Enable Dedicated to use Single-Tenant Self-Hosted AIG/WFS
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
The self-hosted AIG is currently enabled for use with only self-managed customers using GitLab Duo Self-Hosted via the Duo Enterprise license. This issue is to enable Dedicated instances to configure with the single tenant AIG. This enables Dedicated customers to access GitLab Duo features while maintaining complete data isolation within their dedicated AWS environment.
Background
Currently, GitLab Dedicated customers who want to use GitLab Duo features face a choice between:
- Using the multi-tenant AI Gateway (which sends data outside their isolated environment)
- Not using GitLab Duo features at all
This contradicts the core value proposition of Dedicated (isolation, security, compliance) and forces customers to compromise on the principles that led them to choose Dedicated.
Proposal
Deploy a single-tenant AI Gateway within each GitLab Dedicated customer's isolated AWS environment, managed by GitLab as part of the fully-managed service model.
- Dedicated customers can use single-tenant AIGW with self-hosted, BYOK, or GitLab-provided models.
- No additional SKU required - single-tenant AIGW will be part of the standard Dedicated offering and included with Duo
- Self-managed customers remain unchanged - they continue to use multi-tenant AIGW unless they purchase self-hosted SKU
- GitLab manages the AI Gateway configuration with the GitLab monolith
- The customer manages model and model-per-feature configuration: customers can configure any available model from their AWS Bedrock account
- This work supports the broader Self-hosted models for Dedicated via Bring Your Own AI epic and builds upon the foundation established in the Self-Hosted Models on Dedicated epic.
Definition of Done
- The license check has been updated for the Self-Hosted AIG/WFS to also enable connection with Gitlab Dedicated instances