diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -2708,6 +2708,13 @@ ##! Note: We do not recommend changing these values unless absolutely necessary # package['systemd_after'] = 'multi-user.target' # package['systemd_wanted_by'] = 'multi-user.target' + +##! Settings to control secret generation and storage +##! Note: We do not recommend changing these values unless absolutely necessary +##! Set to false to only parse secrets from `gitlab-secrets.json` file but not generate them. +# package['generate_default_secrets'] = true +##! Set to false to prevent creating `gitlab-secrets.json` file +# package['generate_secrets_json_file'] = true ################################################################################ ################################################################################ ## Configuration Settings for GitLab EE only ## diff --git a/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb b/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItZWUvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnMucmI=..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItZWUvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnMucmI= 100644 --- a/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb +++ b/files/gitlab-cookbooks/gitlab-ee/libraries/suggested_reviewers.rb @@ -1,5 +1,6 @@ module SuggestedReviewers class << self def parse_secrets - # Suggested Reviewers and GitLab expects exactly 32 bytes, encoded with base64 + Gitlab['suggested_reviewers']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16)) + end @@ -5,5 +6,8 @@ - Gitlab['suggested_reviewers']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16)) + def validate_secrets + return unless Gitlab['suggested_reviewers']['api_secret_key'] + + # Suggested Reviewers and GitLab expects exactly 32 bytes, encoded with base64 api_secret_key = Base64.strict_decode64(Gitlab['suggested_reviewers']['api_secret_key']) raise "suggested_reviewers['api_secret_key'] should be exactly 32 bytes" if api_secret_key.length != 32 end diff --git a/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb b/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL2xpYnJhcmllcy9naXRsYWJfa2FzLnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL2xpYnJhcmllcy9naXRsYWJfa2FzLnJi 100644 --- a/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb +++ b/files/gitlab-cookbooks/gitlab-kas/libraries/gitlab_kas.rb @@ -88,5 +88,7 @@ end def parse_secrets - # KAS and GitLab expects exactly 32 bytes, encoded with base64 + Gitlab['gitlab_kas']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16)) + Gitlab['gitlab_kas']['private_api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16)) + end @@ -92,5 +94,8 @@ - Gitlab['gitlab_kas']['api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16)) - api_secret_key = Base64.strict_decode64(Gitlab['gitlab_kas']['api_secret_key']) - raise "gitlab_kas['api_secret_key'] should be exactly 32 bytes" if api_secret_key.length != 32 + def validate_secrets + if Gitlab['gitlab_kas']['api_secret_key'] + # KAS and GitLab expects exactly 32 bytes, encoded with base64 + api_secret_key = Base64.strict_decode64(Gitlab['gitlab_kas']['api_secret_key']) + raise "gitlab_kas['api_secret_key'] should be exactly 32 bytes" if api_secret_key.length != 32 + end @@ -96,5 +101,6 @@ - Gitlab['gitlab_kas']['private_api_secret_key'] ||= Base64.strict_encode64(SecretsHelper.generate_hex(16)) + return unless Gitlab['gitlab_kas']['private_api_secret_key'] + private_api_secret_key = Base64.strict_decode64(Gitlab['gitlab_kas']['private_api_secret_key']) raise "gitlab_kas['private_api_secret_key'] should be exactly 32 bytes" if private_api_secret_key.length != 32 end diff --git a/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb b/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvbGlicmFyaWVzL2dpdGxhYl9wYWdlcy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWItcGFnZXMvbGlicmFyaWVzL2dpdGxhYl9wYWdlcy5yYg== 100644 --- a/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb +++ b/files/gitlab-cookbooks/gitlab-pages/libraries/gitlab_pages.rb @@ -17,6 +17,7 @@ require_relative '../../gitlab/libraries/helpers/authorizer_helper' require_relative '../../package/libraries/helpers/shell_out_helper' +require_relative '../../package/libraries/helpers/logging_helper' module GitlabPages class << self @@ -27,6 +28,7 @@ parse_pages_external_url parse_gitlab_pages_daemon parse_secrets + parse_automatic_oauth_registration end def parse_pages_external_url @@ -109,5 +111,10 @@ Gitlab['gitlab_pages']['auth_secret'] ||= SecretsHelper.generate_hex(64) if Gitlab['gitlab_pages']['access_control'] Gitlab['gitlab_pages']['gitlab_id'] ||= SecretsHelper.generate_urlsafe_base64 Gitlab['gitlab_pages']['gitlab_secret'] ||= SecretsHelper.generate_urlsafe_base64 + Gitlab['gitlab_pages']['api_secret_key'] ||= Base64.strict_encode64(SecureRandom.random_bytes(32)) + end + + def validate_secrets + return unless Gitlab['gitlab_pages']['api_secret_key'] # Pages and GitLab expects exactly 32 bytes, encoded with base64 @@ -112,12 +119,20 @@ # Pages and GitLab expects exactly 32 bytes, encoded with base64 - if Gitlab['gitlab_pages']['api_secret_key'] - bytes = Base64.strict_decode64(Gitlab['gitlab_pages']['api_secret_key']) - raise "gitlab_pages['api_secret_key'] should be exactly 32 bytes" if bytes.length != 32 - else - bytes = SecureRandom.random_bytes(32) - Gitlab['gitlab_pages']['api_secret_key'] = Base64.strict_encode64(bytes) - end + bytes = Base64.strict_decode64(Gitlab['gitlab_pages']['api_secret_key']) + raise "gitlab_pages['api_secret_key'] should be exactly 32 bytes" if bytes.length != 32 + end + + def parse_automatic_oauth_registration + # If GitLab Pages isn't enabled, do nothing. + return unless Gitlab['gitlab_pages']['enable'] + + # If writing to gitlab-secrets.json file is not explicitly disabled, do + # nothing. + return if Gitlab['package']['generate_secrets_json_file'] != false + + Gitlab['gitlab_pages']['register_as_oauth_app'] = false + + LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically registering GitLab Pages as an Oauth App. So, GitLab SSO will not be available as a login option.") end end end diff --git a/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb b/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9tYXR0ZXJtb3N0LnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9tYXR0ZXJtb3N0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb +++ b/files/gitlab-cookbooks/gitlab/libraries/gitlab_mattermost.rb @@ -17,6 +17,7 @@ require_relative 'nginx.rb' require_relative '../../package/libraries/deprecations' +require_relative '../../package/libraries/helpers/logging_helper' require_relative '../../letsencrypt/libraries/helper' module GitlabMattermost @@ -24,6 +25,7 @@ def parse_variables parse_mattermost_external_url parse_gitlab_mattermost + parse_automatic_oauth_registration end def parse_secrets @@ -92,5 +94,18 @@ Gitlab['mattermost_nginx']['enable'] = true if Gitlab['mattermost_nginx']['enable'].nil? end + + def parse_automatic_oauth_registration + # If Mattermost isn't enabled, do nothing. + return unless Gitlab['mattermost']['enable'] + + # If writing to gitlab-secrets.json file is not explicitly disabled, do + # nothing. + return if Gitlab['package']['generate_secrets_json_file'] != false + + Gitlab['mattermost']['register_as_oauth_app'] = false + + LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically registering Mattermost as an Oauth App. So, GitLab SSO will not be available as a login option.") + end end end diff --git a/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb b/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9yYWlscy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL2dpdGxhYl9yYWlscy5yYg== 100644 --- a/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb +++ b/files/gitlab-cookbooks/gitlab/libraries/gitlab_rails.rb @@ -53,7 +53,15 @@ parse_repository_storage end - # rubocop:disable Metrics/AbcSize - # rubocop:disable Metrics/CyclomaticComplexity - # rubocop:disable Metrics/PerceivedComplexity + def transform_secrets + # Transform legacy key names to new key names + Gitlab['gitlab_rails']['db_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11 + Gitlab['gitlab_rails']['secret_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11 + Gitlab['gitlab_rails']['otp_key_base'] ||= Gitlab['gitlab_rails']['secret_token'] + Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= Gitlab['gitlab_rails']['jws_private_key'] # Changed in 10.1 + + # Environment variable gets priority over gitlab.rb setting + Gitlab['gitlab_rails']['initial_root_password'] = ENV['GITLAB_ROOT_PASSWORD'] || Gitlab['gitlab_rails']['initial_root_password'] + end + def parse_secrets @@ -59,4 +67,23 @@ def parse_secrets + transform_secrets + + # Note: If you add another secret to generate here make sure it gets written to disk in SecretsHelper.write_to_gitlab_secrets + Gitlab['gitlab_rails']['db_key_base'] ||= SecretsHelper.generate_hex(64) + Gitlab['gitlab_rails']['secret_key_base'] ||= SecretsHelper.generate_hex(64) + Gitlab['gitlab_rails']['otp_key_base'] ||= SecretsHelper.generate_hex(64) + Gitlab['gitlab_rails']['encrypted_settings_key_base'] ||= SecretsHelper.generate_hex(64) + Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem + Gitlab['gitlab_rails']['ci_jwt_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem + + return unless Gitlab['gitlab_rails']['initial_root_password'].nil? + + Gitlab['gitlab_rails']['initial_root_password'] = SecretsHelper.generate_base64(32) + Gitlab['gitlab_rails']['store_initial_root_password'] = true if Gitlab['gitlab_rails']['store_initial_root_password'].nil? + end + + def validate_secrets + transform_secrets + # Blow up when the existing configuration is ambiguous, so we don't accidentally throw away important secrets ci_db_key_base = Gitlab['gitlab_ci']['db_key_base'] rails_db_key_base = Gitlab['gitlab_rails']['db_key_base'] @@ -71,9 +98,5 @@ raise message.join("\n\n") end - # Transform legacy key names to new key names - Gitlab['gitlab_rails']['db_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11 - Gitlab['gitlab_rails']['secret_key_base'] ||= Gitlab['gitlab_ci']['db_key_base'] # Changed in 8.11 - Gitlab['gitlab_rails']['otp_key_base'] ||= Gitlab['gitlab_rails']['secret_token'] - Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= Gitlab['gitlab_rails']['jws_private_key'] # Changed in 10.1 + raise 'initial_root_password: Length is too short, minimum is 8 characters' if Gitlab['gitlab_rails']['initial_root_password'] && Gitlab['gitlab_rails']['initial_root_password'].length < 8 @@ -79,8 +102,3 @@ - # Note: If you add another secret to generate here make sure it gets written to disk in SecretsHelper.write_to_gitlab_secrets - Gitlab['gitlab_rails']['db_key_base'] ||= SecretsHelper.generate_hex(64) - Gitlab['gitlab_rails']['secret_key_base'] ||= SecretsHelper.generate_hex(64) - Gitlab['gitlab_rails']['otp_key_base'] ||= SecretsHelper.generate_hex(64) - Gitlab['gitlab_rails']['encrypted_settings_key_base'] ||= SecretsHelper.generate_hex(64) - Gitlab['gitlab_rails']['openid_connect_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem + return unless Gitlab['gitlab_rails']['ci_jwt_signing_key'] @@ -86,20 +104,8 @@ - Gitlab['gitlab_rails']['initial_root_password'] = ENV['GITLAB_ROOT_PASSWORD'] || Gitlab['gitlab_rails']['initial_root_password'] - if Gitlab['gitlab_rails']['initial_root_password'].nil? - Gitlab['gitlab_rails']['initial_root_password'] = SecretsHelper.generate_base64(32) - Gitlab['gitlab_rails']['store_initial_root_password'] = true if Gitlab['gitlab_rails']['store_initial_root_password'].nil? - elsif Gitlab['gitlab_rails']['initial_root_password'].length < 8 - raise 'initial_root_password: Length is too short, minimum is 8 characters' - end - - if Gitlab['gitlab_rails']['ci_jwt_signing_key'] - begin - key = OpenSSL::PKey::RSA.new(Gitlab['gitlab_rails']['ci_jwt_signing_key']) - raise 'ci_jwt_signing_key: The provided key is not private RSA key' unless key.private? - rescue OpenSSL::PKey::RSAError - raise 'ci_jwt_signing_key: The provided key is not valid RSA key' - end - else - Gitlab['gitlab_rails']['ci_jwt_signing_key'] ||= SecretsHelper.generate_rsa(4096).to_pem + begin + key = OpenSSL::PKey::RSA.new(Gitlab['gitlab_rails']['ci_jwt_signing_key']) + raise 'ci_jwt_signing_key: The provided key is not private RSA key' unless key.private? + rescue OpenSSL::PKey::RSAError + raise 'ci_jwt_signing_key: The provided key is not valid RSA key' end end @@ -104,8 +110,5 @@ end end - # rubocop:enable Metrics/AbcSize - # rubocop:enable Metrics/CyclomaticComplexity - # rubocop:enable Metrics/PerceivedComplexity def parse_external_url return unless Gitlab['external_url'] diff --git a/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb b/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9saWJyYXJpZXMvbGV0c19lbmNyeXB0LnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9sZXRzZW5jcnlwdC9saWJyYXJpZXMvbGV0c19lbmNyeXB0LnJi 100644 --- a/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb +++ b/files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb @@ -14,6 +14,8 @@ # limitations under the License. # +require_relative '../../package/libraries/helpers/logging_helper' + class LetsEncrypt class << self def parse_variables @@ -28,6 +30,11 @@ # else leave it alone. return unless Gitlab['letsencrypt']['enable'].nil? + if should_auto_enable? && Gitlab['package']['generate_secrets_json_file'] == false + LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically enabling Let's Encrypt integration.") + return + end + # We get to make a 'guess' as to if we should enable based on other parsed # values Gitlab['letsencrypt']['enable'] = should_auto_enable? diff --git a/files/gitlab-cookbooks/monitoring/libraries/grafana.rb b/files/gitlab-cookbooks/monitoring/libraries/grafana.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL2xpYnJhcmllcy9ncmFmYW5hLnJi..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL2xpYnJhcmllcy9ncmFmYW5hLnJi 100644 --- a/files/gitlab-cookbooks/monitoring/libraries/grafana.rb +++ b/files/gitlab-cookbooks/monitoring/libraries/grafana.rb @@ -15,6 +15,8 @@ # limitations under the License. # +require_relative '../../package/libraries/helpers/logging_helper' + module Grafana class << self def parse_secrets @@ -30,6 +32,7 @@ def parse_variables disable_unless_forced parse_grafana_datasources + parse_automatic_oauth_registration end def disable_unless_forced @@ -63,5 +66,18 @@ Gitlab['grafana']['datasources'] = datasources end + + def parse_automatic_oauth_registration + # If Grafana isn't enabled, do nothing. + return unless Gitlab['grafana']['enable'] && Gitlab['grafana']['enable_deprecated_service'] + + # If writing to gitlab-secrets.json file is not explicitly disabled, do + # nothing. + return if Gitlab['package']['generate_secrets_json_file'] != false + + Gitlab['grafana']['register_as_oauth_app'] = false + + LoggingHelper.warning("Writing secrets to `gitlab-secrets.json` file is disabled. Hence, not automatically registering Grafana as an Oauth App. So, GitLab SSO will not be available as a login option.") + end end end diff --git a/files/gitlab-cookbooks/package/attributes/default.rb b/files/gitlab-cookbooks/package/attributes/default.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2F0dHJpYnV0ZXMvZGVmYXVsdC5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2F0dHJpYnV0ZXMvZGVmYXVsdC5yYg== 100644 --- a/files/gitlab-cookbooks/package/attributes/default.rb +++ b/files/gitlab-cookbooks/package/attributes/default.rb @@ -26,6 +26,9 @@ default['package']['systemd_wanted_by'] = 'multi-user.target' default['package']['systemd_after'] = 'multi-user.target' +default['package']['generate_default_secrets'] = true +default['package']['generate_secrets_json_file'] = true + # We only want to generate the public attributes file on specific calls to Chef. # Normally, you will not want to change this default['package']['public_attributes'] = false diff --git a/files/gitlab-cookbooks/package/libraries/settings_dsl.rb b/files/gitlab-cookbooks/package/libraries/settings_dsl.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2wucmI=..197e0f506932f38500aa86a4a078882d16709ec7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2wucmI= 100644 --- a/files/gitlab-cookbooks/package/libraries/settings_dsl.rb +++ b/files/gitlab-cookbooks/package/libraries/settings_dsl.rb @@ -202,4 +202,5 @@ def generate_secrets(node_name) # guards against creating secrets on non-bootstrap node SecretsHelper.read_gitlab_secrets + generate_default_secrets = Gitlab['package']['generate_default_secrets'] != false @@ -205,4 +206,5 @@ + Chef::Log.info("Generating default secrets") if generate_default_secrets # Parse secrets using the handlers sorted_settings.each do |_key, value| handler = value.handler @@ -206,6 +208,7 @@ # Parse secrets using the handlers sorted_settings.each do |_key, value| handler = value.handler - handler.parse_secrets if handler.respond_to?(:parse_secrets) + handler.parse_secrets if handler.respond_to?(:parse_secrets) && generate_default_secrets + handler.validate_secrets if handler.respond_to?(:validate_secrets) end @@ -210,6 +213,18 @@ end - SecretsHelper.write_to_gitlab_secrets + if Gitlab['package']['generate_secrets_json_file'] == false + return unless generate_default_secrets + + warning_message = <<~EOS + You've enabled generating default secrets but have disabled writing them to gitlab-secrets.json file. + This results in secrets not persisting across `gitlab-ctl reconfigure` runs and can cause issues with functionality. + EOS + + LoggingHelper.warning(warning_message) + else + Chef::Log.info("Generating gitlab-secrets.json file") + SecretsHelper.write_to_gitlab_secrets + end end def generate_config(node_name) diff --git a/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb b/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWItcGFnZXMvcmVjaXBlcy9naXRsYWItcGFnZXNfc3BlYy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWItcGFnZXMvcmVjaXBlcy9naXRsYWItcGFnZXNfc3BlYy5yYg== 100644 --- a/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb +++ b/spec/chef/cookbooks/gitlab-pages/recipes/gitlab-pages_spec.rb @@ -147,6 +147,28 @@ } end end + + context 'when generating gitlab-secrets.json file is disabled' do + before do + stub_gitlab_rb( + package: { + generate_secrets_json_file: false + } + ) + + allow(LoggingHelper).to receive(:warning).and_call_original + end + + it 'does not register as an oauth app with GitLab' do + expect(chef_run).not_to run_ruby_block('authorize pages with gitlab') + end + + it 'displays a warning about disabling automatic oauth registration' do + expect(LoggingHelper).to receive(:warning).with(/not automatically registering GitLab Pages as an Oauth App/) + + chef_run + end + end end context 'with custom port' do diff --git a/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb b/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnNfc3BlYy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3N1Z2dlc3RlZF9yZXZpZXdlcnNfc3BlYy5yYg== 100644 --- a/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb +++ b/spec/chef/cookbooks/gitlab/libraries/suggested_reviewers_spec.rb @@ -1,7 +1,4 @@ -# This spec is to test the Redis helper and whether the values parsed -# are the ones we expect -require 'spec_helper' require 'chef_helper' RSpec.describe SuggestedReviewers do describe '.parse_secrets' do @@ -4,9 +1,7 @@ require 'chef_helper' RSpec.describe SuggestedReviewers do describe '.parse_secrets' do - let(:some_hex) { '4ecd22c031fee5c7368a5a102f76dc41' } - - subject { described_class.parse_secrets } + let(:chef_run) { converge_config(is_ee: true) } before do @@ -11,6 +6,14 @@ before do - allow(Gitlab).to receive(:[]).and_return({ 'suggested_reviewers': [] }) - allow(SecretsHelper).to receive(:generate_hex).and_return(some_hex) + allow(SecretsHelper).to receive(:generate_hex).and_return('4ecd22c031fee5c7368a5a102f76dc41') + allow(Gitlab).to receive(:[]).and_call_original + end + + context 'by default' do + it 'generates a secret' do + node = chef_run.node + + expect(node['gitlab']['suggested_reviewers']['api_secret_key']).to eq('NGVjZDIyYzAzMWZlZTVjNzM2OGE1YTEwMmY3NmRjNDE=') + end end @@ -15,6 +18,15 @@ end - it 'raises no length error' do - expect { subject }.not_to raise_error - end + context 'with user specified values' do + context 'of sufficient length' do + before do + stub_gitlab_rb( + suggested_reviewers: { + api_secret_key: 'NTliMjc2ZDkxMTZhZGZiZGE4ZWEzODI3NTczODQ5ZjI=' + } + ) + end + + it 'uses the specified value' do + node = chef_run.node @@ -20,4 +32,5 @@ - context 'secret key length is wrong' do - let(:some_hex) { '123456' } + expect(node['gitlab']['suggested_reviewers']['api_secret_key']).to eq('NTliMjc2ZDkxMTZhZGZiZGE4ZWEzODI3NTczODQ5ZjI=') + end + end @@ -23,6 +36,16 @@ - it 'raises no length error' do - expect { subject }.to raise_error "suggested_reviewers['api_secret_key'] should be exactly 32 bytes" + context 'of insufficient length' do + before do + stub_gitlab_rb( + suggested_reviewers: { + api_secret_key: 'MTIzNDU2' + } + ) + end + + it 'raises an error' do + expect { chef_run }.to raise_error.with_message("suggested_reviewers['api_secret_key'] should be exactly 32 bytes") + end end end end diff --git a/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb b/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9tYXR0ZXJtb3N0L3JlY2lwZXMvbWF0dGVybW9zdF9zcGVjLnJi..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9tYXR0ZXJtb3N0L3JlY2lwZXMvbWF0dGVybW9zdF9zcGVjLnJi 100644 --- a/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb +++ b/spec/chef/cookbooks/mattermost/recipes/mattermost_spec.rb @@ -314,4 +314,34 @@ end end end + + describe 'registering as an OAuth app with GitLab' do + context 'by default when Mattermost is enabled' do + it 'registers as an oauth app with GitLab' do + expect(chef_run).to run_ruby_block('authorize mattermost with gitlab') + end + end + + context 'when generating gitlab-secrets.json file is disabled' do + before do + stub_gitlab_rb( + package: { + generate_secrets_json_file: false + } + ) + + allow(LoggingHelper).to receive(:warning).and_call_original + end + + it 'does not register as an oauth app with GitLab' do + expect(chef_run).not_to run_ruby_block('authorize mattermost with gitlab') + end + + it 'displays a warning about disabling automatic oauth registration' do + expect(LoggingHelper).to receive(:warning).with(/not automatically registering Mattermost as an Oauth App/) + + chef_run + end + end + end end diff --git a/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb b/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYV9zcGVjLnJi..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYV9zcGVjLnJi 100644 --- a/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb +++ b/spec/chef/cookbooks/monitoring/recipes/grafana_spec.rb @@ -120,6 +120,49 @@ expect(chef_run).to render_file('/var/opt/gitlab/grafana/provisioning/datasources/gitlab_datasources.yml') .with_content(default_datasources_yml_output) end + + describe 'registering as an OAuth app with GitLab' do + context 'by default Grafana is enabled' do + before do + stub_gitlab_rb( + grafana: { + enable: true, + enable_deprecated_service: true + } + ) + end + + it 'registers as an oauth app with GitLab' do + expect(chef_run).to run_ruby_block('authorize Grafana with GitLab') + end + end + + context 'when generating gitlab-secrets.json file is disabled' do + before do + stub_gitlab_rb( + grafana: { + enable: true, + enable_deprecated_service: true + }, + package: { + generate_secrets_json_file: false + } + ) + + allow(LoggingHelper).to receive(:warning).and_call_original + end + + it 'does not register as an oauth app with GitLab' do + expect(chef_run).not_to run_ruby_block('authorize Grafana with gitlab') + end + + it 'displays a warning about disabling automatic oauth registration' do + expect(LoggingHelper).to receive(:warning).with(/not automatically registering Grafana as an Oauth App/) + + chef_run + end + end + end end context 'when grafana is enabled (forced) and prometheus is disabled' do @@ -156,25 +199,6 @@ end end - it 'authorizes Grafana with gitlab' do - stub_gitlab_rb( - external_url: 'http://gitlab.example.com', - grafana: { - enable: true, - enable_deprecated_service: true - } - ) - - allow(GrafanaHelper).to receive(:authorize_with_gitlab) - - expect(chef_run).to run_ruby_block('authorize Grafana with GitLab') - .at_converge_time - expect(GrafanaHelper).to receive(:authorize_with_gitlab) - .with 'http://gitlab.example.com' - - chef_run.ruby_block('authorize Grafana with GitLab').block.call - end - context 'with user provided settings' do before do stub_gitlab_rb( diff --git a/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb b/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb index 6b42f559a066fd2b501c45d28bef8bdea4437338_c3BlYy9jaGVmL2Nvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2xfc3BlYy5yYg==..197e0f506932f38500aa86a4a078882d16709ec7_c3BlYy9jaGVmL2Nvb2tib29rcy9wYWNrYWdlL2xpYnJhcmllcy9zZXR0aW5nc19kc2xfc3BlYy5yYg== 100644 --- a/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb +++ b/spec/chef/cookbooks/package/libraries/settings_dsl_spec.rb @@ -70,4 +70,80 @@ end end end + + describe 'secrets generation' do + let(:chef_run) { ChefSpec::SoloRunner.new.converge('gitlab::default') } + + before do + allow(Gitlab).to receive(:[]).and_call_original + end + + describe 'default secrets' do + context 'by default' do + it 'generates default secrets' do + expect(GitlabRails).to receive(:parse_secrets) + + chef_run + end + end + + context 'when explicitly disabled' do + before do + stub_gitlab_rb( + package: { + generate_default_secrets: false + } + ) + end + + it 'does not generate default secrets' do + expect(GitlabRails).not_to receive(:parse_secrets) + + chef_run + end + end + end + + describe 'gitlab-secrets.json file' do + let(:file) { double(:file, puts: true, chmod: true) } + + before do + allow(::File).to receive(:directory?).and_call_original + allow(::File).to receive(:directory?).with('/etc/gitlab').and_return(true) + allow(::File).to receive(:open).with('/etc/gitlab/gitlab-secrets.json', 'w', 0600).and_yield(file).once + end + + context 'by default' do + it 'generates gitlab-secrets.json file' do + expect(::File).to receive(:open).with('/etc/gitlab/gitlab-secrets.json', 'w', 0600) + + chef_run + end + end + + context 'when explicitly disabled' do + before do + stub_gitlab_rb( + package: { + generate_secrets_json_file: false + } + ) + + allow(LoggingHelper).to receive(:warning).and_call_original + end + + it 'does not generate gitlab-secrets.json file' do + expect(::File).not_to receive(:open).with('/etc/gitlab/gitlab-secrets.json', 'w', 0600) + + chef_run + end + + it 'generates warning about secrets not persisting' do + expect(LoggingHelper).to receive(:warning).with(/You've enabled generating default secrets but have disabled writing them to gitlab-secrets.json file/) + + chef_run + end + end + end + end end