{{- $NOTICE := "\n=== NOTICE" -}}
{{- $WARNING := "\n=== WARNING" -}}
{{- $CRITICAL := "\n=== CRITICAL" -}}

{{- /* If any development subchart is enabled, note it is not production ready */}}
{{- $enabledNonProdCharts := fromJsonArray (include "gitlab.nonProdCharts.enabledNames" .) -}}
{{- if not (empty $enabledNonProdCharts) }}
{{ $CRITICAL }}
The following charts are included for evaluation purposes only. They will not be supported by GitLab Support
for production workloads. Use Cloud Native Hybrid deployments for production. For more information visit
https://docs.gitlab.com/charts/installation/index.html#use-the-reference-architectures.
{{- range $name := $enabledNonProdCharts }}
- {{ $name }}
{{- end }}
{{- end }}

{{- /* PostgreSQL minimum version change */}}
{{ $NOTICE }}
The minimum required version of PostgreSQL is now 14. See https://docs.gitlab.com/charts/installation/upgrade.html for more details.

{{- /* If the Container Registry metadata database is enabled */}}
{{- if eq .Values.registry.database.enabled true }}
{{ $WARNING }}
The Container Registry metadata database has been enabled.
Carefully review the documentation https://docs.gitlab.com/charts/charts/registry/metadata_database.html before enabling the registry database in production!
If you encounter a problem with either the import or operation of the registry, please add a comment in the feedback issue https://gitlab.com/gitlab-org/gitlab/-/issues/423459#supported-feature-status.
{{- end }}

{{- /* Notifications endpoint threshold should use maxretries instead */ -}}
{{- $usesThreshold := false }}
{{- range $v := .Values.global.registry.notifications.endpoints }}
    {{- if hasKey $v "threshold" }}
        {{- $usesThreshold = true}}
    {{- end }}
{{- end }}
{{- if $usesThreshold }}
{{ $NOTICE }}
registry:
    The configuration of `global.registry.notifications.endpoints[].threshold` has been deprecated and is planned for removal in GitLab 18.0.
    Please use `global.registry.notifications.endpoints[].maxretries` instead https://gitlab.com/gitlab-org/container-registry/-/issues/1243.
{{- end -}}
{{- /* END gitlab.deprecate.registry.notifications.endpoints.threshold */}}

{{- /* If shared-secrets is disable, manual secret creation will be needed */}}
{{- if not (index .Values "shared-secrets").enabled }}
{{ $NOTICE }}
The automatic generation of secrets has been disabled.
The user should ensure all necessary secrets are created according to documentation, or the deployment will fail to operate correctly.
{{- end }}
{{- /* If using self-signed auto-generated certificates, and a service needing them is enabled */}}
{{- if or .Values.gitlab.webservice.enabled .Values.registry.enabled .Values.global.minio.enabled }}
{{-   if not (or .Values.global.ingress.configureCertmanager (include "gitlab.ingress.tls.configured" .)) }}
{{ $WARNING }}
Automatic TLS certificate generation with cert-manager is disabled.
One or more of the components does not have a TLS certificate Secret configured.
As a result, Self-signed certificates were generated for these components.

You may retrieve the CA root for these certificates from the `{{ template "gitlab.wildcard-self-signed-cert-name" $ }}-ca` secret, via the following command. It can then be imported to a web browser or system store.

  kubectl get secret {{ template "gitlab.wildcard-self-signed-cert-name" $ }}-ca -ojsonpath='{.data.cfssl_ca}' | base64 --decode > {{ template "gitlab.gitlab.hostname" $ }}.ca.pem

If you do not wish to use self-signed certificates, please set the following properties:
- global.ingress.tls.secretName
OR all of:
- global.ingress.tls.enabled (set to `true`)
{{- if $.Values.gitlab.webservice.enabled }}
- gitlab.webservice.ingress.tls.secretName
{{- if $.Values.global.appConfig.smartcard.enabled }}
- gitlab.webservice.ingress.tls.smartcardSecretName
{{- end }}
{{- end }}
{{- if $.Values.registry.enabled }}
- registry.ingress.tls.secretName
{{- end }}
{{- if $.Values.global.minio.enabled }}
- minio.ingress.tls.secretName
{{- end }}
{{- if $.Values.global.pages.enabled }}
- gitlab.gitlab-pages.ingress.tls.secretName
{{- end }}
{{- if $.Values.global.kas.enabled }}
- gitlab.kas.ingress.tls.secretName
{{- end }}

{{- if (index .Values "gitlab-runner").install }}
{{ $WARNING }}
Automatic TLS certificate generation with cert-manager is disabled and no TLS certificates were provided. Self-signed certificates were generated that do not work with gitlab-runner. Please either disable gitlab-runner by setting `gitlab-runner.install=false` or provide valid certificates.
{{- end -}}
{{- end -}}
{{- end -}}
{{- /* Runner notice if .install && ! .runners.privileged */}}
{{- if and (index .Values "gitlab-runner").install (not (index .Values "gitlab-runner").runners.privileged) }}
{{ $NOTICE }}
You've installed GitLab Runner without the ability to use 'docker in docker'.
The GitLab Runner chart (gitlab/gitlab-runner) is deployed without the `privileged` flag by default for security purposes. This can be changed by setting `gitlab-runner.runners.privileged` to `true`. Before doing so, please read the GitLab Runner chart's documentation on why we
chose not to enable this by default. See https://docs.gitlab.com/runner/install/kubernetes.html#running-docker-in-docker-containers-with-gitlab-runners
{{- end }}

{{- /* toolbox replicas */}}
{{- if eq (index $.Values.gitlab "toolbox" "replicas" | int) 0 }}
{{ $NOTICE }}
The GitLab toolbox is scaled to 0.
The `toolbox` Pod is very useful for administration and debugging of this application suite. You may configure `gitlab.toolbox.replicas=1` if you wish to leave a Pod running at all times, or you can scale the deployment up when needed:

    `kubectl scale --replicas=1 deployment/{{ .Release.Name }}-toolbox`
{{- end }}

{{- /* WARN: global.registry.notificationSecret */}}
{{- if and (not (index .Values "shared-secrets" "enabled")) (not .Values.global.registry.notificationSecret) }}
{{ $WARNING }}
The attribute `shared-secrets.enabled` is `false`, no `global.registry.notificationSecret` provided.
The shared-secrets chart has been disabled, and `global.registry.notificationSecret` has not been provided.
Starting in 4.11.x of this chart, this secret must be present, but shared-secrets will not be run to generated it.
Please see https://docs.gitlab.com/charts/charts/globals#configure-registry-settings
{{- end }}
{{- /* print install survey link */}}
{{- $appVersion := coalesce .Values.global.gitlabVersion .Chart.AppVersion -}}
{{- if and .Release.IsInstall (regexMatch "^\\d+\\.\\d+\\.\\d+(-rc\\d+)?(-pre)?$" $appVersion) }}
Help us improve the installation experience, let us know how we did with a 1 minute survey:
{{- printf "https://gitlab.fra1.qualtrics.com/jfe/form/SV_6kVqZANThUQ1bZb?installation=helm&release=%s" (regexReplaceAll "^(\\d+)\\.(\\d+)\\..+" $appVersion "${1}-${2}") }}
{{- end }}

{{- /* WARN: Usage of PAGES_UPDATE_LEGACY_STORAGE with bundled Pages discouraged.*/}}
{{- if .Values.global.pages.enabled }}
{{-   $envValues := dict }}
{{-   $_ := set $envValues "gitlab.webservice" (default false .Values.gitlab.webservice.extraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   $_ := set $envValues "gitlab.sidekiq" (default false .Values.gitlab.sidekiq.extraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   $_ := set $envValues "global" (default false .Values.global.extraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   $toolboxExtraEnv := index .Values.gitlab "toolbox" "extraEnv" }}
{{-   $_ := set $envValues "gitlab.toolbox" (default false $toolboxExtraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   range $component, $value := $envValues }}
{{-     if eq $value true }}
{{ $WARNING }}
GitLab Pages configured to use disk storage via `{{ $component }}.extraEnv.PAGES_UPDATE_LEGACY_STORAGE`.
Using `PAGES_UPDATE_LEGACY_STORAGE` environment variable with bundled Pages service is not recommended. This setting is specifically used when using an external GitLab Pages deployment.
{{-     end }}
{{-   end }}
{{- end }}

{{- /* Deprecation notice for global.redis.password */}}
{{- if kindIs "map" .Values.global.redis.password }}
{{ $NOTICE }}
redis:
    The configuration key `global.redis.password` has been renamed. Please use
    `global.redis.auth` instead. This is the source of the `coalesce.go` warning
    message from Helm as well. For more details, please see:
    https://docs.gitlab.com/charts/installation/upgrade.html#use-of-globalredispassword
{{- end -}}

{{- /* If the user is managing RBAC externally with NGINX chart 4.0.6 */}}
{{- if or (and (index .Values "nginx-ingress" "enabled")     (not (index .Values "nginx-ingress" "rbac" "create")))
          (and (index .Values "nginx-ingress-geo" "enabled") (not (index .Values "nginx-ingress-geo" "rbac" "create"))) }}
{{ $WARNING }}
NGINX Ingress Controller: Default RBAC rules creation has been disabled.
Updates to NGINX Ingress Controller require RBAC changes. Without these,
the installation will fallback to version v1.3.1.

Read more on https://docs.gitlab.com/charts/releases/8_0.html#upgrade-to-85x

From GitLab chart 8.8+ the NGINX controller image 1.11.2+ will be the default for
any configuration.
{{- end -}}

{{- /* run removals */}}
{{ include "gitlab.removals" . }}
{{- /* run checkConfig */}}
{{ include "gitlab.checkConfig" . }}
