Add mobile push APNs configuration (mobile_push.apns)

Marcel van Remmerdenrequested to merge
mvanremmerden-mobile-push-apns-config into master

What does this MR do?

Adds chart support for the mobile_push.apns application setting introduced in gitlab-org/gitlab!248026 (merged) (APNs push notifications for GitLab mobile clients, dispatched on to-do creation — see also gitlab-org/gitlab!248022 (merged) and gitlab-org/gitlab!248023 (merged) for the subscription registry and REST API).

  • New global.appConfig.mobilePush.apns values: an authKey secret reference (the .p8 APNs provider token signing key), keyId, teamId, and an optional topic. The rendered gitlab.yml keys keep the snake_case names the Rails settings contract expects.
  • The key file is delivered through the standard configure-secrets init flow (a projected source on the init-*-secrets volume plus a mobile_push entry in the gitlab.scripts.configure.secrets list), landing read-only at /etc/gitlab/mobile_push/apns_auth_key.p8 in the Webservice, Sidekiq, and Toolbox pods; gitlab.yml gets the matching mobile_push.apns section (auth_key_path, key_id, team_id, optional topic). A direct subPath mount is not possible there — /etc/gitlab is the read-only init-secrets volume in CNG pods, which a cluster E2E run caught (containers failed to start with mkdirat …/etc/gitlab/mobile_push: read-only file system). Only Sidekiq sends pushes; the section and key delivery are kept consistent across Rails pods like other appConfig file secrets.
  • Inert by default: when auth_key.secret is unset, nothing renders, and the Rails side no-ops (Gitlab::MobilePush::ApnsClient#configured? is false).
  • Guarded by checkConfig (gitlab.checkConfig.mobilePush.apns): rendering fails with an actionable message when authKey.secret is set without keyId or teamId, mirroring the reconfigure-time validation in the omnibus counterpart. The Rails runtime backstop for an unreadable key file is gitlab-org/gitlab!250320 (merged).
  • Secret creation is documented in doc/installation/secrets.md (linked from the globals.md settings section), including a note on Geo: pushes dispatch from the primary site's Sidekiq, so configure all sites for promotion readiness.

Rails settings counterpart: Settings.mobile_push.apns defaults in config/initializers/1_settings.rb (gitlab-org/gitlab!248026 (merged)).

Omnibus counterpart: gitlab-org/omnibus-gitlab!9676 (merged).

Related issues

Related to gitlab-org/gitlab#607602 and gitlab-org/gitlab#607603 (feature rollout issues).

Author checklist

For general guidance, please follow our Contributing guide.

Required

For anything in this list which will not be completed, please provide a reason in the MR discussion.

  • Merge Request Title and Description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • MR has a green pipeline.
  • Documentation created/updated (doc/charts/globals.md).
  • Tests added/updated (spec/configuration/mobile_push_spec.rb, spec/integration/check_config_spec.rb).
  • Have you validated that your change works end-to-end on a real cluster deployment?
    • Describe how you did it in a comment.
  • Equivalent MR/issue for omnibus-gitlab opened (gitlab-org/omnibus-gitlab!9676 (merged)).

Reviewers checklist

Edited by Marcel van Remmerden

Merge request reports