Kvindo™ Cloud Docs
A managed GitLab Instance is a self-hosted GitLab (Community or Enterprise edition) running on a dedicated VM: source control, CI/CD, container registry, and issue tracking. It is provisioned into a VPC subnet, gets a DNS record, and is optionally reachable at a Floating IP. Register one or more GitLab Runners to execute pipelines.
• Edition & version — community or enterprise (spec.edition) at a specific spec.version
• DNS record — spec.recordName becomes <recordName>-<ulid>.gitlab.kvindo.com (the resource's own id is appended to the name you choose); the effective FQDN is reported in status.fqdn
• Compute & storage — offer IDs size the VM (spec.vmOfferId) and data volume (spec.volumeOfferId, spec.volumeSizeGiB); GitLab is resource-hungry, so size up for real use
• Custom ingress — serve GitLab behind your own hostname and TLS certificate (spec.customIngressConfiguration)
• Secret push protection — reject pushes that contain secrets, with configurable patterns (spec.secretPushProtection)
• No downgrades — the GitLab version cannot be downgraded once set
• Sequential upgrades only — an upgrade must move one supported version at a time; skipping versions is rejected
• Supported versions only — spec.version must be one of the versions the platform publishes; an unsupported value is rejected on create as well as on modify (the Console's picker lists them)
• Edition is one-way — an instance cannot switch from Enterprise back to Community edition
• DNS record freezes with custom ingress — spec.recordName becomes immutable once spec.customIngressConfiguration is enabled
• Backups — every instance gets its own S3 bucket, and a daily backup (full GitLab backup plus gitlab-secrets.json) is taken at 02:00 UTC. spec.backupRetentionDays sets how many daily backups are kept and is settable once: the bucket is created with object lock in compliance mode, so no one — not the instance's own root, not an administrator — can delete a backup or shorten its retention before it expires. Expired backups are removed by the storage itself, never by the instance, and the instance's own credentials carry no delete permission at all. Changing the value therefore requires a new instance
• Restore from a backup — spec.restoreConfiguration creates a NEW instance seeded from another instance's backup in the same organization. It is create-only and immutable, the source instance must be stable, the target's spec.version must equal the release recorded in the backup's name (a restore requires the same release), the edition must match and the volume may not be smaller than the source's. A restore runs at most once — a failed attempt is reported and never retried automatically
• Root password vs the instance's own password policy — the platform applies spec.rootPassword bypassing the instance's own minimum_password_length setting (an instance restored from an external backup can carry a stricter policy), so an unrelated change (a disk resize, a version bump) is never failed by that policy. In rare cases the password still may not be applied while the operation itself completes successfully — the instance keeps a marker file (/etc/gitlab/kvindo-root-password-not-applied) that tells Kvindo support to set the password manually
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Tier | spec.tier |
spec.tier |
No | string | standard |
No | Reserved for future use — only standard is accepted today |
| Edition | spec.edition |
spec.edition |
Yes | string — community/enterprise |
community |
No | GitLab edition |
| Version | spec.version |
spec.version |
No | string — GitLab version | — | No | bare package version, e.g. 17.5.5 |
| Record name | spec.recordName |
spec.record_name |
No | string — DNS label | — | No | Served at <recordName>-<ulid>.gitlab.kvindo.com — the resource's own id is appended to the name; the effective value is reported back in status.fqdn |
| Root password | spec.rootPassword |
spec.root_password |
No | string (sensitive) | — | No | Password for the root user — applied bypassing any stricter password policy the instance itself carries (e.g. after restoring an external backup); see the key concepts |
| VPC subnet | spec.vpcSubnetId |
spec.vpc_subnet_id |
Yes | ULID — references a VPC Subnet | — | No | Subnet the instance runs in |
| Floating IP | spec.floatingIpId |
spec.floating_ip_id |
Yes | ULID — references a Floating IP | — | No | Public address; omit for private-only access |
| VM offer | spec.vmOfferId |
spec.vm_offer_id |
Yes | string (≤32) — compute offer | — | No | VM compute offer |
| VM state | spec.vmState |
spec.vm_state |
Yes | string — running/stopped |
running |
No | Desired power state |
| Volume offer | spec.volumeOfferId |
spec.volume_offer_id |
No | string (≤32) — disk offer | — | No | Data volume type |
| Volume size | spec.volumeSizeGiB |
spec.volume_size_gib |
No | integer — GiB | — | No | Data volume size |
| Backup retention | spec.backupRetentionDays |
spec.backup_retention_days |
Yes | integer — days (1..90) | platform default 7 | No | How many daily backups to keep. Settable once per instance: the backup bucket locks every backup for this period and a retention cannot be shortened, so a later change requires a new instance. Effective value reported in status.backupRetentionDays |
| Restore configuration | spec.restoreConfiguration |
spec.restore_configuration |
Yes | object | — | No | Create-only: seed this instance from another instance's backup |
| Source instance | restoreConfiguration.sourceGitlabId |
restore_configuration.source_gitlab_id |
No | ULID — references a GitLab in the same organization | — | No | The instance whose backup bucket is read; must be stable |
| Backup name | restoreConfiguration.backupName |
restore_configuration.backup_name |
No | string | — | No | Full object name, <epoch>_<YYYY-MM-DD>_<version>_gitlab_backup.tar; the version must equal spec.version |
| Custom ingress | spec.customIngressConfiguration |
spec.custom_ingress_configuration |
Yes | object | — | No | Serve behind your own hostname + certificate |
| Hostname | customIngressConfiguration.hostname |
custom_ingress_configuration.hostname |
No | string | — | No | The public hostname to serve GitLab at |
| Certificate | customIngressConfiguration.certificateId |
custom_ingress_configuration.certificate_id |
No | ULID — references a Certificate | — | No | TLS certificate for the hostname |
| Secret push protection | spec.secretPushProtection |
spec.secret_push_protection |
Yes | object | — | No | Reject pushes containing secrets |
| Enabled | secretPushProtection.enabled |
secret_push_protection.enabled |
No | boolean | — | No | Turn secret push protection on |
| Ignored repository paths | secretPushProtection.ignoredRepositoriesPaths |
secret_push_protection.ignored_repositories_paths |
Yes | list of string | — | No | Repository paths exempt from scanning |
| Regexp patterns | secretPushProtection.regexpPatterns |
secret_push_protection.regexp_patterns |
Yes | list of string | — | No | Extra regexes that flag a push as containing a secret |
| String-contains patterns | secretPushProtection.stringContainsPatterns |
secret_push_protection.string_contains_patterns |
Yes | list of string | — | No | Extra literal substrings that flag a push as containing a secret |
| FQDN | status.fqdn |
status.fqdn |
— | string | — | Yes | Full DNS name of the instance |
| Public IPv4 | status.publicIpV4 |
status.public_ipv4 |
— | string | — | Yes | Set when a Floating IP is attached |
| Public IPv6 | status.publicIpV6 |
status.public_ipv6 |
— | string | — | Yes | Public IPv6. IPv6 is not yet implemented — reserved for future use |
| Private IPv4 | status.privateIpV4 |
status.private_ipv4 |
— | string | — | Yes | Address on the VPC subnet |
| Private IPv6 | status.privateIpV6 |
status.private_ipv6 |
— | string | — | Yes | Private IPv6. IPv6 is not yet implemented — reserved for future use |
A Community-edition instance on an existing subnet, reachable at a Floating IP.
Terraform
Python SDK
kc CLI
Resource docs
Examples