diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb index b006574a38fd270a53b273bb2dd81526ee29fa42_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..8f075ef216fd60cf02a1193b8bc19f4d55452e2c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644 --- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb +++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb @@ -29,6 +29,7 @@ redis_sentinels_master_name = node['redis']['master_name'] gitlab_kas_redis_password_file = File.join(working_dir, 'redis_password_file') redis_network = redis_helper.redis_url.scheme == 'unix' ? 'unix' : 'tcp' +redis_ssl = node['gitlab']['gitlab-rails']['redis_ssl'] redis_address = if redis_network == 'tcp' "#{redis_host}:#{redis_port}" else @@ -80,6 +81,7 @@ authentication_secret_file: gitlab_kas_authentication_secret_file, redis_network: redis_network, redis_address: redis_address, + redis_ssl: redis_ssl, redis_password_file: redis_password ? gitlab_kas_redis_password_file : nil, redis_sentinels_master_name: redis_sentinels_master_name, redis_sentinels: redis_sentinels diff --git a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb index b006574a38fd270a53b273bb2dd81526ee29fa42_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI=..8f075ef216fd60cf02a1193b8bc19f4d55452e2c_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3RlbXBsYXRlcy9kZWZhdWx0L2dpdGxhYi1rYXMtY29uZmlnLnltbC5lcmI= 100644 --- a/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb +++ b/files/gitlab-cookbooks/gitlab-kas/templates/default/gitlab-kas-config.yml.erb @@ -18,6 +18,8 @@ usage_reporting_period: <%= @metrics_usage_reporting_period %>s redis: network: <%= @redis_network %> + tls: + enabled: <%= @redis_ssl %> <%- if @redis_password_file %> password_file: <%= @redis_password_file %> <%- end %> diff --git a/spec/chef/recipes/gitlab-kas_spec.rb b/spec/chef/recipes/gitlab-kas_spec.rb index b006574a38fd270a53b273bb2dd81526ee29fa42_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi..8f075ef216fd60cf02a1193b8bc19f4d55452e2c_c3BlYy9jaGVmL3JlY2lwZXMvZ2l0bGFiLWthc19zcGVjLnJi 100644 --- a/spec/chef/recipes/gitlab-kas_spec.rb +++ b/spec/chef/recipes/gitlab-kas_spec.rb @@ -261,6 +261,39 @@ end end + context 'without sentinel but with tls enabled' do + before do + stub_gitlab_rb( + external_url: 'https://gitlab.example.com', + gitlab_kas: { + enable: true + }, + gitlab_rails: { + redis_host: 'the-host', + redis_port: 12345, + redis_ssl: true, + } + ) + end + + it 'renders a configuration with tls enabled in to the kas config' do + expect(chef_run).to render_file('/var/opt/gitlab/gitlab-kas/gitlab-kas-config.yml').with_content { |content| + kas_redis_cfg = YAML.safe_load(content)['redis'] + expect(kas_redis_cfg).to( + include( + 'network' => 'tcp', + 'tls' => { + 'enabled' => true + }, + 'server' => { + 'address' => 'the-host:12345' + } + ) + ) + } + end + end + context 'with sentinel' do before do stub_gitlab_rb(