diff --git a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIta2FzL3JlY2lwZXMvZW5hYmxlLnJi 100644 --- a/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb +++ b/files/gitlab-cookbooks/gitlab-kas/recipes/enable.rb @@ -90,6 +90,7 @@ mode '0640' notifies :restart, 'runit_service[gitlab-kas]' only_if { redis_password && !redis_password.empty? } + sensitive true end template gitlab_kas_config_file do @@ -127,4 +128,5 @@ config_file: gitlab_kas_config_file, }.merge(params)) log_options node['gitlab']['logging'].to_hash.merge(node['gitlab-kas'].to_hash) + sensitive true end diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI=..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItcmFpbHMucmI= 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-rails.rb @@ -187,6 +187,7 @@ mode "0640" variables node['gitlab']['gitlab-rails'].to_hash dependent_services.each { |svc| notifies :restart, svc } + sensitive true end redis_url = RedisHelper.new(node).redis_url @@ -221,6 +222,7 @@ mode "0644" variables(redis_url: redis_url, redis_sentinels: redis_sentinels, redis_enable_client: redis_enable_client) dependent_services.each { |svc| notifies :restart, svc } + sensitive true end templatesymlink "Create a cable.yml and create a symlink to Rails root" do @@ -240,6 +242,7 @@ mode "0644" variables(redis_url: url, redis_sentinels: sentinels, redis_enable_client: redis_enable_client) dependent_services.each { |svc| notifies :restart, svc } + sensitive true end %w(cache queues shared_state trace_chunks rate_limiting sessions).each do |instance| @@ -259,6 +262,7 @@ variables(redis_url: url, redis_sentinels: sentinels, redis_enable_client: redis_enable_client) dependent_services.each { |svc| notifies :restart, svc } not_if { url.nil? } + sensitive true end [from_filename, to_filename].each do |filename| @@ -316,6 +320,7 @@ ) dependent_services.each { |svc| notifies :restart, svc } notifies :run, 'execute[clear the gitlab-rails cache]' + sensitive true end gitlab_workhorse_services = dependent_services diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItc2hlbGwucmI=..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItc2hlbGwucmI= 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-shell.rb @@ -73,6 +73,7 @@ ssl_cert_dir: node['gitlab']['gitlab-shell']['ssl_cert_dir'] }) notifies :run, 'bash[Set proper security context on ssh files for selinux]', :delayed if SELinuxHelper.enabled? + sensitive true end link File.join(gitlab_shell_dir, ".gitlab_shell_secret") do diff --git a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVjaXBlcy9naXRsYWItd29ya2hvcnNlLnJi 100644 --- a/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb +++ b/files/gitlab-cookbooks/gitlab/recipes/gitlab-workhorse.rb @@ -119,4 +119,5 @@ ) notifies :restart, "runit_service[gitlab-workhorse]" notifies :run, 'bash[Set proper security context on ssh files for selinux]', :delayed if SELinuxHelper.enabled? + sensitive true end diff --git a/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb b/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3JhaWxzX21pZ3JhdGlvbi5yYg==..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9naXRsYWIvcmVzb3VyY2VzL3JhaWxzX21pZ3JhdGlvbi5yYg== 100644 --- a/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb +++ b/files/gitlab-cookbooks/gitlab/resources/rails_migration.rb @@ -4,8 +4,8 @@ property :name, name_property: true property :logfile_prefix, String, required: true property :rake_task, String, required: true -property :helper, required: true -property :environment +property :helper, required: true, sensitive: true +property :environment, sensitive: true property :dependent_services, Array, default: [] default_action :run @@ -31,5 +31,6 @@ end not_if { new_resource.helper.migrated? } + sensitive true end end diff --git a/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb b/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ2l0bGFiLWV4cG9ydGVyLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ2l0bGFiLWV4cG9ydGVyLnJi 100644 --- a/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb +++ b/files/gitlab-cookbooks/monitoring/recipes/gitlab-exporter.rb @@ -60,6 +60,7 @@ connection_string: connection_string, redis_enable_client: node['gitlab']['gitlab-rails']['redis_enable_client'] ) + sensitive true end version_file 'Create version file for GitLab-Exporter' do diff --git a/files/gitlab-cookbooks/monitoring/recipes/grafana.rb b/files/gitlab-cookbooks/monitoring/recipes/grafana.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYS5yYg==..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9tb25pdG9yaW5nL3JlY2lwZXMvZ3JhZmFuYS5yYg== 100644 --- a/files/gitlab-cookbooks/monitoring/recipes/grafana.rb +++ b/files/gitlab-cookbooks/monitoring/recipes/grafana.rb @@ -141,6 +141,7 @@ mode '0644' notifies :restart, 'runit_service[grafana]' only_if { node['monitoring']['grafana']['enable'] } + sensitive true end dashboards = { diff --git a/files/gitlab-cookbooks/postgresql/recipes/bin.rb b/files/gitlab-cookbooks/postgresql/recipes/bin.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvYmluLnJi..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9wb3N0Z3Jlc3FsL3JlY2lwZXMvYmluLnJi 100644 --- a/files/gitlab-cookbooks/postgresql/recipes/bin.rb +++ b/files/gitlab-cookbooks/postgresql/recipes/bin.rb @@ -73,4 +73,5 @@ template "/opt/gitlab/etc/gitlab-psql-rc" do owner 'root' group 'root' + sensitive true end diff --git a/files/gitlab-cookbooks/redis/resources/service.rb b/files/gitlab-cookbooks/redis/resources/service.rb index 2065749a61608d09b92fba03ac79cf145c82c86a_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWRpcy9yZXNvdXJjZXMvc2VydmljZS5yYg==..ed0dade2c088299a3b1a1658093f8d11921c7cb7_ZmlsZXMvZ2l0bGFiLWNvb2tib29rcy9yZWRpcy9yZXNvdXJjZXMvc2VydmljZS5yYg== 100644 --- a/files/gitlab-cookbooks/redis/resources/service.rb +++ b/files/gitlab-cookbooks/redis/resources/service.rb @@ -44,6 +44,7 @@ mode "0644" variables(node['redis'].to_hash.merge({ is_replica: is_replica })) notifies :restart, 'runit_service[redis]', :immediately if new_resource.omnibus_helper.should_notify?('redis') + sensitive true end runit_service 'redis' do