Make default_projects_features accept "only team members"
So far you can only set project feature defaults to either true or false which translates to either "everyone with access" or "disabled":
gitlab_rails['gitlab_default_projects_features_issues'] = true
gitlab_rails['gitlab_default_projects_features_merge_requests'] = true
gitlab_rails['gitlab_default_projects_features_wiki'] = true
gitlab_rails['gitlab_default_projects_features_snippets'] = true
gitlab_rails['gitlab_default_projects_features_builds'] = true
gitlab_rails['gitlab_default_projects_features_container_registry'] = true
However, for something as powerful as pipelines I'm not feeling comfortable to allow just about anyone to push that button. Especially when projects are shared internally by default. Reading and contributing to the code is fine (visibility <- internal). Deployments, however, either need a trained pair of eyes to supervise the outcome or a bullet-proof pipeline (which is likely to be the opposite).
Proposition
Make gitlab_rails['gitlab_default_projects_features_*']
accept (true, false, only team members) such that new projects are configured with Sharing & Permission
-> Project Visibility
-> *
accordingly.