## Goal Run only the AutoFlow module of GitLab Relay (formerly KAS) on Theseus: one `kas` process with `modules.enabled: [autoflow]`, deployed from a Fairway-generated chart. Deployment targets, in order: 1. the gitlab-caproni rig, 2. Runway v2 staging and production for GitLab.com, 3. Dedicated, 4. self-managed CNG through the GitLab Operator (OAK for Omnibus customers). Artifact Registry GA in January 2027 covers all three products, and AR's lifecycle policies run on AutoFlow, so the code for Dedicated and self-managed lands by mid-December 2026. autocore's databases and Redis come through the infrastructure contract, with runtime connections through the platform's connection pooler; tracing and logging follow the platform's `GITLAB_TRACING` and `GITLAB_LOG_*` conventions. The process keeps four listeners: | Port | Protocol | Purpose | |---|---|---| | 8153 | gRPC | the Trigger service (and Rails, later) calls the `AutoFlow` service | | 8150 | gRPC | remote AutoFlow modules register over module tunnels | | 8155 | gRPC | private API: replicas route to agents and to each other | | 8151 | HTTP | Prometheus metrics, liveness and readiness probes | Each listener speaks TLS when both `certificate_file` and `key_file` are configured, plaintext otherwise. The Kubernetes API proxy and the other agent-facing modules are off. Relay stays as it is in CNG, in the Linux package and on GitLab.com for the other modules. The analysis behind this epic is [gitlab-agent#1084](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1084); the issues attached to this epic are what remains to do. ## Kubernetes-only, acknowledged Theseus reaches self-managed customers only through Kubernetes: the GitLab Operator, Crete and OAK ([vision](https://gitlab.com/gitlab-org/theseus/theseus/-/blob/27fb24990a951e52ab020e9e742169a191b9b648/docs/explanation/vision.md#L105-L113)). A Linux package installation without a Kubernetes cluster cannot run a Theseus component. OAK needs a customer-provided cluster, is beta and opt-in, ships one component, and its design keeps the option to retire it before GA ([OAK design document](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/omnibus_adjacent_kubernetes/)). Putting AutoFlow on Theseus therefore means: **self-managed customers without Kubernetes get no AutoFlow, and Theseus has no plan that changes this.** Accepted on 2026-10-02 ([theseus!106](https://gitlab.com/gitlab-org/theseus/theseus/-/merge_requests/106)). Artifact Registry is Kubernetes-only: "AC is Kubernetes-only. It will never ship inside Omnibus" (Tim Rizzi, AR CTO review, 2026-10-02). Omnibus customers get AR through OAK. AutoFlow has one customer today, Artifact Registry, so AutoFlow is Kubernetes-only for now too. ## Scope In scope: - module selection in Relay; - the Fairway chart with its `templates/custom` overlay, published from Relay's CI together with the Relay image with GLAZ; - the contract extension for several PostgreSQL databases with roles, across protos, Fairway, LabKit, runwayctl and gitlab-dev-stack; - Redis, tracing and logging through the platform conventions, and Prometheus metrics on 8151 through Fairway `spec.metrics`; - gRPC health on the API listener; - the Rails change that sends `AutoFlow` RPCs to a separate Relay; - the Runway staging and production deployments; - the Dedicated and self-managed CNG deliveries; - SLOs, dashboards and alerts: the runbooks metrics catalog for GitLab.com, Metropolis resources in the chart everywhere else; - security fixes built in the security mirror and deployed per service, independent of the monolith's release. Out of scope: - every Relay module except AutoFlow: Kubernetes agents, the Kubernetes API proxy, the Job Router, the events platform and Workspaces are not served by this deployment; - the Linux package path for AutoFlow, which stays with [gitlab-agent#1084](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1084). ## Milestones Every child issue of this epic is on one of these `gitlab-org` milestones. Each milestone's description is the source of truth for what it delivers, its exit condition and the platform-side items it depends on. ### :white_check_mark: [AutoFlow on Theseus: caproni](https://gitlab.com/groups/gitlab-org/-/milestones/169) One database, one role, today's contract, on the gitlab-caproni rig. <details> <summary>Related issues</summary> ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: caproni"' ``` </details> ### [AutoFlow on Theseus: Runway staging](https://gitlab.com/groups/gitlab-org/-/milestones/170) The same Relay on Runway v2 staging, with dashboard, SLIs and runbook. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: Runway staging"' ``` ### [AutoFlow on Theseus: production](https://gitlab.com/groups/gitlab-org/-/milestones/171) GitLab.com production, Dedicated and self-managed CNG, for Artifact Registry GA in January 2027. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: production"' ``` ### [AutoFlow on Theseus: after the MVC](https://gitlab.com/groups/gitlab-org/-/milestones/172) Placeholder for everything the MVC does not need, to be split into milestones when the MVC ships. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: after the MVC"' ``` ## Tracked elsewhere Dependencies of these milestones that live under other epics: - [gitlab-agent#1168](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1168) Expose autocore configuration in `kascfg` (staging; blocks the staging configuration) - [gitlab-agent#1200](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1200) Accept the admin's token-exchange JWT with an `autoflow` audience (staging) - [gitlab-agent#1199](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1199) Authenticate the Trigger service on the API listener (production) - [gitlab-agent#1193](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1193) AutoFlow acts for the recorded principal (being rewritten for ADR 002) - [trigger!10](https://gitlab.com/gitlab-org/primitives/trigger/-/merge_requests/10) ADR 002: the Trigger is a workload principal; service-to-service auth is Kubernetes identity - [fairway#93](https://gitlab.com/gitlab-com/gl-infra/platform/runway/fairway/-/work_items/93) Pod identity tokens per audience, the platform dependency of the two auth items above - [gitlab-caproni!94](https://gitlab.com/gitlab-org/gitlab-caproni/-/merge_requests/94) Metropolis on the rig, which the dashboard issue needs