GitLab Configurations on Web Interface

Some of Configurations and Opstella Integrations are done on Web Interface.

Preparation

You need to access gitlab.${BASE_DOMAIN} and Login with root User Account.

Create Access Token for Opstella

1. Sign In to GitLab Instance with root Local Account and Create Access Token for Opstella

   Go to Profile Logo > Preferences > Access Tokens

   

   Create new Access Token named opstella-platform with the following scope

   

The scopes ticked in the screenshot, as text:

Scope	Why
api	everything Opstella does against GitLab (already covers read_api, read_repository, write_repository)
read_user	resolve the user behind a request
create_runner	register the Opstella-managed GitLab Runner
k8s_proxy	GitLab’s Kubernetes proxy endpoints
sudo, admin_mode	act as another user and perform admin actions
ai_features, read_service_ping	only if those features are used on this instance

This token is as powerful as the instance itself

sudo together with admin_mode lets the holder impersonate any user and perform any administrative action — leaking this one token is equivalent to losing the GitLab instance. Keep it out of shell history and out of any file that is not 0600, and grant only the scopes your installation actually uses.

Set the expiration to 365 days — the default is 30

Since GitLab 17.6, require_personal_access_token_expiry is enabled by default: a token cannot be created without an expiry, and the form pre-fills 30 days. Accepting that default means the Opstella ↔ GitLab integration stops working about a month after handover, with no warning.

Set the expiration date to the maximum GitLab allows (365 days), note the date, and rotate the token before it expires — after every rotation the new value has to be applied again in Opstella Platform Create Config.

Store the token now — it is shown once

GitLab displays the token value only on the screen that creates it, and it is needed again much later. Keep it with the other tool credentials:

## For security reasons turn off bash history momentarily
set +o history
echo "export GITLAB_OPSTELLA_PLATFORM_TOKEN='<paste the token>'" \
  >> $BASE_WORKING_DIR/shell-values/tools/gitlab.vars.sh
chmod 600 $BASE_WORKING_DIR/shell-values/tools/gitlab.vars.sh
set -o history

Customize GitLab Web Interface

Needs assets from the customer

This step needs the customer’s logo files, so it is often done after the rest of the installation. Leaving it undone does not affect any Opstella integration.

1. Customize Site Information: Go to Admin Area > Settings > Appearance

   • Sign in/Sign up pages : GitLab | <Customer Name>
   • Sign in/Sign up pages > Logo : Upload Logo of Customer
   • Navigation bar : Upload Logo of Customer

   

Disable Instance-wide Auto DevOps

Auto DevOps feature that built-in with GitLab may cause unexepected behaviour when integrating with Opstella, you need to disable it.

1. Sign In to GitLab Instance with root Local Account and then Go to Admin Area > Settings > CI/CD

   

2. Open Continuous Integration and Deployment and untick Default to Auto DevOps pipeline for all projects

   

3. Scroll down and click Save changes

   

Alternative: configure with gitlab-rails runner

Everything on this page is also reachable from the GitLab host itself, which is the way through when the web interface is not available yet (no DNS, ports not open, certificate not trusted).

Caution

Write the script to a file first. Passing it on the command line puts the token value into shell history and into ps output. Delete the file, and anything it writes, as soon as you are done.

/tmp/gl-setup.rb

# 1. Disable instance-wide Auto DevOps
ApplicationSetting.current.update!(auto_devops_enabled: false)

# 2. Create the Access Token for Opstella
want = %w[api read_api read_user create_runner k8s_proxy read_repository
          write_repository ai_features sudo admin_mode read_service_ping]
use  = want & Gitlab::Auth.all_available_scopes.map(&:to_s)

root = User.find_by_username('root')
t = root.personal_access_tokens.create!(name: 'opstella-platform', scopes: use,
                                        expires_at: 365.days.from_now.to_date)
File.write('/tmp/pat.line', "export GITLAB_OPSTELLA_PLATFORM_TOKEN='#{t.token}'\n")
File.chmod(0600, '/tmp/pat.line')

sudo gitlab-rails runner -e production /tmp/gl-setup.rb

# move the token to the Bastion Host without printing it, then remove the source
sudo cat /tmp/pat.line >> $BASE_WORKING_DIR/shell-values/tools/gitlab.vars.sh
sudo rm -f /tmp/pat.line /tmp/gl-setup.rb

Verify:

sudo gitlab-rails runner -e production \
  'puts ApplicationSetting.current.auto_devops_enabled;
   puts PersonalAccessToken.find_by(name: "opstella-platform")&.expires_at'

Caution

Write the file as a user gitlab-rails can read. gitlab-rails runs as git, so a script created under another account in /tmp fails to load — and a script that writes its output to a path only the creating user owns silently produces nothing.