RedHat-certified images

Tier: Free, Premium, Ultimate
Offering: GitLab Self-Managed

The following table lists the images that the GitLab Operator deploys. The table includes links to the RedHat Technology Portal project listings where these images can be managed by GitLab team members.

The GitLab Operator image tags align with the GitLab Operator release versions.

The NGINX Ingress Controller image tags align with the contents of the TAG file in the project fork managed by GitLab.

The rest of the image tags follow v<GitLab version>-ubi8 format, for example v15.4.0-ubi8. The tag suffix denotes the images that have been built on top of the RedHat Universal Base Image (UBI), a requirement for certification by RedHat. The GitLab Operator image itself only has one variant, which is already built on top of UBI.

See the Charts documentation on UBI images for more information, including example Helm values to use these images.

Component	Registry path
`gitlab-operator`	`registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:$OPERATOR_VERSION`
`gitlab-operator-bundle`	`registry.connect.redhat.com/gitlab/gitlab-operator-bundle`
`alpine-certificates`	`registry.gitlab.com/gitlab-org/build/cng/alpine-certificates:$GITLAB_VERSION-ubi`
`cfssl-self-sign`	`registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:$GITLAB_VERSION-ubi`
`kubectl`	`registry.gitlab.com/gitlab-org/build/cng/kubectl:$GITLAB_VERSION-ubi`
`gitaly`	`registry.gitlab.com/gitlab-org/build/cng/gitaly:$GITLAB_VERSION-ubi`
`gitlab-container-registry`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:$GITLAB_VERSION-ubi`
`gitlab-exporter`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:$GITLAB_VERSION-ubi`
`gitlab-geo-logcursor`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-geo-logcursor:$GITLAB_VERSION-ubi`
`gitlab-kas`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-kas:$GITLAB_VERSION-ubi`
`gitlab-mailroom`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-mailroom:$GITLAB_VERSION-ubi`
`gitlab-pages`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-pages:$GITLAB_VERSION-ubi`
`gitlab-shell`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:$GITLAB_VERSION-ubi`
`gitlab-sidekiq-ee`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ee:$GITLAB_VERSION-ubi`
`gitlab-toolbox-ee`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ee:$GITLAB_VERSION-ubi`
`gitlab-webservice-ee`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ee:$GITLAB_VERSION-ubi`
`gitlab-workhorse-ee`	`registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee:$GITLAB_VERSION-ubi`
`gitlab-ingress-nginx`	`registry.gitlab.com/gitlab-org/cloud-native/charts/gitlab-ingress-nginx/controller:$NGINX_VERSION-ubi`

Image signatures

The Operator image can be verified with cosign:

cosign verify "registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:$OPERATOR_VERSION" \
  --certificate-identity "https://gitlab.com/gitlab-org/cloud-native/gitlab-operator//.gitlab-ci.yml@refs/heads/$OPERATOR_VERSION" \
  --certificate-oidc-issuer "https://gitlab.com"

Information on how to verify the CNG image signature can be found in the Helm chart documentation.