# HG changeset patch # User Balasankar "Balu" C <balasankar@gitlab.com> # Date 1694768688 -19800 # Fri Sep 15 14:34:48 2023 +0530 # Node ID b9783d9e34b28c8b46b2bf3047e43271b01d6256 # Parent 37bc7ee8b175455bb9ad94f8e623e2828677fbc5 Add Redis TLS settings for Rails Changelog: added Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com> diff --git a/files/gitlab-config-template/gitlab.rb.template b/files/gitlab-config-template/gitlab.rb.template --- a/files/gitlab-config-template/gitlab.rb.template +++ b/files/gitlab-config-template/gitlab.rb.template @@ -776,6 +776,10 @@ # gitlab_rails['redis_password'] = nil # gitlab_rails['redis_database'] = 0 # gitlab_rails['redis_enable_client'] = true +# gitlab_rails['redis_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_tls_client_cert_file'] = nil +# gitlab_rails['redis_tls_client_key_file'] = nil #### Redis local UNIX socket (will be disabled if TCP method is used) # gitlab_rails['redis_socket'] = "/var/opt/gitlab/redis/redis.socket" @@ -810,60 +814,100 @@ # gitlab_rails['redis_cache_username'] = nil # gitlab_rails['redis_cache_password'] = nil # gitlab_rails['redis_cache_cluster_nodes'] = nil +# gitlab_rails['redis_cache_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_cache_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_cache_tls_client_cert_file'] = nil +# gitlab_rails['redis_cache_tls_client_key_file'] = nil # gitlab_rails['redis_queues_instance'] = nil # gitlab_rails['redis_queues_sentinels'] = nil # gitlab_rails['redis_queues_sentinels_password'] = nil # gitlab_rails['redis_queues_username'] = nil # gitlab_rails['redis_queues_password'] = nil # gitlab_rails['redis_queues_cluster_nodes'] = nil +# gitlab_rails['redis_queues_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_queues_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_queues_tls_client_cert_file'] = nil +# gitlab_rails['redis_queues_tls_client_key_file'] = nil # gitlab_rails['redis_shared_state_instance'] = nil # gitlab_rails['redis_shared_state_sentinels'] = nil # gitlab_rails['redis_shared_state_sentinels_password'] = nil # gitlab_rails['redis_shared_state_username'] = nil # gitlab_rails['redis_shared_state_password'] = nil # gitlab_rails['redis_shared_state_cluster_nodes'] = nil +# gitlab_rails['redis_shared_state_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_shared_state_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_shared_state_tls_client_cert_file'] = nil +# gitlab_rails['redis_shared_state_tls_client_key_file'] = nil # gitlab_rails['redis_trace_chunks_instance'] = nil # gitlab_rails['redis_trace_chunks_sentinels'] = nil # gitlab_rails['redis_trace_chunks_sentinels_password'] = nil # gitlab_rails['redis_trace_chunks_username'] = nil # gitlab_rails['redis_trace_chunks_password'] = nil # gitlab_rails['redis_trace_chunks_cluster_nodes'] = nil +# gitlab_rails['redis_trace_chunks_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_trace_chunks_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_trace_chunks_tls_client_cert_file'] = nil +# gitlab_rails['redis_trace_chunks_tls_client_key_file'] = nil # gitlab_rails['redis_actioncable_instance'] = nil # gitlab_rails['redis_actioncable_sentinels'] = nil # gitlab_rails['redis_actioncable_sentinels_password'] = nil # gitlab_rails['redis_actioncable_username'] = nil # gitlab_rails['redis_actioncable_password'] = nil # gitlab_rails['redis_actioncable_cluster_nodes'] = nil +# gitlab_rails['redis_actioncable_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_actioncable_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_actioncable_tls_client_cert_file'] = nil +# gitlab_rails['redis_actioncable_tls_client_key_file'] = nil # gitlab_rails['redis_rate_limiting_instance'] = nil # gitlab_rails['redis_rate_limiting_sentinels'] = nil # gitlab_rails['redis_rate_limiting_sentinels_password'] = nil # gitlab_rails['redis_rate_limiting_username'] = nil # gitlab_rails['redis_rate_limiting_password'] = nil # gitlab_rails['redis_rate_limiting_cluster_nodes'] = nil +# gitlab_rails['redis_rate_limiting_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_rate_limiting_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_rate_limiting_tls_client_cert_file'] = nil +# gitlab_rails['redis_rate_limiting_tls_client_key_file'] = nil # gitlab_rails['redis_sessions_instance'] = nil # gitlab_rails['redis_sessions_sentinels'] = nil # gitlab_rails['redis_sessions_sentinels_password'] = nil # gitlab_rails['redis_sessions_username'] = nil # gitlab_rails['redis_sessions_password'] = nil # gitlab_rails['redis_sessions_cluster_nodes'] = nil +# gitlab_rails['redis_sessions_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_sessions_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_sessions_tls_client_cert_file'] = nil +# gitlab_rails['redis_sessions_tls_client_key_file'] = nil # gitlab_rails['redis_cluster_rate_limiting_instance'] = nil # gitlab_rails['redis_cluster_rate_limiting_sentinels'] = nil # gitlab_rails['redis_cluster_rate_limiting_sentinels_password'] = nil # gitlab_rails['redis_cluster_rate_limiting_username'] = nil # gitlab_rails['redis_cluster_rate_limiting_password'] = nil # gitlab_rails['redis_cluster_rate_limiting_cluster_nodes'] = nil +# gitlab_rails['redis_cluster_rate_limiting_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_cluster_rate_limiting_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_cluster_rate_limiting_tls_client_cert_file'] = nil +# gitlab_rails['redis_cluster_rate_limiting_tls_client_key_file'] = nil # gitlab_rails['redis_repository_cache_instance'] = nil # gitlab_rails['redis_repository_cache_sentinels'] = nil # gitlab_rails['redis_repository_cache_sentinels_password'] = nil # gitlab_rails['redis_repository_cache_username'] = nil # gitlab_rails['redis_repository_cache_password'] = nil # gitlab_rails['redis_repository_cache_cluster_nodes'] = nil +# gitlab_rails['redis_repository_cache_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_repository_cache_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_repository_cache_tls_client_cert_file'] = nil +# gitlab_rails['redis_repository_cache_tls_client_key_file'] = nil # gitlab_rails['redis_workhorse_instance'] = nil # gitlab_rails['redis_workhorse_sentinels'] = nil # gitlab_rails['redis_workhorse_sentinels_password'] = nil # gitlab_rails['redis_workhorse_username'] = nil # gitlab_rails['redis_workhorse_password'] = nil # gitlab_rails['redis_workhorse_cluster_nodes'] = nil +# gitlab_rails['redis_workhorse_tls_ca_cert_dir'] = '/opt/gitlab/embedded/ssl/certs/' +# gitlab_rails['redis_workhorse_tls_ca_cert_file'] = '/opt/gitlab/embedded/ssl/certs/cacert.pem' +# gitlab_rails['redis_workhorse_tls_client_cert_file'] = nil +# gitlab_rails['redis_workhorse_tls_client_key_file'] = nil # gitlab_rails['redis_workhorse_sentinel_master'] = nil diff --git a/files/gitlab-cookbooks/gitlab/attributes/default.rb b/files/gitlab-cookbooks/gitlab/attributes/default.rb --- a/files/gitlab-cookbooks/gitlab/attributes/default.rb +++ b/files/gitlab-cookbooks/gitlab/attributes/default.rb @@ -438,6 +438,10 @@ default['gitlab']['gitlab_rails']['redis_host'] = "127.0.0.1" default['gitlab']['gitlab_rails']['redis_port'] = nil default['gitlab']['gitlab_rails']['redis_ssl'] = false +default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'] = "#{node['package']['install-dir']}/embedded/ssl/certs/" +default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'] = "#{node['package']['install-dir']}/embedded/ssl/certs/cacert.pem" +default['gitlab']['gitlab_rails']['redis_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_password'] = nil default['gitlab']['gitlab_rails']['redis_socket'] = "/var/opt/gitlab/redis/redis.socket" default['gitlab']['gitlab_rails']['redis_enable_client'] = true @@ -449,60 +453,110 @@ default['gitlab']['gitlab_rails']['redis_cache_username'] = nil default['gitlab']['gitlab_rails']['redis_cache_password'] = nil default['gitlab']['gitlab_rails']['redis_cache_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_cache_ssl'] = false +default['gitlab']['gitlab_rails']['redis_cache_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_cache_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_cache_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_cache_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_queues_instance'] = nil default['gitlab']['gitlab_rails']['redis_queues_username'] = nil default['gitlab']['gitlab_rails']['redis_queues_password'] = nil default['gitlab']['gitlab_rails']['redis_queues_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_queues_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_queues_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_queues_ssl'] = false +default['gitlab']['gitlab_rails']['redis_queues_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_queues_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_queues_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_queues_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_instance'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_shared_state_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_username'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_password'] = nil default['gitlab']['gitlab_rails']['redis_shared_state_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_shared_state_ssl'] = false +default['gitlab']['gitlab_rails']['redis_shared_state_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_shared_state_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_shared_state_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_shared_state_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_instance'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_trace_chunks_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_username'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_password'] = nil default['gitlab']['gitlab_rails']['redis_trace_chunks_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_trace_chunks_ssl'] = false +default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_trace_chunks_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_instance'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_actioncable_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_username'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_password'] = nil default['gitlab']['gitlab_rails']['redis_actioncable_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_actioncable_ssl'] = false +default['gitlab']['gitlab_rails']['redis_actioncable_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_actioncable_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_actioncable_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_actioncable_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_instance'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_rate_limiting_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_username'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_password'] = nil default['gitlab']['gitlab_rails']['redis_rate_limiting_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_rate_limiting_ssl'] = false +default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_rate_limiting_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_sessions_instance'] = nil default['gitlab']['gitlab_rails']['redis_sessions_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_sessions_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_sessions_username'] = nil default['gitlab']['gitlab_rails']['redis_sessions_password'] = nil default['gitlab']['gitlab_rails']['redis_sessions_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_sessions_ssl'] = false +default['gitlab']['gitlab_rails']['redis_sessions_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_sessions_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_sessions_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_sessions_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_instance'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_repository_cache_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_username'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_password'] = nil default['gitlab']['gitlab_rails']['redis_repository_cache_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_repository_cache_ssl'] = false +default['gitlab']['gitlab_rails']['redis_repository_cache_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_repository_cache_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_repository_cache_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_repository_cache_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_instance'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_username'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_password'] = nil default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_ssl'] = false +default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_cluster_rate_limiting_tls_client_key_file'] = nil default['gitlab']['gitlab_rails']['redis_workhorse_instance'] = nil default['gitlab']['gitlab_rails']['redis_workhorse_sentinels'] = [] default['gitlab']['gitlab_rails']['redis_workhorse_sentinels_password'] = nil default['gitlab']['gitlab_rails']['redis_workhorse_username'] = nil default['gitlab']['gitlab_rails']['redis_workhorse_password'] = nil default['gitlab']['gitlab_rails']['redis_workhorse_cluster_nodes'] = [] +default['gitlab']['gitlab_rails']['redis_workhorse_ssl'] = false +default['gitlab']['gitlab_rails']['redis_workhorse_tls_ca_cert_dir'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'].dup +default['gitlab']['gitlab_rails']['redis_workhorse_tls_ca_cert_file'] = default['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'].dup +default['gitlab']['gitlab_rails']['redis_workhorse_tls_client_cert_file'] = nil +default['gitlab']['gitlab_rails']['redis_workhorse_tls_client_key_file'] = nil # used by workhorse to connect to a separate external redis instead of the omnibus-gitlab redis default['gitlab']['gitlab_rails']['redis_workhorse_sentinel_master'] = nil diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb @@ -200,6 +200,11 @@ redis_sentinels = node['gitlab']['gitlab_rails']['redis_sentinels'] redis_sentinels_password = node['gitlab']['gitlab_rails']['redis_sentinels_password'] redis_enable_client = node['gitlab']['gitlab_rails']['redis_enable_client'] +redis_ssl = node['gitlab']['gitlab_rails']['redis_ssl'] +redis_tls_ca_cert_dir = node['gitlab']['gitlab_rails']['redis_tls_ca_cert_dir'] +redis_tls_ca_cert_file = node['gitlab']['gitlab_rails']['redis_tls_ca_cert_file'] +redis_tls_client_cert_file = node['gitlab']['gitlab_rails']['redis_tls_client_cert_file'] +redis_tls_client_key_file = node['gitlab']['gitlab_rails']['redis_tls_client_key_file'] templatesymlink "Create a secrets.yml and create a symlink to Rails root" do link_from File.join(gitlab_rails_source_dir, "config/secrets.yml") @@ -227,7 +232,17 @@ owner "root" group "root" mode "0644" - variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_sentinels_password: redis_sentinels_password, redis_enable_client: redis_enable_client) + variables( + redis_url: redis_url, + redis_sentinels: redis_sentinels, + redis_sentinels_password: redis_sentinels_password, + redis_enable_client: redis_enable_client, + redis_ssl: redis_ssl, + redis_tls_ca_cert_dir: redis_tls_ca_cert_dir, + redis_tls_ca_cert_file: redis_tls_ca_cert_file, + redis_tls_client_cert_file: redis_tls_client_cert_file, + redis_tls_client_key_file: redis_tls_client_key_file + ) dependent_services.each { |svc| notifies :restart, svc } sensitive true end @@ -273,6 +288,11 @@ clusters = node['gitlab']['gitlab_rails']["redis_#{instance}_cluster_nodes"] username = node['gitlab']['gitlab_rails']["redis_#{instance}_username"] password = node['gitlab']['gitlab_rails']["redis_#{instance}_password"] + redis_ssl = node['gitlab']['gitlab_rails']["redis_#{instance}_ssl"] + ca_cert_dir = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_ca_cert_dir"] + ca_cert_file = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_ca_cert_file"] + certificate_file = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_client_cert_file"] + key_file = node['gitlab']['gitlab_rails']["redis_#{instance}_tls_client_key_file"] from_filename = File.join(gitlab_rails_source_dir, "config/#{filename}") to_filename = File.join(gitlab_rails_etc_dir, filename) @@ -292,7 +312,12 @@ redis_enable_client: redis_enable_client, cluster_nodes: clusters, cluster_username: username, - cluster_password: password + cluster_password: password, + redis_ssl: redis_ssl, + redis_tls_ca_cert_dir: ca_cert_dir, + redis_tls_ca_cert_file: ca_cert_file, + redis_tls_client_cert_file: certificate_file, + redis_tls_client_key_file: key_file ) dependent_services.each { |svc| notifies :restart, svc } action :delete if url.nil? && clusters.empty? diff --git a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb --- a/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb +++ b/files/gitlab-cookbooks/gitlab/templates/default/resque.yml.erb @@ -13,6 +13,13 @@ <% end %> <% else %> url: <%= @redis_url %> + <%- if @redis_ssl %> + ssl_params: + <%- if @redis_tls_ca_cert_dir %>ca_path: "<%= @redis_tls_ca_cert_dir %>"<% end %> + <%- if @redis_tls_ca_cert_file %>ca_file: "<%= @redis_tls_ca_cert_file %>"<% end %> + <%- if @redis_tls_client_cert_file %>cert_file: "<%= @redis_tls_client_cert_file %>"<% end %> + <%- if @redis_tls_client_key_file %>key_file: "<%= @redis_tls_client_key_file %>"<% end %> + <% end %> <% unless @redis_sentinels.empty? %> sentinels: <% @redis_sentinels.each do |sentinel| %> diff --git a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb --- a/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb +++ b/spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb @@ -306,6 +306,38 @@ end end + context 'with TLS settings' do + let(:resque_yml_template) { chef_run.template('/var/opt/gitlab/gitlab-rails/etc/resque.yml') } + let(:resque_yml_file_content) { ChefSpec::Renderer.new(chef_run, resque_yml_template).content } + let(:resque_yml) { YAML.safe_load(resque_yml_file_content, [], [], true, symbolize_names: true) } + + before do + stub_gitlab_rb( + gitlab_rails: { + redis_host: 'redis.example.com', + redis_port: 8888, + redis_password: 'mypass', + redis_ssl: true, + redis_tls_ca_cert_dir: '/tmp/certs', + redis_tls_ca_cert_file: '/tmp/ca.crt', + redis_tls_client_cert_file: '/tmp/self_signed.crt', + redis_tls_client_key_file: '/tmp/self_signed.key', + } + ) + end + + it 'renders configuration with tls settings' do + expected_output = { + ca_file: "/tmp/ca.crt", + ca_path: "/tmp/certs", + cert_file: "/tmp/self_signed.crt", + key_file: "/tmp/self_signed.key" + } + + expect(resque_yml[:production][:ssl_params]).to eq(expected_output) + end + end + shared_examples 'instances does not support redis cluster' do |instance| context "with disallowed instance: #{instance}" do before do @@ -403,7 +435,12 @@ redis_enable_client: false, cluster_nodes: [{ "host" => instance, "port" => "1234" }, { "host" => instance, "port" => "3456" }], cluster_username: instance, - cluster_password: "#{instance}_password" + cluster_password: "#{instance}_password", + redis_ssl: false, + redis_tls_ca_cert_dir: "/opt/gitlab/embedded/ssl/certs/", + redis_tls_ca_cert_file: "/opt/gitlab/embedded/ssl/certs/cacert.pem", + redis_tls_client_cert_file: nil, + redis_tls_client_key_file: nil ) expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content| @@ -440,7 +477,12 @@ redis_enable_client: false, cluster_nodes: [], cluster_username: nil, - cluster_password: nil + cluster_password: nil, + redis_ssl: false, + redis_tls_ca_cert_dir: "/opt/gitlab/embedded/ssl/certs/", + redis_tls_ca_cert_file: "/opt/gitlab/embedded/ssl/certs/cacert.pem", + redis_tls_client_cert_file: nil, + redis_tls_client_key_file: nil ) expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content| @@ -477,7 +519,12 @@ redis_enable_client: false, cluster_nodes: [], cluster_username: nil, - cluster_password: nil + cluster_password: nil, + redis_ssl: false, + redis_tls_ca_cert_dir: "/opt/gitlab/embedded/ssl/certs/", + redis_tls_ca_cert_file: "/opt/gitlab/embedded/ssl/certs/cacert.pem", + redis_tls_client_cert_file: nil, + redis_tls_client_key_file: nil ) expect(chef_run).to render_file("/var/opt/gitlab/gitlab-rails/etc/redis.#{instance}.yml").with_content { |content|