Contents

Deploy on Kubernetes Enterprise

The Helm chart gitta-server runs two independent team servers by default. It works on EKS, GKE, AKS and any other cluster with Helm 3.

Before you start

Helm 3 and kubectl access to the cluster.
The chart and access to the image europe-north1-docker.pkg.dev/gitta-io-prod/enterprise/gitta-server. Both come with gitta Enterprise. The image runs on amd64 and arm64 nodes.
Your licence file, if you have one. Without it the server runs as an evaluation for 5 people.
For access from outside the cluster, an ingress controller and a TLS certificate, for example from cert-manager.

Install

Make an admin token and keep it in your password manager.
Terminal
```
$ openssl rand -hex 24
```

Install the chart.

Terminal

$ helm install gitta ./gitta-server \
    --namespace gitta --create-namespace \
    --set image.repository=europe-north1-docker.pkg.dev/gitta-io-prod/enterprise/gitta-server --set image.tag=0.1.0 \
    --set "tokens={<admin token>}" \
    --set-file license=example.license \
    --set ingress.enabled=true --set ingress.className=nginx \
    --set ingress.hostTemplate=gitta-%d.example.com

Wait until both servers are ready. The install notes print the gitta init line with every address.
Terminal
```
$ kubectl -n gitta rollout status statefulset/gitta-gitta-server
```
Make a token for each person and CI runner, or set up SSO.

What the chart makes

Object	Purpose
StatefulSet, 2 replicas	Two independent servers, spread over zones and nodes. Each keeps the team's state in memory.
One Service per server	Each server has its own address. Agents report to all of them.
Ingress (optional)	One host per server from `ingress.hostTemplate`, where `%d` is the server number.
Secret	Admin tokens, the signing key and the licence. The signing key is made at install and kept across upgrades.
PersistentVolumeClaim per server	1 GiB, so a restart keeps the team view and the audit copies.

The pods run as a non-root user with a read-only root file system and no Linux capabilities. Readiness and liveness probes use /healthz.

Values

Value	Default	Use
`replicas`	2	Number of independent servers.
`tokens`	none	Admin tokens. Required, unless you use `existingSecret`.
`existingSecret`	empty	A Secret you manage, with the keys `GITTA_TOKENS` and `GITTA_SIGNING_KEY`.
`signingKey`	generated	Set it only to share one key with servers outside this release.
`license`	empty	The licence file's contents. Use `--set-file`.
`sso.issuer`, `sso.clientId`, `sso.domains`	empty	SSO. See Tokens and sign-in.
`service.type`	`ClusterIP`	Use `LoadBalancer` to expose each server without an ingress.
`ingress.enabled`, `ingress.hostTemplate`, `ingress.tls`	off	Hosts and TLS for access from outside.
`persistence.enabled`, `persistence.size`	on, 1Gi	A volume per server.
`resources`	50m CPU, 64Mi	Requests and limits. A team of 50 needs little more.

Upgrade

Terminal

$ helm upgrade gitta ./gitta-server --namespace gitta --reuse-values --set image.tag=<new version>

The servers restart one at a time, so agents keep their warnings during the upgrade.

Agents inside the cluster

CI runners and agents in the same cluster can use the internal addresses that the install notes print, for example http://gitta-gitta-server-0.gitta.svc. Use HTTPS for everything that crosses a network you do not control.

For certificates, see TLS. To give each person and each CI runner a token, see Tokens and sign-in.