Orbit on Self Managed - Beta (#22739) · Epics · GitLab.org

Orbit on Self Managed - Beta

# Orbit on Self-Managed - Beta (&22739) > SSOT for Orbit on GitLab Self-Managed. Scope agreed by Product, Eng, and leadership. - Parent: [&20992](https://gitlab.com/groups/gitlab-org/-/work_items/20992) - Sibling: [Dedicated &22740](https://gitlab.com/groups/gitlab-org/-/work_items/22740) - Blocked by: .com Siphon + NATS ## What ships The customer runs the whole stack on their own Kubernetes, beside GitLab. Cloud-native only, not in the Omnibus VM. | Component | What | How | |-----------|------|-----| | Orbit service | `gkg-server` (Rust, multi-mode) | GKG Helm chart | | Siphon | CDC, Analytics-owned | Helm chart | | NATS | JetStream | Helm chart | | DIP | Siphon + NATS together | Helm chart | | ClickHouse | datalake + graph DBs | Cloud / BYOC / self-hosted (external) | | GitLab link | gRPC + shared JWT, TLS/mTLS | config | Two install paths: - OAK: GitLab stays on Omnibus, Orbit runs on a separate customer K8s cluster - Pure Helm: cloud-native customers extend their existing K8s Onboarding is white-glove, and stays that way for beta. We get the documentation in order for design partners. We do not generalize it. ### Versions Minimum for cloud-native (CNG) is GitLab 19.2, with some Orbit backports likely. The Siphon table migrations do not reach the monolith until 19.3, so anything a 19.2 customer needs has to be backported. Until Fairway exists, the guidance to customers is to install the GKG Helm chart. ## In scope - Hardened customer Helm chart (GKG + Siphon + NATS) - Install docs, including how to create the shared secret. Customers own their own secret storage, so the docs walk through the common path of a Kubernetes secret and leave vaults and external managers to the customer. - Logical replication setup runbooks per Postgres flavor (Omnibus Postgres, RDS) - ClickHouse Cloud / BYOC / self-hosted - Reference architecture sizing - TLS / mTLS - Operational runbooks - OSS reach-back telemetry - CustomersDot metering Docs and runbooks are the gate on onboarding anyone. Everything else is further along than the writing is. ## Out of scope - Orbit inside the Omnibus VM. Omnibus is a separate workstream: secrets come from a Chef recipe ([omnibus#9718](https://gitlab.com/gitlab-org/omnibus-gitlab/-/work_items/9718)), and monolith support lands in 19.3. - Multi-region / geo ## Reference architecture Sizing per instance scale is a GA deliverable. Starting point: - ClickHouse: 3 nodes (~4 vCPU / 16 GB) - NATS: 3 nodes (~4 vCPU / 8 GB) - Indexer: memory scales with codebase size ## Design partners - Pipeline secured across financial services, insurance, and hardware - Discovery running now - Add via [#595847](https://gitlab.com/gitlab-org/gitlab/-/work_items/595847) ## Related - Product def: [#1023](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1023) - Planning: [#1024](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1024) - PREP: [#1029](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/1029) - Deployment strategy: [kg-parser #108](https://gitlab.com/gitlab-org/rust/gitlab-code-parser/-/work_items/108) - ClickHouse arch: [kg #36](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/36) - Backup / DR: [kg #183](https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/work_items/183) - Omnibus workstream: [omnibus#9718](https://gitlab.com/gitlab-org/omnibus-gitlab/-/work_items/9718) - [Helm charts repo](https://gitlab.com/gitlab-org/orbit/gkg-helm-charts) - [Operate #11](https://gitlab.com/groups/gitlab-com/gl-infra/software-delivery/operate/-/work_items/11)

epic