# HG changeset patch # User Taka Nishida <tnishida@gitlab.com> # Date 1712606460 0 # Mon Apr 08 20:01:00 2024 +0000 # Node ID b6f6aa9bda4200d00ffcfb0eceba468d9e735a77 # Parent 3c1c33892d8a77dbe769e3ed86c6aadcbbd55c85 Support TLS for kas->kas communication in Omnibus Closes https://gitlab.com/gitlab-org/gitlab/-/issues/375327 Changelog: added diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -2165,6 +2165,9 @@ # # 'OWN_PRIVATE_API_CIDR' => '2001:db8:8a2e:370::7334/64', # IPv6 example # # 'OWN_PRIVATE_API_PORT' => '8155', # if not set, port from private_api_listen_address is used # # 'OWN_PRIVATE_API_SCHEME' => 'grpc', # use grpcs when using TLS on private API endpoint +# # OWN_PRIVATE_API_HOST is used to verify the TLS cert hostname. +# # Set KAS' host name if you want to use TLS for KAS->KAS communication. +# # 'OWN_PRIVATE_API_HOST' => '<server-name-from-cert>', # } ##! Error Reporting and Logging with Sentry diff --git a/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb b/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb --- a/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb +++ b/spec/chef/cookbooks/gitlab-kas/recipes/gitlab-kas_spec.rb @@ -117,6 +117,9 @@ sentry_dsn: 'https://my_key:my_secret@sentry.io/test_project', sentry_environment: 'production', log_level: 'debug', + env: { + 'OWN_PRIVATE_API_HOST' => 'fake-host.example.com' + } } ) end @@ -157,6 +160,10 @@ expect(chef_run).to render_file("/var/opt/gitlab/gitlab-kas/authentication_secret_file").with_content(api_secret_key) expect(chef_run).to render_file("/var/opt/gitlab/gitlab-kas/private_api_authentication_secret_file").with_content(private_api_secret_key) end + + it 'sets OWN_PRIVATE_API_HOST' do + expect(chef_run).to render_file('/opt/gitlab/etc/gitlab-kas/env/OWN_PRIVATE_API_HOST').with_content('fake-host.example.com') + end end describe 'gitlab.yml configuration' do @@ -186,7 +193,7 @@ ) end - it 'has exernal URL with scheme `ws` instead of `wss`' do + it 'has external URL with scheme `ws` instead of `wss`' do expect(gitlab_yml[:production][:gitlab_kas]).to include( external_url: 'ws://gitlab.example.com/-/kubernetes-agent/' )