Correct chart defaults and keys in the parameter tables

What does this MR do?

Several parameter tables list a default that values.yaml does not set, or a key that no template reads. A default read from those tables is not what the chart deploys, a key copied from them is ignored, and one of them stops the install: --set certmanager.rbac.create=false, which the RBAC section of the GitLab chart prerequisites page asks for on a cluster without RBAC, is refused by the cert-manager chart's schema.

I compared each row with values.yaml and the templates, and rendered the chart with Helm 4.3.0 (the HELM_VERSION in .gitlab-ci.yml) to check that the default I document is what the chart produces, and that each key I document changes the output while the old spelling does not. This MR changes only the table rows and the --set lines in doc/. I left doc-locale/ alone, since the translation workflow in argo_translation.yml produces those pages from doc/.

Defaults corrected to what values.yaml sets:

• Registry: authAutoRedirect is false (it has to be for Windows clients, as the comment in values.yaml says), and gc.disabled is false.
• Sidekiq: the chart-wide concurrency is 20, timeout is 25 and minReplicas is 1. A pod without its own minReplicas takes the chart-wide value, so that row now says so, as the concurrency and timeout rows of the same table already do.
• Webservice: deployment.readinessProbe.periodSeconds is 5 and failureThreshold is 2, the memory request is 2.5G, and workhorse.metrics.enabled is false. The Workhorse metrics listener uses workhorse.monitoring.exporter.port, and no template reads workhorse.metrics.port, so its row says that.
• Gitaly: metrics.enabled is true, and the init-cgroups image is on registry.gitlab.com.
• GitLab Exporter runs with runAsNonRoot: true, KAS runs as group 65532, and Praefect sets failover.readonlyAfter to true.
• NGINX Ingress: nginx-ingress.rbac.create is true.

Keys renamed to the ones the chart reads:

• Webservice: workhorse.healthcheckListener.minSuccessfulProbes, ingress.tls.smartcardSecretName and ingress.useGeoClass (the Geo guide already nests it that way).
• Gitaly: persistence.labels.
• Globals: gravatar.plainUrl.
• RBAC: certmanager.global.rbac.create, which is where the cert-manager chart reads it. The bundled ingress-nginx chart has no rbac.createRole or rbac.createClusterRole, so the prerequisites page now sets nginx-ingress.rbac.create, and the RBAC table lists nginx-ingress.rbac.scope with the reason the chart refuses true.

Defaults: documented, values.yaml and rendered

Rendered from the default values in spec/helm_template_helper.rb plus global.praefect.enabled: true, at fdcf0c3e9.

Page	Parameter	Documented	values.yaml	Rendered
Registry	authAutoRedirect	true	false (charts/registry/values.yaml:263)	autoredirect: false
Registry	gc.disabled	true	false (charts/registry/values.yaml:477)	gc: disabled: false
Sidekiq, chart-wide table	concurrency	25	20 (charts/gitlab/charts/sidekiq/values.yaml:258)	SIDEKIQ_CONCURRENCY=20
Sidekiq, chart-wide table	timeout	4	25 (charts/gitlab/charts/sidekiq/values.yaml:300)	SIDEKIQ_TIMEOUT=25
Sidekiq, command line options and chart-wide tables	minReplicas	2	1 (charts/gitlab/charts/sidekiq/values.yaml:256)	HPA minReplicas: 1
Sidekiq, per-pod table	pods[].minReplicas	2	not set; hpa.yaml:26 reads default $.Values.minReplicas .minReplicas	HPA minReplicas: 3 with gitlab.sidekiq.minReplicas=3
Webservice	deployment.readinessProbe.periodSeconds	10	5 (charts/gitlab/charts/webservice/values.yaml:300)	periodSeconds: 5
Webservice	deployment.readinessProbe.failureThreshold	3	2 (charts/gitlab/charts/webservice/values.yaml:303)	failureThreshold: 2
Webservice	resources.requests.memory	1.5G	2.5G (charts/gitlab/charts/webservice/values.yaml:591)	memory: 2.5G
Webservice	workhorse.metrics.enabled	true	false (charts/gitlab/charts/webservice/values.yaml:351)	Workhorse container has only the http-workhorse port
Webservice	workhorse.metrics.port	8083	9229 (charts/gitlab/charts/webservice/values.yaml:352)	with workhorse.metrics.enabled=true and workhorse.metrics.port=8083, the listener is still addr = ":9229"
Gitaly	metrics.enabled	false	true (charts/gitlab/charts/gitaly/values.yaml:148)	http-metrics port 9236 on the Gitaly container
Gitaly	cgroups.initContainer.image.repository	registry.com/gitlab-org/build/cng/gitaly-init-cgroups	registry.gitlab.com/gitlab-org/build/cng/gitaly-init-cgroups (charts/gitlab/charts/gitaly/values.yaml:79)	same as values.yaml, with cgroups.enabled=true
GitLab Exporter	containerSecurityContext.runAsNonRoot	false	true (charts/gitlab/charts/gitlab-exporter/values.yaml:97)	runAsNonRoot: true
KAS	securityContext.runAsGroup	65534	65532 (charts/gitlab/charts/kas/values.yaml:215)	runAsGroup: 65532
Praefect	failover.readonlyAfter	false	true (charts/gitlab/charts/praefect/values.yaml:7)	read_only_after_failover = true
Command-line options	nginx-ingress.rbac.create	false	true (values.yaml:1257)	with nginx-ingress.enabled=true: ClusterRole, ClusterRoleBinding, Role and RoleBinding test-nginx-ingress

Keys: the documented spelling against the key the chart reads

Rendered with global.ingress.enabled=true, nginx-ingress.enabled=true, global.appConfig.smartcard.enabled=true, gitlab.webservice.workhorse.healthcheckListener.enabled=true and gitlab.gitaly.cgroups.enabled=true on top of the values above, once with each documented key and once with the key the chart reads.

Documented key	Key the chart reads	With the documented key	With the chart's key
workhorse.healthcheckListener.minSuccessfullProbes=3	minSuccessfulProbes (charts/gitlab/charts/webservice/templates/configmap.yml:290)	min_successful_probes = 1	min_successful_probes = 3
ingress.tls.smardcardSecretName=doc-smartcard-tls	ingress.tls.smartcardSecretName (charts/gitlab/charts/webservice/templates/_helpers.tpl:55)	smartcard Ingress TLS secret test-wildcard-tls	doc-smartcard-tls
ingress.tls.useGeoClass=true	ingress.useGeoClass (charts/gitlab/charts/webservice/templates/_datamodel.tpl:63)	kubernetes.io/ingress.class: test-nginx	test-nginx-geo
persistance.labels.team=docs	persistence.labels (charts/gitlab/charts/gitaly/templates/_statefulset_spec.yaml:306)	no team label on the volume claim template	team: docs
global.appConfig.gravatar.plainURL=http://libravatar.example.com/avatar/%{hash}	gravatar.plainUrl (charts/gitlab/templates/_gitlab.yaml.tpl:336)	plain_url: empty in gitlab.yml	plain_url: http://libravatar.example.com/avatar/%{hash}
nginx-ingress.rbac.createRole=false	nginx-ingress.rbac.create	all four NGINX Ingress RBAC objects rendered	none rendered
certmanager.rbac.create=false	certmanager.global.rbac.create (the cert-manager chart's schema)	helm template fails: certmanager: - at '': additional properties 'rbac' not allowed	no cert-manager RBAC object is rendered; the only certmanager-named RBAC objects left are the Role and RoleBinding of certmanager-issuer, which has its own rbac.create

--set nginx-ingress.rbac.scope=true stops the render at the chart's own check: 'rbac.scope' should be false. Namespaced IngressClasses do not exist.

Checks

In the DOCS_LINT_IMAGE from .gitlab-ci.yml, the commands of check_docs_content, check_docs_markdown and check_docs_links:

• vale --minAlertLevel error doc: 0 errors, 0 warnings and 0 suggestions in 126 files.
• markdownlint-cli2 'doc/**/*.md': 0 issues in 126 files.
• lychee --offline --include-fragments doc: 2281 links, 845 OK, 1436 excluded, 0 errors.

Related issues

Related to !3833 (closed), where the review pointed out that the documented workhorse.metrics options are out of date. This MR corrects the documentation to what the chart does rather than changing the default.

Related to !5411 (merged), which corrected the Gitaly seccompProfile default in the same table format.

Related to #3120, which asks for every chart parameter to be documented with its default. This MR corrects defaults the existing tables already document; it does not add the list that issue asks for.

Author's checklist

• Ensure the branch name starts with docs-, docs/ or ends with -docs, so only the docs-related CI jobs are included
• Consider taking the GitLab Technical Writing Fundamentals course
• Follow the:
  • Documentation process.
  • Documentation guidelines.
  • Style Guide.
• Merge Request Title and Description are up to date, accurate, and descriptive
• MR targeting the appropriate branch
• MR has a green pipeline on GitLab.com
• When ready for review, MR is marked as ready (not a draft) and assigned to a reviewer

If you are only adding documentation, do not add any of the following labels:

• ~"feature"
• ~"frontend"
• ~"backend"
• ~"bug"
• ~"database"

These labels cause the MR to be added to code verification QA issues.

Review checklist

Documentation-related MRs should be reviewed by a Technical Writer for a non-blocking review, based on Documentation Guidelines and the Style Guide.

• As soon as you begin reviewing, select Start a review on your first comment so the MR shows Reviewer started review.
• If the content requires it, ensure the information is reviewed by a subject matter expert.
• Technical writer review items:
  • Ensure docs metadata is present and up-to-date.
  • Ensure the appropriate labels are added to this MR.
  • If relevant to this MR, ensure content topic type principles are in use, including:
    • The headings should be something you'd do a Google search for. Instead of Default behavior, say something like Default behavior when you close an issue.
    • The headings (other than the page title) should be active. Instead of Configuring GDK, say something like Configure GDK.
    • Any task steps should be written as a numbered list.
    • If the content still needs to be edited for topic types, you can create a follow-up issue with the docs-technical-debt label.
• Review by assigned maintainer, who can always request/require the above reviews. Maintainer's review can occur before or after a technical writer review.
• Ensure a release milestone is set.