Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThis PR updates GitLab from chart version 9.10.3 to 9.11.2 with Gateway API routing for shell, pages, and registry components; adds a kube-prometheus-stack Helm release for monitoring with Grafana; configures a TCP SSH listener in the Gateway; removes the Terraform Helm provider; and updates GitLab S3 secrets to use Cloudflare R2 credentials instead of account credentials. ChangesMonitoring Infrastructure
GitLab and Gateway Infrastructure
Terraform Provider and Credential Management
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f9b33149-ad5d-40b9-a9dd-ecef2ceac482
📒 Files selected for processing (8)
flux/runtime/releases/gitlab.yamlflux/runtime/releases/kube-prometheus-stack.yamlflux/runtime/repositories/prometheus-community.yamlhelm/gateway-config/chart/templates/gateway.yamlterraform/fluxcd.tfterraform/kubernetes.tfterraform/providers.tfterraform/versions.tf
💤 Files with no reviewable changes (2)
- terraform/versions.tf
- terraform/providers.tf
📜 Review details
🧰 Additional context used
🪛 Trivy (0.69.3)
flux/runtime/repositories/prometheus-community.yaml
[info] 6-8: resource quota usage
A resource quota policy with hard memory and CPU limits should be configured per namespace
Rule: KSV-0040
(IaC/Kubernetes)
flux/runtime/releases/kube-prometheus-stack.yaml
[info] 6-42: resource quota usage
A resource quota policy with hard memory and CPU limits should be configured per namespace
Rule: KSV-0040
(IaC/Kubernetes)
🔇 Additional comments (4)
terraform/kubernetes.tf (1)
129-130: Credential migration is applied consistently in both S3 secrets.Switching to dedicated R2 access key credentials here is correct and improves secret hygiene versus reusing account/API-token fields.
Also applies to: 168-169
terraform/fluxcd.tf (1)
12-12: Good runtime value wiring for Grafana host.This addition is consistent with the new Grafana host templating flow.
flux/runtime/releases/gitlab.yaml (1)
149-159: Gateway route section mappings look consistent.The new
sectionNamevalues align with the defined Gateway listeners and complete the route wiring.Also applies to: 173-174
flux/runtime/releases/kube-prometheus-stack.yaml (1)
23-33: Grafana host and Gateway parentRef wiring looks good.The templated hostname and parent reference are set up correctly for Gateway-based exposure.
| name: gitlab | ||
| namespace: flux-system | ||
| spec: | ||
| interval: 5m | ||
| url: https://prometheus-community.github.io/helm-charts |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo_file="$(fd -i 'prometheus-community.yaml' flux/runtime/repositories | head -n1)"
release_file="$(fd -i 'kube-prometheus-stack.yaml' flux/runtime/releases | head -n1)"
echo "Repository file: $repo_file"
echo "Release file: $release_file"
echo
echo "[HelmRepository metadata.name]"
awk '
/^metadata:/ {in_meta=1; next}
in_meta && /^[^[:space:]]/ {in_meta=0}
in_meta && /^[[:space:]]*name:/ {print; exit}
' "$repo_file"
echo "[HelmRelease sourceRef.name]"
awk '
/sourceRef:/ {in_src=1; next}
in_src && /^[^[:space:]]/ {in_src=0}
in_src && /^[[:space:]]*name:/ {print; exit}
' "$release_file"Repository: clofour/gitlab-kubernetes
Length of output: 315
Rename HelmRepository to match the HelmRelease sourceRef.
kube-prometheus-stack references sourceRef.name: prometheus-community, but this repository is named gitlab. Flux cannot resolve that source, and the release will fail to fetch its chart.
Suggested fix
metadata:
- name: gitlab
+ name: prometheus-community
namespace: flux-system📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| name: gitlab | |
| namespace: flux-system | |
| spec: | |
| interval: 5m | |
| url: https://prometheus-community.github.io/helm-charts | |
| name: prometheus-community | |
| namespace: flux-system | |
| spec: | |
| interval: 5m | |
| url: https://prometheus-community.github.io/helm-charts |
🧰 Tools
🪛 Trivy (0.69.3)
[info] 6-8: resource quota usage
A resource quota policy with hard memory and CPU limits should be configured per namespace
Rule: KSV-0040
(IaC/Kubernetes)
| allowedRoutes: | ||
| namespaces: | ||
| from: All |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In Kubernetes Gateway API v1, what are the recommended secure alternatives to allowedRoutes.namespaces.from: All for TCP listeners (especially SSH/port 22)?
💡 Result:
In Kubernetes Gateway API v1, the recommended secure alternatives to allowedRoutes.namespaces.from: All for TCP listeners (including SSH on port 22) are: 1. from: Same - Restricts TCPRoute attachments to only the same namespace as the Gateway. This is the default and most secure option for single-namespace isolation. 2. from: Selector with a namespace label selector - Allows TCPRoutes from a specific set of labeled namespaces, enabling controlled cross-namespace access without opening to all namespaces. Label namespaces with stable keys like kubernetes.io/metadata.name for precision. Example for a TCP listener on port 22 (SSH): apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: ssh-gateway namespace: infra spec: gatewayClassName: example-class listeners: - name: ssh protocol: TCP port: 22 allowedRoutes: kinds: - kind: TCPRoute namespaces: from: Selector selector: matchLabels: ssh-access: "allowed" Additionally, if TCPRoutes reference backends (e.g., Services) in other namespaces, use ReferenceGrant in the backend's namespace to explicitly authorize those cross-namespace references. This provides defense-in-depth. These apply uniformly to all listeners, including TCP, as allowedRoutes.namespaces is a core field shared across protocols. Official docs emphasize Same or Selector as best practices to prevent unintended Route attachments in multi-tenant clusters, especially avoiding All.
Citations:
- 1: https://gateway-api.sigs.k8s.io/guides/multiple-ns/
- 2: https://gateway-api.sigs.k8s.io/reference/1.3/spec/
- 3: https://gateway-api.sigs.k8s.io/guides/multiple-ns
- 4: https://gateway-api.sigs.k8s.io/reference/spec/?h=sectionname
- 5: https://gateway-api.sigs.k8s.io/concepts/api-overview/?h=tcproute
- 6: https://gateway-api.sigs.k8s.io/concepts/security/
🏁 Script executed:
# Check if the file exists and read the relevant section
cat -n helm/gateway-config/chart/templates/gateway.yaml | head -50Repository: clofour/gitlab-kubernetes
Length of output: 1140
Restrict namespace attachment on the SSH listener.
Allowing from: All on port 22 lets any namespace attach a TCPRoute to this listener. Use from: Selector with namespace label matching to limit attachment to trusted namespaces only.
Suggested hardening
allowedRoutes:
namespaces:
- from: All
+ from: Selector
+ selector:
+ matchLabels:
+ gateway-access: "true"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| allowedRoutes: | |
| namespaces: | |
| from: All | |
| allowedRoutes: | |
| namespaces: | |
| from: Selector | |
| selector: | |
| matchLabels: | |
| gateway-access: "true" |
1 participant
Summary by CodeRabbit
New Features
Updates
Chores