Skip to content
Snippets Groups Projects
Commit bf844a8ffc97 authored by Taka Nishida's avatar Taka Nishida
Browse files

Enable KAS in FIPS mode

- Removes code that blocked KAS service when GitLab is
  deployed in FIPS mode

Related https://gitlab.com/gitlab-org/gitlab/-/issues/375327

Changelog: changed
parent aeb78fd06b24
No related branches found
No related tags found
2 merge requests!144heptapod#1622: making 17.0 the oldstable,!127Merge upstream Omnibus GitLab into Omnibus Heptapod
......@@ -20,13 +20,6 @@
Gitlab['gitlab_rails']['enable'] = true if Gitlab['gitlab_rails']['enable'].nil?
service_exclusions = []
# Certain services, like KAS doesn't work on FIPS environments. So we
# disable it by default on FIPS environments.
# Check https://gitlab.com/groups/gitlab-org/-/epics/7933 for details
# about KAS.
service_exclusions << 'skip_on_fips' if OpenSSL.fips_mode
Services.enable_group('rails', except: service_exclusions)
Services.enable_group('rails')
end
end
......@@ -23,12 +23,6 @@
service_exclusions = []
service_exclusions << 'rails' if Gitlab['gitlab_rails']['enable'] == false
# Certain services, like KAS doesn't work on FIPS environments. So we
# disable it by default on FIPS environments.
# Check https://gitlab.com/groups/gitlab-org/-/epics/7933 for details
# about KAS.
service_exclusions << 'skip_on_fips' if OpenSSL.fips_mode
Services.enable_group(Services::DEFAULT_GROUP, except: service_exclusions)
end
......
......@@ -35,7 +35,7 @@
service 'alertmanager', groups: [DEFAULT_GROUP, 'monitoring', 'monitoring_role']
service 'postgres_exporter', groups: [DEFAULT_GROUP, 'monitoring', 'postgres', 'postgres_role', 'patroni_role']
service 'gitlab_pages', groups: ['pages_role']
service 'gitlab_kas', groups: [DEFAULT_GROUP, 'rails', 'skip_on_fips']
service 'gitlab_kas', groups: [DEFAULT_GROUP, 'rails']
service 'mailroom'
service 'mattermost'
service 'registry'
......
......@@ -81,14 +81,6 @@
expect(Services).to have_received(:enable_group).with(Services::DEFAULT_GROUP, hash_including(except: ['rails'])).once
end
it 'leaves skip_on_fips services disabled when on FIPS environment' do
allow(OpenSSL).to receive(:fips_mode).and_return(true)
Gitlab.load_roles
expect(Services).to have_received(:enable_group).with(Services::DEFAULT_GROUP, hash_including(except: ['skip_on_fips'])).once
end
end
describe 'ApplicationRole' do
......@@ -103,17 +95,7 @@
expect(ApplicationRole).to have_received(:load_role)
expect(Gitlab['gitlab_rails']['enable']).to eq true
expect(Services).to have_received(:enable_group).with('rails', except: []).once
end
it 'leaves skip_on_fips services disabled when on FIPS environment' do
allow(OpenSSL).to receive(:fips_mode).and_return(true)
stub_gitlab_rb(application_role: { enable: true })
Gitlab.load_roles
expect(Services).to have_received(:enable_group).with('rails', except: ['skip_on_fips']).once
expect(Services).to have_received(:enable_group).with('rails').once
end
end
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment