For AI agents: the complete documentation index is available at /llms.txt, the full documentation bundle is available at /llms-full.txt, and this page is available as Markdown at /reference/docs/decisions/0041-gitlab-waldur-services.md.

0041 — GitLab and Waldur as Argo CD services

Status: Proposed. Implements stage 3 of 0040; the implementation is in DD-0041. Date: 13 October 2026. Waldur pin updated to 8.1.3 on 22 October 2026.

Context

0040 places every service in Argo CD and keeps the cluster layers in Ansible. GitLab and Waldur are the first services. Each needs a database and a broker or cache. Users must sign in through the shared AAI, and the services must be reachable through the existing catalogue edge. Neither may widen what the Argo controller can do outside its own namespaces.

Decision

  1. One Application per service (gitops/apps/base/{gitlab,waldur}.yaml), each a wrapper chart in gitops/manifests/<service>/chart that vendors the upstream chart (GitLab 10.5.1, Waldur 8.1.3) by SHA-256 and pins every image by digest. Both run on sync wave 3, after shared infrastructure, AAI and the routes.
  2. A separate services AppProject and cluster binding limit the controller to the gitlab and waldur namespaces and to an explicit list of namespaced kinds. No cluster-scoped resources are allowed. The namespaces, their Pod Security labels and the controller's Roles stay in the Ansible bootstrap. The route-writer admission fence also covers the new project.
  3. Shared providers retain separate consumer authority. The development stack uses PostgreSQL 18.6 with separate GitLab/Waldur databases and roles, and shared RabbitMQ 4.1 with isolated Waldur vhosts. GitLab 19.5.1 retains its private Redis 7.2 cache. Providers use Ceph block volumes; GitLab claims separate Ceph RGW buckets per type. Generated credentials remain in named cluster Secrets. See 0048.
  4. Sign-in uses Argo-managed shared AAI. Each service has its own client in devops/aai/clients.json. Ordered AAI administration delivers the client Secret from gitops/manifests/<service>/aai-client.yaml and public CA into the named consumer namespace. GitLab uses OpenID Connect with PKCE; Waldur uses its Keycloak provider with PKCE, imported by its bootstrap through the API.
  5. The catalogue exposes them on gitlab.pharos.<domain> and waldur.pharos.<domain> through the shared gateway. Waldur's API, static and health paths go to the API, /admin/ is management-only, and routes may set a request body limit and switch off buffering for Git and LFS transfers. The paired NetworkPolicies admit the gateway on each backend pod's own port. Inside the cluster, a CoreDNS override resolves pharos.<domain> names to the edge, so services reach the issuer and each other by their public names.
  6. Administrator credentials stay out of the services. Waldur's bootstrap (the staff user and the Pharos customer) runs from a PostSync Job through kubectl exec. GitLab's root password remains the chart's generated Secret.

Consequences

Positive: GitLab and Waldur use the same delivery, rollback and drift control as the routes. The controller's added rights are limited to two namespaces. Both are base services of every dev box (gitops/apps/base); Themelio will be the first optional component.

Negative: isolation inside each namespace is ingress-only. Egress isolation follows separately. GitLab's client is a new registration with any external identity federation. The first GitLab install takes several minutes, so the Argo wait allows 25 minutes.

Dev-box seed: Waldur's first installation spends most of an hour in its migrations. On dev boxes a Sync hook restores a migrated, credential-free database before them, and a PostSync hook captures one after a fresh installation, before the bootstrap adds users or the AAI client. make deploy keeps the file in the checkout's .local/metallo/seeds, named by chart version and image digest, and moves it through a claim it owns. Without a seed the installation migrates from scratch.

Neutral: routes stay in the catalogue until stage 7 moves them to each service.

Development provider sharing is updated by decision 0048. Consumer database identities and broker scopes remain separate.

Page source

Source snapshot · Revision f928834c8.