Expose bundled PostgreSQL and Redis to the OAK cluster

What does this MR do?

Stack 1 of 4. Targets master.

Note

Rebased 2026-09-23. The triage bot closed this merge request on 2026-09-19 for inactivity, and stack 1 (!9694 (merged)) merged on 2026-09-21. The stack is now four merge requests on current master, because the former stack 2 is superseded: gitlab_rails['artifact_registry']['api_url'] landed separately in 6d0f3d71.

Also open and needed before this component works: !9817, which fixes a master defect where an OAK component server block receives all requests on oak['network_address'].

An OAK component runs in a Kubernetes cluster and needs to reach the services on the Omnibus host, but nothing bound them to oak['network_address'].

This gap predates Artifact Registry: the shipped OpenBao Helm values already render that address as the PostgreSQL host, so operators had to discover postgresql['listen_address'] for themselves. Redis was worse — Omnibus ships redis['port'] = 0, so it was not reachable over TCP at all.

Adds Oak::NetworkExposure, which widens postgresql['listen_address'] and redis['bind'] to include the OAK address. Both are opt-in and inert by default: nothing changes until a component asks for them or an operator sets the attributes, and an explicit false always wins.

Two prerequisites fail loudly rather than guessing

oak['cluster_source_cidrs'] must be set, because pg_hba.conf has to admit the source address and Omnibus cannot discover it. This was measured rather than assumed: on a k3d cluster, a pod at 10.42.2.4 reaching the exposed PostgreSQL at 172.28.0.10 arrived with source address 172.28.0.3 — its node, because the CNI masquerades traffic leaving the cluster. Granting only the pod CIDR produced:

FATAL: no pg_hba.conf entry for host "172.28.0.3", user "artifact_registry", ...

So the setting is documented as usually the node range, not the pod CIDR, with a kubectl run … inet_client_addr() recipe for determining it. Refusing to guess is deliberate: a wrong narrow value silently rejects every pod, and a wide fallback is a real grant on a password-authenticated database.

redis['password'] must be set. Redis accepts unauthenticated connections by default, and reaching it over TCP from a cluster network without one exposes every queue and cached session.

One non-obvious in-Omnibus consequence

Giving Redis a port makes the redis cookbook treat it as a request for TCP: it drops the UNIX socket and re-points Rails at host:port, taking the password from redis['master_password']. That is only inferred from redis['password'] for Sentinel, replica and master-role topologies — never for the single-node case OAK targets. Left alone, Rails moved to TCP with no password and gitlab-ctl reconfigure failed with NOAUTH Authentication required. Setting master_password at parse time (priority 19, ahead of redis at 20) lets the redis cookbook derive the Rails value, and Workhorse derive its own from the Rails URI.

Note

This work is deliberately early. It runs well ahead of Artifact Registry's own deliverable timelines. It is raised primarily to exercise OAK enablement itself — this MR is a good example of what that exercise surfaces, since both the NOAUTH failure and the source-address finding are OAK-level rather than component-level. Artifact Registry is the consumer providing a concrete target. It is not required by any current Artifact Registry milestone.

PostgreSQL needs a restart, Redis does not

gitlab-ctl reconfigure reloads PostgreSQL, but listen_addresses takes effect on a start. Reconfigure therefore reports the setting as pending a restart, and the cluster cannot reach the database until the operator runs gitlab-ctl restart postgresql. The template now says so. Redis needs no restart: reconfigure applies its bind address directly. Timo Furrer found this while building !9742 (closed), which cherry-picks this commit for a GitLab Relay proof of concept.

Related issues

Related to #10053

Checklist

See Definition of done.

Required

• MR title and description are up to date, accurate, and descriptive.
• MR targeting the appropriate branch. — master.
• Latest Merge Result pipeline is green.
• When ready for review, MR is labeled workflowready for review.
• The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable. — n/a.

Expected

• Test plan indicating conditions for success has been posted and passes. — 36 new library examples; verified end to end against a real package with a k3d cluster on a shared network, where pods authenticate to both exposed services.
• Documentation created/updated. — all four new settings documented in gitlab.rb.template.
• Tests added.
• Integration tests added to GitLab QA. — n/a; covered by the OAK smoke test in stack 6.
• Equivalent MR/issue for the GitLab Chart opened. — n/a, Omnibus-only concern.
• Validate potential values for new configuration settings. — cluster_source_cidrs accepts a String or Array, is validated through IPAddr, and prefixed entries are masked so pg_hba.conf never receives host bits outside the prefix; invalid input raises.