Compare revisions

Stan Hu · Balasankar 'Balu' C · Balasankar 'Balu' C · João Alexandre Cunha · Balasankar 'Balu' C · Balasankar 'Balu' C
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -61,11 +61,11 @@ variables:
  CACHE_KEY_SUFFIX: '-v2'
  CACHE_EDITION: "CE"
  ISSUE_BOT_LABELS_EXTRA: "group::distribution"
-  BUNDLER_VERSION: "2.4.12"
+  BUNDLER_VERSION: "2.4.13"
  # NOTE: When `NEXT_RUBY_VERSION` is updated, flip
  # `USE_NEXT_RUBY_VERSION_IN_*` variables to false to avoid surprises.
  NEXT_RUBY_VERSION: "3.0.6"
-  GET_GEO_TAG: "0.6.0"
+  GET_GEO_TAG: "0.7.1"
  CANONICAL_PROJECT_PATH: 'gitlab-org/omnibus-gitlab'
  SECURITY_PROJECT_PATH: 'gitlab-org/security/omnibus-gitlab'
  DEV_PROJECT_PATH: 'gitlab/omnibus-gitlab'

--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,87 @@
 The latest version of this file can be found at the master branch of the
 omnibus-gitlab repository.
+## 16.0.0 (2023-05-18)
+### Added (6 changes)
+- [Add AlmaLinux 9 packages](gitlab-org/omnibus-gitlab@61f050298f5293367e8aa8e6acb4c25a25192512) ([merge request](gitlab-org/omnibus-gitlab!6817))
+- [Add SMTP timeout configuration options](gitlab-org/omnibus-gitlab@50e7a5b96bbe8fedd3a555a73fd36799e8ac6925) ([merge request](gitlab-org/omnibus-gitlab!6874))
+- [Add EPL 2.0 as acceptable license](gitlab-org/omnibus-gitlab@06466fcdc5427c27395de0396a32ba513dbb1dc0) ([merge request](gitlab-org/omnibus-gitlab!6853))
+- [Add ability to set log directory group for runit managed services](gitlab-org/omnibus-gitlab@ecfca36c98ddb95fc7157b3484c94670f0db1386) ([merge request](gitlab-org/omnibus-gitlab!6809))
+- [Allow configuring an embedding database](gitlab-org/omnibus-gitlab@586eea00c656a02a3541f3beb0da8a2940581094) ([merge request](gitlab-org/omnibus-gitlab!6823))
+- [Add `GITLAB_PRE_RECONFIGURE_SCRIPT` variable support to Docker image](gitlab-org/omnibus-gitlab@69c83d60cc6ef1796a4b22be0aac988b9d31e4c0) by @ergoz ([merge request](gitlab-org/omnibus-gitlab!6744))
+### Fixed (4 changes)
+- [Update Redis URL implementation to work with Ruby 3.1+](gitlab-org/omnibus-gitlab@5df3c4d34cb30efb184eb9586f77e682fe140ab1) ([merge request](gitlab-org/omnibus-gitlab!6864))
+- [EL Stream releases have different VERSION strings](gitlab-org/omnibus-gitlab@93845747f901d00c9a383b0681a8bc63a451d10d) ([merge request](gitlab-org/omnibus-gitlab!6884))
+- [Make it possible to run Puma v6](gitlab-org/omnibus-gitlab@d378406baf91c9d7074c7de6539ed9a30ff37184) ([merge request](gitlab-org/omnibus-gitlab!6854))
+- [Symlink the public ssh key to /ets/ssh folder](gitlab-org/omnibus-gitlab@33e1af97797af90161ab8d6d946d3c74dbe0ae08) ([merge request](gitlab-org/omnibus-gitlab!6732))
+### Changed (10 changes)
+- [Bump rubygems to 3.4.13](gitlab-org/omnibus-gitlab@56c0d2ee28e4bf9e9e3307d8fe1435e072676d38) ([merge request](gitlab-org/omnibus-gitlab!6880))
+- [Validate that SMTP settings do not enable both TLS and STARTTLS](gitlab-org/omnibus-gitlab@30be4382b7a765c983e6f50eb3c9f45dbb87f0b4) ([merge request](gitlab-org/omnibus-gitlab!6863))
+- [Default to two database connections i.e. main and ci](gitlab-org/omnibus-gitlab@cd3fcb86b03041f11aaed66d3830aea4de866b6d) ([merge request](gitlab-org/omnibus-gitlab!6850))
+- [Prune extraneous precompiled shared libraries in gems](gitlab-org/omnibus-gitlab@4aa93d9bb8668c2d23f2e1a381504ea439f57071) ([merge request](gitlab-org/omnibus-gitlab!6869))
+- [Update libre2 to 2023-03-01](gitlab-org/omnibus-gitlab@bf75e78ce0d8a4ab56b35402b5b4ec75cd5d718c) ([merge request](gitlab-org/omnibus-gitlab!6733))
+- [Bump container-registry version to 3.72.0](gitlab-org/omnibus-gitlab@f135f9bd322f0e54147d42e28610f0941e84005c) ([merge request](gitlab-org/omnibus-gitlab!6859))
+- [Build use golang 1.19.8](gitlab-org/omnibus-gitlab@fc4b211526c6770165a36bdddf8d9b340fbcd1d4) ([merge request](gitlab-org/omnibus-gitlab!6851))
+- [Update RubyGems to v3.4.12](gitlab-org/omnibus-gitlab@8366c46608f87ef35e539dc8b47058f94ab31925) ([merge request](gitlab-org/omnibus-gitlab!6843))
+- [Make 15.11 minimum required version to upgrade to 16.0](gitlab-org/omnibus-gitlab@5a2cc648af2dac967de78846742b86d0278d1ad1) ([merge request](gitlab-org/omnibus-gitlab!6833))
+- [Remove gitaly-ruby build](gitlab-org/omnibus-gitlab@08138799d93064f7c760c7d708b4483495eb920f) ([merge request](gitlab-org/omnibus-gitlab!6837))
+### Deprecated (12 changes)
+- [Document Grafana deprecation](gitlab-org/omnibus-gitlab@069a9ab67dac6f7fd6ae8be8d34b303b7eb390c7) ([merge request](gitlab-org/omnibus-gitlab!6878))
+- [Turn off Grafana unless forced](gitlab-org/omnibus-gitlab@5d11d3defe583eea0aaf4a741af2676b55c17208) ([merge request](gitlab-org/omnibus-gitlab!6847))
+- [Deprecate usage of node['gitlab']['web-server'] in gitlab.rb](gitlab-org/omnibus-gitlab@5b590ecefeeb5b84855262f65bc2c6d5a2a720b9) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['storage-check'] in gitlab.rb](gitlab-org/omnibus-gitlab@4845016b0b2de70c45361ccd7efdcb4b3c0883e7) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['prometheus-monitoring'] in gitlab.rb](gitlab-org/omnibus-gitlab@aad1b69270a0a4265079a8e2845b19813eccc274) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['omnibus-gitconfig'] in gitlab.rb](gitlab-org/omnibus-gitlab@c4cc17e9d74f00774d17d858736eb3776c2dbea6) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['manage-storage-directories']](gitlab-org/omnibus-gitlab@7d6b0aed8b99bac356da1ce447278d8e09199c63) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['manage-accounts'] in gitlab.rb](gitlab-org/omnibus-gitlab@8ad1c813565f487f8cd2a2f47920467827980e70) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['high-availability'] in gitlab.rb](gitlab-org/omnibus-gitlab@6288b920d5753524b6e27806077531ad5d6fa95c) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['gitlab-ci'] in gitlab.rb](gitlab-org/omnibus-gitlab@b0551cbc86507f4f62d233d32cba4aa44153d2c5) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [Deprecate usage of node['gitlab']['*-external-url'] in gitlab.rb](gitlab-org/omnibus-gitlab@f8d7a6639fcd9278a1e95099f8d934a098e4a888) ([merge request](gitlab-org/omnibus-gitlab!6766))
+- [gitaly: Remove gitaly-ruby configuration](gitlab-org/omnibus-gitlab@5a69dd55c230ce74add138aa0c0e255e1c98de0a) ([merge request](gitlab-org/omnibus-gitlab!6826))
+### Removed (5 changes)
+- [Remove old Praefect configuration remapping](gitlab-org/omnibus-gitlab@deccf323279ab1b82c05e632d8f1203b13508b2c) ([merge request](gitlab-org/omnibus-gitlab!6867))
+- [Disable Consul telemetry compatibility](gitlab-org/omnibus-gitlab@5c404cdf79c692cb90af60b381f0883ea0f4ac6c) ([merge request](gitlab-org/omnibus-gitlab!6872))
+- [Remove select2 from software list](gitlab-org/omnibus-gitlab@61e4a2907a83eb6b83bd46cf4d88f281764c6f0e) ([merge request](gitlab-org/omnibus-gitlab!6871))
+- [Remove puma_worker_killer](gitlab-org/omnibus-gitlab@88dd1dc6dfc51b37f41b302b46af1d1ed1b0cef6) ([merge request](gitlab-org/omnibus-gitlab!6845))
+- [Remove rails 'default_can_create_group' setting](gitlab-org/omnibus-gitlab@205c0c96092796d6ecbff23fb5692defcba10749) ([merge request](gitlab-org/omnibus-gitlab!6819))
+### Security (2 changes)
+- [Patch Openssl for CVE-2023-0464](gitlab-org/omnibus-gitlab@190e03ea2669535a98d3be8a43f723e1b2c0ebbb)
+- [Patch Grafana against session cookie vulnerability and CVE-2023-1410](gitlab-org/omnibus-gitlab@5366ca75405e2fe30f01bd2be5066409c179cba4)
+### Other (5 changes)
+- [Fix broken link in GitLab 15 docs](gitlab-org/omnibus-gitlab@7002b28aed05822c6e8f248d369b144cf1372d63) by @felix.divo ([merge request](gitlab-org/omnibus-gitlab!6882))
+- [Use Ubuntu 22.04 as base for the GitLab Docker image.](gitlab-org/omnibus-gitlab@0728bc4104b5e1c883e38a2ace42acdcac252349) ([merge request](gitlab-org/omnibus-gitlab!6830))
+- [Postpone cinc EOL message](gitlab-org/omnibus-gitlab@d549962217889f3104f972e0ebb93ad8e3bda08a) ([merge request](gitlab-org/omnibus-gitlab!6857))
+- [Drop bundler software definition](gitlab-org/omnibus-gitlab@3f08274227a17adf5f7d42403804af198895a726) ([merge request](gitlab-org/omnibus-gitlab!6849))
+- [Update Mattermost to 7.10.0](gitlab-org/omnibus-gitlab@ec498e8b899bfaf00d07d161a5a03ae9aed66612) by @akis.maziotis ([merge request](gitlab-org/omnibus-gitlab!6827))
+## 15.11.5 (2023-05-19)
+No changes.
+## 15.11.4 (2023-05-16)
+### Added (1 change)
+- [Add SMTP timeout configuration options](gitlab-org/omnibus-gitlab@42c08ac804b58e31b67f81193589a3d1d2523d07) ([merge request](gitlab-org/omnibus-gitlab!6888))
+### Changed (1 change)
+- [Validate that SMTP settings do not enable both TLS and STARTTLS](gitlab-org/omnibus-gitlab@0bc5f6a53fad0873563f3456b368a84da6128a50) ([merge request](gitlab-org/omnibus-gitlab!6876))
 ## 15.11.3 (2023-05-10)
 No changes.

--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -578,4 +578,4 @@ DEPENDENCIES
  yard
 BUNDLED WITH
-   2.4.12
+   2.4.13
--- a/doc/settings/logs.md
+++ b/doc/settings/logs.md
@@ -47,6 +47,13 @@ registry['log_directory'] = "/var/log/gitlab/registry"
 ...
 ```
+Gitaly and Mattermost have different log directory configs:
+```ruby
+gitaly['configuration']['logging']['dir'] = "/var/log/gitlab/registry"
+mattermost['log_file_directory'] = "/var/log/gitlab/registry"
+```
 Run `sudo gitlab-ctl reconfigure` to configure your instance with these settings.
 ## runit logs
@@ -226,7 +233,7 @@ gitaly['logging_format'] = ''
 gitlab_shell['log_format'] = 'text'
 gitlab_workhorse['log_format'] = 'text'
 registry['log_formatter'] = 'text'
-sidekiq['log_format'] = 'default'
+sidekiq['log_format'] = 'text'
 gitlab_pages['log_format'] = 'text'
 ```

--- a/files/gitlab-config-template/gitlab.rb.template
+++ b/files/gitlab-config-template/gitlab.rb.template
@@ -2443,7 +2443,6 @@ external_url 'GENERATED_EXTERNAL_URL'
 # deployments, see https://docs.gitlab.com/ee/administration/gitaly/index.html .
 # gitaly['enable'] = true
 # gitaly['dir'] = "/var/opt/gitlab/gitaly"
-# gitaly['log_directory'] = "/var/log/gitlab/gitaly"
 # gitaly['log_group'] = nil
 # gitaly['bin_path'] = "/opt/gitlab/embedded/bin/gitaly"
 # gitaly['env_directory'] = "/opt/gitlab/etc/gitaly/env"
@@ -2474,6 +2473,7 @@ external_url 'GENERATED_EXTERNAL_URL'
 #   },
 #   graceful_restart_timeout: '1m', # Grace time for a gitaly process to finish ongoing requests
 #   logging: {
+#     dir: "/var/log/gitlab/gitaly"
 #     level: 'warn',
 #     format: 'json',
 #     sentry_dsn: 'https://<key>:<secret>@sentry.io/<project>',
@@ -2517,7 +2517,7 @@ external_url 'GENERATED_EXTERNAL_URL'
 #     hierarchy_root: 'gitaly',
 #     memory_bytes: 1048576,
 #     cpu_shares: 512,
-#     cpu_quota_us: 400000
+#     cpu_quota_us: 400000,
 #     repositories: {
 #       count: 1000,
 #       memory_bytes: 12884901888,

--- a/files/gitlab-cookbooks/gitaly/attributes/default.rb
+++ b/files/gitlab-cookbooks/gitaly/attributes/default.rb
@@ -4,7 +4,6 @@ default['gitaly']['dir'] = "/var/opt/gitlab/gitaly"
 default['gitaly']['env_directory'] = "/opt/gitlab/etc/gitaly/env"
 # default['gitaly']['env'] is set in ../recipes/enable.rb
 default['gitaly']['bin_path'] = "/opt/gitlab/embedded/bin/gitaly"
-default['gitaly']['storage'] = []
 default['gitaly']['open_files_ulimit'] = 15000
 default['gitaly']['consul_service_name'] = 'gitaly'
 default['gitaly']['consul_service_meta'] = nil
@@ -21,5 +20,6 @@ default['gitaly']['configuration'] = {
  git: {
    use_bundled_binaries: true,
    bin_path: "#{node['package']['install-dir']}/embedded/bin/git"
-  }
+  },
+  storage: []
 }
--- a/files/gitlab-cookbooks/gitaly/libraries/gitaly.rb
+++ b/files/gitlab-cookbooks/gitaly/libraries/gitaly.rb
@@ -27,33 +27,12 @@ module Gitaly
      parse_git_data_dirs
      parse_gitaly_storages
      parse_gitconfig
-      parse_legacy_cgroup_variables
-      remap_legacy_values
-      check_array_entries
-    end
-    def parse_legacy_cgroup_variables
-      # Don't map these if the new configuraton is set. Doing so would set the old keys
-      # and raise an error as both keys are set.
-      return unless Gitlab['gitaly'].dig('configuration', 'cgroups').nil?
-      # maintain backwards compatibility with pre 15.0 Gitaly cgroups config
-      cgroups_repositories_memory_bytes = Gitlab['gitaly']['cgroups_repositories_memory_bytes'] || (Gitlab['gitaly']['cgroups_memory_limit'] if Gitlab['gitaly']['cgroups_memory_enabled'])
-      cgroups_repositories_cpu_shares = Gitlab['gitaly']['cgroups_repositories_cpu_shares'] || (Gitlab['gitaly']['cgroups_cpu_shares'] if Gitlab['gitaly']['cgroups_cpu_enabled'])
-      cgroups_repositories_count = Gitlab['gitaly']['cgroups_repositories_count'] || Gitlab['gitaly']['cgroups_count']
-      cgroups_cpu_shares = Gitlab['gitaly']['cgroups_cpu_shares'] if Gitlab['gitaly']['cgroups_repositories_count'] && cgroups_repositories_count&.positive?
-      Gitlab['gitaly']['cgroups_cpu_shares'] = cgroups_cpu_shares
-      Gitlab['gitaly']['cgroups_repositories_count'] = cgroups_repositories_count
-      Gitlab['gitaly']['cgroups_repositories_memory_bytes'] = cgroups_repositories_memory_bytes
-      Gitlab['gitaly']['cgroups_repositories_cpu_shares'] = cgroups_repositories_cpu_shares
    end
    def gitaly_address
-      socket_path = user_config.dig('configuration', 'socket_path')         || user_config['socket_path']     || package_default.dig('configuration', 'socket_path')
+      listen_addr = user_config.dig('configuration', 'listen_addr')         || package_default.dig('configuration', 'listen_addr')
-      listen_addr = user_config.dig('configuration', 'listen_addr')         || user_config['listen_addr']     || package_default.dig('configuration', 'listen_addr')
+      socket_path = user_config.dig('configuration', 'socket_path')         || package_default.dig('configuration', 'socket_path')
-      tls_listen_addr = user_config.dig('configuration', 'tls_listen_addr') || user_config['tls_listen_addr'] || package_default.dig('configuration', 'tls_listen_addr')
+      tls_listen_addr = user_config.dig('configuration', 'tls_listen_addr') || package_default.dig('configuration', 'tls_listen_addr')
      # Default to using socket path if available
      if tls_listen_addr && !tls_listen_addr.empty?
@@ -84,7 +63,7 @@ module Gitaly
    end
    def parse_gitaly_storages
-      return unless Gitlab['gitaly']['storage'].nil? && Gitlab['gitaly'].dig('configuration', 'storage').nil?
+      return unless Gitlab['gitaly'].dig('configuration', 'storage').nil?
      storages = []
      Gitlab['gitlab_rails']['repositories_storages'].each do |key, value|
@@ -100,9 +79,9 @@ module Gitaly
    # Compute the default gitconfig from the old Omnibus gitconfig setting.
    # This depends on the Gitlab cookbook having been parsed already.
    def parse_gitconfig
-      # If the administrator has set `gitaly['gitconfig']` then we do not add a
+      # If the administrator has set `gitaly[:configuration][:git][:config]` then we do not add a
      # fallback gitconfig.
-      return unless Gitlab['gitaly']['gitconfig'].nil?
+      return unless Gitlab['gitaly'].dig('configuration', 'git', 'config').nil?
      # Furthermore, if the administrator has not overridden the
      # `omnibus_gitconfig` we do not have to migrate anything either. Most
@@ -165,7 +144,20 @@ module Gitaly
      return unless gitaly_gitconfig.any?
-      Gitlab['gitaly']['gitconfig'] = gitaly_gitconfig
+      tmp_source_hash = {
+        configuration: {
+          git: {
+            config: gitaly_gitconfig.map do |entry|
+              {
+                key: [entry['section'], entry['subsection'], entry['key']].compact.join('.'),
+                value: entry['value']
+              }
+            end
+          }
+        }
+      }
+      Chef::Mixin::DeepMerge.deep_merge!(tmp_source_hash, Gitlab['gitaly'])
    end
    private
@@ -177,163 +169,5 @@ module Gitaly
    def package_default
      Gitlab['node']['gitaly'].to_hash
    end
-    # remap_legacy_values moves configuration values from their legacy locations to where they are
-    # in Gitaly's own configuration. All of the configuration was previously grouped under Gitlab['gitaly']
-    # but now Gitaly's own config is under Gitlab['gitaly']['configuration']. This then allows us to
-    # simply encode the map as TOML to get the resulting Gitaly configuration file without having to manually
-    # template every key. As existing configuration files may can still have the configuration in its old place,
-    # this method provides backwards compatibility by moving the old values to their new locations. This can
-    # compatibility wrapper can be removed in 16.0
-    def remap_legacy_values
-      Gitlab['gitaly']['configuration'] = {} unless Gitlab['gitaly']['configuration']
-      remap_recursive(
-        {
-          socket_path: 'socket_path',
-          runtime_dir: 'runtime_dir',
-          listen_addr: 'listen_addr',
-          prometheus_listen_addr: 'prometheus_listen_addr',
-          tls_listen_addr: 'tls_listen_addr',
-          tls: {
-            certificate_path: 'certificate_path',
-            key_path: 'key_path'
-          },
-          graceful_restart_timeout: 'graceful_restart_timeout',
-          logging: {
-            level: 'logging_level',
-            format: 'logging_format',
-            sentry_dsn: 'logging_sentry_dsn',
-            sentry_environment: 'logging_sentry_environment',
-            dir: 'log_directory'
-          },
-          prometheus: {
-            grpc_latency_buckets: lambda {
-              return [] unless Gitlab['gitaly'].key?('prometheus_grpc_latency_buckets')
-              raise "Legacy configuration key 'prometheus_grpc_latency_buckets' can't be set when its new key 'configuration.prometheus.grpc_latency_buckets' is set." if (Gitlab['gitaly'].dig('configuration', 'prometheus') || {}).key?('grpc_latency_buckets')
-              # The legacy value is not actually an array but a string like '[0, 1, 2]'.
-              # The template evaluated Ruby code, so the array string got evaluated to
-              # an array. Parse the array into a Ruby array here.
-              JSON.parse(Gitlab['gitaly']['prometheus_grpc_latency_buckets'])
-            },
-          },
-          auth: {
-            token: 'auth_token',
-            transitioning: 'auth_transitioning'
-          },
-          git: {
-            catfile_cache_size: 'git_catfile_cache_size',
-            bin_path: 'git_bin_path',
-            use_bundled_binaries: 'use_bundled_git',
-            signing_key: 'gpg_signing_key_path',
-            config: lambda {
-              return [] unless Gitlab['gitaly']['gitconfig']
-              raise "Legacy configuration keys 'gitconfig' and 'omnibus_gitconfig' can't be set when its new key 'configuration.git.config' is set." if (Gitlab['gitaly'].dig('configuration', 'git') || {}).key?('config')
-              Gitlab['gitaly']['gitconfig'].map do |entry|
-                {
-                  key: [entry['section'], entry['subsection'], entry['key']].compact.join('.'),
-                  value: entry['value']
-                }
-              end
-            }
-          },
-          storage: 'storage',
-          hooks: {
-            custom_hooks_dir: 'custom_hooks_dir'
-          },
-          daily_maintenance: {
-            disabled: 'daily_maintenance_disabled',
-            start_hour: 'daily_maintenance_start_hour',
-            start_minute: 'daily_maintenance_start_minute',
-            duration: 'daily_maintenance_duration',
-            storages: 'daily_maintenance_storages'
-          },
-          cgroups: {
-            mountpoint: 'cgroups_mountpoint',
-            hierarchy_root: 'cgroups_hierarchy_root',
-            memory_bytes: 'cgroups_memory_bytes',
-            cpu_shares: 'cgroups_cpu_shares',
-            repositories: {
-              count: 'cgroups_repositories_count',
-              memory_bytes: 'cgroups_repositories_memory_bytes',
-              cpu_shares: 'cgroups_repositories_cpu_shares'
-            }
-          },
-          concurrency: 'concurrency',
-          rate_limiting: 'rate_limiting',
-          pack_objects_cache: {
-            enabled: 'pack_objects_cache_enabled',
-            dir: 'pack_objects_cache_dir',
-            max_age: 'pack_objects_cache_max_age'
-          }
-        },
-        Gitlab['gitaly']['configuration'],
-        ['configuration']
-      )
-    end
-    # remap_recursive goes over the mappings to remap the configuration from the old format into the new
-    # format:
-    #   - Hash values indicate a subsection in the destination configuration. Hashes are recursed into to
-    #     build the expected configuration structure.
-    #   - Proc values are mapping functions that return the new value when executed.
-    #   - String values indicate an old configuration key that should be copied into the new configuration
-    #     under the new key.
-    #
-    # new_parent contains the parent key path on each level of recursion.
-    def remap_recursive(mappings, new_configuration, new_parent)
-      mappings.each do |new_key, mapping|
-        # If this is a hash, recurse the tree to create the correct structure.
-        if mapping.is_a?(Hash)
-          new_value = remap_recursive(
-            mappings[new_key],
-            # If there is already a section in the new configuration under the key, use that. If not,
-            # initialize and empty hash for the section.
-            Gitlab['gitaly'].dig(*[new_parent, new_key].flatten) || {},
-            [new_parent, new_key].flatten
-          )
-          new_configuration[new_key] = new_value unless new_value.empty?
-          next
-        end
-        # If this is a Proc, it's a mapping function that returns the value for the
-        # new key.
-        if mapping.is_a?(Proc)
-          new_value = mapping.call
-          new_configuration[new_key] = new_value unless new_value.empty?
-          next
-        end
-        # If the mapping is not a hash nor a lambda, then it is a String. The value gets copied from the
-        # mapping to the new_key as is.
-        #
-        # If there is no old key, then there's nothing to map. Proceed to the next key.
-        next unless Gitlab['gitaly'].key?(mapping)
-        # Raise an error if both the old key and the new key are present in the configuration as it would be
-        # ambigious which key is ued in the final configuration.
-        raise "Legacy configuration key '#{mapping}' can't be set when its new key '#{[new_parent, new_key].flatten.join('.')}' is set." if new_configuration.key?(new_key)
-        new_configuration[new_key] = Gitlab['gitaly'][mapping]
-      end
-      new_configuration
-    end
-    # check_array_entries checks that array values in the new configuration are actually arrays.
-    # These values were historically configured as strings. This check guards against copy paster mistakes
-    # users may do while migrating to the new configuration. This check can be removed along the
-    # backwards compatibility code in 16.0.
-    def check_array_entries
-      [
-        [:prometheus, :grpc_latency_buckets]
-      ].each do |key_path|
-        value = Gitlab['gitaly']['configuration'].dig(*key_path)
-        raise "gitaly['configuration']#{key_path.map { |e| "[:#{e}]" }.join('')} must be an array, not a string" unless value.nil? || value.is_a?(Array)
-      end
-    end
  end
 end
--- a/files/gitlab-cookbooks/package/libraries/config/gitlab.rb
+++ b/files/gitlab-cookbooks/package/libraries/config/gitlab.rb
@@ -57,7 +57,7 @@ module Gitlab
  attribute('spamcheck')
  attribute('patroni').use { Patroni }
  attribute('gitaly').use { Gitaly }
-  attribute('praefect').use { Praefect }
+  attribute('praefect')
  attribute('mattermost',   priority: 30).use { GitlabMattermost } # Mattermost checks if GitLab is enabled on the same box
  attribute('letsencrypt',  priority: 17).use { LetsEncrypt } # After GitlabRails, but before Registry and Mattermost
  attribute('crond')

--- a/files/gitlab-cookbooks/package/libraries/deprecations.rb
+++ b/files/gitlab-cookbooks/package/libraries/deprecations.rb
@@ -287,7 +287,7 @@ module Gitlab
          {
            config_keys: %w(gitaly cgroups_count),
            deprecation: '15.1',
-            removal: '16.1', # https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6828
+            removal: '16.0', # https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6828
            note: "Use `gitaly['cgroups_repositories_count']` instead."
          },
          {

--- a/files/gitlab-cookbooks/praefect/attributes/default.rb
+++ b/files/gitlab-cookbooks/praefect/attributes/default.rb
@@ -13,7 +13,6 @@ default['praefect']['configuration'] = {
  logging: {
    format: 'json',
  },
-  prometheus_exclude_database_from_default_metrics: true,
  auth: {
    transitioning: false
  },

--- a/files/gitlab-cookbooks/praefect/libraries/praefect.rb
+++ b/files/gitlab-cookbooks/praefect/libraries/praefect.rb
-require 'tomlib'
-module Praefect
-  class << self
-    def parse_variables
-      parse_virtual_storages
-      remap_legacy_values
-      check_array_entries
-    end
-    # remap_legacy_values moves configuration values from their legacy locations to where they are
-    # in Praefect's own configuration. All of the configuration was previously grouped under Gitlab['praefect']
-    # but now Praefect's own config is under Gitlab['praefect']['configuration']. This then allows us to
-    # simply encode the map as TOML to get the resulting Praefect configuration file without having to manually
-    # template every key. As existing configuration files may can still have the configuration in its old place,
-    # this method provides backwards compatibility by moving the old values to their new locations. This can
-    # compatibility wrapper can be removed in 16.0
-    def remap_legacy_values
-      Gitlab['praefect']['configuration'] = {} unless Gitlab['praefect']['configuration']
-      remap_recursive(
-        {
-          listen_addr: 'listen_addr',
-          socket_path: 'socket_path',
-          prometheus_listen_addr: 'prometheus_listen_addr',
-          tls_listen_addr: 'tls_listen_addr',
-          prometheus_exclude_database_from_default_metrics: 'separate_database_metrics',
-          auth: {
-            token: 'auth_token',
-            transitioning: 'auth_transitioning',
-          },
-          logging: {
-            format: 'logging_format',
-            level: 'logging_level',
-          },
-          failover: {
-            enabled: 'failover_enabled',
-          },
-          background_verification: {
-            delete_invalid_records: 'background_verification_delete_invalid_records',
-            verification_interval: 'background_verification_verification_interval',
-          },
-          reconciliation: {
-            scheduling_interval: 'reconciliation_scheduling_interval',
-            histogram_buckets: lambda {
-              return [] unless Gitlab['praefect'].key?('reconciliation_histogram_buckets')
-              raise "Legacy configuration key 'reconciliation_histogram_buckets' can't be set when its new key 'configuration.reconciliation.histogram_buckets' is set." if (Gitlab['praefect'].dig('configuration', 'reconciliation') || {}).key?('histogram_buckets')
-              # The legacy key is not actually an array but a string like '[0, 1, 2]'.
-              # The template evaluated Ruby code, so the array string got evaluated to
-              # an array. Parse the array into a Ruby array here.
-              JSON.parse(Gitlab['praefect']['reconciliation_histogram_buckets'])
-            },
-          },
-          tls: {
-            certificate_path: 'certificate_path',
-            key_path: 'key_path',
-          },
-          database: {
-            host: 'database_host',
-            port: 'database_port',
-            user: 'database_user',
-            password: 'database_password',
-            dbname: 'database_dbname',
-            sslmode: 'database_sslmode',
-            sslcert: 'database_sslcert',
-            sslkey: 'database_sslkey',
-            sslrootcert: 'database_sslrootcert',
-            session_pooled: {
-              host: 'database_direct_host',
-              port: 'database_direct_port',
-              user: 'database_direct_user',
-              password: 'database_direct_password',
-              dbname: 'database_direct_dbname',
-              sslmode: 'database_direct_sslmode',
-              sslcert: 'database_direct_sslcert',
-              sslkey: 'database_direct_sslkey',
-              sslrootcert: 'database_direct_sslrootcert',
-            }
-          },
-          sentry: {
-            sentry_dsn: 'sentry_dsn',
-            sentry_environment: 'sentry_environment',
-          },
-          prometheus: {
-            grpc_latency_buckets: lambda {
-              return [] unless Gitlab['praefect'].key?('prometheus_grpc_latency_buckets')
-              raise "Legacy configuration key 'prometheus_grpc_latency_buckets' can't be set when its new key 'configuration.prometheus.grpc_latency_buckets' is set." if (Gitlab['praefect'].dig('configuration', 'prometheus') || {}).key?('grpc_latency_buckets')
-              # The legacy key is not actually an array but a string like '[0, 1, 2]'.
-              # The template evaluated Ruby code, so the array string got evaluated to
-              # an array. Parse the array into a Ruby array here.
-              JSON.parse(Gitlab['praefect']['prometheus_grpc_latency_buckets'])
-            },
-          },
-          graceful_stop_timeout: 'graceful_stop_timeout',
-          virtual_storage: lambda {
-            return [] unless Gitlab['praefect']['virtual_storages']
-            raise "Legacy configuration key 'virtual_storages' can't be set when its new key 'configuration.virtual_storage' is set." if Gitlab['praefect']['configuration'].key?('virtual_storage')
-            Gitlab['praefect']['virtual_storages'].map do |name, details|
-              virtual_storage = {
-                name: name,
-                node: details['nodes'].map do |name, details|
-                  {
-                    storage: name,
-                    address: details['address'],
-                    token: details['token'],
-                  }
-                end
-              }
-              virtual_storage['default_replication_factor'] = details['default_replication_factor'] if details['default_replication_factor']
-              virtual_storage
-            end
-          }
-        },
-        Gitlab['praefect']['configuration'],
-        ['configuration']
-      )
-    end
-    # remap_recursive goes over the mappings to remap the configuration from the old format into the new
-    # format:
-    #   - Hash values indicate a subsection in the destination configuration. Hashes are recursed into to
-    #     build the expected configuration structure.
-    #   - Proc values are mapping functions that return the new value when executed.
-    #   - String values indicate an old configuration key that should be copied into the new configuration
-    #     under the new key.
-    #
-    # new_parent contains the parent key path on each level of recursion.
-    def remap_recursive(mappings, new_configuration, new_parent)
-      mappings.each do |new_key, mapping|
-        # If this is a hash, recurse the tree to create the correct structure.
-        if mapping.is_a?(Hash)
-          new_value = remap_recursive(
-            mappings[new_key],
-            # If there is already a section in the new configuration under the key, use that. If not,
-            # initialize and empty hash for the section.
-            Gitlab['praefect'].dig(*[new_parent, new_key].flatten) || {},
-            [new_parent, new_key].flatten
-          )
-          new_configuration[new_key] = new_value unless new_value.empty?
-          next
-        end
-        # If this is a Proc, it's a mapping function that returns the value for the
-        # new key.
-        if mapping.is_a?(Proc)
-          new_value = mapping.call
-          new_configuration[new_key] = new_value unless new_value.empty?
-          next
-        end
-        # If the mapping is not a hash nor a lambda, then it is a String. The value gets copied from the
-        # mapping to the new_key as is.
-        #
-        # If there is no old key, then there's nothing to map. Proceed to the next key.
-        next unless Gitlab['praefect'].key?(mapping)
-        # Raise an error if both the old key and the new key are present in the configuration as it would be
-        # ambigious which key is ued in the final configuration.
-        raise "Legacy configuration key '#{mapping}' can't be set when its new key '#{[new_parent, new_key].flatten.join('.')}' is set." if new_configuration.key?(new_key)
-        new_configuration[new_key] = Gitlab['praefect'][mapping]
-      end
-      new_configuration
-    end
-    # check_array_entries checks that array values in the new configuration are actually arrays.
-    # These values were historically configured as strings. This check guards against copy paster mistakes
-    # users may do while migrating to the new configuration. This check can be removed along the
-    # backwards compatibility code in 16.0.
-    def check_array_entries
-      [
-        [:prometheus, :grpc_latency_buckets],
-        [:reconciliation, :histogram_buckets]
-      ].each do |key_path|
-        value = Gitlab['praefect']['configuration'].dig(*key_path)
-        raise "praefect['configuration']#{key_path.map { |e| "[:#{e}]" }.join('')} must be an array, not a string" unless value.nil? || value.is_a?(Array)
-      end
-    end
-    def parse_virtual_storages
-      return if Gitlab['praefect']['virtual_storages'].nil?
-      raise "Praefect virtual_storages must be a hash" unless Gitlab['praefect']['virtual_storages'].is_a?(Hash)
-      Gitlab['praefect']['virtual_storages'].each do |virtual_storage, config_keys|
-        next unless config_keys.key?('nodes')
-        raise "Nodes of Praefect virtual storage `#{virtual_storage}` must be a hash" unless config_keys['nodes'].is_a?(Hash)
-      end
-    end
-  end
-end
--- a/files/gitlab-ctl-commands/lib/praefect.rb
+++ b/files/gitlab-ctl-commands/lib/praefect.rb
@@ -30,9 +30,9 @@ module Praefect
  VIRTUAL_STORAGE_DESC = <<~EOS.freeze
    Name of the virtual storage where the repository resides (mandatory).
-    %%The virtual-storage-name can be found in /etc/gitlab/gitlab.rb under praefect["virtual_storages"].
+    %%The virtual-storage-name can be found in /etc/gitlab/gitlab.rb under praefect["configuration"]["virtual_storage"].
-    %%If praefect["virtual_storages"] = { "default" => {"nodes" => { ... }},
+    %%If praefect["configuration"]["virtual_storage"] = [{ "name" => "default" , "nodes" => [{ ... }]},
-    %%"storage_1" => {"nodes" => { ... }}}, the virtual-storage-name would be either "default", or "storage_1".
+    %%{ "name" => "storage_1", "nodes" => [{ ... }]}], the virtual-storage-name would be either "default", or "storage_1".
    %%This can also be found in the Project Detail page in the Admin Panel under "Gitaly storage name".'
  EOS

--- a/spec/chef/cookbooks/gitaly/recipes/gitaly_spec.rb
+++ b/spec/chef/cookbooks/gitaly/recipes/gitaly_spec.rb
@@ -17,7 +17,7 @@ RSpec.describe 'gitaly' do
  let(:logging_sentry_dsn) { 'https://my_key:my_secret@sentry.io/test_project' }
  let(:logging_sentry_environment) { 'production' }
  let(:prometheus_grpc_latency_buckets) do
-    '[0.001, 0.005, 0.025, 0.1, 0.5, 1.0, 10.0, 30.0, 60.0, 300.0, 1500.0]'
+    [0.001, 0.005, 0.025, 0.1, 0.5, 1.0, 10.0, 30.0, 60.0, 300.0, 1500.0]
  end
  let(:auth_token) { '123secret456' }
  let(:auth_transitioning) { true }
@@ -93,7 +93,6 @@ RSpec.describe 'gitaly' do
            ignore_gitconfig: true,
            use_bundled_binaries: true
          },
-          cgroups: { repositories: {} },
          gitlab: {
            relative_url_root: '',
            url: 'http+unix://%2Fvar%2Fopt%2Fgitlab%2Fgitlab-workhorse%2Fsockets%2Fsocket'
@@ -151,42 +150,6 @@ RSpec.describe 'gitaly' do
    end
  end
-  context 'with pre 15.0 cgroups settings' do
-    before do
-      stub_gitlab_rb(
-        gitaly: {
-          cgroups_mountpoint: cgroups_mountpoint,
-          cgroups_count: 100,
-          cgroups_hierarchy_root: cgroups_hierarchy_root,
-          cgroups_memory_limit: cgroups_memory_bytes,
-          cgroups_memory_enabled: true,
-          cgroups_cpu_shares: cgroups_cpu_shares,
-          cgroups_cpu_enabled: true,
-          pack_objects_cache_enabled: pack_objects_cache_enabled,
-          pack_objects_cache_dir: pack_objects_cache_dir,
-          pack_objects_cache_max_age: pack_objects_cache_max_age,
-          custom_hooks_dir: gitaly_custom_hooks_dir
-        }
-      )
-    end
-    it 'populates gitaly cgroups with correct values' do
-      cgroups_section = Regexp.new([
-        %r{\[cgroups\]},
-        %r{mountpoint = "#{cgroups_mountpoint}"},
-        %r{hierarchy_root = "#{cgroups_hierarchy_root}"},
-        %r{\[cgroups.repositories\]},
-        %r{count = 100},
-        %r{memory_bytes = #{cgroups_memory_bytes}},
-        %r{cpu_shares = #{cgroups_cpu_shares}},
-      ].map(&:to_s).join('\s+'))
-      expect(chef_run).to render_file(config_path).with_content { |content|
-        expect(content).to match(cgroups_section)
-      }
-    end
-  end
  context 'sets cgroups settings' do
    before do
      stub_gitlab_rb(
@@ -231,44 +194,6 @@ RSpec.describe 'gitaly' do
    end
  end
-  context 'with new gitconfig' do
-    it 'raises an error with legacy gitconfig set' do
-      stub_gitlab_rb(
-        {
-          gitaly: {
-            gitconfig: [{ key: 'legacy_key', value: 'legacy_value' }],
-            configuration: {
-              git: {
-                config: [{ key: 'new_key', value: 'new_value' }]
-              }
-            }
-          }
-        }
-      )
-      expect { chef_run }.to raise_error "Legacy configuration keys 'gitconfig' and 'omnibus_gitconfig' can't be set when its new key 'configuration.git.config' is set."
-    end
-    it 'raises an error if omnibus_gitconfig is set' do
-      stub_gitlab_rb(
-        {
-          omnibus_gitconfig: {
-            system: { nondefault: ['bar = baz'] }
-          },
-          gitaly: {
-            configuration: {
-              git: {
-                config: [{ key: 'new_key', value: 'new_value' }]
-              }
-            }
-          }
-        }
-      )
-      expect { chef_run }.to raise_error "Legacy configuration keys 'gitconfig' and 'omnibus_gitconfig' can't be set when its new key 'configuration.git.config' is set."
-    end
-  end
  context 'with Omnibus gitconfig' do
    let(:omnibus_gitconfig) { nil }
    let(:gitaly_gitconfig) { nil }
@@ -279,7 +204,11 @@ RSpec.describe 'gitaly' do
          system: omnibus_gitconfig,
        },
        gitaly: {
-          gitconfig: gitaly_gitconfig,
+          configuration: {
+            git: {
+              config: gitaly_gitconfig,
+            }
+          }
        }
      )
    end
@@ -395,7 +324,7 @@ RSpec.describe 'gitaly' do
      end
    end
-    context 'with Gitaly gitconfig' do
+    context 'with Gitaly configuration git config' do
      let(:gitaly_gitconfig) do
        [
          { key: "core.fsckObjects", value: "true" },
@@ -448,82 +377,6 @@ RSpec.describe 'gitaly' do
        }
      end
    end
-    context 'with sections' do
-      let(:gitaly_gitconfig) do
-        [
-          { section: 'core', key: 'fsckObjects', value: 'true' },
-          { section: 'core', key: 'somethingElse', value: 'true' },
-          { section: 'another', key: 'section', value: 'true' },
-        ]
-      end
-      it 'writes the correct keys' do
-        gitconfig_section = Regexp.new([
-          %r{\[\[git.config\]\]},
-          %r{key = "core.fsckObjects"},
-          %r{value = "true"},
-          %r{},
-          %r{\[\[git.config\]\]},
-          %r{key = "core.somethingElse"},
-          %r{value = "true"},
-          %r{},
-          %r{\[\[git.config\]\]},
-          %r{key = "another.section"},
-          %r{value = "true"},
-        ].map(&:to_s).join('\s+'))
-        expect(chef_run).to render_file(config_path).with_content { |content|
-          expect(content).to match(gitconfig_section)
-          expect(content).not_to include("overridden")
-        }
-      end
-    end
-    context 'with subsections' do
-      let(:gitaly_gitconfig) do
-        [
-          { section: 'http', subsection: 'http://example.com', key: 'insteadOf', value: 'http://rewritten.example.com' },
-          { key: 'http.http://another.example.com.insteadOf', value: 'http://rewritten.example.com' },
-        ]
-      end
-      it 'writes the correct keys' do
-        gitconfig_section = Regexp.new([
-          %r{\[\[git.config\]\]},
-          %r{key = "http.http://example.com.insteadOf"},
-          %r{value = "http://rewritten.example.com"},
-          %r{},
-          %r{\[\[git.config\]\]},
-          %r{key = "http.http://another.example.com.insteadOf"},
-          %r{value = "http://rewritten.example.com"},
-        ].map(&:to_s).join('\s+'))
-        expect(chef_run).to render_file(config_path).with_content { |content|
-          expect(content).to match(gitconfig_section)
-          expect(content).not_to include("overridden")
-        }
-      end
-    end
-  end
-  context 'with array configured as string' do
-    it 'raises an error with prometheus grpc latency buckets' do
-      stub_gitlab_rb(
-        {
-          gitaly: {
-            enable: true,
-            configuration: {
-              prometheus: {
-                grpc_latency_buckets: '[0, 1, 2]'
-              }
-            }
-          }
-        }
-      )
-      expect { chef_run }.to raise_error("gitaly['configuration'][:prometheus][:grpc_latency_buckets] must be an array, not a string")
-    end
  end
  context 'with some defaults overridden with custom configuration' do
@@ -587,48 +440,10 @@ RSpec.describe 'gitaly' do
            }
          ],
          cgroups: {
-            cpu_shares: 100,
+            cpu_shares: 100
-          }
-        }
-      )
-    end
-  end
-  context 'with old key and its new key set' do
-    it 'raises an error in generic case' do
-      stub_gitlab_rb(
-        {
-          gitaly: {
-            enable: true,
-            certificate_path: 'legacy_certificate_path_key',
-            configuration: {
-              tls: {
-                certificate_path: 'new_certificate_path_key',
-              }
-            }
-          }
-        }
-      )
-      expect { chef_run }.to raise_error "Legacy configuration key 'certificate_path' can't be set when its new key 'configuration.tls.certificate_path' is set."
-    end
-    it 'raises an error in generic case' do
-      stub_gitlab_rb(
-        {
-          gitaly: {
-            enable: true,
-            prometheus_grpc_latency_buckets: '[0, 1, 2]',
-            configuration: {
-              prometheus: {
-                grpc_latency_buckets: '[0, 1, 3]',
-              }
-            }
          }
        }
      )
-      expect { chef_run }.to raise_error "Legacy configuration key 'prometheus_grpc_latency_buckets' can't be set when its new key 'configuration.prometheus.grpc_latency_buckets' is set."
    end
  end
@@ -636,70 +451,88 @@ RSpec.describe 'gitaly' do
    before do
      stub_gitlab_rb(
        gitaly: {
-          concurrency: [
-            {
-              rpc: '/gitaly.SmartHTTPService/PostReceivePack',
-              max_per_repo: 20
-            },
-            {
-              rpc: '/gitaly.SSHService/SSHUploadPack',
-              max_per_repo: 5
-            }
-          ],
-          storage: [
-            { name: 'default', path: '/tmp/path-1' },
-            { name: 'nfs1', path: '/mnt/nfs1' }
-          ],
-          rate_limiting: [
-            {
-              rpc: '/gitaly.SmartHTTPService/PostReceivePack',
-              interval: '1s',
-              burst: 100
-            }, {
-              rpc: '/gitaly.SSHService/SSHUploadPack',
-              interval: '1s',
-              burst: 200,
-            }
-          ],
-          socket_path: socket_path,
-          runtime_dir: runtime_dir,
-          listen_addr: listen_addr,
-          tls_listen_addr: tls_listen_addr,
-          certificate_path: certificate_path,
-          key_path: key_path,
-          gpg_signing_key_path: gpg_signing_key_path,
-          prometheus_listen_addr: prometheus_listen_addr,
-          logging_level: logging_level,
-          logging_format: logging_format,
-          logging_sentry_dsn: logging_sentry_dsn,
-          logging_sentry_environment: logging_sentry_environment,
-          prometheus_grpc_latency_buckets: prometheus_grpc_latency_buckets,
-          auth_token: auth_token,
-          auth_transitioning: auth_transitioning,
-          graceful_restart_timeout: graceful_restart_timeout,
-          git_catfile_cache_size: git_catfile_cache_size,
-          git_bin_path: git_bin_path,
-          use_bundled_git: false,
          open_files_ulimit: open_files_ulimit,
-          daily_maintenance_start_hour: daily_maintenance_start_hour,
-          daily_maintenance_start_minute: daily_maintenance_start_minute,
-          daily_maintenance_duration: daily_maintenance_duration,
-          daily_maintenance_storages: %w(storage0 storage1),
-          daily_maintenance_disabled: daily_maintenance_disabled,
-          cgroups_mountpoint: cgroups_mountpoint,
-          cgroups_hierarchy_root: cgroups_hierarchy_root,
-          cgroups_memory_bytes: cgroups_memory_bytes,
-          cgroups_cpu_shares: cgroups_cpu_shares,
-          cgroups_repositories_count: cgroups_repositories_count,
-          cgroups_repositories_memory_bytes: cgroups_repositories_memory_bytes,
-          cgroups_repositories_cpu_shares: cgroups_repositories_cpu_shares,
-          pack_objects_cache_enabled: pack_objects_cache_enabled,
-          pack_objects_cache_dir: pack_objects_cache_dir,
-          pack_objects_cache_max_age: pack_objects_cache_max_age,
-          custom_hooks_dir: gitaly_custom_hooks_dir,
          # Sanity check that configuration values get printed out.
          configuration: {
+            socket_path: socket_path,
+            listen_addr: listen_addr,
+            tls_listen_addr: tls_listen_addr,
            string_value: 'some value',
+            runtime_dir: runtime_dir,
+            git: {
+              signing_key: gpg_signing_key_path,
+              bin_path: git_bin_path,
+              catfile_cache_size: git_catfile_cache_size,
+              use_bundled_binaries: false,
+            },
+            prometheus: {
+              grpc_latency_buckets: prometheus_grpc_latency_buckets
+            },
+            prometheus_listen_addr: prometheus_listen_addr,
+            graceful_restart_timeout: graceful_restart_timeout,
+            auth: {
+              token: auth_token,
+              transitioning: auth_transitioning,
+            },
+            tls: {
+              certificate_path: certificate_path,
+              key_path: key_path,
+            },
+            storage: [
+              { name: 'default', path: '/tmp/path-1' },
+              { name: 'nfs1', path: '/mnt/nfs1' }
+            ],
+            logging: {
+              level: logging_level,
+              format: logging_format,
+              sentry_dsn: logging_sentry_dsn,
+              sentry_environment: logging_sentry_environment,
+            },
+            hooks: { custom_hooks_dir: gitaly_custom_hooks_dir },
+            pack_objects_cache: {
+              enabled: pack_objects_cache_enabled,
+              dir: pack_objects_cache_dir,
+              max_age: pack_objects_cache_max_age,
+            },
+            cgroups: {
+              mountpoint: cgroups_mountpoint,
+              hierarchy_root: cgroups_hierarchy_root,
+              memory_bytes: cgroups_memory_bytes,
+              cpu_shares: cgroups_cpu_shares,
+              repositories: {
+                count: cgroups_repositories_count,
+                memory_bytes: cgroups_repositories_memory_bytes,
+                cpu_shares: cgroups_repositories_cpu_shares,
+              },
+            },
+            daily_maintenance: {
+              disabled: daily_maintenance_disabled,
+              start_hour: daily_maintenance_start_hour,
+              start_minute: daily_maintenance_start_minute,
+              duration: daily_maintenance_duration,
+              storages: %w(storage0 storage1),
+            },
+            concurrency: [
+              {
+                rpc: '/gitaly.SmartHTTPService/PostReceivePack',
+                max_per_repo: 20
+              },
+              {
+                rpc: '/gitaly.SSHService/SSHUploadPack',
+                max_per_repo: 5
+              }
+            ],
+            rate_limiting: [
+              {
+                rpc: '/gitaly.SmartHTTPService/PostReceivePack',
+                interval: '1s',
+                burst: 100
+              }, {
+                rpc: '/gitaly.SSHService/SSHUploadPack',
+                interval: '1s',
+                burst: 200,
+              }
+            ],
            subsection: {
              array_value: [1, 2, 3]
            }
@@ -865,16 +698,6 @@ RSpec.describe 'gitaly' do
        .with_content(/svlogd -tt \/var\/log\/gitlab\/gitaly/)
    end
-    context 'when maintenance is disabled' do
-      let(:daily_maintenance_disabled) { true }
-      it 'renders daily_maintenance with disabled set to true' do
-        expect(chef_run).to render_file(config_path).with_content { |content|
-          expect(content).to include("[daily_maintenance]\ndisabled = true\n")
-        }
-      end
-    end
    context 'when using git_data_dirs storage configuration' do
      context 'using local gitaly' do
        before do
@@ -956,35 +779,6 @@ RSpec.describe 'gitaly' do
              .with_content(%r{\[\[storage\]\]\s+name = "nfs1"\s+path = "/mnt/nfs1/repositories"})
          end
        end
-        context "using legacy gitaly['storage'] key" do
-          before do
-            stub_gitlab_rb(
-              gitaly: {
-                storage: [
-                  {
-                    'name' => 'nfs1',
-                    'path' => '/mnt/nfs1/repositories'
-                  },
-                  {
-                    'name' => 'default',
-                    'path' => '/tmp/default/git-data/repositories'
-                  }
-                ]
-              },
-              git_data_dirs: {
-                'default' => { 'path' => '/tmp/gitaly-git-data' },
-              }
-            )
-          end
-          it 'populates gitaly config.toml with custom storages from gitaly configuration' do
-            expect(chef_run).to render_file(config_path)
-              .with_content(%r{\[\[storage\]\]\s+name = "default"\s+path = "/tmp/default/git-data/repositories"})
-            expect(chef_run).to render_file(config_path)
-              .with_content(%r{\[\[storage\]\]\s+name = "nfs1"\s+path = "/mnt/nfs1/repositories"})
-          end
-        end
      end
    end
  end
@@ -1004,63 +798,7 @@ RSpec.describe 'gitaly' do
    end
  end
-  shared_examples 'empty concurrency configuration' do
-    it 'does not generate a gitaly concurrency configuration' do
-      expect(chef_run).not_to render_file(config_path)
-        .with_content(%r{\[\[concurrency\]\]})
-    end
-  end
-  shared_examples 'empty rate limiting configuration' do
-    it 'does not generate a gitaly concurrency configuration' do
-      expect(chef_run).not_to render_file(config_path)
-        .with_content(%r{\[\[rate_limiting\]\]})
-    end
-  end
  context 'when not using concurrency configuration' do
-    context 'when concurrency configuration is not set' do
-      before do
-        stub_gitlab_rb(
-          {
-            gitaly: {
-            }
-          }
-        )
-      end
-      it_behaves_like 'empty concurrency configuration'
-      it_behaves_like 'empty rate limiting configuration'
-    end
-    context 'when concurrency configuration is empty' do
-      before do
-        stub_gitlab_rb(
-          {
-            gitaly: {
-              concurrency: []
-            }
-          }
-        )
-      end
-      it_behaves_like 'empty concurrency configuration'
-    end
-    context 'when rate limiting configuration is empty' do
-      before do
-        stub_gitlab_rb(
-          {
-            gitaly: {
-              rate_limiting: []
-            }
-          }
-        )
-      end
-      it_behaves_like 'empty rate limiting configuration'
-    end
    context 'when max_queue_size and max_queue_wait are empty' do
      before do
        stub_gitlab_rb(
@@ -1119,12 +857,14 @@ RSpec.describe 'gitaly' do
        stub_gitlab_rb(
          {
            gitaly: {
-              concurrency: [
+              configuration: {
-                {
+                concurrency: [
-                  'rpc' => "/gitaly.SmartHTTPService/PostReceivePack",
+                  {
-                  'max_queue_wait' => "10s",
+                    'rpc' => "/gitaly.SmartHTTPService/PostReceivePack",
-                }
+                    'max_queue_wait' => "10s",
-              ]
+                  }
+                ]
+              }
            }
          }
        )
@@ -1265,8 +1005,10 @@ RSpec.describe 'gitaly::git_data_dirs' do
                         'path' => '/tmp/user/git-data'
                       }
                     }, gitaly: {
-                       socket_path: '',
+                       configuration: {
-                       listen_addr: 'localhost:8123'
+                         socket_path: '',
+                         listen_addr: 'localhost:8123'
+                       }
                     })
    end
@@ -1283,7 +1025,10 @@ RSpec.describe 'gitaly::git_data_dirs' do
                         'path' => '/tmp/user/git-data'
                       }
                     }, gitaly: {
-                       socket_path: '', tls_listen_addr: 'localhost:8123'
+                       configuration: {
+                         socket_path: '',
+                         tls_listen_addr: 'localhost:8123'
+                       }
                     })
    end
@@ -1300,7 +1045,10 @@ RSpec.describe 'gitaly::git_data_dirs' do
                         'path' => '/tmp/user/git-data'
                       }
                     }, gitaly: {
-                       socket_path: '/some/socket/path.socket', tls_listen_addr: 'localhost:8123'
+                       configuration: {
+                         socket_path: '/some/socket/path.socket',
+                         tls_listen_addr: 'localhost:8123'
+                       }
                     })
    end

--- a/spec/chef/cookbooks/logrotate/recipes/folders_and_configs_spec.rb
+++ b/spec/chef/cookbooks/logrotate/recipes/folders_and_configs_spec.rb
@@ -107,7 +107,11 @@ RSpec.describe 'gitlab::logrotate_folder_and_configs_spec' do
            services: ['gitlab-rails', 'gitaly']
          },
          gitaly: {
-            log_directory: '/my/log/directory'
+            configuration: {
+              logging: {
+                dir: '/my/log/directory'
+              }
+            }
          }
        )
        expect(chef_run).to create_template('/var/opt/gitlab/logrotate/logrotate.d/gitlab-rails')

--- a/spec/chef/cookbooks/praefect/recipes/praefect_spec.rb
+++ b/spec/chef/cookbooks/praefect/recipes/praefect_spec.rb
 require 'chef_helper'
 RSpec.describe 'praefect' do
  let(:chef_run) { ChefSpec::SoloRunner.new(step_into: %w(runit_service env_dir)).converge('gitlab::default') }
  let(:prometheus_grpc_latency_buckets) do
-    '[0.001, 0.005, 0.025, 0.1, 0.5, 1.0, 10.0, 30.0, 60.0, 300.0, 1500.0]'
+    [0.001, 0.005, 0.025, 0.1, 0.5, 1.0, 10.0, 30.0, 60.0, 300.0, 1500.0]
  end
  before do
@@ -44,7 +45,6 @@ RSpec.describe 'praefect' do
        'listen_addr' => 'localhost:2305',
        'logging' => { 'format' => 'json' },
        'prometheus_listen_addr' => 'localhost:9652',
-        'prometheus_exclude_database_from_default_metrics' => true,
        'failover' => { 'enabled' => true },
      }
@@ -83,7 +83,6 @@ RSpec.describe 'praefect' do
                  format: 'custom_format',
                  has_no_default: 'should get output'
                },
-                prometheus_exclude_database_from_default_metrics: false,
                auth: {
                  transitioning: true
                },
@@ -143,7 +142,6 @@ RSpec.describe 'praefect' do
                'format' => 'custom_format',
                'has_no_default' => 'should get output'
              },
-              'prometheus_exclude_database_from_default_metrics' => false,
              'prometheus_listen_addr' => 'custom_prometheus_listen_addr:5432',
              'virtual_storage' => [
                {
@@ -183,140 +181,6 @@ RSpec.describe 'praefect' do
      end
    end
-    context 'with old key and its new key set' do
-      it 'raises an error in the generic case' do
-        stub_gitlab_rb(
-          {
-            praefect: {
-              enable: true,
-              database_direct_host: 'database_direct_host_legacy',
-              configuration: {
-                database: {
-                  session_pooled: {
-                    host: 'database_direct_host_new'
-                  }
-                }
-              }
-            }
-          }
-        )
-        expect { chef_run }.to raise_error("Legacy configuration key 'database_direct_host' can't be set when its new key 'configuration.database.session_pooled.host' is set.")
-      end
-      it 'raises an error with prometheus_grpc_latency_buckets' do
-        stub_gitlab_rb(
-          {
-            praefect: {
-              enable: true,
-              prometheus_grpc_latency_buckets: '[0, 1, 2]',
-              configuration: {
-                prometheus: {
-                  grpc_latency_buckets: [0, 1, 2]
-                }
-              }
-            }
-          }
-        )
-        expect { chef_run }.to raise_error("Legacy configuration key 'prometheus_grpc_latency_buckets' can't be set when its new key 'configuration.prometheus.grpc_latency_buckets' is set.")
-      end
-      it 'raises an error with reconciliation_histogram_buckets' do
-        stub_gitlab_rb(
-          {
-            praefect: {
-              enable: true,
-              reconciliation_histogram_buckets: '[0, 1, 2]',
-              configuration: {
-                reconciliation: {
-                  histogram_buckets: [0, 1, 2]
-                }
-              }
-            }
-          }
-        )
-        expect { chef_run }.to raise_error("Legacy configuration key 'reconciliation_histogram_buckets' can't be set when its new key 'configuration.reconciliation.histogram_buckets' is set.")
-      end
-    end
-    context 'with old virtual_storages and new virtual_storage set' do
-      before do
-        stub_gitlab_rb(
-          {
-            praefect: {
-              enable: true,
-              virtual_storages: {
-                default: {
-                  nodes: {
-                    praefect1: {
-                      address: 'tcp://node1.internal',
-                      token: "praefect1-token"
-                    }
-                  }
-                }
-              },
-              configuration: {
-                virtual_storage: [
-                  {
-                    name: 'default',
-                    node: [
-                      {
-                        storage: 'praefect2',
-                        address: 'tcp://node2.internal',
-                        token: 'praefect2-token'
-                      }
-                    ]
-                  }
-                ]
-              }
-            }
-          }
-        )
-      end
-      it 'raises an error' do
-        expect { chef_run }.to raise_error("Legacy configuration key 'virtual_storages' can't be set when its new key 'configuration.virtual_storage' is set.")
-      end
-    end
-    context 'with array configured as string' do
-      it 'raises an error with reconciliation histogram buckets' do
-        stub_gitlab_rb(
-          {
-            praefect: {
-              enable: true,
-              configuration: {
-                reconciliation: {
-                  histogram_buckets: '[0, 1, 2]'
-                }
-              }
-            }
-          }
-        )
-        expect { chef_run }.to raise_error("praefect['configuration'][:reconciliation][:histogram_buckets] must be an array, not a string")
-      end
-      it 'raises an error with prometheus grpc latency buckets' do
-        stub_gitlab_rb(
-          {
-            praefect: {
-              enable: true,
-              configuration: {
-                prometheus: {
-                  grpc_latency_buckets: '[0, 1, 2]'
-                }
-              }
-            }
-          }
-        )
-        expect { chef_run }.to raise_error("praefect['configuration'][:prometheus][:grpc_latency_buckets] must be an array, not a string")
-      end
-    end
    context 'with custom settings' do
      let(:dir) { nil }
      let(:socket_path) { '/var/opt/gitlab/praefect/praefect.socket' }
@@ -329,23 +193,39 @@ RSpec.describe 'praefect' do
      let(:certificate_path) { '/path/to/cert.pem' }
      let(:key_path) { '/path/to/key.pem' }
      let(:prom_addr) { 'localhost:1234' }
-      let(:separate_database_metrics) { false }
      let(:log_level) { 'debug' }
      let(:log_format) { 'text' }
      let(:log_group) { 'fugee' }
      let(:primaries) { %w[praefect1 praefect2] }
-      let(:virtual_storages) do
+      let(:virtual_storage) do
-        {
+        [
-          'default' => {
+          {
-            'default_replication_factor' => 2,
+            "default_replication_factor" => 2,
-            'nodes' => {
+            "name" => "default",
-              'praefect1' => { address: 'tcp://node1.internal', token: "praefect1-token" },
+            "node" => [
-              'praefect2' => { address: 'tcp://node2.internal', token: "praefect2-token" },
+              {
-              'praefect3' => { address: 'tcp://node3.internal', token: "praefect3-token" },
+                "address" => "tcp://node1.internal",
-              'praefect4' => { address: 'tcp://node4.internal', token: "praefect4-token" }
+                "storage" => "praefect1",
-            }
+                "token" => "praefect1-token"
+              },
+              {
+                "address" => "tcp://node2.internal",
+                "storage" => "praefect2",
+                "token" => "praefect2-token"
+              },
+              {
+                "address" => "tcp://node3.internal",
+                "storage" => "praefect3",
+                "token" => "praefect3-token"
+              },
+              {
+                "address" => "tcp://node4.internal",
+                "storage" => "praefect4",
+                "token" => "praefect4-token"
+              }
+            ]
          }
-        }
+        ]
      end
      let(:failover_enabled) { true }
      let(:database_host) { 'pg.external' }
@@ -360,7 +240,7 @@ RSpec.describe 'praefect' do
      let(:database_direct_host) { 'pg.internal' }
      let(:database_direct_port) { 1234 }
      let(:reconciliation_scheduling_interval) { '1m' }
-      let(:reconciliation_histogram_buckets) { '[1.0, 2.0]' }
+      let(:reconciliation_histogram_buckets) { [1.0, 2.0] }
      let(:user) { 'user123' }
      let(:password) { 'password321' }
      let(:ca_file) { '/path/to/ca_file' }
@@ -372,42 +252,59 @@ RSpec.describe 'praefect' do
        stub_gitlab_rb(praefect: {
                         enable: true,
                         dir: dir,
-                         socket_path: socket_path,
-                         auth_token: auth_token,
-                         auth_transitioning: auth_transitioning,
-                         sentry_dsn: sentry_dsn,
-                         sentry_environment: sentry_environment,
-                         listen_addr: listen_addr,
-                         tls_listen_addr: tls_listen_addr,
-                         certificate_path: certificate_path,
-                         key_path: key_path,
-                         prometheus_listen_addr: prom_addr,
-                         prometheus_grpc_latency_buckets: prometheus_grpc_latency_buckets,
-                         separate_database_metrics: separate_database_metrics,
-                         logging_level: log_level,
-                         logging_format: log_format,
                         log_group: log_group,
                         failover_enabled: failover_enabled,
-                         virtual_storages: virtual_storages,
-                         database_host: database_host,
-                         database_port: database_port,
-                         database_user: database_user,
-                         database_password: database_password,
-                         database_dbname: database_dbname,
-                         database_sslmode: database_sslmode,
-                         database_sslcert: database_sslcert,
-                         database_sslkey: database_sslkey,
-                         database_sslrootcert: database_sslrootcert,
-                         database_direct_host: database_direct_host,
-                         database_direct_port: database_direct_port,
-                         reconciliation_scheduling_interval: reconciliation_scheduling_interval,
-                         reconciliation_histogram_buckets: reconciliation_histogram_buckets,
-                         background_verification_verification_interval: '168h',
-                         background_verification_delete_invalid_records: true,
-                         graceful_stop_timeout: graceful_stop_timeout,
                         # Sanity check that the configuration values get templated out as TOML.
                         configuration: {
                           string_value: 'value',
+                           graceful_stop_timeout: graceful_stop_timeout,
+                           listen_addr: listen_addr,
+                           socket_path: socket_path,
+                           auth: {
+                             token: auth_token,
+                             transitioning: auth_transitioning
+                           },
+                           logging: {
+                             format: log_format,
+                             level: log_level
+                           },
+                           background_verification: {
+                             verification_interval: '168h',
+                             delete_invalid_records: true,
+                           },
+                           prometheus: {
+                             grpc_latency_buckets: prometheus_grpc_latency_buckets
+                           },
+                           reconciliation: {
+                             scheduling_interval: reconciliation_scheduling_interval,
+                             histogram_buckets: reconciliation_histogram_buckets,
+                           },
+                           sentry: {
+                             sentry_dsn: sentry_dsn,
+                             sentry_environment: sentry_environment
+                           },
+                           tls: {
+                             certificate_path: certificate_path,
+                             key_path: key_path,
+                           },
+                           tls_listen_addr: tls_listen_addr,
+                           virtual_storage: virtual_storage,
+                           database: {
+                             host: database_host,
+                             port: database_port,
+                             user: database_user,
+                             password: database_password,
+                             dbname: database_dbname,
+                             sslmode: database_sslmode,
+                             sslcert: database_sslcert,
+                             sslkey: database_sslkey,
+                             sslrootcert: database_sslrootcert,
+                             session_pooled: {
+                               host: database_direct_host,
+                               port: database_direct_port,
+                             }
+                           },
+                           prometheus_listen_addr: prom_addr,
                           subsection: {
                             array_value: [1, 2]
                           },
@@ -422,7 +319,7 @@ RSpec.describe 'praefect' do
            {
              'auth' => {
                'token' => 'secrettoken123',
-                'transitioning' => false
+                'transitioning' => false,
              },
              'database' => {
                'dbname' => 'praefect_production',
@@ -463,7 +360,6 @@ RSpec.describe 'praefect' do
                'sentry_environment' => 'production'
              },
              'prometheus_listen_addr' => 'localhost:1234',
-              'prometheus_exclude_database_from_default_metrics' => false,
              'socket_path' => '/var/opt/gitlab/praefect/praefect.socket',
              'string_value' => 'value',
              'subsection' => {
@@ -512,42 +408,6 @@ RSpec.describe 'praefect' do
        expect(chef_run).to render_file(File.join(env_dir, "WRAPPER_JSON_LOGGING"))
          .with_content('false')
      end
-      context 'with virtual_storages as an array' do
-        let(:virtual_storages) { [{ name: 'default', 'nodes' => [{ storage: 'praefect1', address: 'tcp://node1.internal', token: "praefect1-token" }] }] }
-        it 'raises an error' do
-          expect { chef_run }.to raise_error("Praefect virtual_storages must be a hash")
-        end
-      end
-      context 'with nodes of virtual storage as an array' do
-        let(:virtual_storages) do
-          {
-            'default' => {
-              'nodes' => {
-                'node-1' => {
-                  'address' => 'tcp://node1.internal',
-                  'token' => 'praefect1-token'
-                }
-              }
-            },
-            'external' => {
-              'nodes' => [
-                {
-                  'storage' => 'node-2',
-                  'address' => 'tcp://node2.external',
-                  'token' => 'praefect2-token'
-                }
-              ]
-            }
-          }
-        end
-        it 'raises an error' do
-          expect { chef_run }.to raise_error('Nodes of Praefect virtual storage `external` must be a hash')
-        end
-      end
    end
    describe 'database migrations' do
No results found