional(map(string), { "karpenter.sh/do-not-disrupt" = "true" }) resources = optional(any, { requests = { cpu = "500m", memory = "1G" } }) })	{}	no
namespace_labels	Labels for GitLab namespace	map(string)	{}	no
omniauth_providers	OmniAuth providers	map(string)	{}	no
redis_password	Password to access Redis database	string	n/a	yes
registry_database_password	Password to access Registry PostgreSQL database	string	null	no
release_max_history	Maximum saved revisions per release	number	10	no
release_name	This is the name of the release which also used as a prefix or suffix for the resources	string	"gitlab"	no
release_namespace	Namespace name where you want to deploy the release. If empty, release_name will be used.	string	""	no
role_policy	Policy for GitLab role	string	null	no
role_suffix	Optional suffix for GitLab role	string	"access-aws"	no
smtp_password	SMTP Password	string	""	no
smtp_user	SMTP Username	string	""	no
tags	A map of tags to add to all resources	map(string)	{}	no
values	Custom values.yaml file for the Helm chart	any	[]	no

Outputs

Name	Description
buckets	List of buckets created
lean_backup_cronjob_name	Name of the lean backup CronJob, or null when lean_backup is disabled
role_arn	ARN of IAM role
role_name	Name of IAM role