Merge branch 'renovate/ironbank' into 'main'

SKIP UPDATE CHECK Update Ironbank

See merge request !338

.gitignore

+.idea
+chart/tests/.env
+chart/tests/cypress.env.json
+chart/tests/cypress.config.js
+chart/tests/cypress/downloads/
+chart/tests/cypress/fixtures/
+chart/tests/cypress/support/
+chart/tests/cypress/screenshots/
+chart/tests/cypress/videos/
+node_modules
\ No newline at end of file

CHANGELOG.md

@@ -3,6 +3,28 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
+
+## [8.3.0-bb.0] (2024-10-23)
+
+### Changed
+
+- ironbank/gitlab/gitlab/gitlab-webservice (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/bitnami/analytics/redis-exporter (source) v1.64.1 -> v1.65.0
+- registry1.dso.mil/ironbank/gitlab/gitlab/certificates (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitaly (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-container-registry (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-exporter (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-mailroom (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-pages (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-shell (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-sidekiq (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-toolbox (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-webservice (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-webservice (source) v17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-workhorse (source) 17.2.9 -> 17.3.6
+- registry1.dso.mil/ironbank/gitlab/gitlab/kubectl (source) 17.2.9 -> 17.3.6
+
 ## [8.2.9-bb.4] (2024-10-22)
 
 ### Added
@@ -80,7 +102,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 - Update ironbank/bitnami/redis (source) 7.0.0-debian-10-r3 -> 7.4.0
 
-
 ## [8.2.7-bb.0] (2024-09-18)
 
 ### Changed

chart/.gitlab-ci.yml

@@ -28,7 +28,7 @@ default:
 
 variables:
   AUTO_DEPLOY_TAG_REGEX: '^[0-9]+\.[0-9]+\.[0-9]+\+[a-z0-9]{7,}$'
-  DOCKER_VERSION: "24.0.6"
+  DOCKER_VERSION: "27.1.1"
   HELM_VERSION: "3.10.3"
   KUBECTL_VERSION: "1.27.9"
   STABLE_REPO_URL: "https://charts.helm.sh/stable"
@@ -50,7 +50,7 @@ variables:
   DEBIAN_VERSION: bookworm
   RUBY_VERSION: "3.1.5"
   CI_TOOLS_VERSION: "4.22.0"
-  GITLAB_QA_VERSION: "14.12.0"
+  GITLAB_QA_VERSION: "14.13.0"
   # STRICT_VERSIONS is used in RSpecs to ensure exact version match for tools like "helm" and "kubectl"
   STRICT_VERSIONS: "true"
   KUBE_CRD_SCHEMA_URL: "https://raw.githubusercontent.com/kubernetes/kubernetes/master/api/openapi-spec/v3/apis__apiextensions.k8s.io__v1_openapi.json"
@@ -87,6 +87,7 @@ stages:
 include:
   - local: '/.gitlab/ci/rules.gitlab-ci.yml'
   - local: '/.gitlab/ci/review-apps.gitlab-ci.yml'
+  - local: '/.gitlab/ci/operator.gitlab-ci.yml'
   - template: Jobs/Dependency-Scanning.latest.gitlab-ci.yml
   - template: Jobs/Secret-Detection.latest.gitlab-ci.yml
   - template: Jobs/SAST.latest.gitlab-ci.yml

chart/.gitlab/ci/operator.gitlab-ci.yml

+trigger_operator_test:
+  stage: approve-review-apps
+  trigger:
+    project: 'gitlab-org/cloud-native/gitlab-operator'
+    branch: master
+  variables:
+    CHARTS_REF: "${CI_COMMIT_SHA}"
+    TRIGGER_PROJECT: "${CI_PROJECT_PATH}"
+  inherit:
+    variables: false
+  when: manual
+  rules:
+    - if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PIPELINE_SOURCE == "merge_request_event"'
+

chart/.markdownlint-cli2.yaml

@@ -16,7 +16,12 @@ config:
     style: "atx"
   hr-style:                         # MD035
     style: "---"
-  line-length: false                # MD013
+  line-length:                      # MD013
+    code_blocks: false
+    tables: false
+    headings: true
+    heading_line_length: 100
+    line_length: 800
   no-duplicate-heading:             # MD024
     siblings_only: true
   no-emphasis-as-heading: false     # MD036

chart/.vale.ini

@@ -6,4 +6,7 @@ StylesPath = doc/.vale
 MinAlertLevel = suggestion
 
 [*.md]
-BasedOnStyles = gitlab
+BasedOnStyles = gitlab_base, gitlab_docs
+
+# Ignore SVG markup
+TokenIgnores = (\*\*\{\w*\}\*\*)

chart/CONTRIBUTING.md

@@ -67,8 +67,8 @@ request is as follows:
     1. If you are contributing code, fill in the template already provided in the
      "Description" field.
     1. If you are contributing documentation
-      1. Choose `Documentation` from the "Choose a template" menu and fill in the template.
-      1. Ensure the branch name starts with `docs-` or ends with `-docs`
+    1. Choose `Documentation` from the "Choose a template" menu and fill in the template.
+    1. Ensure the branch name starts with `docs-` or ends with `-docs`
     1. Mention the issue(s) your merge request solves, using the `Solves #XXX` or
     `Closes #XXX` syntax to auto-close the issue(s) once the merge request will
     be merged.
@@ -162,7 +162,7 @@ This code of conduct applies both within project spaces and in public spaces
 when an individual is representing the project or its community.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior can be
-reported by emailing contact@gitlab.com.
+reported by emailing <contact@gitlab.com>.
 
 This Code of Conduct is adapted from the [Contributor Covenant][contributor-covenant], version 1.1.0,
 available at [http://contributor-covenant.org/version/1/1/0/](http://contributor-covenant.org/version/1/1/0/).
@@ -174,5 +174,4 @@ available at [http://contributor-covenant.org/version/1/1/0/](http://contributor
 [changelog]: doc/development/changelog.md "Generate a changelog entry"
 [git-squash]: https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits
 [definition-of-done]: http://guide.agilealliance.org/guide/definition-of-done.html
-[contributor-covenant]: http://contributor-covenant.org
 [CNG]: https://gitlab.com/gitlab-org/build/CNG/

chart/Chart.yaml

 ---
 apiVersion: v1
 name: gitlab
-version: 8.2.9-bb.4
-appVersion: v17.2.9
+version: 8.3.6-bb.0
+appVersion: v17.3.6
 description: GitLab is the most comprehensive AI-powered DevSecOps Platform.
 keywords:
 - gitlab
@@ -15,40 +15,40 @@ maintainers:
   email: support@gitlab.com
 annotations:
   bigbang.dev/applicationVersions: |
-    - Gitlab: 17.2.9
+    - Gitlab: 17.3.6
   bigbang.dev/upstreamReleaseNotesMarkdown: |
     The [upstream chart's release notes](https://gitlab.com/gitlab-org/charts/gitlab/-/blob/master/CHANGELOG.md) may help when reviewing this package.
   helm.sh/images: |
     - name: redis-exporter
       condition: redis.metrics.enabled
-      image: registry1.dso.mil/ironbank/bitnami/analytics/redis-exporter:v1.64.1
+      image: registry1.dso.mil/ironbank/bitnami/analytics/redis-exporter:v1.65.0
     - name: redis
       condition: redis.install
       image: registry1.dso.mil/ironbank/bitnami/redis:7.4.1
     - name: alpine-certificates
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/certificates:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/certificates:17.3.6
     - name: cfssl-self-sign
       condition: shared-secrets.enabled
       image: registry1.dso.mil/ironbank/gitlab/gitlab/cfssl-self-sign:1.6.1
     - name: gitaly
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitaly:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitaly:17.3.6
     - name: gitlab-container-registry
       condition: registry.enabled
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-container-registry:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-container-registry:17.3.6
     - name: gitlab-shell
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-shell:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-shell:17.3.6
     - name: gitlab-sidekiq
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-sidekiq:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-sidekiq:17.3.6
     - name: gitlab-toolbox
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-toolbox:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-toolbox:17.3.6
     - name: gitlab-webservice
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-webservice:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-webservice:17.3.6
     - name: gitlab-workhorse
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-workhorse:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-workhorse:17.3.6
     - name: gitlab-pages
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-pages:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-pages:17.3.6
     - name: kubectl
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/kubectl:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/kubectl:17.3.6
     - name: mc
       image: registry1.dso.mil/ironbank/opensource/minio/mc:RELEASE.2024-10-02T08-27-28Z
     - name: minio
@@ -60,10 +60,10 @@ annotations:
       condition: upgradeCheck.enabled
       image: registry1.dso.mil/ironbank/redhat/ubi/ubi9:9.4
     - name: gitlab-base
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-base:17.3.6
     - name: gitlab-exporter
       condition: gitlab.gitlab-exporter.enabled
-      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-exporter:17.2.9
+      image: registry1.dso.mil/ironbank/gitlab/gitlab/gitlab-exporter:17.3.6
     - name: bbtests
       condition: bbtests.enabled
       image: registry1.dso.mil/bigbang-ci/gitlab-tester:0.0.4

chart/Kptfile

@@ -5,7 +5,7 @@ metadata:
 upstream:
   type: git
   git:
-    commit: 7747e52f59619c1d3f885e6e326bcb248008fc0f
+    commit: 960b9c67fb2c0a92dfbd71f4197248e714c1652b
     repo: https://gitlab.com/gitlab-org/charts/gitlab
     directory: /
-    ref: v8.2.9
+    ref: v8.3.6

chart/bigbang/README.md

 # DoD Approved External PKI Certificate Trust Chains
+
 The version 9.5 certs were downloaded from [public.cyber.mil](https://public.cyber.mil/pki-pke/pkipke-document-library/)
-https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/unclass-dod_approved_external_pkis_trust_chains.zip
\ No newline at end of file
+<https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/unclass-dod_approved_external_pkis_trust_chains.zip>

chart/charts/gitlab/charts/geo-logcursor/Chart.yaml

 apiVersion: v1
 name: geo-logcursor
-version: 8.2.9
-appVersion: v17.2.9
+version: 8.3.6
+appVersion: v17.3.6
 description: GitLab Geo logcursor
 keywords:
 - gitlab

chart/charts/gitlab/charts/gitaly/Chart.yaml

 apiVersion: v1
 name: gitaly
-version: 8.2.9
-appVersion: 17.2.9
+version: 8.3.6
+appVersion: 17.3.6
 description: Git RPC service for handling all the git calls made by GitLab
 keywords:
 - gitlab

chart/charts/gitlab/charts/gitaly/templates/_configmap_spec.yaml

@@ -31,22 +31,25 @@ data:
     prometheus_listen_addr = "0.0.0.0:{{ default .Values.metrics.port .Values.metrics.metricsPort }}"
     {{- end }}
 
+    # Graceful shutdown timeout, how long to wait for in-flight requests to complete
+    graceful_restart_timeout = "{{ .Values.gracefulRestartTimeout | toString | duration }}"
+
     {{- if $.Values.global.gitaly.tls.enabled }}
     [tls]
     certificate_path = '/etc/gitlab-secrets/gitaly/gitaly.crt'
     key_path = '/etc/gitlab-secrets/gitaly/gitaly.key'
     {{- end }}
 
+    # Storage configuration
     {{- if .storage }}
 
     {{- /*
     Passing in "skipStorages=true" below prevents changes in the Gitaly replica counts from modifying
     the contents of the ConfigMap, which would cause existing pods to restart unnecessarily.
     */}}
-    {{ if not .skipStorages }}
+    {{- if not .skipStorages }}
     {% $storages := coll.Slice {{ include "gitlab.praefect.gitaly.storageNames" . }} %}
     {{- end }}
-
     {% $hostname := .Env.HOSTNAME | strings.TrimSpace %}
     {% if coll.Has $storages $hostname %}
     [[storage]]
@@ -62,10 +65,9 @@ data:
     Passing in "skipStorages=true" below prevents changes in the Gitaly replica counts from modifying
     the contents of the ConfigMap, which would cause existing pods to restart unnecessarily.
     */}}
-    {{ if not .skipStorages }}
+    {{- if not .skipStorages }}
     {% $storages := coll.Slice {{ include "gitlab.gitaly.storageNames" . }} %}
     {{- end }}
-
     {% $index := index (.Env.HOSTNAME | strings.Split "-" | coll.Reverse) 0 | conv.ToInt64 %}
     {% if len $storages | lt $index %}
     [[storage]]

chart/charts/gitlab/charts/gitaly/templates/_statefulset_spec.yaml

@@ -54,7 +54,7 @@ spec:
         {{- toYaml .Values.tolerations | nindent 8 }}
       {{- end }}
       {{- include "gitlab.priorityClassName" . | nindent 6 }}
-      terminationGracePeriodSeconds: 30
+      terminationGracePeriodSeconds: {{ .Values.gracefulRestartTimeout | int | add 5 }}
       initContainers:
       {{- if .Values.cgroups.enabled }}
         - name: init-cgroups

chart/charts/gitlab/charts/gitaly/values.yaml

@@ -67,17 +67,23 @@ tolerations: []
 ## The Gitaly StatefulSet's priorityClassName
 # priorityClassName:
 
+# Gitaly shutdown grace period, how long to wait for in-flight requests to complete (seconds)
+# Pod `terminationGracePeriodSeconds` is set to this value + 5 seconds
+gracefulRestartTimeout: 25
+
 logging:
   format: "json"
   # level:
   # sentryDsn:
   # sentryEnvironment:
+
 git: {}
   # catFileCacheSize:
   ## Amend the default configuration Gitaly is using when spawning Git
   ## commands. Accepts configuration as documented in git-config(1).
   # config:
   #   - {key: "pack.threads", value: 4}
+
 prometheus: {}
   # grpcLatencyBuckets: "[1.0, 1.5, 2.0, 2.5]"