(tech-debt): DRY logic to query topologyServiceClient.tls.enabled

Summary

Pure refactor — no change to rendered output.

The Rails-side Topology Service mTLS predicate is inlined in three generic helpers in templates/_helpers.tpl:

  • gitlab.topologyService.mountSecrets
  • gitlab.topologyService.volumeMounts
  • gitlab.topologyService.configureScript

Each repeats:

global.appConfig.cell.enabled AND global.appConfig.cell.topologyServiceClient.tls.enabled

Extract it into a single boolean-safe helper and use it as the guard in all three.

Originally raised in this !5111 discussion.

Update (2026-10): the original discussion also listed the GitLab Shell helper as a fourth copy of this predicate. That is no longer true: !5141 (merged) renamed it to gitlab.gitlab-shell.topologyService.tls.enabled and changed it to config.topologyService.enabled AND global.appConfig.cell.enabled (it no longer reads tls.enabled). Whether Shell should read tls.enabled is a behaviour change, tracked separately in #6698. It is out of scope here.

Scope

  1. Add gitlab.global.cell.topologyService.tls.enabled to templates/_helpers.tpl. It returns "true" when both values above are true and "false" otherwise (mirroring gitlab.global.ingress.tls.enabled).
  2. Use it as the {{- if }} guard in the three helpers listed above, for example {{- if eq (include "gitlab.global.cell.topologyService.tls.enabled" $) "true" }}.
    • gitlab.topologyService.volumeMounts is called with (dict "context" $ …), so it must pass $context, not $.
    • Keep the helper bodies as they are; only the guard changes.
  3. Optional: use the helper for the {{- if .topologyServiceClient.tls.enabled }} cert-path block in gitlab.appConfig.cell (charts/gitlab/templates/_gitlab.yaml.tpl). It sits inside if cell.enabled, so the result is identical. Leave the rendered tls.enabled: {{ … }} value as is.

Out of scope

  • Anything in GitLab Shell: gitlab.gitlab-shell.topologyService.{tls.enabled,configureScript,mountSecrets}, gitlab-shell/templates/configmap.yml, Shell specs and docs. See #6698.
  • Unifying cert paths. Shell uses shell/topology-service/… under /etc/gitlab-secrets, Rails uses /srv/gitlab/config/topology-service/…. Changing this would alter Shell's secret layout and config schema.
  • Any change to values, values.schema.json, defaults or documentation.

Acceptance criteria

  • helm template output is byte-for-byte identical before and after the change, for at least:
    • defaults (Cells off)
    • Cells on, TLS off
    • Cells on, TLS on
    • Cells on, TLS on, with gitlab-shell.config.topologyService.enabled: true
  • RSpec coverage in spec/configuration/cell_spec.rb (or similar) for webservice, sidekiq, toolbox and migrations:
    • Cells on + TLS on: topology-service secret projected, volume mounts present, configure script copies the certs.
    • Cells on + TLS off, and Cells off: none of the above rendered.
  • Existing spec/configuration/gitlab_shell_spec.rb passes unchanged.
  • No changelog trailer needed (no user-facing change).
Edited by João Alexandre Cunha