## Goal Run only the AutoFlow module of GitLab Relay (formerly KAS) on Theseus: one `kas` process with `modules.enabled: [autoflow]`, deployed from a Fairway-generated chart. Deployment targets, in order: 1. the gitlab-caproni rig, 2. Runway v2 staging and production for GitLab.com, 3. self-managed Kubernetes, once a self-managed installer consumes Fairway charts. autocore's databases and Redis come through the infrastructure contract, with runtime connections through the platform's connection pooler; tracing and logging follow the platform's `GITLAB_TRACING` and `GITLAB_LOG_*` conventions. The process keeps four listeners: | Port | Protocol | Purpose | |---|---|---| | 8153 | gRPC | Rails calls the `AutoFlow` service | | 8150 | gRPC | remote AutoFlow modules register over module tunnels | | 8155 | gRPC | private API: replicas route to agents and to each other | | 8151 | HTTP | Prometheus metrics, liveness and readiness probes | Each listener speaks TLS when both `certificate_file` and `key_file` are configured, plaintext otherwise. The Kubernetes API proxy and the other agent-facing modules are off. Relay stays as it is in CNG, in the Linux package and on GitLab.com for the other modules. The analysis behind this epic is [gitlab-agent#1084](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1084); the issues attached to this epic are what remains to do. ## Blocker: self-managed without Kubernetes Theseus reaches self-managed customers only through Kubernetes: the GitLab Operator, Crete and OAK ([vision](https://gitlab.com/gitlab-org/theseus/theseus/-/blob/27fb24990a951e52ab020e9e742169a191b9b648/docs/explanation/vision.md#L105-L113)). A Linux package installation without a Kubernetes cluster cannot run a Theseus component. OAK needs a customer-provided cluster, is beta and opt-in, ships one component, and its design keeps the option to retire it before GA ([OAK design document](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/omnibus_adjacent_kubernetes/)). AutoFlow is meant to be a core primitive of GitLab, installed by default in every distribution. Putting it on Theseus therefore means: **self-managed customers without Kubernetes get no AutoFlow, and Theseus has no plan that changes this.** That is an architectural constraint we take on with this epic, not an implementation gap. It has to be acknowledged and accepted by product and engineering leadership before AutoFlow on Theseus goes beyond GitLab.com. The analysis is G-01 in [gitlab-agent#1084](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1084); the Linux package path stays there. ## Scope In scope: - module selection in Relay; - the Fairway chart with its `templates/custom` overlay, published from Relay's CI together with the Relay image with GLAZ; - the contract extension for several PostgreSQL databases with roles, across protos, Fairway, LabKit, runwayctl and gitlab-dev-stack; - Redis, tracing and logging through the platform conventions, and Prometheus metrics on 8151 through Fairway `spec.metrics`; - gRPC health on the API listener; - the Rails change that sends `AutoFlow` RPCs to a separate Relay; - the Runway staging and production deployments; - the self-managed Kubernetes delivery, once unblocked. Out of scope: - every Relay module except AutoFlow: Kubernetes agents, the Kubernetes API proxy, the Job Router, the events platform and Workspaces are not served by this deployment; - the Linux package path for AutoFlow, which stays with [gitlab-agent#1084](https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/work_items/1084). ## Milestones Every child issue of this epic is on one of these `gitlab-org` milestones. Each milestone's description is the source of truth for what it delivers, its exit condition and the platform-side items it depends on. ### [AutoFlow on Theseus: caproni](https://gitlab.com/groups/gitlab-org/-/milestones/169) One database, one role, today's contract, on the gitlab-caproni rig. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: caproni"' ``` ### [AutoFlow on Theseus: Runway staging](https://gitlab.com/groups/gitlab-org/-/milestones/170) The same Relay on Runway v2 staging, with dashboard, SLIs and runbook. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: Runway staging"' ``` ### [AutoFlow on Theseus: Runway production](https://gitlab.com/groups/gitlab-org/-/milestones/171) Promoted to production for Artifact Registry GA. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: Runway production"' ``` ### [AutoFlow on Theseus: after the MVC](https://gitlab.com/groups/gitlab-org/-/milestones/172) Placeholder for everything the MVC does not need, to be split into milestones when the MVC ships. ```glql display: table fields: status, title, project, assignees limit: 50 sort: created asc query: 'type = Issue AND group = "gitlab-org" AND includeSubgroups = true AND milestone = "AutoFlow on Theseus: after the MVC"' ```