Ingress¶

The spec.ingress block controls how the hostnames declared in spec.domains are served. The operator translates these settings into global.ingress.* and the external URL scheme (global.hosts.https) in the emitted HelmRelease values.

The operator does not install an ingress controller or cert-manager

spec.ingress only configures the chart-side values. You must have a compatible ingress controller (e.g. ingress-nginx, Contour, Traefik) and, if you enable cert-manager integration, a cert-manager instance already running in the cluster.

Fields¶

Field	Type	Default	Description
`spec.ingress.class`	string	cluster default	Ingress class name (`global.ingress.class`). Leave empty to use the cluster's default ingress class.
`spec.ingress.tls`	`*bool`	`true` (chart default)	Controls TLS termination and whether the external URL is `https`. Set to `false` for HTTP-only deployments (e.g. dev/test behind a terminating proxy).
`spec.ingress.configureCertManager`	`*bool`	chart default	Whether the chart wires cert-manager to issue certificates for the GitLab ingresses (`global.ingress.configureCertmanager`). Requires cert-manager in the cluster.
`spec.ingress.annotations`	`map[string]string`	—	Annotations added to every GitLab ingress resource (`global.ingress.annotations`).

How `spec.domains` and `spec.ingress` relate¶

spec.domains sets the hostnames; spec.ingress controls how they are served. The operator composes the two: it places the domain values into global.hosts.* and applies the ingress settings from spec.ingress.

spec.domains.gitlab    →  global.hosts.gitlab.name
spec.domains.registry  →  global.hosts.registry.name
spec.domains.kas       →  global.hosts.kas.name
spec.domains.pages     →  global.hosts.pages.name

spec.ingress.tls       →  global.ingress.tls.enabled
                          global.hosts.https  (controls http/https in external_url)
spec.ingress.class     →  global.ingress.class
spec.ingress.configureCertManager → global.ingress.configureCertmanager
spec.ingress.annotations          → global.ingress.annotations

Examples¶

HTTPS with cert-manager¶

spec:
  domains:
    gitlab: git.example.com
    registry: registry.example.com
  ingress:
    class: nginx
    tls: true
    configureCertManager: true
    annotations:
      cert-manager.io/cluster-issuer: letsencrypt-prod

The chart issues a Certificate via cert-manager for each domain. cert-manager and a ClusterIssuer (or Issuer) must be present in the cluster before applying this configuration.

HTTPS with externally-managed TLS (no cert-manager)¶

Use this when you manage TLS certificates outside the chart (e.g. wildcard cert via External Secrets, or termination at a load balancer).

spec:
  domains:
    gitlab: git.example.com
  ingress:
    class: nginx
    tls: true
    configureCertManager: false

You must create the TLS Secrets expected by the chart manually, or use the chart's global.ingress.tls.secretName override via spec.helm.values.

Custom ingress class with additional annotations¶

spec:
  domains:
    gitlab: git.internal.example.com
  ingress:
    class: traefik
    tls: true
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"

Plain HTTP (development or behind a TLS-terminating proxy)¶

spec:
  domains:
    gitlab: git.dev.example.com
  ingress:
    tls: false

Setting tls: false causes the operator to set global.ingress.tls.enabled: false and global.hosts.https: false, so the chart renders all internal URLs and the external_url with the http:// scheme.

Troubleshooting¶

Ingress resource not created / 404 : Verify that an ingress controller matching spec.ingress.class is installed and running. The chart creates ingress resources but they are only picked up by a controller whose class matches.

cert-manager certificate stays Pending : Check that a ClusterIssuer (or Issuer) matching the annotation value exists in the cluster. Inspect the Certificate and CertificateRequest resources in the GitLab namespace for events.

External URL is http:// when you expected https:// : Verify spec.ingress.tls is true (or omitted, since true is the chart default). If you pass global.hosts.https: false through spec.helm.values, that overrides the operator's setting.