Complete the checks in Requirements before you start. The steps below install Deckhouse Code as the release code in the namespace code, with the web interface at code.example.com. The container registry is disabled by default; Container registry describes how to enable it.

Sign in to the chart registry

The chart is published as an OCI artifact. <CHART_REGISTRY> is the registry address, <CHART_VERSION> the chart version; both come with the product together with the registry credentials. Sign in to the registry:

helm registry login <CHART_REGISTRY>

Prepare the values file

Create values.yaml with the host names, the ingress class, the connections to PostgreSQL, Redis and the object storage, the bucket names and the StorageClass for Git repositories. The chart creates the Secrets with the passwords and keys from the global.codeHelm.externalSecrets block, so no Secret is created by hand:

global:
  hosts:
    domain: example.com
    gitlab:
      name: code.example.com
  ingress:
    class: nginx
  psql:
    host: <POSTGRESQL_HOST>
    port: 5432
    database: <POSTGRESQL_DATABASE>
    username: <POSTGRESQL_USERNAME>
  praefect:
    psql:
      host: <POSTGRESQL_HOST>
      user: <PRAEFECT_USERNAME>
      dbName: <PRAEFECT_DATABASE>
  redis:
    host: <REDIS_HOST>
    port: 6379
  appConfig:
    lfs:
      bucket: <LFS_BUCKET>
    artifacts:
      bucket: <ARTIFACTS_BUCKET>
    uploads:
      bucket: <UPLOADS_BUCKET>
    packages:
      bucket: <PACKAGES_BUCKET>
    externalDiffs:
      bucket: <MR_DIFFS_BUCKET>
    terraformState:
      bucket: <TERRAFORM_STATE_BUCKET>
    dependencyProxy:
      bucket: <DEPENDENCY_PROXY_BUCKET>
    backups:
      bucket: <BACKUPS_BUCKET>
      tmpBucket: <BACKUP_TMP_BUCKET>
  codeHelm:
    ingress:
      tls:
        clusterIssuer: <CLUSTER_ISSUER_NAME>
    externalSecrets:
      enabled: true
      psqlPassword: <POSTGRESQL_PASSWORD>
      praefectPassword: <PRAEFECT_PASSWORD>
      redisPassword: <REDIS_PASSWORD>
      s3:
        provider: AWS
        region: <S3_REGION>
        endpoint: <S3_ENDPOINT_URL>
        aws_access_key_id: <S3_ACCESS_KEY_ID>
        aws_secret_access_key: <S3_SECRET_ACCESS_KEY>
      backup:
        aws_access_key_id: <S3_ACCESS_KEY_ID>
        aws_secret_access_key: <S3_SECRET_ACCESS_KEY>
      registryDockerConfig: <BASE64_DOCKERCONFIGJSON>
    backup:
      region: <S3_REGION>
      endpoint: <S3_ENDPOINT_URL>
gitlab:
  gitaly:
    persistence:
      size: 50Gi
      storageClass: <STORAGE_CLASS_NAME>

Replace every placeholder in angle brackets. <S3_ENDPOINT_URL> is the storage URL with the scheme, for example https://storage.example.com. <BASE64_DOCKERCONFIGJSON> is the image registry credentials file encoded with base64 -w0. The buckets exist in the storage before the install. Configuration explains every value shown here, and Advanced configuration lists the rest.

Install the release

helm upgrade --install code oci://<CHART_REGISTRY>/code \
  --version <CHART_VERSION> \
  -n code --create-namespace \
  -f values.yaml

The command creates the namespace code when it does not exist and installs the release code. The chart checks the values before it creates any object; when a check fails, the command prints the reason and exits without installing. Troubleshooting lists the messages.

Point DNS at the load balancer

The release exposes HTTP, HTTPS and Git over SSH through one Service of type LoadBalancer. Get its external address:

d8 k -n code get service code-code-loadbalancer

Create a DNS record for code.example.com that points at the address in the EXTERNAL-IP column. Git clients connect over SSH to port 22 of the same address.

Wait for the release to become ready

The migrations job runs once and prepares the database schema; the web service and Sidekiq pods wait for it. Confirm that the job has completed and every pod is Running:

d8 k -n code get jobs,pods

The Ingress certificates are issued by cert-manager after the install. Confirm that every Certificate reports READY as True:

d8 k -n code get certificate

Sign in for the first time

The chart generates the initial password of the root account into the Secret code-initial-root-password. Read it:

d8 k -n code get secret code-initial-root-password -o jsonpath='{.data.password}' | base64 -d

Open https://code.example.com and sign in as root with this password. Change the password in the account settings after the first sign-in.

Verify the installation

Create a project in the web interface, then clone it over HTTPS and over SSH to confirm both paths through the load balancer work:

git clone https://code.example.com/root/<PROJECT>.git
git clone git@code.example.com:root/<PROJECT>.git

The SSH clone needs the public key of your account added in the user settings.

Additional resources

←
Helm Chart / Requirements
Helm Chart / Configuration
→