gitlab-org/gitlab-environment-toolkit 3.12.0 on GitLab

[!important]
The GitLab Environment Toolkit automates deploying and managing scaled GitLab environments following the Reference Architectures. It's recommended that users review the Before You Start section before use. Users are expected to have a good working knowledge of Terraform, Ansible, GitLab administration, and infrastructure management, as environments ultimately remain the responsibility of the user. As such, it's strongly recommended that you independently review the Toolkit in full before any use to ensure it meets your requirements, especially around security or data integrity.
If upgrading, it's always recommended to review the release notes in full as well as the relevant documentation and to upgrade the Toolkit first before the environment.

[[TOC]]

New Key Features

OpenBao (GitLab Secrets Manager) GA

Merge Request(s): !1920
Documentation: OpenBao (GitLab Secrets Manager)

OpenBao is now supported for Cloud Native Hybrid environments, following GitLab Secrets Manager reaching GA in GitLab 19.5. Refer to the documentation for setup and sizing.

OCI GitLab Chart sources

Merge Request(s): !1900
Documentation: Chart Install Options

The GitLab Chart can now be installed from an OCI registry via gitlab_charts_ref, such as a mirror in a restricted network.

Helm Charts Zero Downtime Upgrade improvements

Merge Request(s): !1901 (thanks @shenson!), !1919, !1925, !1930, !1932 (thanks @nwestbury!)
Documentation: Zero Downtime Upgrades

Zero Downtime Upgrades for GitLab Helm Charts have had a full review with a number of fixes, including correct rollout strategy settings, failing fast on failed migration Jobs, recovering paused Deployments after a failed upgrade and running the Geo tracking database migrations on secondary sites. Please see the Upgrade Notes for changes that affect existing environments.

Further Updates and Improvements

Bumped Ansible to 14.x, Terraform to 1.16.7 and the Azure azurerm provider to 5.x. !1927, !1929, !1936, !1879. See Upgrade Notes for more information.
Updated dependency versions (kube-prometheus-stack, Consul, cert-manager). !1937
Changed Ansible collections to use the versions bundled with Ansible by default. !1941. See Upgrade Notes for more information.
Bumped Python packages, including cryptography to 50.0.2 for open vulnerabilities, and automated their updates going forward. !1928, !1934, !1942
Added Helm 4 support. !1904
Added gitlab_charts_envoy_proxy_type to allow the Envoy proxy to run as a Deployment instead of a DaemonSet. !1909
Added ElastiCache Redis log delivery configuration on AWS. !1872 (thanks @appletechy!)
Added cleanup of Gateway API resources to the uninstall playbook. !1895 (thanks @niskhakova!)
Fixed the Azure dynamic inventory returning no hosts in releases 3.10.1 to 3.11.0. !1921 (thanks @niskhakova!)
Fixed Envoy Gateway version lookup to read from the GitLab Chart instead of gitlab.com. !1892, !1897 (thanks @shenson!)
Fixed incremental Gitaly server-side backups on AWS. !1890
Updated Redis Zero Downtime Upgrades on Linux package environments to update replicas before the Sentinel master. !1898, !1903
Switched to the google-cloud-cli package as Google has removed google-cloud-sdk. !1896
Various other small updates, improvements, and fixes.

Upgrade Notes

Terraform, Ansible and Azure provider upgrades

The minimum Terraform version is now 1.16.7. State written by newer Terraform versions can't be read by older ones, so all users of an environment should upgrade together.

Ansible has been bumped to 14.x as 13.x is now EOL. If you don't use the Toolkit's Docker image, reinstall the Python and Ansible Galaxy requirements.

The Azure module now requires azurerm 5.1 or later, so run terraform init -upgrade before your next terraform apply.

Ansible collection installs

Ansible Galaxy roles and collections are now installed separately, with collections no longer installed with --force so the versions bundled with Ansible are kept. If you don't use the Toolkit's Docker image, please use the updated commands in the docs.

Any collections already installed in ~/.ansible/collections will take priority over the bundled versions. Either remove them or install their Python packages as described in Ansible Collections.

Helm Charts Zero Downtime Upgrade changes

gitlab_charts_zero_downtime_terminationGracePeriodSeconds has been removed as it had no effect on most components. A 90 second termination grace period is now set on Webservice pods only, which will trigger a one-off rolling restart of Webservice on the next GitLab Charts run. If you plan to do a zero downtime upgrade, do a normal run at your current GitLab version first.

Geo zero downtime upgrades also have a new final step to run the post-deployment migrations on each secondary site. Please see the Geo zero downtime upgrade docs for more details.

Feedback

Got any feedback or found an issue? Please feel free to create an issue on our tracker: https://gitlab.com/gitlab-org/gitlab-environment-toolkit/-/issues