fix: add netpol to allow gitaly to perform repository mirroring actions

charts/config/templates/uds-package.yaml

@@ -445,6 +445,17 @@ spec:
         {{- end }}
         description: "Gitlab Pages Storage"
 
+      # Gitaly
+      {{ if .Values.mirroring.enabled }}
+      - direction: Egress
+        selector:
+          app: gitaly
+        remoteGenerated: Anywhere
+        ports:
+          {{- .Values.mirroring.ports | toYaml | nindent 10 }}
+        description: Gitaly repository mirroring
+      {{- end }}
+
       # Custom rules for unanticipated scenarios
       {{- range .Values.custom }}
       - direction: {{ .direction }}

charts/config/values.yaml

@@ -48,6 +48,17 @@ runner:
     app: gitlab-runner
   namespace: gitlab-runner
   sandboxNamespace: gitlab-runner-sandbox
+
+# Gitaly is responsible for mirroring actions, and there are 4 valid protocols with the following ports
+# ssh: 22
+# http: 80
+# https: 443
+# git: 9418
+mirroring:
+  enabled: false
+  ports:
+    - 443
+
 # custom:
 #    # Notice no `remoteGenerated` field here on custom internal rule
 #   - direction: Ingress

docs/configuration.md

@@ -15,6 +15,7 @@ Network policies are controlled via the `uds-gitlab-config` chart in accordance
 - `storage`: sets network policies for accessing object storage from all GitLab services (`registry`, `pages`, `webservice`, `toolbox`, `sidekiq`)
 - `redis`:  sets network policies for accessing a Redis-compatible server from all GitLab services (`webservice`, `toolbox`, `sidekiq`, `migrations`, `gitlab-exporter`)
 - `postgres`: sets network policies for accessing a Postgres database from all GitLab services (`webservice`, `toolbox`, `sidekiq`, `migrations`, `gitlab-exporter`)
+- `mirroring`: sets network policies that allow the gitlab repository mirroring feature to work. It defaults to only `https` (443) but can be set to allow the other protocols gitlab supports via the `ports` key.
 - `custom`: sets custom network policies for the GitLab namespace - this allows for custom integrations with other services (i.e. Jira)
 
 > [!NOTE]