GitLab 19 Upgrade
This MR contains the following updates:
Verified Publisher image migration: The GitLab image rows also move repositories from registry1.dso.mil/ironbank/gitlab/gitlab/* to Verified Publisher CNG UBI images under registry1.dso.mil/gitlab/gitlab-org/build/cng/*. Because the Verified Publisher images use upstream component-specific tag schemes, Renovate’s generated major classification is not a direct semantic-version comparison for every component; the left-hand tag belongs to the former Iron Bank image and the right-hand tag to the replacement Verified Publisher image. Disabled-by-default Gitaly cgroups, Geo log cursor, OpenBao, and Zoekt workloads use the same VP release images; Zoekt gateways use Iron Bank Nginx.
Complete MR checklist
Assignee
- Followed upgrade instructions outlined in docs/DEVELOPMENT_MAINTENANCE.md
- Update Docs with new/updated steps as needed
- Tested and Validated Changes made with supporting info like logs or screenshots from test pipelines
Add supporting info below
Fresh staged upgrade: GitLab and GitLab Runner HelmReleases
Fresh staged upgrade: GitLab namespace pods
Redis HelmRelease
Redis namespace pods
Garage HelmRelease
Garage namespace pods
CloudNativePG operator HelmRelease
CloudNativePG operator namespace pods
PostgreSQL operand HelmRelease (wrapper/post-renderer)
PostgreSQL operand namespace pods
Pre-upgrade and post-upgrade backups
Batched background migrations
GitLab 19.1.3 version
Upgraded repository and LFS content
Pre-upgrade and post-upgrade pipelines and artifacts
Preserved issue attachment
Preserved package registry content
Preserved container registry content
P1 CAC SSO session
P1 CAC SSO user profile
P1 CAC SSO profile update
Ambient topology validation
GitLab application script test
GitLab webservice Prometheus target
Validation summary
The GitLab package remains external-service-only. It adds no PostgreSQL, Redis, Garage, or CloudNativePG subcharts, templates, custom resources, or consumer defaults. For internal validation only, the temporary Big Bang umbrella validation MR !8036 provisions the dependencies as independent releases through the umbrella packages: mechanism:
- The Big Bang maintained CloudNativePG operator runs in the
cloudnative-pgnamespace. - Big Bang
wrapperchart0.4.15is thepostgresqlHelmRelease. Flux replaces its placeholder ConfigMap in memory with the single PostgreSQL 17Cluster/postgresqlresource before Helm applies or stores the manifest, so no placeholder ConfigMap is installed. The release depends on CloudNativePG and waits for the Cluster'sReady=Truecondition; CloudNativePG generatesSecret/postgresql-app. - The Big Bang maintained Redis and Garage releases run in the
redisandgaragenamespaces. - GitLab depends on the PostgreSQL, Redis, and Garage HelmReleases. A CI-only Kyverno policy copies the Redis and CloudNativePG-generated credentials and transforms Garage's test-only source Secret into the GitLab namespace.
These dependencies and credentials exist only in package and umbrella test profiles. They are not part of this GitLab chart and are not a supported consumer development or production persistence topology.
Static validation passed at package head 96f0d3cb: Helm dependencies are synchronized, chart linting and standard/ambient rendering pass, all package Helm unit tests pass (5/5), both test-value files parse successfully, the chart/changelog versions agree, git diff --check passes, and Renovate 43.268.4 validates the configuration and extracts the expected dependencies.
A fresh staged upgrade was completed from GitLab 18.11.7 / chart 9.11.8-bb.1 to GitLab 19.1.3 / chart 10.1.3-bb.0. The GitLab 18 deployment was seeded with repository history, Git LFS, an issue attachment, a generic package, a Container Registry image, a Runner pipeline, and an artifact. PostgreSQL 17.10, Redis, and Garage were installed and populated before GitLab 18 was moved off its bundled services; GitLab 18 and a fresh backup were then verified against those external services before the GitLab 19 upgrade.
The upgraded deployment completed all 513 regular database migrations and all 19 batched background migrations. A GitLab 19 backup and restore was also exercised: pre-backup application data survived, a post-backup sentinel commit was removed by the restore, and a fresh post-restore Runner pipeline and artifact passed. Existing GitLab 18 and new GitLab 19 repository, LFS, upload, package, Registry, and pipeline data were verified; new Git, LFS, package, upload, Registry push/pull/delete, and backup operations also passed.
The final deployment was validated with both sidecar and ambient service-mesh profiles. GitLab, GitLab Runner, CloudNativePG, PostgreSQL, Redis, and Garage reconciled Ready; application pods are healthy with no active failures. Verified Publisher image pulls, P1 CAC SSO login and profile updates, the documented GitLab application script test, and the GitLab Prometheus target all passed.
The approved skip-job-upgrade label remains necessary because the generic one-step CI upgrade lane cannot perform GitLab 19's required staged data migration away from the removed bundled services. The full staged upgrade, backup, restore, and application checks above provide the upgrade evidence for this major release. Required exact-head pipeline results remain visible in the GitLab widgets for package MR !473 and temporary umbrella validation MR !8036.
Reviewer only
- Tested and Validated changes
Configuration
- If you want to rebase/retry this MR, check this box
This MR was automatically generated by Renovate Bot.
Upgrade Notices
GitLab 19 / chart 10 removes the bundled PostgreSQL, Redis, and MinIO charts. Helm does not migrate their data.
- Consumers using any bundled service must remain on the latest GitLab 18.11 / chart 9.11 patch while following GitLab's bundled-chart migration procedure. Verify GitLab and a fresh backup against the replacement services before upgrading to chart 10. Retain the old PVCs, Secrets, and recovery artifacts until GitLab 19 and a new backup are verified.
- Consumers already using GitLab 19-compatible external PostgreSQL 17, Redis 7.0 or later (7.2 recommended) or Valkey 7.2 or later, and GitLab-supported external object storage do not need a service-data migration solely because the bundled charts were removed. They must still complete the normal GitLab 19 pre-upgrade checks, verify every external connection and bucket, finish pending migrations, and take a fresh verified backup.
- This package does not deploy or support replacement PostgreSQL, Redis/Valkey, object-storage, or CloudNativePG resources for consumers. Configure GitLab-supported external services before upgrading. If CloudNativePG is selected, install and manage the Big Bang maintained CloudNativePG operator before creating the PostgreSQL
Cluster; its lifecycle remains outside this GitLab package. For production, follow GitLab's Cloud Native Hybrid guidance. - Build clean chart 10 values instead of reusing chart 9 values. Remove obsolete
global.minio,upstream.minio,upstream.postgresql, andupstream.rediskeys while retaining every supported override. In particular, preserve the existing Gitaly persistence size because the StatefulSet volume-claim template is immutable. Render and diff the chart 10 StatefulSets before reconciling. - Follow the Big Bang-specific GitLab 19 upgrade notes. Inventory all optional databases and object-storage buckets because the default GitLab backup does not cover every site-specific data store. Once GitLab 19 database migrations run, do not start GitLab 18 against that database; rollback requires matching GitLab, database, and object-storage recovery points.
- GitLab 19 removes the OAuth Resource Owner Password Credentials grant. Replace integrations using that grant before upgrading. If bundled Spamcheck is enabled, deploy Spamcheck separately. GitLab 19.1 also drops Elasticsearch 7.x support for Advanced Search; move to a supported Elasticsearch or OpenSearch release first.
- GitLab application images move from Iron Bank to Verified Publisher CNG images under
registry1.dso.mil/gitlab/gitlab-org/build/cng/*. No separate application or data migration is required for this image-source change, but Registry1 credentials, mirrors, policies, and allowlists must permit the new path. - Review the GitLab 19 breaking changes, deprecations and removals, chart 10 upgrade notes, and GitLab 19 upgrade changes for site-specific impacts.
Umbrella Branch
gitlab-19-external-ci-dependencies