Support KAS gRPC Ingress with Traefik

Clemens Beckrequested to merge
cb/grpc-traefik-kas into master

What does this MR do?

Support KAS gRPC Ingress with Traefik

With global.ingress.provider: traefik and global.kas.ingress.grpc.enabled: true, the KAS gRPC Ingress now works with Traefik v3 as an external Ingress controller:

  • The gRPC Ingress matches the /gitlab.agent. path prefix through the router.pathmatcher: PathPrefix annotation, because Traefik's PathRegexp is unanchored.
  • The Ingress routes to a dedicated <release>-kas-grpc Service for the agent port, annotated with service.serversscheme: h2c (or https with KAS TLS). Traefik picks the backend protocol per Service, and the KAS Kubernetes API proxy behind the main Service does not accept h2c.
  • With KAS TLS, the chart renders a Traefik ServersTransport (requires Traefik v3.4 or later) that both KAS Services use with the https scheme, mirroring the proxy-ssl-* annotations for NGINX.

gRPC stays opt-in for Traefik, because it also needs configuration on the Traefik entrypoint, which the chart cannot manage. The defaults are unchanged.

Split out of this MR to keep it reviewable:

  • CI for the k3d Traefik environment over HTTPS and a controller-independent KAS feature spec: !5453 (merged) (stacked on this MR)
  • Workspaces routing fixes, including workspaces with KAS TLS: !5454 (merged)

Related issues

Closes KAS gRPC Ingress: render and test default annot... (#6659 - closed) • Clemens Beck

Test Plan

  1. Setup a fresh (GKE) cluster and install third party dependencies through scripts/dev_dependencies.sh

  2. Install Traefik

    ingressClass:
  enabled: true
  name: traefik
ports:
  websecure:
    transport:
      respondingTimeouts:
        readTimeout: 0   # the 60s default cuts the agent's gRPC tunnel
accessLog:
  enabled: true
    helm repo add traefik https://traefik.github.io/charts
helm upgrade --install traefik traefik/traefik --version 41.6.0 \
  -n traefik --create-namespace -f traefik-values.yaml --wait

  3. Deploy GitLab

    certmanager-issuer:
  email: webmaster@example.com
global:
  hosts:
    domain: example.com
  gatewayApi:
    enabled: false
    installEnvoy: false
  ingress:
    enabled: true
    provider: traefik
    class: traefik
    configureCertmanager: true
    useNewIngressForCerts: true
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
  kas:
    ingress:
      grpc:
        enabled: true

  4. In GitLab, create a project and register an agent under Operate > Kubernetes clusters > Connect a cluster. Copy the agent token.

  5. Confirm the advertised address uses grpc(s)

  6. Install the agent and confirm the agent shows as connected in Operate > Kubernetes clusters.

Author checklist

For general guidance, please follow our Contributing guide.

Required

For anything in this list which will not be completed, please provide a reason in the MR discussion.

  • Merge Request Title and Description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • MR has a green pipeline.
  • Documentation created/updated.
  • Tests added/updated.
  • Have you validated that your change works end-to-end on a real cluster deployment?
    • Describe how you did it in a comment.
  • Equivalent MR/issue for omnibus-gitlab opened.
  • When ready for review, MR is marked as ready (not a draft) and assigned to a reviewer.

Reviewers checklist

Edited by Clemens Beck

Merge request reports