►
Description
This is an experimental feature, it is not ready to be used in production environments. Follow this guide at your own risk, including
potential data loss from the container registry
The following guide specifies the steps required to enable the Container Registry metadata database for a new
Helm charts installation on GCP. This guide assumes this is a completely new installation without data and there is a high
risk of losing data and working configurations in the process.
Stay tuned for a guide that includes migration steps.
For Omnibus instructions, see https://youtu.be/_d27dDbLSv4
Epic: https://gitlab.com/groups/gitlab-org/-/epics/5521
Issue: https://gitlab.com/gitlab-org/container-registry/-/issues/1065
Snippet: https://gitlab.com/-/snippets/2582598
A
This
is
a
continuation
on
the
previous
video
that
I
made
for
Omnibus
installations,
but
today
I'm
going
to
focus
on
the
helm,
charts,
there's
already
a
snippet
here
that
I've
created
where
you
can
follow
the
steps
to
enable
the
database
and
stuff
so
I'm
going
to
be
basically
working
through
that
yeah.
So,
let's,
let's
get
started
just
before.
We
do
that.
Just
a
few
reminders
there's
a
few
risks.
This
is
not
production
ready.
This
is
just
a
demo
on
how
to
do
it.
A
The
postgres
instance
using
this
guide
is
the
one
included
in
the
cluster,
but
gitlab
does
not
recommend
this
for
production
use.
Please
provision
your
own
database
in
a
different
instance
or
through
a
SAS
platform
of
your
choice
and
there's
also
the
risk
of
data
loss
or
data
inconsistency,
especially
if
at
any
point
you
turn
on
the
database,
push
images
and
or
delete
them
and
eventually
disable
the
database.
The
data
that
you
have
is
not
going
to
match
anymore,
so
yeah
just
Please,
be
aware
of
that
and
yeah.
A
So
this
issue
that
I'm
gonna
Link
in
the
video
description
please
feel
free
to
reach
out.
If
you
have
any
questions
or
any
comments
about
this,
so
yeah,
let's
get
started
before
the
first
step,
is
going
to
be
to
create
like
a
directory
where
we
store
all
the
things
that
we
need.
So
in
this
case
it
means
anime
directory
call.
You
know
gitlab
and
test,
let's
see
into
that.
A
I'm
gonna
be
using
the
ultimate
cluster
creation
setup,
which
is
basically
I'm,
gonna,
say
Google
kubernetes
engine
and
this
this
eventually
points
to
this
bootstrap
boost
trap
script
that
is
available
here
in
this
Repository.
Basically,
the
charts
repository
I'm
gonna.
You
can
neither
clone
this
repo
or
you
can
just
get
a
copy
of
this
I'm.
A
Just
gonna
get
a
copy
for
this
I'm
gonna
open
this
file,
I'm
already
I
already
downloaded
this,
but
basically
we
need
this
bootstrap
script
and
the
other
file
we
need
from
the
same
repository,
the
command.sh
that
you
can
find.
You
can
also
find
in
this
repository.
If
you
go
back
to
scripts,
there's
a
common,
it's
age,
it's
going
to
copy
it
and
I'm
gonna,
put
it
in
the
same
directory.
A
One
yes
cool,
so
now
we
have,
we
should
have
two
files,
common
sh
and
bootstrap
sh.
Let's
make
sure
that
we
add
execution
permissions
to
both
so
let's
say
come
on
and
do
the
same
for
the
bootstrap
awesome.
There
are
a
few
important
values
that
we
need
to
configure.
One
is
the
region
that
you
want
to
use
for
your
for
your
cluster.
The
default
is
US
Central,
one
I
already
I
have
already
set
it
up
to
my
local
region,
so
that
should
be
ready
and
then
the
project
remember.
A
This
is
the
gke
es
or
the
gcp
project
ID.
So
in
this
case,
I
already
have
a
project
that
you
can
see
here
this
number
here,
and
this
is
the
one
that
matches
the
the
project
on
Google
Cloud.
So
awesome.
Those
are
the
most
important
Set
variables
that
we
need
to
configure,
but
there's
also
a
few
more
that
you
can
use,
there's
one
that
is
called
static.
Ip
I
believe
I
had
set
that
to
True.
A
Yes,
and
this
is
because
we
I
want
to
be
using
an
external
IP
address
instead
of
a
DNS
name
and
I
want
the.
This
will
create
a
static
IP
in
the
gke
resources.
Sorry
in
the
GCS
resources,
so
that
the
IP
doesn't
change
it's
just
and
for
the
purposes
of
the
demo.
That's
that's
fine
awesome
so
now
that
I
have
both
scripts
and
they
all
have
the
permissions
and
I
have
the
proper
environment
variables.
I
can
just
call
GPA
bootstrap,
and
this
script
requires
you
to
use
the
word
up.
A
A
All
right
welcome
back
everyone,
as
you
can
see,
on
the
right
hand,
side,
the
script
has
finished
and
I
have
now
a
cluster
in
my
preferred
location.
If
I
go
to
gke
in
every
phase
this
page,
we
should
be
able
to
see
this
cluster
in
here.
If
I
go
on
into
it,
it's
gonna
show
some
details.
There's
an
external
endpoint.
Let's
just
grab
this
for
now.
It's
the
IP
address
that
we're
going
to
be
using
for
testing
and
now
we're
gonna
keep
going
on
this.
A
A
A
A
I'm
just
gonna
say:
let's
grab
the
IP
address
and
then
we're
gonna
use
this
service
nip
IO,
it's
pretty
handy
for
testing.
So
let's
go
with
that
one,
and
we
also
gonna
set
the
certificate
manager
because
try
to
get
a
to
try
to
get
a
PLS
certificate
from
let's
encrypt.
The
only
problem
with
that
is,
it
might
be
a
very
limited
time.
You
know,
let's
just
let's
just
try
that
out
I'm
just
going
to
use
my
email
address.
A
A
Okay,
so
installing
the
helm
chart
took
a
little
bit
time
didn't
take
that
long
as
I
thought
it
would
have.
So
this
is
good.
If
we
go
and
check
with
kubernetes
we
keep
control
yeah
pods,
for
example.
We
should
start.
We
should
see
all
the
ports
initializing
running.
Most
of
them
are
running
now,
but
some
of
them
will
take
some
time
to
complete,
but
we
can
keep
going
right
now.
A
No,
it
didn't
so
the
address
has
changed
so
we're
gonna
have
to
change
some
things
before
we
move
on
before
we
are
able
to
sign
in
to
gitnab.
So
this
is
because,
if
we
follow
the
steps,
it's
asking
us
to
configure
a
DNS
record
with
this
IP
address.
So
what
we're
gonna
do
is
gonna
change
the
gitlab
config
to
use
this
new
IP
address
and
to
do
that.
We're
gonna,
Step
Ahead
here
we're
gonna,
get
the
Helm
chart
values
that
we
have
for
git
left.
A
If
we
do
this,
we
can
see
whatever
configuration
we
use.
So
it's
basically
the
two
values
that
I
provisioned
before
and
what
we're
going
to
do
is
pass
them,
save
them
to
a
file
to
a
various
yaml
file.
Now
that
we
have
this,
let's
open
the
file
over
here
and
we're
going
to
replace
the
IP
address
with
this
one
that
is
here.
A
So
what
we're
going
to
call
is
Helm
upgrade
gitlab
and
we're
going
to
pass
the
file,
which
is
called
values
yamo,
and
this
should
take
a
minute,
but
it's
basically
gonna
restart,
gitlab
and
well.
Whatever
networking
configurations
need
to
happen
to
change
their
host
names
So.
Eventually,
we
should
be
able
to
go
to
this
domain
here
to
The
gitlab
Domain,
okay,
so
this
shouldn't
take
too
long.
But
let's
wait
and
see.
A
A
Basically
that
allows
us
to
see
what's
going
on.
So
if
I
go
pay
9s,
you
should
connect
to
the
cluster
that
I
have
running.
As
you
can
see,
it's
using
the
project
cluster
in
the
in
the
current
location,
gitlab
cluster,
which
should
match
whatever
cluster
we
have
here:
yeah,
actually
GitHub
cluster
cool.
So
this
gives
us
a
very
cool
visual
guide
of.
What's
going
on,
as
you
can
see,
all
the
pots
are
running
now
most
of
them
have
completed
I
think
most
of
them
yeah
they
have
all
completed.
A
So
if
we
actually
go,
we
could
try
to
get
the
address
again
this
one.
So
the
host
gitlab
IP
address.net
bio
matches
the
address.
So,
if
I
navigate
to
that
on
the
browser
that
should
take
me
to
the
sign
in
page
of
my
good
level
instance
cool,
so
the
username
is
root
and
to
get
the
password
for
your
clustered.
You
can
just
follow
this.
A
Just
get
it
from
one
of
the
secrets
that
is
available
in
kubernetes,
so
I'm
gonna
paste.
This
just
give
me
the
password
and
I'm
gonna
sign
meeting
with
this
password,
and
this
is
the
first
time
I'm
signing
in
so
I'm
gonna
disable
signings.
This
is
a
normal
precaution,
awesome
cool,
so
we
are
able
to
sign
into
gitlab.
So
we
are
done
with
this
part
of
the
test.
A
Now
we're
gonna
do
the
next
step
is:
let's
create
a
test
project
that
we're
going
to
be
using
for
testing
our
I
container
registry
so,
for
example,
I'm
gonna
say
create
line
project
and
I'm
gonna,
set
it
to
the
roof
project
to
the
root
user,
and
it's
going
to
say
registry,
yes,
I'm
gonna
make
it
private
and
I'm
gonna
initialize
with
a
redmi.
This
is,
should
be
fairly
quick.
A
A
This
is
to
be
able
to
authenticate
against
the
registry
so
to
you,
navigate
to
your
user
preferences
and
go
to
access
tokens
you're
going
to
create
a
token
here,
so
I'm
gonna,
say
UK
GK
mean
token
and
I'm
gonna
give
it
API
API
scope
with
this
test.
This
creates
an
access
token.
This
puts
it
in
the
this,
creates
a
token
in
here:
I'm
gonna
copy
it
and
I'm
gonna
export
it.
Following
the
guide
here,
I'm
gonna
export
it
to
a
random
variable.
A
A
A
A
This
is
going
to
create
a
kubernetes
secret
that
is
going
to
be
able
that
we
can
use
to
connect
to
the
registry
with
sorry
to
the
postgres
instance
database
remember
this
is
using
the
in
cluster
postgres
database.
If
you're
using
a
separated
instance,
then
you
will
have
to
do
this,
create
the
password
and
store
it
securely
somewhere
else.
A
But
for
this
purpose
it's
pretty
straightforward.
Now
we
have
a
password
now
we're
gonna
go
and
accept
into
we're
gonna
shell
into
the
postgres
into
the
postgres
Container,
which
is
somewhere
around
here.
The
square,
zero
yep,
the
the
one-liner-
is
to
use
this
one
here,
which
is
just
executing
this
Cube
control,
exec
and
bashing,
into
the
container.
A
A
A
A
A
A
Okay,
this
is
not
working
so
I'm,
maybe
using
the
wrong
the
wrong
cluster.
So
give
me
one.
Second,
I'm
gonna
pause
this
video,
while
I
figure
this
out
all
right,
so
I
was
using
the
wrong
password.
So
that's
why
I
was
getting
the
wrong
dress.
So
sorry,
the
wrong
password,
so
I
couldn't
login
the
secret
lab
postgresql
password
actually
has
this
other
key
in
there.
That
is
called
postgres,
SQL
postgres
password,
that's
the
one
we
actually
want.
A
A
A
Yes,
awesome
that
connected
me
to
the
database,
the
user
we
can
see
which
databases
are
available.
We
only
have
the
production
and
a
few
more
now
that
I'm
wearing
here
we're
gonna,
create
the
username,
the
database
username
or
the
registry
database.
So
basically
roll
with
the
registry
with
login,
that's
great
and
we're
gonna
type.
We're
gonna
get
the
password
remember
that
this
is
saved
in
the
kubernetes
secret.
A
A
Now
that
we
have
a
username
the
password
we
are
going
to
create
the
registry
database.
In
this
case
it's
simple,
Ackman
awesome
and
we
should
be
able
to
connect
to
the
records
chain.
So
if
you
do
backwards,
slash
C
registry
is
a
name.
We
are
now
connected
to
the
registry
with
the
user
postgres.
So
it's
all
good.
A
It
was
a
thing
getting
this
and
get
values
gitlab,
and
now
that
we
have
that
we're
gonna,
add
the
registry
configuration
so
to
do
that.
Let's
copy
this!
Is
this
block
and
I'm
gonna
explain
that
in
just
a
second
all
these
configuration
values
are
available
in
the
registry
chart.
So
all
this
information
should
be
it's
all
available
here
and
you
search
for
database
all
the
need
and
grid
of
this
configuration
values
that
you
can
use.
Most
of
them
wanted
to
control
like
some
of
the
pool
connections
and
the
timeouts,
and
things
like
that.
A
A
The
username
is
also
called
registry
for
the
password,
and
here
you
cannot
put
a
blank
line
and
sorry
a
text,
plain
text.
You
need
to
use
a
secret
so
we're
basically
going
to
reference
to
the
gitlab
registry
database
password
and
we're
going
to
use
in
the
secret.
That's
this
key
story
name
as
password.
Now,
if
you
remember,
if
you
check
on
the
right,
it
will
get
secret.
We
are
basically
saying
okay.
A
Give
me
the
key
password
for
this
put
this
Secret
and
it's
a
string
that
is
going
to
be
eventually
be
replaced
in
the
configuration
as
it
needs
to
be,
and
one
of
the
other
neat
things
that
we
have
in
the
the
helm
chart
system.
The
schema
migrations
can
be
run
automatically.
So
you
can
just
say
migrations
enable
to
true
and
that's
gonna.
Take
a
lot
of
these
things
that
I'm
gonna
do
all
the
migrations
for
us.
So
awesome.
A
Let's
search
for
registry,
some
of
the
pods,
these
are
the
pods
that
are
running
right
now.
It's
been
mapped
for
a
while,
so
it's
gonna
eventually,
once
this
upgrade
is
done.
We're
gonna
see
the
Pod
restarting
because
it's
applying
the
configuration
awesome.
So
this
is
done
if
I
go
back
to
I
lost
this
awesome,
so,
as
you
can
see,
we
have
two
new
pods.
A
A
But
I
was
go
to
that
in
a
second
awesome,
so
we
have
two
in
two
ports
running
the
newest.
One
is
probably
both
of
them
are
running
and
there
are
the
newer
ones.
I
suppose.
Yes,
awesome!
This
is
good,
so
they
start
telling
the
logs
of
one
of
the
registry
pots
and
the
important
message
to
look
forward
to
to
look
forward
here.
Is
this
the
one
that
says
metadata
database
is
an
experimental
feature.
Please
don't
enable
it
in
production.
That
means
the
registry
started
in
the
database
mode,
which
is
which
is
good.
A
A
It's
going
to
give
me
a
list
of
all
of
them
and
miss
all
the
all
the
times
times
when
these
migrations
were
applied.
If
I
went,
if
I
can
the
records
here,
it
should
give
me
133,
as
we
saw
before,
yeah
so
133
rows,
which
matches
whatever
logs
we
had
for
the
migrations.
Oh,
they
have
been
removed,
so
we
can't
see
them
anymore,
but
awesome.
Let's
tail
this
one
of
the
logs
okay
yeah
wait.
We
can't
see
because
it's
like
it's
tailing,
so
it's
whatever
the
current
is
awesome.
So
where
am
I.
A
Cool,
so
we
are
done
with
this
part.
We
we
I'm,
basically
when
I
have
with
these
steps
here,
which
was
applying
the
applying
the
migrations
upgrading
the
the
registry,
sorry
the
helm
chart,
and
now
we
check
the
logs
and
we
exit
we're
already
in
the
registry.
Sorry
in
the
postgres
database,
so
we
are
verifying
everything
is
in
there,
so
cool.
Now
that
we
have
this,
we're
gonna
have
to
do.
Let's
push
a
new
image
to
the
to
this
registry.
A
A
This
one
get
Ingress.
This
is
a
registry
address
right
and
the
other
way
to
get
this
is
by
going
into
here
into
the
instance
and
see
okay.
This
is
my
instance.
My
registry
instance
and
we're
gonna
do
a
Docker
login,
but
we're
going
to
follow
the
same
format
that
we
have
in
here
in
the
guide,
which
is
basically
okay,.
A
A
A
This
is
what
we
want
it,
and
now
that
we
are
able
to
log
in
oh,
please
note
that
we
didn't
have
to
do
the
insecure
Registries,
that's
because
the
certificates
were
generated
correctly,
but
if,
for
some
reason,
we're
using
cell
signs
or
ticket
tickets
specified
here,
you
might
need
to
configure
an
insecure
registry,
and
that
depends
on
the
on
the
container
runtime
that
you're
using
so
okay.
Let's
do
we're
logged
in
on
this
Terminator.
So
let's
do.
A
Great
that
was
push
all
done
and
if
I
refresh
this
page,
this
should
show
up
register
test
Alpine
and
it's
basically
the
same.
The
digest
that
you
see
here,
B312
blah
blah
blah,
is
the
same
first
few
digits
that
appear
here
over
here.
That's
awesome!
So
that's
all
good!
Now.
What
we're
gonna
do
is
just
verify
that
this
is
all
working
correctly
so
in
the
database.
So
one
way
to
do
that
is
to
accept
into
the
into
the
postgres
instance
again
exec
Bash
and
then
we're
gonna
do
psql
user.
A
That
should
keep
me
the
name
of
the
repository,
the
path
of
that
repository,
which
matches
whatever
we
pushed
up
here,
which
is
root
registry
Alpine.
It's
exactly
the
same.
If
I
select
from
text,
we're
gonna
see
the
latest
tag
and
it's
this
matches
a
repository,
ID
one,
which
is
this
one
over
here
and
the
top
level.
Namespace
is
the
same.
So
you
can
look
around
at
the
schema
open
to
see
what
else
you
can
query
so,
for
example,
select
from
blocks.
A
This
should
be
like
the
layers
that
will
be
restoring
and
select
from
manifest,
for
example,
that
gives
us
a
lot
of
other
metadata
about
this.
This
register
for
this
image
so
yeah
as
you
can
see
it's
all
working
as
expected,
it's
all
showing
up
in
the
database
and
we
navigated
as
well
to
the
UI.
So
this
is
all
in
here
so
yeah.
That's
how
you
enable
the
registry,
please
feel
free
to
reach
out
to
this
issue.