<p>I have deploy <code>helm upgrade --install gitlab gitlab/gitlab --timeout 600s -f gitlab.yaml</code></p>
<p>gitlab.yaml is here, ip is <code>minikube ip</code>.</p>
<pre class="lang-yaml prettyprint-override"><code># values-minikube.yaml
# This example intended as baseline to use Minikube for the deployment of GitLab
# - Services that are not compatible with how Minikube runs are disabled
# - Configured to use 192.168.99.100, and nip.io for the domain

# Minimal settings
global:
  ingress:
    configureCertmanager: false
    class: &quot;nginx&quot;
  hosts:
    domain: &quot;${ip}.nip.io&quot;
    externalIP: &quot;${ip}&quot;
  rails:
    bootsnap:
      enabled: false
  shell:
    # Configure the clone link in the UI to include the high-numbered NodePort
    # value from below (gitlab.gitlab-shell.service.nodePort)
    port: 32022
  psql:
    host: ${POSTGRES_K8S_SERVICE}
    database: postgres
    username: postgres
    password:
      secret: ${POSTGRES_K8S_SERVICE}
      key: postgresql-password
# Don't use certmanager, we'll self-sign
certmanager:
  install: false
# Use the &quot;ingress&quot; addon, not our Ingress (can't map 22/80/443)
nginx-ingress:
  enabled: false
# Save resources, only 3 CPU
prometheus:
  install: false
gitlab-runner:
  install: false
# Reduce replica counts, reducing CPU &amp; memory requirements
gitlab:
  webservice:
    minReplicas: 1
    maxReplicas: 1
  sidekiq:
    minReplicas: 1
    maxReplicas: 1
  gitlab-shell:
    minReplicas: 1
    maxReplicas: 1
    # Map gitlab-shell to a high-numbered NodePort to support cloning over SSH since
    # Minikube takes port 22.
    service:
      type: NodePort
      nodePort: 32022
registry:
  hpa:
    minReplicas: 1
    maxReplicas: 1
</code></pre>
<p>After deploying, it will generate several ingresses, but <strong>we cannot access them by using external machine</strong>.
<a href="https://i.stack.imgur.com/B4M8j.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/B4M8j.png" alt="enter image description here" /></a></p>
<p>So I try to forward them by</p>
<pre><code>kubectl port-forward --namespace default svc/gitlab-webservice-default 9000:8080 --address 0.0.0.0
kubectl port-forward --namespace default svc/gitlab-webservice-default 9001:8081 --address 0.0.0.0
</code></pre>
<p>8080 are from <code>ingress/gitlab-webservice-default</code>.  <strong>9001</strong> cannot be access, It means I cannot access https</p>
<pre><code>  rules:
    - host: gitlab.192.168.49.2.nip.io
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              serviceName: gitlab-webservice-default
              servicePort: 8181
          - path: /admin/sidekiq
            pathType: ImplementationSpecific
            backend:
              serviceName: gitlab-webservice-default
              servicePort: 8080
</code></pre>
<p>But it seems not work when I try to login.</p>
<blockquote>
<p>422</p>
<p>The change you requested was rejected. Make sure you have access to the thing you tried to change.</p>
<p>Please contact your GitLab administrator if you think this is a mistake.</p>
</blockquote>
<p><a href="https://i.stack.imgur.com/4fWAz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/4fWAz.png" alt="enter image description here" /></a></p>

Jess Chen
<p>This issue is poorly documented via gitlab itself and the below 'answer' is for any googlers (hint, it's not really an answer):</p>
<p>The gitlab minikube setup spins up it's own ingress controllers that are bypassed, which is where TLS would normally be terminated. The '422' error is legitimate because <code>localhost:8080</code> does not provide a valid authenticity token to be processed by the host <code>gitlab.192.168.49.2.nip.io</code></p>
<p>You can confirm this by tailing the logs of the webserver container (it outputs all logging to stdout).</p>
<p>So you can either disable to CSRF token check in the <code>omniauth.rb</code> file inside <code>config/initializers</code> and restart the rails instance, or move away from minikube (we used KinD to get this working) since ingress appeared to be broken with the gitlab setup.</p>
