Kvindo™ Cloud Docs
A managed GitLab Instance is a self-hosted GitLab (Community or Enterprise edition) running on a dedicated VM: source control, CI/CD, container registry, and issue tracking. It is provisioned into a VPC subnet, gets a DNS record, and is optionally reachable at a Floating IP. Register one or more GitLab Runners to execute pipelines.
• Edition & version — community or enterprise (spec.edition) at a specific spec.version
• DNS record — spec.recordName becomes <recordName>-<ulid>.gitlab.kvindo.com (the resource's own id is appended to the name you choose); the effective FQDN is reported in status.fqdn
• Compute & storage — offer IDs size the VM (spec.vmOfferId) and data volume (spec.volumeOfferId, spec.volumeSizeGiB); GitLab is resource-hungry, so size up for real use
• Custom ingress — serve GitLab behind your own hostname and TLS certificate (spec.customIngressConfiguration)
• Secret push protection — reject pushes that contain secrets, with configurable patterns (spec.secretPushProtection)
• No downgrades — the GitLab version cannot be downgraded once set
• Sequential upgrades only — an upgrade must move one supported version at a time; skipping versions is rejected
• Supported versions only — spec.version must be one of the versions the platform publishes; an unsupported value is rejected on create as well as on modify (the Console's picker lists them)
• Edition is one-way — an instance cannot switch from Enterprise back to Community edition
• DNS record freezes with custom ingress — spec.recordName becomes immutable once spec.customIngressConfiguration is enabled
• Root password vs the instance's own password policy — the platform applies spec.rootPassword bypassing the instance's own minimum_password_length setting (an instance restored from an external backup can carry a stricter policy), so an unrelated change (a disk resize, a version bump) is never failed by that policy. In rare cases the password still may not be applied while the operation itself completes successfully — the instance keeps a marker file (/etc/gitlab/kvindo-root-password-not-applied) that tells Kvindo support to set the password manually
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Tier | spec.tier |
spec.tier |
No | string | standard |
No | Reserved for future use — only standard is accepted today |
| Edition | spec.edition |
spec.edition |
Yes | string — community/enterprise |
community |
No | GitLab edition |
| Version | spec.version |
spec.version |
No | string — GitLab version | — | No | bare package version, e.g. 17.5.5 |
| Record name | spec.recordName |
spec.record_name |
No | string — DNS label | — | No | Served at <recordName>-<ulid>.gitlab.kvindo.com — the resource's own id is appended to the name; the effective value is reported back in status.fqdn |
| Root password | spec.rootPassword |
spec.root_password |
No | string (sensitive) | — | No | Password for the root user — applied bypassing any stricter password policy the instance itself carries (e.g. after restoring an external backup); see the key concepts |
| VPC subnet | spec.vpcSubnetId |
spec.vpc_subnet_id |
Yes | ULID — references a VPC Subnet | — | No | Subnet the instance runs in |
| Floating IP | spec.floatingIpId |
spec.floating_ip_id |
Yes | ULID — references a Floating IP | — | No | Public address; omit for private-only access |
| VM offer | spec.vmOfferId |
spec.vm_offer_id |
Yes | string (≤32) — compute offer | — | No | VM compute offer |
| VM state | spec.vmState |
spec.vm_state |
Yes | string — running/stopped |
running |
No | Desired power state |
| Volume offer | spec.volumeOfferId |
spec.volume_offer_id |
No | string (≤32) — disk offer | — | No | Data volume type |
| Volume size | spec.volumeSizeGiB |
spec.volume_size_gib |
No | integer — GiB | — | No | Data volume size |
| Custom ingress | spec.customIngressConfiguration |
spec.custom_ingress_configuration |
Yes | object | — | No | Serve behind your own hostname + certificate |
| Hostname | customIngressConfiguration.hostname |
custom_ingress_configuration.hostname |
No | string | — | No | The public hostname to serve GitLab at |
| Certificate | customIngressConfiguration.certificateId |
custom_ingress_configuration.certificate_id |
No | ULID — references a Certificate | — | No | TLS certificate for the hostname |
| Secret push protection | spec.secretPushProtection |
spec.secret_push_protection |
Yes | object | — | No | Reject pushes containing secrets |
| Enabled | secretPushProtection.enabled |
secret_push_protection.enabled |
No | boolean | — | No | Turn secret push protection on |
| Ignored repository paths | secretPushProtection.ignoredRepositoriesPaths |
secret_push_protection.ignored_repositories_paths |
Yes | list of string | — | No | Repository paths exempt from scanning |
| Regexp patterns | secretPushProtection.regexpPatterns |
secret_push_protection.regexp_patterns |
Yes | list of string | — | No | Extra regexes that flag a push as containing a secret |
| String-contains patterns | secretPushProtection.stringContainsPatterns |
secret_push_protection.string_contains_patterns |
Yes | list of string | — | No | Extra literal substrings that flag a push as containing a secret |
| FQDN | status.fqdn |
status.fqdn |
— | string | — | Yes | Full DNS name of the instance |
| Public IPv4 | status.publicIpV4 |
status.public_ipv4 |
— | string | — | Yes | Set when a Floating IP is attached |
| Public IPv6 | status.publicIpV6 |
status.public_ipv6 |
— | string | — | Yes | Public IPv6. IPv6 is not yet implemented — reserved for future use |
| Private IPv4 | status.privateIpV4 |
status.private_ipv4 |
— | string | — | Yes | Address on the VPC subnet |
| Private IPv6 | status.privateIpV6 |
status.private_ipv6 |
— | string | — | Yes | Private IPv6. IPv6 is not yet implemented — reserved for future use |
A Community-edition instance on an existing subnet, reachable at a Floating IP.
Terraform
Python SDK
kc CLI
Resource docs
Examples