docs: add the self-managed CNG install guide (AR and GATE)

João Pereirarequested to merge
docs/sm-install-baseline into main

Context

Action item from the AR/GATE deployment sync (2026-07-13), part of the closed-beta scope (gitlab-org&21052): document the as-is steps a self-managed customer follows today to install AR and its full dependency chain on an existing GitLab CNG installation, so reviewers can flag functionally untenable steps and Product can judge the experience.

The doc unifies the AR baseline and the GATE companion (originally gitlab-org/auth/iam!416 (closed)) into one dependency-ordered flow: iam-data-access first (steps 1-7), then AR installed in its target shape (steps 8-17), with the glaz sidecar deployed (chart default) and AR's iam client configured against the Part 1 service. Temporary states (bootstrap-token mode, inert enforcement) are inline notes at the steps where they apply, not structure.

Every step was executed end to end on a clean local Kubernetes environment (GitLab 19.1.2 / chart 10.1.2, iam-data-access chart 1.32.0), full-order run on 2026-07-15 at AR chart 1.163.1 / glaz v0.4.0. Steps 13-17 re-ran on 2026-07-29 at AR chart 1.202.0, upgrading that install in place. The steps now pin chart 1.223.2 / glaz v1.4.0, which carries the public-image default from !1218 (merged), so no imageOverride is needed.

What's included

  • docs/dev/self-managed-install.md: prerequisites, 17 steps in two parts, a 12-row known-gaps table with a component column, and an appendix with in-cluster backing services. Replaces the separate baseline and GATE files.
  • An updated row in docs/dev/README.md.

Related

  • #308 (closed) / !939 (merged): found by this walk's verification step, now fixed and merged.
  • !918 (merged) (configuration reference, merged) and !919 (merged) (token realm scheme fix) came from the same walk and are linked from the doc.
  • Step 14 provisions the namespace through POST /api/gitlab/v1/namespaces with the ADR-007 organization anchor, replacing the earlier direct SQL. GitLab does not call it during onboarding yet, so the operator runs it by hand.
Edited by João Pereira

Merge request reports