diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb index f4812f534f82876fce37c3c8258f65b890312b53_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..8ced820a6744e5f59c1f9293e78e324d69ff78a6_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644 --- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb +++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb @@ -30,6 +30,7 @@ redis_sentinels_master_name = node['redis']['master_name'] gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file') redis_network = redis_helper.redis_url.scheme == 'unix' ? 'unix' : 'tcp' +redis_ssl = node['gitlab']['gitlab-rails']['redis_ssl'] redis_address = if redis_network == 'tcp' "#{redis_host}:#{redis_port}" else @@ -90,6 +91,7 @@ private_api_authentication_secret_file: gitlab_kas_private_api_authentication_secret_file, redis_network: redis_network, redis_address: redis_address, + redis_ssl: redis_ssl, redis_password_file: redis_password ? gitlab_kas_redis_password_file : nil, redis_sentinels_master_name: redis_sentinels_master_name, redis_sentinels: redis_sentinels diff --git a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb index f4812f534f82876fce37c3c8258f65b890312b53_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI=..8ced820a6744e5f59c1f9293e78e324d69ff78a6_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb +++ b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb @@ -22,6 +22,8 @@ usage_reporting_period: <%= @metrics_usage_reporting_period %>s redis: network: <%= @redis_network %> + tls: + enabled: <%= @redis_ssl %> <%- if @redis_password_file %> password_file: <%= @redis_password_file %> <%- end %> diff --git a/spec/chef/recipes/gitlab-kas_spec.rb b/spec/chef/recipes/gitlab-kas_spec.rb index f4812f534f82876fce37c3c8258f65b890312b53_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi..8ced820a6744e5f59c1f9293e78e324d69ff78a6_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi 100644 --- a/spec/chef/recipes/gitlab-kas_spec.rb +++ b/spec/chef/recipes/gitlab-kas_spec.rb @@ -310,6 +310,39 @@ end end + context 'without sentinel but with tls enabled' do + before do + stub_gitlab_rb( + external_url: 'https://gitlab.example.com', + gitlab_kas: { + enable: true + }, + gitlab_rails: { + redis_host: 'the-host', + redis_port: 12345, + redis_ssl: true, + } + ) + end + + it 'renders a configuration with tls enabled in to the kas config' do + expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/gitlab-kas-config.yml').with_content { |content| + kas_redis_cfg = YAML.safe_load(content)['redis'] + expect(kas_redis_cfg).to( + include( + 'network' => 'tcp', + 'tls' => { + 'enabled' => true + }, + 'server' => { + 'address' => 'the-host:12345' + } + ) + ) + } + end + end + context 'with sentinel' do before do stub_gitlab_rb(