# HG changeset patch # User Vasilii Iakliushin <viakliushin@gitlab.com> # Date 1726865408 0 # Fri Sep 20 20:50:08 2024 +0000 # Node ID ac8cc786a34bb5cedfb752db4e7f0d3149ead0d2 # Parent 4434a54b8bffb350563034ac9434010dc4228f4c Support PAT configuration for gitlab-shell New configuration options were added to gitlab-shell: https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/1141. Adds an option to configure them in Omnibus. Related https://gitlab.com/gitlab-org/gitlab/-/issues/460290 Changelog: added diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -1365,6 +1365,7 @@ # gitlab_shell['dir'] = "/var/opt/gitlab/gitlab-shell" # gitlab_shell['lfs_pure_ssh_protocol'] = false +# gitlab_shell['pat'] = { enabled: true, allowed_scopes: [] } ################################################################################ ## gitlab-sshd diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -758,6 +758,7 @@ default['gitlab']['gitlab_shell']['migration'] = { enabled: true, features: [] } default['gitlab']['gitlab_shell']['ssl_cert_dir'] = "#{node['package']['install-dir']}/embedded/ssl/certs/" default['gitlab']['gitlab_shell']['lfs_pure_ssh_protocol'] = false +default['gitlab']['gitlab_shell']['pat'] = { enabled: true, allowed_scopes: [] } # DEPRECATED! Not used by gitlab-shell default['gitlab']['gitlab_shell']['git_data_directories'] = { "default" => { "path" => "/var/opt/gitlab/git-data" } diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb @@ -146,7 +146,8 @@ migration: node['gitlab']['gitlab_shell']['migration'], ssl_cert_dir: node['gitlab']['gitlab_shell']['ssl_cert_dir'], gitlab_sshd: gitlab_sshd_enabled ? sshd_helper.json_config : nil, - lfs_pure_ssh_protocol: node['gitlab']['gitlab_shell']['lfs_pure_ssh_protocol'] + lfs_pure_ssh_protocol: node['gitlab']['gitlab_shell']['lfs_pure_ssh_protocol'], + pat: node['gitlab']['gitlab_shell']['pat'] } end ) diff --git a/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb --- a/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/gitlab-shell-config.yml.erb @@ -68,3 +68,8 @@ lfs: pure_ssh_protocol: <%= @lfs_pure_ssh_protocol %> <%- end -%> + +<%- if @pat -%> +pat: + <%= @pat.to_json %> +<% end %> diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-shell_spec.rb @@ -34,7 +34,8 @@ gitlab_relative_path: '', ssl_cert_dir: '/opt/gitlab/embedded/ssl/certs/', gitlab_sshd: nil, - lfs_pure_ssh_protocol: false + lfs_pure_ssh_protocol: false, + pat: { enabled: true, allowed_scopes: [] } ) ) end @@ -52,6 +53,7 @@ expect(data['ssl_cert_dir']).to eq('/opt/gitlab/embedded/ssl/certs/') expect(data['sshd']).to be_nil expect(data['lfs']).to be_nil + expect(data['pat']).to eq({ "enabled" => true, "allowed_scopes" => [] }) } end end @@ -161,6 +163,30 @@ end end + context 'when pat is disabled (set to false)' do + before do + stub_gitlab_rb( + gitlab_shell: { + pat: { + enabled: false, + allowed_scopes: [] + } + } + ) + end + + it 'creates the config file with pat disabled' do + expect(chef_run).to create_templatesymlink('Create a config.yml and create a symlink to Rails root').with_variables( + hash_including( + pat: { + enabled: false, + allowed_scopes: [] + } + ) + ) + end + end + context 'with a non-default workhorse unix socket' do context 'without sockets_directory defined' do before do