Support KAS #3180

kkimurak · 2025-10-24T10:53:11Z

This PR adds configurations for external / built-in KAS and installation process to build built-in KAS.

External KAS settings implemented by @antt1995 (in #2598, rebased by @kkimurak)
Built-in KAS build process implemented by @kkimurak
Built-in KAS configuration test, improvements and updates until it works by @th-2021

TODO

Documentation cleanup, verify that the actual behavior matches the documentation

th-2021 · 2025-10-24T11:16:32Z

Should we make the builtin kas the only option? Remove GITLAB_AGENT_BUILTIN_KAS_ENABLED?

th-2021 · 2025-10-24T14:18:19Z

One last fix on my side. Now kubernetes dashboard is working.

kkimurak · 2025-10-24T14:52:26Z

@th-2021 Thanks, I cherry-picked 4a4c484 .

For GITLAB_AGENT_BUILTIN_KAS_ENABLED removal, I'm not sure. Some people may want to continue using the existing KAS and connect it to sameersbn/gitlab (although I can't imagine many situations where KAS is running alone).

kkimurak · 2025-10-24T15:26:05Z

For those who interested, I have pushed self built image kkimurak/sameersbn-gitlab:18.5.1-kas-8d3907d to docker hub. I look forward to feedback. I really don't use k8s so want to hear test report and opinion from users.

chodorenko · 2025-11-20T09:30:02Z

We are really looking forward to the implementation of this function in the main project code, @kkimurak and @th-2021 thank you very much for the work done

kkimurak · 2026-01-06T11:08:23Z

Some documentation updated. I think it's ready for review.

For those who interested in but cannot build themselves, I pushed kkimurak/sameersbn-gitlab:18.7.0-kas for testing. Any feedback would be appreciated.

th-2021 · 2026-01-06T12:02:20Z

@kkimurak it's not working for me. The reason seems to be that gitlab cannot be reached at port 8080. Changing the port to 8181 in gitlab kas config seems to solve it. At least for kas itself. The gitlab-agent (k8s part) still cannot connect.

kkimurak · 2026-01-06T12:07:13Z

@th-2021 Oh sorry, I'll look into it. I made some changes based on your code (18.5.1), so I'll start by checking if the generated configuration is the same after starting the container.

th-2021 · 2026-01-06T12:52:56Z

@kkimurak the port 8080 stuff is imho not related to the patches. Maybe a puma change in gitlab itself.

kkimurak · 2026-01-06T12:57:54Z

~~Ah, I have to include kkimurak/docker-gitlab@ce92d2c to launch gitlab as I wrote in #3197 (comment)..~~ This patch is broken. Fix later..

th-2021 · 2026-01-06T13:05:42Z

@kkimurak if puma runs no longer at port 8080, maybe we should change gitlab kas config to use port 8181 (gitlab workhorse).

Without those changes puma (and then gitlab itself) does not starts See following upstream changes: - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/128619 (overwritten by gitlab-org/gitlab!132581) - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/132581 - https://gitlab.com/gitlab-org/gitlab/-/merge_requests/211331

Co-authored-by: Kazunori Kimura <[email protected]>

Removed +

Co-authored-by: Kazunori Kimura <[email protected]>

Fix link fragment for gitlab-kas in TOC (markdownlint: MD-051 - must be lowercase)

also add process to generate secret files for KAS - GITLAB_KAS_SECRET - GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE - GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE

sync with upstream

- build KAS on build, enable via GITLAB_AGENT_KAS_ENABLED (automatically enabled if GITLAB_KAS_ENABLED=true) - Add built-in KAS config file kas config: import upstream (v15.10.0 - d88f4b89) - minimal parameterization gitlab side: - GITLAB_KAS_ENABLED gitlab_rails['gitlab_kas_enabled'] for omnibus installation - GITLAB_KAS_INTERNAL gitlab_rails['gitlab_kas_internal_url'] for omnibus installation - GITLAB_KAS_EXTERNAL gitlab_rails['gitlab_kas_external_url'] for omnibus installation - GITLAB_KAS_PROXY gitlab_rails['gitlab_kas_external_k8s_proxy_url'] for omnibus installation kas side: - GITLAB_AGENT_KAS_ENABLED gitlab_kas['enabled'] for omnibus installation - GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE gitlab_kas['internal_api_listen_authentication_secret_file'] - GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE used by both: - GITLAB_KAS_SECRET used as a value for - gitlabhq/gitlab.yml : production.gitlab_kas.secret_file - gitlab-agent/gitlab-kas_config.yaml : gitlab.authentication_secret_file Prefix for parameters that only used by gitlab-agent/kas is "GITLAB_AGENT_KAS_" Also add process to generate secret files for KAS Update built-in KAS to 16.10.1, sync config Update built-in gitlab-kas to v17.0.2, sync configuration - Bump to v17.0.0, sync configuration GitOps module have been removed. See upstream change: https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/merge_requests/1436 - Bump: gitlab-kas 17.0.1 no change in configuration file - Bump: gitlab-kas 17.0.2 no change in configuration file Personal note: I am still unable to successfully connect the agent from the WebUI. The problem is that I don't know the correct way to do it in the first place, so I have to check it out. Stop gitlab_kas before restoring backup It seems that kas has DB connection and blocks restoration - Bump: gitlab-kas 18.1.0 reference configuration file have been renamed to kascfg_defaults.yaml and does not contain full configurations So I have to search a way to generate full configuration from .proto or docs

default to api.listen.authentication_secret_file, as omnibus-gitlab do

squash following commit: - update to 18.5.0 - upgrade to 18.5.1

add WEBTOKEN secret; remove GITLAB_KAS_SECRET Replace GITLAB_KAS_SECRET by GITLAB_AGENT_KAS_WEBSOCKET_TOKEN_SECRET_FILE

Add kas location to assets/runtime/config/nginx/gitlab(-ssl) config KAS location is affected by GITLAB_RELATIVE_URL_ROOT so add update process to assets/runtime/functions

in gitlab-kas_config.yaml complete 18.5.0 upgrade

Merge GITLAB_AGENT_BUILTIN_KAS_ENABLED and GITLAB_AGENT_KAS_ENABLED

User still only required to set `GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE` as `GITLAB_KAS_SECRET` finally default to `GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE` (over `GITLAB_AGENT_KAS_GITLAB_AUTHENTICATION_SECRET_FILE`)

kkimurak · 2026-01-06T13:16:59Z

I have noticed that I removed bind 'tcp://127.0.0.1:8080' from puma.rb by mistake. I should revert the line deletion. I have fixed the patch (kkimurak/docker-gitlab@1a75e89) and rebased onto it.

kkimurak · 2026-01-06T13:46:16Z

Built successfully. pushed kkimurak/sameersbn-gitlab:18.7.0-kas-e2673eb7

th-2021 · 2026-01-06T14:20:41Z

@kkimurak I removed my old agent entry and now I cannot register a new agent. The entry is missing. Only "create a cluster" is shown. Any idea?

th-2021 · 2026-01-10T09:51:17Z

@kkimurak not sure, what was, the issue is gone now. k8s environment is working again.

This was referenced Oct 24, 2025

Change localhost to 127.0.0.1 in assets/runtime #3181

Merged

Include builtin-kas in docker image provided by @kkimurak #2736

Open

Upgrade GitLab CE to 18.7.0

baa49e0

kkimurak force-pushed the support-builtin-kas branch from 8d3907d to 66cb842 Compare January 6, 2026 08:55

kkimurak marked this pull request as ready for review January 6, 2026 09:06

kkimurak force-pushed the support-builtin-kas branch from 66cb842 to dead92d Compare January 6, 2026 09:28

kkimurak and others added 13 commits January 6, 2026 22:15

KAS

7826902

Added functions

987c723

Update assets/runtime/env-defaults

01aa149

Co-authored-by: Kazunori Kimura <[email protected]>

Added to Readme

a155048

Update assets/runtime/env-defaults

6de43c7

Co-authored-by: Kazunori Kimura <[email protected]>

Update README.md

7ef8a4c

Update README.md

c908e6c

Removed +

Update README.md

ebc96da

Co-authored-by: Kazunori Kimura <[email protected]>

README.md: revise GitLab KAS section

dab94ca

Fix link fragment for gitlab-kas in TOC (markdownlint: MD-051 - must be lowercase)

Add KAS config file, minimal parameterization

8798c22

also add process to generate secret files for KAS - GITLAB_KAS_SECRET - GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE - GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE

Tweak kas config order in gitlab.yml

71a555b

sync with upstream

kkimurak and others added 13 commits January 6, 2026 22:16

kas: tweak defaults for gitlab.authentication_secret_file

0288326

default to api.listen.authentication_secret_file, as omnibus-gitlab do

upgrade to 18.5.1

f5089a7

squash following commit: - update to 18.5.0 - upgrade to 18.5.1

change name of secret

9dad8d9

add WEBTOKEN secret; remove GITLAB_KAS_SECRET Replace GITLAB_KAS_SECRET by GITLAB_AGENT_KAS_WEBSOCKET_TOKEN_SECRET_FILE

configure NGINX for GITLAB_BUILTIN_KAS

0e581ba

Add kas location to assets/runtime/config/nginx/gitlab(-ssl) config KAS location is affected by GITLAB_RELATIVE_URL_ROOT so add update process to assets/runtime/functions

tweak agent.kubernetes_api.url_path_prefix

702b596

in gitlab-kas_config.yaml complete 18.5.0 upgrade

fix GITLAB_AGENT_BUILTIN_KAS_ENABLED == false

7c4fbf9

Fix parameter name to enable builtin-kas

cc4582a

Merge GITLAB_AGENT_BUILTIN_KAS_ENABLED and GITLAB_AGENT_KAS_ENABLED

fix kubernetes access

6843550

Add description for GITLAB_AGENT_KAS_WEBSOCKET_TOKEN_SECRET_FILE

eee2dde

Add example KAS configuration to README.md

c93d5ba

Fix assignment for GITLAB_KAS_SECRET

1ba4723

User still only required to set `GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE` as `GITLAB_KAS_SECRET` finally default to `GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE` (over `GITLAB_AGENT_KAS_GITLAB_AUTHENTICATION_SECRET_FILE`)

Update gitlab_agent_kas to 18.7.0

e2673eb

kkimurak force-pushed the support-builtin-kas branch from dead92d to e2673eb Compare January 6, 2026 13:16

Support KAS #3180

Are you sure you want to change the base?

Support KAS #3180

Conversation

kkimurak commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

th-2021 commented Oct 24, 2025

Uh oh!

th-2021 commented Oct 24, 2025

Uh oh!

kkimurak commented Oct 24, 2025

Uh oh!

kkimurak commented Oct 24, 2025

Uh oh!

chodorenko commented Nov 20, 2025

Uh oh!

kkimurak commented Jan 6, 2026

Uh oh!

th-2021 commented Jan 6, 2026

Uh oh!

kkimurak commented Jan 6, 2026

Uh oh!

th-2021 commented Jan 6, 2026

Uh oh!

kkimurak commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

th-2021 commented Jan 6, 2026

Uh oh!

kkimurak commented Jan 6, 2026

Uh oh!

kkimurak commented Jan 6, 2026

Uh oh!

th-2021 commented Jan 6, 2026

Uh oh!

th-2021 commented Jan 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kkimurak commented Oct 24, 2025 •

edited

Loading

kkimurak commented Jan 6, 2026 •

edited

Loading