GitLab Helm chart 10.0 upgrade notes

With the 19.0 release of GitLab, we have released version 10.0 of the GitLab Helm chart.

This document highlights the changes with the highest impact. For a comprehensive overview, see:

• GitLab 19.0 deprecations
• A guide to the breaking changes in GitLab 19.0

Summary of major changes

• NGINX Ingress is now disabled by default and replaced by Gateway API with Envoy Gateway.
• The bundled PostgreSQL, Redis, and MinIO have been removed from the GitLab chart.
• Support for PostgreSQL 16 has been removed. Make sure you are running PostgreSQL 17 before upgrading.
• Resource Owner Password Credentials (ROPC) OAuth grant removed.

For mitigation steps and full details, follow the linked deprecation notices.

Upgrade to 10.4.0

KAS advertises native gRPC to agents by default

The address in gitlab_kas.external_url, shown in the agent installation instructions, now defaults to grpcs://kas.example.com instead of wss://kas.example.com when the chart routes gRPC to KAS: with Gateway API and the chart-managed Envoy Gateway policies (the default), or with the NGINX Ingress provider, for which the KAS gRPC Ingress is now rendered by default. Other Ingress controllers and installations with a relative URL root keep wss://. Agents already connected over wss:// are not affected. To keep advertising WebSocket, set global.appConfig.gitlab_kas.externalUrl. To skip the gRPC Ingress, set global.kas.ingress.grpc.enabled: false. For details, see agent connection protocol.

Upgrade to 10.3

Envoy Gateway upgrade requires new CRDs

The bundled Envoy Gateway chart is upgraded from 1.8.3 to 1.9.1. Helm does not upgrade CRDs, so apply the Envoy Gateway CRDs for 1.9.1 and the required version 1.6 Gateway API CRDs before you upgrade GitLab. Otherwise the upgrade fails on the GitLab Shell TCPRoute, and the API server prunes the new Host header setting on the Webservice listeners. For the upgrade steps, see Upgrade the Envoy Gateway CRDs.