# HG changeset patch
# User Taka Nishida <tnishida@gitlab.com>
# Date 1713210065 0
#      Mon Apr 15 19:41:05 2024 +0000
# Node ID bf844a8ffc9780a2aa922b977bf520d73b476a50
# Parent  aeb78fd06b24876a8b903e39b9cdf2a826f76108
Enable KAS in FIPS mode

- Removes code that blocked KAS service when GitLab is
  deployed in FIPS mode

Related https://gitlab.com/gitlab-org/gitlab/-/issues/375327

Changelog: changed

diff --git a/files/gitlab-cookbooks/package/libraries/config/roles/application.rb b/files/gitlab-cookbooks/package/libraries/config/roles/application.rb
--- a/files/gitlab-cookbooks/package/libraries/config/roles/application.rb
+++ b/files/gitlab-cookbooks/package/libraries/config/roles/application.rb
@@ -20,13 +20,6 @@
 
     Gitlab['gitlab_rails']['enable'] = true if Gitlab['gitlab_rails']['enable'].nil?
 
-    service_exclusions = []
-    # Certain services, like KAS doesn't work on FIPS environments. So we
-    # disable it by default on FIPS environments.
-    # Check https://gitlab.com/groups/gitlab-org/-/epics/7933 for details
-    # about KAS.
-    service_exclusions << 'skip_on_fips' if OpenSSL.fips_mode
-
-    Services.enable_group('rails', except: service_exclusions)
+    Services.enable_group('rails')
   end
 end
diff --git a/files/gitlab-cookbooks/package/libraries/config/roles/default.rb b/files/gitlab-cookbooks/package/libraries/config/roles/default.rb
--- a/files/gitlab-cookbooks/package/libraries/config/roles/default.rb
+++ b/files/gitlab-cookbooks/package/libraries/config/roles/default.rb
@@ -23,12 +23,6 @@
       service_exclusions = []
       service_exclusions << 'rails' if Gitlab['gitlab_rails']['enable'] == false
 
-      # Certain services, like KAS doesn't work on FIPS environments. So we
-      # disable it by default on FIPS environments.
-      # Check https://gitlab.com/groups/gitlab-org/-/epics/7933 for details
-      # about KAS.
-      service_exclusions << 'skip_on_fips' if OpenSSL.fips_mode
-
       Services.enable_group(Services::DEFAULT_GROUP, except: service_exclusions)
     end
 
diff --git a/files/gitlab-cookbooks/package/libraries/config/services.rb b/files/gitlab-cookbooks/package/libraries/config/services.rb
--- a/files/gitlab-cookbooks/package/libraries/config/services.rb
+++ b/files/gitlab-cookbooks/package/libraries/config/services.rb
@@ -35,7 +35,7 @@
     service 'alertmanager',       groups: [DEFAULT_GROUP, 'monitoring', 'monitoring_role']
     service 'postgres_exporter',  groups: [DEFAULT_GROUP, 'monitoring', 'postgres', 'postgres_role', 'patroni_role']
     service 'gitlab_pages',       groups: ['pages_role']
-    service 'gitlab_kas',         groups: [DEFAULT_GROUP, 'rails', 'skip_on_fips']
+    service 'gitlab_kas',         groups: [DEFAULT_GROUP, 'rails']
     service 'mailroom'
     service 'mattermost'
     service 'registry'
diff --git a/spec/chef/cookbooks/package/libraries/config/roles_spec.rb b/spec/chef/cookbooks/package/libraries/config/roles_spec.rb
--- a/spec/chef/cookbooks/package/libraries/config/roles_spec.rb
+++ b/spec/chef/cookbooks/package/libraries/config/roles_spec.rb
@@ -81,14 +81,6 @@
 
       expect(Services).to have_received(:enable_group).with(Services::DEFAULT_GROUP, hash_including(except: ['rails'])).once
     end
-
-    it 'leaves skip_on_fips services disabled when on FIPS environment' do
-      allow(OpenSSL).to receive(:fips_mode).and_return(true)
-
-      Gitlab.load_roles
-
-      expect(Services).to have_received(:enable_group).with(Services::DEFAULT_GROUP, hash_including(except: ['skip_on_fips'])).once
-    end
   end
 
   describe 'ApplicationRole' do
@@ -103,17 +95,7 @@
 
       expect(ApplicationRole).to have_received(:load_role)
       expect(Gitlab['gitlab_rails']['enable']).to eq true
-      expect(Services).to have_received(:enable_group).with('rails', except: []).once
-    end
-
-    it 'leaves skip_on_fips services disabled when on FIPS environment' do
-      allow(OpenSSL).to receive(:fips_mode).and_return(true)
-
-      stub_gitlab_rb(application_role: { enable: true })
-
-      Gitlab.load_roles
-
-      expect(Services).to have_received(:enable_group).with('rails', except: ['skip_on_fips']).once
+      expect(Services).to have_received(:enable_group).with('rails').once
     end
   end