{{- $NOTICE := "\n=== NOTICE" -}}
{{- $WARNING := "\n=== WARNING" -}}
{{- $CRITICAL := "\n=== CRITICAL" -}}

{{- /* ===== CRITICAL NOTIFICATIONS ===== */}}
{{- /* Warn users about Ingress controller changes */}}
{{- if or (index .Values "nginx-ingress").enabled .Values.traefik.install (index .Values "kubernetes-ingress").enabled }}
{{ $CRITICAL }}
The bundled Ingress controllers including NGINX Ingress are deprecated. Starting with GitLab 19.0, GitLab chart will
disable NGINX Ingress and will default to Gateway API and Envoy Gateway. Please migrate to Gateway API or an externally
managed Ingress controller and review the deprecation announcements at https://docs.gitlab.com/update/deprecations/#support-for-nginx-ingress
and https://docs.gitlab.com/update/deprecations/#support-for-nginx-ingress-haproxy-and-traefik-charts.
{{- end }}

{{- /* Warn users about MinIO and Bitnami Redis/PostgreSQL removal */}}
{{- if or (eq .Values.postgresql.install true) (eq .Values.redis.install true) (eq .Values.global.minio.enabled true) }}
{{ $CRITICAL }}
The bundled PostgreSQL, Redis and MinIO will be removed in GitLab 19.0. Please review
the deprecation announcement at https://docs.gitlab.com/update/deprecations/#support-for-bundled-postgresql-redis-and-minio-in-gitlab-helm-chart
and plan to migrate to externally managed alternatives by following https://docs.gitlab.com/charts/installation/migration/bundled_chart_migration/.
{{- end }}

{{- /* If any development subchart is enabled, note it is not production ready */}}
{{- $enabledNonProdCharts := fromJsonArray (include "gitlab.nonProdCharts.enabledNames" .) -}}
{{- if not (empty $enabledNonProdCharts) }}
{{ $CRITICAL }}
The following charts are included for evaluation purposes only. They will not be supported by GitLab Support
for production workloads. Use Cloud Native Hybrid deployments for production. For more information visit
https://docs.gitlab.com/charts/installation/index.html#use-the-reference-architectures.
{{- range $name := $enabledNonProdCharts }}
- {{ $name }}
{{- end }}
{{- end }}

{{- /* ===== WARNING NOTIFICATIONS ===== */}}

{{- /* If the Container Registry metadata database is enabled */}}
{{- if eq .Values.registry.database.enabled true }}
{{ $WARNING }}
The Container Registry metadata database has been enabled.
Carefully review the documentation https://docs.gitlab.com/charts/charts/registry/metadata_database.html before enabling the registry database in production!
If you encounter a problem with either the import or operation of the registry, please add a comment in the feedback issue https://gitlab.com/gitlab-org/gitlab/-/issues/423459#supported-feature-status.
{{- end }}

{{- /* If the Container Registry database load balancing is enabled */}}
{{- if eq .Values.registry.database.loadBalancing.enabled true }}
{{ $WARNING }}
The Container Registry database load balancing feature has been enabled. This is an experimental feature under active development and must not be used in production.
{{- end }}

{{- /* If the Container Registry database metrics is enabled */}}
{{- if eq .Values.registry.database.metrics.enabled true }}
{{ $WARNING }}
The Container Registry database metrics feature has been enabled. This is an experimental feature under active development and must not be used in production.
{{- end }}

{{- /* If using self-signed auto-generated certificates, and a service needing them is enabled */}}
{{- if or .Values.gitlab.webservice.enabled .Values.registry.enabled .Values.global.minio.enabled }}
{{-   if not (or .Values.global.ingress.configureCertmanager (include "gitlab.ingress.tls.configured" .)) }}
{{ $WARNING }}
{{-     if (eq (include "gitlab.global.ingress.tls.enabled" .) "false") }}
TLS is globaly disabled.
{{-     else }}
Automatic TLS certificate generation with cert-manager is disabled.
One or more of the components does not have a TLS certificate Secret configured.
As a result, Self-signed certificates were generated for these components.

You may retrieve the CA root for these certificates from the `{{ template "gitlab.wildcard-self-signed-cert-name" $ }}-ca` secret, via the following command. It can then be imported to a web browser or system store.

  kubectl get secret {{ template "gitlab.wildcard-self-signed-cert-name" $ }}-ca -ojsonpath='{.data.cfssl_ca}' | base64 --decode > {{ template "gitlab.gitlab.hostname" $ }}.ca.pem

If you do not wish to use self-signed certificates, please set the following properties:
- global.ingress.tls.secretName
OR all of:
- global.ingress.tls.enabled (set to `true`)
{{- if $.Values.gitlab.webservice.enabled }}
- gitlab.webservice.ingress.tls.secretName
{{- if $.Values.global.appConfig.smartcard.enabled }}
- gitlab.webservice.ingress.tls.smartcardSecretName
{{- end }}
{{- end }}
{{- if $.Values.registry.enabled }}
- registry.ingress.tls.secretName
{{- end }}
{{- if $.Values.global.minio.enabled }}
- minio.ingress.tls.secretName
{{- end }}
{{- if $.Values.global.pages.enabled }}
- gitlab.gitlab-pages.ingress.tls.secretName
{{- end }}
{{- if $.Values.global.kas.enabled }}
- gitlab.kas.ingress.tls.secretName
{{- end }}
{{- end }}

{{- if (index .Values "gitlab-runner").install }}
{{ $WARNING }}
Automatic TLS certificate generation with cert-manager is disabled and no TLS certificates were provided. Self-signed certificates were generated that do not work with gitlab-runner. Please either disable gitlab-runner by setting `gitlab-runner.install=false` or provide valid certificates.
{{- end -}}
{{- end -}}
{{- end -}}

{{- /* WARN: global.registry.notificationSecret */}}
{{- if and (not (index .Values "shared-secrets" "enabled")) (not .Values.global.registry.notificationSecret) }}
{{ $WARNING }}
The attribute `shared-secrets.enabled` is `false`, no `global.registry.notificationSecret` provided.
The shared-secrets chart has been disabled, and `global.registry.notificationSecret` has not been provided.
Starting in 4.11.x of this chart, this secret must be present, but shared-secrets will not be run to generated it.
Please see https://docs.gitlab.com/charts/charts/globals#configure-registry-settings
{{- end }}

{{- /* WARN: Usage of PAGES_UPDATE_LEGACY_STORAGE with bundled Pages discouraged.*/}}
{{- if .Values.global.pages.enabled }}
{{-   $envValues := dict }}
{{-   $_ := set $envValues "gitlab.webservice" (default false .Values.gitlab.webservice.extraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   $_ := set $envValues "gitlab.sidekiq" (default false .Values.gitlab.sidekiq.extraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   $_ := set $envValues "global" (default false .Values.global.extraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   $toolboxExtraEnv := index .Values.gitlab "toolbox" "extraEnv" }}
{{-   $_ := set $envValues "gitlab.toolbox" (default false $toolboxExtraEnv.PAGES_UPDATE_LEGACY_STORAGE) }}
{{-   range $component, $value := $envValues }}
{{-     if eq $value true }}
{{ $WARNING }}
GitLab Pages configured to use disk storage via `{{ $component }}.extraEnv.PAGES_UPDATE_LEGACY_STORAGE`.
Using `PAGES_UPDATE_LEGACY_STORAGE` environment variable with bundled Pages service is not recommended. This setting is specifically used when using an external GitLab Pages deployment.
{{-     end }}
{{-   end }}
{{- end }}

{{/*
Warn that `global.openbao.enabled` is present and true, noting an Experimenal feature.
*/}}
{{- if (pluck "enabled" .Values.global.openbao | first) }}
{{ $WARNING }}
openbao:
  You have enabled the configuration of OpenBao. This feature is currently Experimental, and entirely unsupported.
  See https://docs.gitlab.com/policy/development_stages_support/#experiment
{{- end -}}

{{- $minHelm := "4.0" }}
{{- $mergeChangeHelm := "3.17" }}
{{- if semverCompare (printf "<%s" $minHelm) .Capabilities.HelmVersion.Version }}
{{ $WARNING }}
helm:
  GitLab chart now recommends Helm {{ $minHelm }}+. Please make sure to update your current Helm version {{ .Capabilities.HelmVersion.Version }}.
  {{- if semverCompare (printf "<%s" $mergeChangeHelm) .Capabilities.HelmVersion.Version }}
  Please check the release notes and test your configuration before upgrading, because Helm {{ $mergeChangeHelm }}
  changed how some values are being merged.
  {{- else }}
  Please check the release notes and test your configuration before upgrading.
  {{- end }}
{{- end }}

{{- /* PostgreSQL minimum version change */}}
{{ $WARNING }}
The minimum required version of PostgreSQL is now 16. See https://docs.gitlab.com/charts/installation/upgrade.html for more details.

{{- /* NGINX Ingress update */}}
{{- if (index $.Values "nginx-ingress").enabled }}
{{ $WARNING }}
The default NGINX Ingress version was updated from to 1.15.1. Please check the
upstream changelogs for impact on your usage:
  https://github.com/kubernetes/ingress-nginx/blob/main/changelog/controller-1.15.0.md
{{- end }}

{{- /* Certmanager update */}}
{{- if .Values.installCertmanager }}
{{ $WARNING }}
The bundled certmanager was upgraded from 1.17.4 to 1.19.2. Please check the
upstream changelog if your usage is impacted by the potentially breaking changes:
- https://cert-manager.io/docs/releases/upgrading/upgrading-1.17-1.18
- https://cert-manager.io/docs/releases/upgrading/upgrading-1.18-1.19
{{- end }}

{{- /* ===== INFORMATIONAL NOTIFICATIONS ===== */}}
{{- /* Notifications endpoint threshold should use maxretries instead */ -}}
{{- $usesThreshold := false }}
{{- range $v := .Values.global.registry.notifications.endpoints }}
    {{- if hasKey $v "threshold" }}
        {{- $usesThreshold = true}}
    {{- end }}
{{- end }}
{{- if $usesThreshold }}
{{ $NOTICE }}
registry:
    The configuration of `global.registry.notifications.endpoints[].threshold` has been deprecated and is planned for removal in GitLab 23.0.
    Please use `global.registry.notifications.endpoints[].maxretries` instead https://docs.gitlab.com/administration/packages/container_registry/#configure-container-registry-notifications.
{{- end -}}
{{- /* END gitlab.deprecate.registry.notifications.endpoints.threshold */}}

{{- /* If shared-secrets is disable, manual secret creation will be needed */}}
{{- if not (index .Values "shared-secrets").enabled }}
{{ $NOTICE }}
The automatic generation of secrets has been disabled.
The user should ensure all necessary secrets are created according to documentation, or the deployment will fail to operate correctly.
{{- end }}

{{- /* Runner notice if .install && ! .runners.privileged */}}
{{- if and (index .Values "gitlab-runner").install (not (index .Values "gitlab-runner").runners.privileged) }}
{{ $NOTICE }}
You've installed GitLab Runner without the ability to use 'docker in docker'.
The GitLab Runner chart (gitlab/gitlab-runner) is deployed without the `privileged` flag by default for security purposes. This can be changed by setting `gitlab-runner.runners.privileged` to `true`. Before doing so, please read the GitLab Runner chart's documentation on why we
chose not to enable this by default. See https://docs.gitlab.com/runner/install/kubernetes.html#running-docker-in-docker-containers-with-gitlab-runners
{{- end }}

{{- /* toolbox replicas */}}
{{- if eq (index $.Values.gitlab "toolbox" "replicas" | int) 0 }}
{{ $NOTICE }}
The GitLab toolbox is scaled to 0.
The `toolbox` Pod is very useful for administration and debugging of this application suite. You may configure `gitlab.toolbox.replicas=1` if you wish to leave a Pod running at all times, or you can scale the deployment up when needed:

    `kubectl scale --replicas=1 deployment/{{ .Release.Name }}-toolbox`
{{- end }}

{{- /* Deprecation notice for global.redis.password */}}
{{- if kindIs "map" .Values.global.redis.password }}
{{ $NOTICE }}
redis:
    The configuration key `global.redis.password` has been renamed. Please use
    `global.redis.auth` instead. This is the source of the `coalesce.go` warning
    message from Helm as well. For more details, please see:
    https://docs.gitlab.com/charts/installation/upgrade.html#use-of-globalredispassword
{{- end -}}

{{- /* print install survey link */}}
{{- $appVersion := coalesce .Values.global.gitlabVersion .Chart.AppVersion -}}
{{- if and .Release.IsInstall (regexMatch "^\\d+\\.\\d+\\.\\d+(-rc\\d+)?(-pre)?$" $appVersion) }}
Help us improve the installation experience, let us know how we did with a 1 minute survey:
{{- printf "https://gitlab.fra1.qualtrics.com/jfe/form/SV_6kVqZANThUQ1bZb?installation=helm&release=%s" (regexReplaceAll "^(\\d+)\\.(\\d+)\\..+" $appVersion "${1}-${2}") }}
{{- end }}

{{- /* run removals */}}
{{ include "gitlab.removals" . }}
{{- /* run checkConfig */}}
{{ include "gitlab.checkConfig" . }}
