diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvbmZpZy10ZW1wbGF0ZS9naXRsYWIucmIudGVtcGxhdGU= 100644 --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -789,7 +789,7 @@ # gitlab_rails['redis_sentinels'] = [ # {'host' => '127.0.0.1', 'port' => 26379}, # ] - +# gitlab_rails['redis_sentinels_password'] = 'sentinel-requirepass-goes-here' #### Cluster support ####! Cluster support is only available for selected Redis instances. `resque.yml` will not @@ -806,8 +806,9 @@ ###! Docs: https://docs.gitlab.com/omnibus/settings/redis.html#running-with-multiple-redis-instances # gitlab_rails['redis_cache_instance'] = nil # gitlab_rails['redis_cache_sentinels'] = nil +# gitlab_rails['redis_cache_sentinels_password'] = nil # gitlab_rails['redis_cache_username'] = nil # gitlab_rails['redis_cache_password'] = nil # gitlab_rails['redis_cache_cluster_nodes'] = nil # gitlab_rails['redis_queues_instance'] = nil # gitlab_rails['redis_queues_sentinels'] = nil @@ -809,10 +810,11 @@ # gitlab_rails['redis_cache_username'] = nil # gitlab_rails['redis_cache_password'] = nil # gitlab_rails['redis_cache_cluster_nodes'] = nil # gitlab_rails['redis_queues_instance'] = nil # gitlab_rails['redis_queues_sentinels'] = nil +# gitlab_rails['redis_queues_sentinels_password'] = nil # gitlab_rails['redis_queues_username'] = nil # gitlab_rails['redis_queues_password'] = nil # gitlab_rails['redis_queues_cluster_nodes'] = nil # gitlab_rails['redis_shared_state_instance'] = nil # gitlab_rails['redis_shared_state_sentinels'] = nil @@ -814,10 +816,11 @@ # gitlab_rails['redis_queues_username'] = nil # gitlab_rails['redis_queues_password'] = nil # gitlab_rails['redis_queues_cluster_nodes'] = nil # gitlab_rails['redis_shared_state_instance'] = nil # gitlab_rails['redis_shared_state_sentinels'] = nil +# gitlab_rails['redis_shared_state_sentinels_password'] = nil # gitlab_rails['redis_shared_state_username'] = nil # gitlab_rails['redis_shared_state_password'] = nil # gitlab_rails['redis_shared_state_cluster_nodes'] = nil # gitlab_rails['redis_trace_chunks_instance'] = nil # gitlab_rails['redis_trace_chunks_sentinels'] = nil @@ -819,10 +822,11 @@ # gitlab_rails['redis_shared_state_username'] = nil # gitlab_rails['redis_shared_state_password'] = nil # gitlab_rails['redis_shared_state_cluster_nodes'] = nil # gitlab_rails['redis_trace_chunks_instance'] = nil # gitlab_rails['redis_trace_chunks_sentinels'] = nil +# gitlab_rails['redis_trace_chunks_sentinels_password'] = nil # gitlab_rails['redis_trace_chunks_username'] = nil # gitlab_rails['redis_trace_chunks_password'] = nil # gitlab_rails['redis_trace_chunks_cluster_nodes'] = nil # gitlab_rails['redis_actioncable_instance'] = nil # gitlab_rails['redis_actioncable_sentinels'] = nil @@ -824,10 +828,11 @@ # gitlab_rails['redis_trace_chunks_username'] = nil # gitlab_rails['redis_trace_chunks_password'] = nil # gitlab_rails['redis_trace_chunks_cluster_nodes'] = nil # gitlab_rails['redis_actioncable_instance'] = nil # gitlab_rails['redis_actioncable_sentinels'] = nil +# gitlab_rails['redis_actioncable_sentinels_password'] = nil # gitlab_rails['redis_actioncable_username'] = nil # gitlab_rails['redis_actioncable_password'] = nil # gitlab_rails['redis_actioncable_cluster_nodes'] = nil # gitlab_rails['redis_rate_limiting_instance'] = nil # gitlab_rails['redis_rate_limiting_sentinels'] = nil @@ -829,10 +834,11 @@ # gitlab_rails['redis_actioncable_username'] = nil # gitlab_rails['redis_actioncable_password'] = nil # gitlab_rails['redis_actioncable_cluster_nodes'] = nil # gitlab_rails['redis_rate_limiting_instance'] = nil # gitlab_rails['redis_rate_limiting_sentinels'] = nil +# gitlab_rails['redis_rate_limiting_sentinels_password'] = nil # gitlab_rails['redis_rate_limiting_username'] = nil # gitlab_rails['redis_rate_limiting_password'] = nil # gitlab_rails['redis_rate_limiting_cluster_nodes'] = nil # gitlab_rails['redis_sessions_instance'] = nil # gitlab_rails['redis_sessions_sentinels'] = nil @@ -834,10 +840,11 @@ # gitlab_rails['redis_rate_limiting_username'] = nil # gitlab_rails['redis_rate_limiting_password'] = nil # gitlab_rails['redis_rate_limiting_cluster_nodes'] = nil # gitlab_rails['redis_sessions_instance'] = nil # gitlab_rails['redis_sessions_sentinels'] = nil +# gitlab_rails['redis_sessions_sentinels_password'] = nil # gitlab_rails['redis_sessions_username'] = nil # gitlab_rails['redis_sessions_password'] = nil # gitlab_rails['redis_sessions_cluster_nodes'] = nil # gitlab_rails['redis_cluster_rate_limiting_instance'] = nil # gitlab_rails['redis_cluster_rate_limiting_sentinels'] = nil @@ -839,10 +846,11 @@ # gitlab_rails['redis_sessions_username'] = nil # gitlab_rails['redis_sessions_password'] = nil # gitlab_rails['redis_sessions_cluster_nodes'] = nil # gitlab_rails['redis_cluster_rate_limiting_instance'] = nil # gitlab_rails['redis_cluster_rate_limiting_sentinels'] = nil +# gitlab_rails['redis_cluster_rate_limiting_sentinels_password'] = nil # gitlab_rails['redis_cluster_rate_limiting_username'] = nil # gitlab_rails['redis_cluster_rate_limiting_password'] = nil # gitlab_rails['redis_cluster_rate_limiting_cluster_nodes'] = nil # gitlab_rails['redis_repository_cache_instance'] = nil # gitlab_rails['redis_repository_cache_sentinels'] = nil @@ -844,8 +852,9 @@ # gitlab_rails['redis_cluster_rate_limiting_username'] = nil # gitlab_rails['redis_cluster_rate_limiting_password'] = nil # gitlab_rails['redis_cluster_rate_limiting_cluster_nodes'] = nil # gitlab_rails['redis_repository_cache_instance'] = nil # gitlab_rails['redis_repository_cache_sentinels'] = nil +# gitlab_rails['redis_repository_cache_sentinels_password'] = nil # gitlab_rails['redis_repository_cache_username'] = nil # gitlab_rails['redis_repository_cache_password'] = nil # gitlab_rails['redis_repository_cache_cluster_nodes'] = nil diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644 --- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb +++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb @@ -27,5 +27,6 @@ gitlab_kas_authentication_secret_file = File.join(working_dir, 'authentication_secret_file') gitlab_kas_private_api_authentication_secret_file = File.join(working_dir, 'private_api_authentication_secret_file') redis_host, redis_port, redis_password = redis_helper.redis_params +redis_password_present = redis_password && !redis_password.empty? redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels'] redis_sentinels_master_name = node['redis']['master_name'] @@ -30,3 +31,6 @@ redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels'] redis_sentinels_master_name = node['redis']['master_name'] +redis_sentinels_password = node['gitlab']['gitlab_rails']['redis_sentinels_password'] +redis_sentinels_password_present = redis_sentinels_password && !redis_sentinels_password.empty? + gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file') @@ -32,4 +36,5 @@ gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file') +gitlab_kas_redis_sentinels_password_file = File.join(working_dir, 'redis_sentinels_password_file') redis_default_port = URI::Redis::DEFAULT_PORT redis_network = redis_helper.redis_url.scheme == 'unix' ? 'unix' : 'tcp' redis_ssl = node['gitlab']['gitlab_rails']['redis_ssl'] @@ -99,7 +104,17 @@ group account_helper.gitlab_group mode '0640' notifies :restart, 'runit_service[gitlab-kas]' - only_if { redis_password && !redis_password.empty? } + only_if { redis_password_present } + sensitive true +end + +file gitlab_kas_redis_sentinels_password_file do + content redis_sentinels_password + owner 'root' + group account_helper.gitlab_group + mode '0640' + notifies :restart, 'runit_service[gitlab-kas]' + only_if { redis_sentinels_password_present } sensitive true end @@ -116,5 +131,5 @@ redis_address: redis_address, redis_ssl: redis_ssl, redis_default_port: redis_default_port, - redis_password_file: redis_password ? gitlab_kas_redis_password_file : nil, + redis_password_file: redis_password_present ? gitlab_kas_redis_password_file : nil, redis_sentinels_master_name: redis_sentinels_master_name, @@ -120,5 +135,6 @@ redis_sentinels_master_name: redis_sentinels_master_name, - redis_sentinels: redis_sentinels + redis_sentinels: redis_sentinels, + redis_sentinels_password_file: redis_sentinels_password_present ? gitlab_kas_redis_sentinels_password_file : nil ) ) notifies :restart, 'runit_service[gitlab-kas]' diff --git a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb +++ b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb @@ -58,6 +58,9 @@ <%- @redis_sentinels.each do |sentinel| %> - '<%= sentinel['host'] %>:<%= sentinel['port'] || @redis_default_port %>' <%- end %> + <%- if @redis_sentinels_password_file %> + sentinel_password_file: <%= @redis_sentinels_password_file %> + <%- end %> <%- end %> api: listen: diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvYXR0cmlidXRlcy9kZWZhdWx0LnJi 100644 --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -442,5 +442,6 @@ default['gitlab']['gitlab_rails']['redis_socket'] = "/var/opt/gitlab/redis/redis.socket" default['gitlab']['gitlab_rails']['redis_enable_client'] = true default['gitlab']['gitlab_rails']['redis_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_cache_instance'] = nil default['gitlab']['gitlab_rails']['redis_cache_sentinels'] = [] @@ -445,5 +446,6 @@ default['gitlab']['gitlab_rails']['redis_cache_instance'] = nil default['gitlab']['gitlab_rails']['redis_cache_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_cache_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_cache_username'] = nil default['gitlab']['gitlab_rails']['redis_cache_password'] = nil default['gitlab']['gitlab_rails']['redis_cache_cluster_nodes'] = [] @@ -451,6 +453,7 @@ default['gitlab']['gitlab_rails']['redis_queues_username'] = nil default['gitlab']['gitlab_rails']['redis_queues_password'] = nil default['gitlab']['gitlab_rails']['redis_queues_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_queues_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_queues_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_shared_state_instance'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_sentinels'] = [] @@ -454,8 +457,9 @@ default['gitlab']['gitlab_rails']['redis_queues_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_shared_state_instance'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_shared_state_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_username'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_password'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_trace_chunks_instance'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels'] = [] @@ -457,10 +461,11 @@ default['gitlab']['gitlab_rails']['redis_shared_state_username'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_password'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_trace_chunks_instance'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_username'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_password'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_actioncable_instance'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] = [] @@ -462,10 +467,11 @@ default['gitlab']['gitlab_rails']['redis_trace_chunks_username'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_password'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_actioncable_instance'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_actioncable_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_username'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_password'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_rate_limiting_instance'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels'] = [] @@ -467,10 +473,11 @@ default['gitlab']['gitlab_rails']['redis_actioncable_username'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_password'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_rate_limiting_instance'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_username'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_password'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_sessions_instance'] = nil default['gitlab']['gitlab_rails']['redis_sessions_sentinels'] = [] @@ -472,10 +479,11 @@ default['gitlab']['gitlab_rails']['redis_rate_limiting_username'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_password'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_sessions_instance'] = nil default['gitlab']['gitlab_rails']['redis_sessions_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_sessions_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_sessions_username'] = nil default['gitlab']['gitlab_rails']['redis_sessions_password'] = nil default['gitlab']['gitlab_rails']['redis_sessions_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_repository_cache_instance'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels'] = [] @@ -477,10 +485,11 @@ default['gitlab']['gitlab_rails']['redis_sessions_username'] = nil default['gitlab']['gitlab_rails']['redis_sessions_password'] = nil default['gitlab']['gitlab_rails']['redis_sessions_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_repository_cache_instance'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_username'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_password'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_instance'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels'] = [] @@ -482,8 +491,9 @@ default['gitlab']['gitlab_rails']['redis_repository_cache_username'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_password'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_cluster_nodes'] = [] default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_instance'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels'] = [] +default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_username'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_password'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_cluster_nodes'] = [] diff --git a/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb b/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3JlZGlzX2hlbHBlci5yYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvbGlicmFyaWVzL3JlZGlzX2hlbHBlci5yYg== 100644 --- a/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb +++ b/files/gitlab-cookbooks/gitlab/libraries/redis_helper.rb @@ -37,6 +37,4 @@ uri = URI('unix:/') uri.path = redis_socket else - scheme = gitlab_rails['redis_ssl'] ? 'rediss:/' : 'redis:/' - uri = URI(scheme) params = redis_params(support_sentinel_groupname: support_sentinel_groupname) @@ -42,8 +40,12 @@ params = redis_params(support_sentinel_groupname: support_sentinel_groupname) - # In case the password has non-alphanumeric passwords, be sure to encode it - params[2] = CGI.escape(params[2]) if params[2] - uri.host, uri.port, uri.password = params - uri.path = "/#{gitlab_rails['redis_database']}" + + uri = build_redis_url( + ssl: gitlab_rails['redis_ssl'], + host: params[0], + port: params[1], + password: params[2], + path: "/#{gitlab_rails['redis_database']}" + ) end uri @@ -61,6 +63,37 @@ raise "Cluster mode is not allowed for #{instance}" unless ALLOWED_REDIS_CLUSTER_INSTANCE.include?(instance) end + def build_redis_url(ssl:, host:, port:, path:, password:) + scheme = ssl ? 'rediss:/' : 'redis:/' + uri = URI(scheme) + uri.host = host + uri.port = port + uri.path = path + # In case the password has non-alphanumeric passwords, be sure to encode it + uri.password = CGI.escape(password) if password + + uri + end + + def redis_sentinel_urls(sentinels_key) + gitlab_rails = @node['gitlab']['gitlab_rails'] + + sentinels = gitlab_rails[sentinels_key] + + return [] unless sentinels + + sentinels_password = gitlab_rails["#{sentinels_key}_password"] + + sentinels.map do |sentinel| + build_redis_url( + ssl: sentinel['ssl'], + host: sentinel['host'], + port: sentinel['port'], + path: '', + password: sentinels_password) + end + end + def running_version return unless OmnibusHelper.new(@node).service_up?('redis') diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI= 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb @@ -198,6 +198,7 @@ redis_url = redis_helper.redis_url redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels'] +redis_sentinels_password = node['gitlab']['gitlab_rails']['redis_sentinels_password'] redis_enable_client = node['gitlab']['gitlab_rails']['redis_enable_client'] templatesymlink "Create a secrets.yml and create a symlink to Rails root" do @@ -226,7 +227,7 @@ owner "root" group "root" mode "0644" - variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_enable_client: redis_enable_client) + variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_sentinels_password: redis_sentinels_password, redis_enable_client: redis_enable_client) dependent_services.each { |svc| notifies :restart, svc } sensitive true end @@ -246,6 +247,7 @@ templatesymlink "Create a cable.yml and create a symlink to Rails root" do url = node['gitlab']['gitlab_rails']['redis_actioncable_instance'] sentinels = node['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] + sentinels_password = node['gitlab']['gitlab_rails']['redis_actioncable_sentinels_password'] if url.nil? url = redis_url @@ -258,7 +260,7 @@ owner "root" group "root" mode "0644" - variables(redis_url: url, redis_sentinels: sentinels, redis_enable_client: redis_enable_client) + variables(redis_url: url, redis_sentinels: sentinels, redis_sentinels_password: sentinels_password, redis_enable_client: redis_enable_client) dependent_services.each { |svc| notifies :restart, svc } sensitive true end @@ -267,6 +269,7 @@ filename = "redis.#{instance}.yml" url = node['gitlab']['gitlab_rails']["redis_#{instance}_instance"] sentinels = node['gitlab']['gitlab_rails']["redis_#{instance}_sentinels"] + sentinels_password = node['gitlab']['gitlab_rails']["redis_#{instance}_sentinels_password"] clusters = node['gitlab']['gitlab_rails']["redis_#{instance}_cluster_nodes"] username = node['gitlab']['gitlab_rails']["redis_#{instance}_username"] password = node['gitlab']['gitlab_rails']["redis_#{instance}_password"] @@ -285,6 +288,7 @@ variables( redis_url: url, redis_sentinels: sentinels, + redis_sentinels_password: sentinels_password, redis_enable_client: redis_enable_client, cluster_nodes: clusters, cluster_username: username, diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb @@ -91,7 +91,7 @@ _redis_host, _redis_port, redis_password = redis_helper.redis_params workhorse_keywatcher = node['gitlab']['gitlab_workhorse']['workhorse_keywatcher'] redis_url = redis_helper.redis_url.to_s -redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels'] +redis_sentinel_urls = redis_helper.redis_sentinel_urls('redis_sentinels') redis_sentinel_master = node['redis']['master_name'] redis_sentinel_master_password = node['redis']['master_password'] config_file_path = File.join(working_dir, "config.toml") @@ -110,7 +110,7 @@ workhorse_keywatcher: workhorse_keywatcher, redis_url: redis_url, password: redis_password, - sentinels: redis_sentinels, + sentinels: redis_sentinel_urls, sentinel_master: redis_sentinel_master, shutdown_timeout: shutdown_timeout, master_password: redis_sentinel_master_password, diff --git a/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvY2FibGUueW1sLmVyYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvY2FibGUueW1sLmVyYg== 100644 --- a/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/cable.yml.erb @@ -10,5 +10,6 @@ - host: <%= sentinel['host'] %> port: <%= sentinel['port'] %> + <%- if @redis_sentinels_password %>password: "<%= @redis_sentinels_password %>"<% end %> <% end %> <% end %> diff --git a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcmVzcXVlLnltbC5lcmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvcmVzcXVlLnltbC5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb @@ -19,6 +19,7 @@ - host: <%= sentinel['host'] %> port: <%= sentinel['port'] %> + <%- if @redis_sentinels_password %>password: "<%= @redis_sentinels_password %>"<% end %> <% end %> <% end %> <% end %> diff --git a/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb b/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvd29ya2hvcnNlLWNvbmZpZy50b21sLmVyYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvdGVtcGxhdGVzL2RlZmF1bHQvd29ya2hvcnNlLWNvbmZpZy50b21sLmVyYg== 100644 --- a/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/workhorse-config.toml.erb @@ -17,7 +17,7 @@ URL = "<%= @redis_url %>" Password = "<%= @password %>" <% else %> -Sentinel = <%= @sentinels.map{ |sentinel| "tcp://#{sentinel['host']}:#{sentinel['port']}" }.to_s %> +Sentinel = <%= @sentinels.to_json %> SentinelMaster = "<%= @sentinel_master %>" Password = "<%= @master_password %>" <% end %> diff --git a/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb b/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi 100644 --- a/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb +++ b/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb @@ -454,8 +454,8 @@ end context 'with sentinel' do - before do - stub_gitlab_rb( + let(:sentinel_params) do + { external_url: 'https://gitlab.example.com', gitlab_rails: { redis_sentinels: [ @@ -467,7 +467,11 @@ redis: { master_name: 'example-redis' } - ) + } + end + + before do + stub_gitlab_rb(sentinel_params) end it 'renders a single server configuration in to the kas config' do @@ -489,6 +493,38 @@ expect(kas_redis_cfg).not_to(include('server')) } end + + context 'when there is a Sentinel password' do + before do + sentinel_params[:gitlab_rails]['redis_sentinels_password'] = 'some pass' + + stub_gitlab_rb(sentinel_params) + end + + it 'writes sentinel_password_file into the kas config' do + expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/gitlab-kas-config.yml').with_content { |content| + kas_redis_cfg = YAML.safe_load(content)['redis'] + + expect(kas_redis_cfg).to( + include( + 'sentinel' => { + 'master_name' => 'example-redis', + 'addresses' => [ + 'a:1', + 'b:2', + 'c:6379' + ], + 'sentinel_password_file' => '/var/opt/gitlab/gitlab-kas/redis_sentinels_password_file' + } + ) + ) + } + end + + it 'renders the password file' do + expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/redis_sentinels_password_file').with_content('some pass') + end + end end end diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHNfc3BlYy5yYg==..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHNfc3BlYy5yYg== 100644 --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb @@ -350,7 +350,8 @@ stub_gitlab_rb(gitlab_rails: { redis_enable_client: false, redis_actioncable_instance: "redis://:fakepass@fake.redis.actioncable.com:8888/2", - redis_actioncable_sentinels: [{ host: 'actioncable', port: '1234' }, { host: 'actioncable', port: '3456' }] + redis_actioncable_sentinels: [{ host: 'actioncable', port: '1234' }, { host: 'actioncable', port: '3456' }], + redis_actioncable_sentinels_password: 'some pass' }) end @@ -363,6 +364,7 @@ hash_including( redis_url: "redis://:fakepass@fake.redis.actioncable.com:8888/2", redis_sentinels: [{ 'host' => 'actioncable', 'port' => '1234' }, { 'host' => 'actioncable', 'port' => '3456' }], + redis_sentinels_password: 'some pass', redis_enable_client: false ) ) @@ -366,6 +368,13 @@ redis_enable_client: false ) ) + + expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/cable.yml").with_content { |content| + generated_yml = YAML.safe_load(content) + expect(generated_yml.dig('production', 'url')).to eq("redis://:fakepass@fake.redis.actioncable.com:8888/2") + expect(generated_yml.dig('production', 'cluster')).to eq(nil) + expect(generated_yml.dig('production', 'sentinels')).to eq([{ "host" => 'actioncable', 'port' => 1234, 'password' => 'some pass' }, { 'host' => 'actioncable', 'port' => 3456, 'password' => 'some pass' }]) + } end end @@ -390,6 +399,7 @@ expect(chef_run).to create_templatesymlink("Create a redis.#{instance}.yml and create a symlink to Rails root").with_variables( redis_url: nil, redis_sentinels: [], + redis_sentinels_password: nil, redis_enable_client: false, cluster_nodes: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }], cluster_username: instance, @@ -426,6 +436,7 @@ expect(chef_run).to create_templatesymlink("Create a redis.#{instance}.yml and create a symlink to Rails root").with_variables( redis_url: "redis://:fakepass@fake.redis.#{instance}.com:8888/2", redis_sentinels: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }], + redis_sentinels_password: nil, redis_enable_client: false, cluster_nodes: [], cluster_username: nil, @@ -445,6 +456,44 @@ end end + context 'with Sentinel passwords' do + before do + stub_hash = { redis_enable_client: false } + redis_instances.each do |instance| + stub_hash["redis_#{instance}_instance"] = "redis://:fakepass@fake.redis.#{instance}.com:8888/2" + stub_hash["redis_#{instance}_sentinels"] = [{ host: instance, port: '1234' }, { host: instance, port: '3456' }] + stub_hash["redis_#{instance}_sentinels_password"] = 'sentinelpass' + end + + stub_gitlab_rb(gitlab_rails: stub_hash) + end + + it 'render separate config files' do + redis_instances.each do |instance| + expect(chef_run).to create_templatesymlink("Create a redis.#{instance}.yml and create a symlink to Rails root").with_variables( + redis_url: "redis://:fakepass@fake.redis.#{instance}.com:8888/2", + redis_sentinels: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }], + redis_sentinels_password: 'sentinelpass', + redis_enable_client: false, + cluster_nodes: [], + cluster_username: nil, + cluster_password: nil + ) + + expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content| + generated_yml = YAML.safe_load(content) + expect(generated_yml.dig('production', 'url')).to eq("redis://:fakepass@fake.redis.#{instance}.com:8888/2") + expect(generated_yml.dig('production', 'sentinels')).to eq([{ "host" => instance, "port" => 1234, "password" => 'sentinelpass' }, { "host" => instance, "port" => 3456, "password" => 'sentinelpass' }]) + expect(generated_yml.dig('production', 'cluster')).to eq(nil) + expect(generated_yml.dig('production', 'username')).to eq(nil) + expect(generated_yml.dig('production', 'password')).to eq(nil) + } + + expect(chef_run).not_to delete_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml") + end + end + end + it 'still renders the default configuration file' do expect(chef_run).to create_templatesymlink('Create a resque.yml and create a symlink to Rails root') end diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb index ea165a3cdc9db44649cce76db8b49e1d5f09fe5b_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlX3NwZWMucmI=..40d4a733762f00bb5c1a60e23a1f4ee68fad5819_c3BlYy9jaGVmL2Nvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlX3NwZWMucmI= 100644 --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-workhorse_spec.rb @@ -553,7 +553,7 @@ end it 'should generate config file with the specified values' do - content = 'Sentinel = ["tcp://127.0.0.1:2637", "tcp://127.0.8.1:1234"]' + content = 'Sentinel = ["redis://127.0.0.1:2637","redis://127.0.8.1:1234"]' content_url = 'URL =' content_sentinel_master = 'SentinelMaster = "gitlab-redis"' expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content) @@ -579,7 +579,36 @@ end it 'should generate config file with the specified values' do - content = 'Sentinel = ["tcp://127.0.0.1:26379", "tcp://127.0.8.1:12345"]' + content = 'Sentinel = ["redis://127.0.0.1:26379","redis://127.0.8.1:12345"]' + content_sentinel_master = 'SentinelMaster = "examplemaster"' + content_sentinel_password = 'Password = "examplepassword"' + content_url = 'URL =' + expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content) + expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content_sentinel_master) + expect(chef_run).to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content_sentinel_password) + expect(chef_run).not_to render_file("/var/opt/gitlab/gitlab-workhorse/config.toml").with_content(content_url) + end + end + + context 'with Sentinels password specified' do + before do + stub_gitlab_rb( + gitlab_rails: { + redis_sentinels: [ + { 'host' => '127.0.0.1', 'port' => 26379 }, + { 'host' => '127.0.8.1', 'port' => 12345 } + ], + redis_sentinels_password: 'some pass' + }, + redis: { + master_name: 'examplemaster', + master_password: 'examplepassword' + } + ) + end + + it 'should generate config file with the specified values' do + content = 'Sentinel = ["redis://:some+pass@127.0.0.1:26379","redis://:some+pass@127.0.8.1:12345"]' content_sentinel_master = 'SentinelMaster = "examplemaster"' content_sentinel_password = 'Password = "examplepassword"' content_url = 'URL ='