Skip to content

Commit 0090687

Browse files
kkimurakkkimurak
committed
Add built-in KAS
- build KAS on build, enable via GITLAB_AGENT_KAS_ENABLED (automatically enabled if GITLAB_KAS_ENABLED=true) - Add built-in KAS config file kas config: import upstream (v15.10.0 - d88f4b89) - minimal parameterization gitlab side: - GITLAB_KAS_ENABLED gitlab_rails['gitlab_kas_enabled'] for omnibus installation - GITLAB_KAS_INTERNAL gitlab_rails['gitlab_kas_internal_url'] for omnibus installation - GITLAB_KAS_EXTERNAL gitlab_rails['gitlab_kas_external_url'] for omnibus installation - GITLAB_KAS_PROXY gitlab_rails['gitlab_kas_external_k8s_proxy_url'] for omnibus installation kas side: - GITLAB_AGENT_KAS_ENABLED gitlab_kas['enabled'] for omnibus installation - GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE gitlab_kas['internal_api_listen_authentication_secret_file'] - GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE used by both: - GITLAB_KAS_SECRET used as a value for - gitlabhq/gitlab.yml : production.gitlab_kas.secret_file - gitlab-agent/gitlab-kas_config.yaml : gitlab.authentication_secret_file Prefix for parameters that only used by gitlab-agent/kas is "GITLAB_AGENT_KAS_" Also add process to generate secret files for KAS Update built-in KAS to 16.10.1, sync config Update built-in gitlab-kas to v17.0.2, sync configuration - Bump to v17.0.0, sync configuration GitOps module have been removed. See upstream change: https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/merge_requests/1436 - Bump: gitlab-kas 17.0.1 no change in configuration file - Bump: gitlab-kas 17.0.2 no change in configuration file Personal note: I am still unable to successfully connect the agent from the WebUI. The problem is that I don't know the correct way to do it in the first place, so I have to check it out. Stop gitlab_kas before restoring backup It seems that kas has DB connection and blocks restoration - Bump: gitlab-kas 18.1.0 reference configuration file have been renamed to kascfg_defaults.yaml and does not contain full configurations So I have to search a way to generate full configuration from .proto or docs
1 parent a58bd76 commit 0090687

6 files changed

Lines changed: 100 additions & 56 deletions

File tree

‎Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ ENV GITLAB_VERSION=${VERSION} \
1010
GITLAB_SHELL_VERSION=14.54.0 \
1111
GITLAB_PAGES_VERSION=19.1.1 \
1212
GITALY_SERVER_VERSION=19.1.1 \
13+
GITLAB_AGENT_VERSION=18.1.0 \
1314
GITLAB_USER="git" \
1415
GITLAB_HOME="/home/git" \
1516
GITLAB_LOG_DIR="/var/log/gitlab" \
@@ -24,6 +25,7 @@ ENV GITLAB_VERSION=${VERSION} \
2425
ENV GITLAB_INSTALL_DIR="${GITLAB_HOME}/gitlab" \
2526
GITLAB_SHELL_INSTALL_DIR="${GITLAB_HOME}/gitlab-shell" \
2627
GITLAB_GITALY_INSTALL_DIR="${GITLAB_HOME}/gitaly" \
28+
GITLAB_AGENT_INSTALL_DIR="${GITLAB_HOME}/gitlab-agent" \
2729
GITLAB_DATA_DIR="${GITLAB_HOME}/data" \
2830
GITLAB_BUILD_DIR="${GITLAB_CACHE_DIR}/build" \
2931
GITLAB_RUNTIME_DIR="${GITLAB_CACHE_DIR}/runtime"

‎README.md‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -936,18 +936,24 @@ Configuring gitlab::feature_flags...
936936

937937
#### Gitlab KAS
938938

939-
GitLab agent server for Kubernetes (KAS) is disabled by default, but you can enable it by setting configuration parameter [`GITLAB_KAS_ENABLED`](#GITLAB_KAS_ENABLED) to true.
940-
By default, built-in `gitlab-kas` is used. But you can use an external installation of KAS by setting internal URL for the GItLab backend. Corresponding configuration parameter is [`GITLAB_KAS_INTERNAL`](#GITLAB_KAS_INTERNAL).
941-
You can specify user-facing URL by setting [`GITLAB_KAS_EXTERNAL`](#GITLAB_KAS_EXTERNAL). If you set up proxy URL, use `GITLAB_KAS_PROXY`.
939+
GitLab agent server for Kubernetes (KAS) is disabled by default, but you can enable it by setting configuration parameter [`GITLAB_KAS_ENABLED`](#gitlab_kas_enabled) to true.
940+
By default, built-in `gitlab-kas` is also enabled once you enable KAS feature. But you can use an external installation of KAS by setting internal URL for the GitLab backend. Corresponding configuration parameter is [`GITLAB_KAS_INTERNAL`](#gitlab_kas_internal).
941+
You can specify user-facing URL by setting [`GITLAB_KAS_EXTERNAL`](#gitlab_kas_external). If you set up proxy URL, use `GITLAB_KAS_PROXY`.
942942

943-
You can specify custom secret file by setting [`GITLAB_KAS_SECRET`](#GITLAB_KAS_SECRET), [`GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE) and [`GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE). These secret files are automatically generated if they don't exist.
943+
You can specify custom secret file by setting [`GITLAB_KAS_SECRET`](#gitlab_kas_secret). This secret file will be generated if they don't exist.
944+
945+
#### Built-in GitLab-Agent KAS
946+
947+
To control whether launch built-in `gitlab-kas` on container startup or not, you can use configuration parameter [`GITLAB_AGENT_KAS_ENABLED`](#gitlab_agent_kas_enabled).
948+
949+
You can specify custom secret file by setting [`GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`](#gitlab_agent_kas_api_listen_authentication_secret_file) and [`GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`](#gitlab_agent_kas_private_api_listen_authentication_secret_file). These secret files also be generated if they don't exist.
944950

945951
Built-in KAS communicates to redis. The host and ports are set using `REDIS_HOST` and `REDIS_PORT`.
946-
You can specify the password file path in `GITLAB_KAS_REDIS_PASSWORD_FILE`, but please do not set the parameter. We still do not support password authentication for Redis. The password file should contain the redis authentication password, but this is not currently done because there is no way to specify the redis password. So please let this parameter empty. See https://github.com/sameersbn/docker-gitlab/pull/1026
952+
You can specify the password file path in `GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE`, but please do not set the parameter. We still do not support password authentication for Redis. The password file should contain the redis authentication password, but this is not currently done because there is no way to specify the redis password. So please let this parameter empty. See [sameersbn/gitlab#1026](https://github.com/sameersbn/docker-gitlab/pull/1026)
947953

948954
Also note that KAS requires that environment variable `OWN_PRIVATE_API_URL` is set (e.g. `OWN_PRIVATE_API_URL=grpc://127.0.0.1:8155`). If not, the KAS service will keep restarting.
949955

950-
See official documentation : https://docs.gitlab.com/ee/administration/clusters/kas.html
956+
See [official documentation](https://docs.gitlab.com/ee/administration/clusters/kas.html) for more detail.
951957

952958
#### Available Configuration Parameters
953959

@@ -1299,19 +1305,23 @@ Internal URL for the GitLab backend. Defaults to `"grpc://localhost:8153"`
12991305

13001306
The URL to the Kubernetes API proxy (used by GitLab users). No default.
13011307

1302-
##### `GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1308+
##### `GITLAB_AGENT_KAS_ENABLED`
1309+
1310+
Control startup behavior of built-in KAS. `autostart` value in supervisor configuration for KAS will be set to this value. Default to [`GITLAB_KAS_ENABLED`](#gitlab_kas_enabled)
1311+
1312+
##### `GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`
13031313

1304-
An authentication secret file to verify JWT token, for KAS API. If not exist, an secret file will be generated on startup. Defaults to `${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret`
1314+
An authentication secret file to verify JWT token, for built-in KAS API. If not exist, an secret file will be generated on startup. Defaults to `${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret`
13051315

1306-
##### `GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1316+
##### `GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`
13071317

1308-
An authentication secret file to verify JWT token, for KAS internal API. If not exists, an secret file will be generated on startup. This is not "required", so please leave blank if you don't need it. No default.
1318+
An authentication secret file to verify JWT token, for built-in KAS internal API. If not exists, an secret file will be generated on startup. This is not "required", so please leave blank if you don't need it. No default.
13091319

1310-
##### `GITLAB_KAS_REDIS_PASSWORD_FILE`
1320+
##### `GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE`
13111321

1312-
Path for the file that contains redis password. This is not "required", so please leave blank if you don't need it. No default.
1322+
Path for the file that contains redis password to be used by built-in KAS. This is not "required", so please leave blank if you don't need it. No default.
13131323

1314-
NOTE: We currently do not support password authentication between gitlab and redis. See https://github.com/sameersbn/docker-gitlab/pull/1026
1324+
NOTE: We currently do not support password authentication between gitlab and redis. See [sameersbn/gitlab#1026](https://github.com/sameersbn/docker-gitlab/pull/1026)
13151325

13161326
##### `GITLAB_LFS_ENABLED`
13171327

‎assets/build/install.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,12 @@ GITLAB_CLONE_URL=https://gitlab.com/gitlab-org/gitlab-foss.git
55
GITLAB_SHELL_URL=https://gitlab.com/gitlab-org/gitlab-shell/-/archive/v${GITLAB_SHELL_VERSION}/gitlab-shell-v${GITLAB_SHELL_VERSION}.tar.bz2
66
GITLAB_PAGES_URL=https://gitlab.com/gitlab-org/gitlab-pages.git
77
GITLAB_GITALY_URL=https://gitlab.com/gitlab-org/gitaly.git
8+
GITLAB_AGENT_URL=https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent.git
89

910
GITLAB_WORKHORSE_BUILD_DIR=${GITLAB_INSTALL_DIR}/workhorse
1011
GITLAB_PAGES_BUILD_DIR=/tmp/gitlab-pages
1112
GITLAB_GITALY_BUILD_DIR=/tmp/gitaly
13+
GITLAB_AGENT_BUILD_DIR=/tmp/gitlab-agent
1214

1315
RUBY_SRC_URL=https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RUBY_VERSION}.tar.gz
1416

@@ -171,6 +173,18 @@ make -C ${GITLAB_GITALY_BUILD_DIR} git GIT_PREFIX=/usr/local
171173
# clean up
172174
rm -rf ${GITLAB_GITALY_BUILD_DIR}
173175

176+
# download gitlab-agent (KAS)
177+
echo "Downloading gitlab-agent v.${GITLAB_AGENT_VERSION}..."
178+
git clone -q -b v${GITLAB_AGENT_VERSION} --depth 1 ${GITLAB_AGENT_URL} ${GITLAB_AGENT_BUILD_DIR}
179+
180+
# install gitlab-agent (KAS)
181+
mkdir -p "${GITLAB_AGENT_INSTALL_DIR}"
182+
make -C ${GITLAB_AGENT_BUILD_DIR} kas TARGET_DIRECTORY=/usr/local/bin
183+
chown -R ${GITLAB_USER}: ${GITLAB_AGENT_INSTALL_DIR}
184+
185+
# clean up
186+
rm -rf ${GITLAB_AGENT_BUILD_DIR}
187+
174188
# remove go
175189
go clean --modcache
176190
rm -rf ${GITLAB_BUILD_DIR}/go${GOLANG_VERSION}.linux-amd64.tar.gz ${GOROOT}
@@ -411,6 +425,20 @@ stdout_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
411425
stderr_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
412426
EOF
413427

428+
# configure superisord to start gitlab-agent (KAS)
429+
cat > /etc/supervisor/conf.d/gitlab-kas.conf <<EOF
430+
[program:gitlab_kas]
431+
priority=5
432+
directory=${GITLAB_AGENT_INSTALL_DIR}
433+
environment=HOME=${GITLAB_HOME}
434+
command=/usr/local/bin/kas --configuration-file="${GITLAB_AGENT_INSTALL_DIR}/gitlab-kas_config.yaml"
435+
user=git
436+
autostart={{GITLAB_AGENT_BUILTIN_KAS_ENABLED}}
437+
autorestart=true
438+
stdout_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
439+
stderr_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
440+
EOF
441+
414442
# configure supervisord to start mail_room
415443
cat > /etc/supervisor/conf.d/mail_room.conf <<EOF
416444
[program:mail_room]

‎assets/runtime/config/gitlab-agent/gitlab-kas_config.yaml‎

Lines changed: 23 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -8,34 +8,29 @@ gitlab:
88
authentication_secret_file: {{GITLAB_KAS_SECRET}} # required
99
# ca_certificate_file: /server-ca.pem
1010
api_rate_limit:
11-
refill_rate_per_second: 10.0
12-
bucket_size: 50
11+
bucket_size: 250
12+
refill_rate_per_second: 50
1313
agent:
1414
listen:
1515
network: tcp
1616
address: 127.0.0.1:8150
1717
websocket: false
1818
# certificate_file: /server-cert.pem
1919
# key_file: /server-key.pem
20-
connections_per_token_per_minute: 10000
21-
max_connection_age: "1800s"
20+
connections_per_token_per_minute: 40000
21+
max_connection_age: "7200s"
22+
listen_grace_period: "5s"
2223
configuration:
23-
poll_period: "20s"
24+
poll_period: "300s"
2425
max_configuration_file_size: 131072
25-
gitops:
26-
poll_period: "20s"
27-
project_info_cache_ttl: "300s"
28-
project_info_cache_error_ttl: "60s"
29-
max_manifest_file_size: 5242880
30-
max_total_manifest_file_size: 20971520
31-
max_number_of_paths: 100
32-
max_number_of_files: 1000
3326
kubernetes_api:
3427
listen:
3528
network: tcp
3629
address: 0.0.0.0:8154
3730
# certificate_file: /server-cert.pem
3831
# key_file: /server-key.pem
32+
listen_grace_period: "5s"
33+
shutdown_grace_period: "3600s"
3934
url_path_prefix: /
4035
allowed_agent_cache_ttl: "60s"
4136
allowed_agent_cache_error_ttl: "10s"
@@ -45,14 +40,16 @@ agent:
4540
redis_conn_info_refresh: "240s"
4641
redis_conn_info_gc: "600s"
4742
observability:
48-
usage_reporting_period: "60s"
43+
usage_reporting_period: "10s"
4944
listen:
5045
network: tcp
5146
address: 127.0.0.1:8151
5247
prometheus:
5348
url_path: /metrics
54-
tracing:
55-
connection_string: ""
49+
# tracing:
50+
# otlp_endpoint: "https://localhost:4317/traces/foo/bar"
51+
# otlp_token_secret_file: "/some/path"
52+
# otlp_ca_certificate_file: "/some/path/ca.crt"
5653
sentry:
5754
dsn: ""
5855
environment: ""
@@ -68,6 +65,7 @@ observability:
6865
url_path: /liveness
6966
readiness_probe:
7067
url_path: /readiness
68+
event_reporting_period: "10s"
7169
gitaly:
7270
global_api_rate_limit:
7371
refill_rate_per_second: 30.0
@@ -77,25 +75,25 @@ gitaly:
7775
bucket_size: 40
7876
private_api:
7977
listen:
78+
network: tcp
8079
address: 127.0.0.1:8155
81-
authentication_secret_file: {{GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}}
82-
max_connection_age: 1800s
80+
authentication_secret_file: {{GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}}
81+
max_connection_age: 7200s
82+
listen_grace_period: "5s"
8383
redis:
8484
server:
8585
address: "{{REDIS_HOST}}:{{REDIS_PORT}}" # required
86-
pool_size: 5
8786
dial_timeout: "5s"
88-
read_timeout: "1s"
89-
write_timeout: "1s"
90-
idle_timeout: "50s"
87+
write_timeout: "3s"
9188
key_prefix: gitlab-kas
92-
password_file: {{GITLAB_KAS_REDIS_PASSWORD_FILE}}
89+
password_file: {{GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE}}
9390
network: "tcp"
9491
api:
9592
listen:
9693
network: tcp
9794
address: 127.0.0.1:8153
98-
authentication_secret_file: {{GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}} # required
95+
authentication_secret_file: {{GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}} # required
9996
# certificate_file: /server-cert.pem
10097
# key_file: /server-key.pem
101-
max_connection_age: "1800s"
98+
max_connection_age: "7200s"
99+
listen_grace_period: "5s"

‎assets/runtime/env-defaults‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -701,6 +701,9 @@ GITLAB_KAS_SECRET=${GITLAB_KAS_SECRET:-${GITLAB_INSTALL_DIR}/.gitlab_kas_secret}
701701
GITLAB_KAS_EXTERNAL=${GITLAB_KAS_EXTERNAL:-"wss://kas.example.com"}
702702
GITLAB_KAS_INTERNAL=${GITLAB_KAS_INTERNAL:-"grpc://localhost:8153"}
703703
GITLAB_KAS_PROXY=${GITLAB_KAS_PROXY:-}
704-
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret}
705-
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE:-}
706-
GITLAB_KAS_REDIS_PASSWORD_FILE=${GITLAB_KAS_REDIS_PASSWORD_FILE:-}
704+
705+
## gitlab-agent KAS (built-in one)
706+
GITLAB_AGENT_KAS_ENABLED=${GITLAB_AGENT_KAS_ENABLED:-${GITLAB_KAS_ENABLED}}
707+
GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret}
708+
GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_private_api_secret}
709+
GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE=${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE:-}

‎assets/runtime/functions‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ GITLAB_REGISTRY_NGINX_CONFIG="/etc/nginx/conf.d/gitlab-registry.conf"
2929
GITLAB_PAGES_NGINX_CONFIG="/etc/nginx/conf.d/gitlab-pages.conf"
3030
GITLAB_PAGES_CONFIG="${GITLAB_INSTALL_DIR}/gitlab-pages-config"
3131
GITLAB_GITALY_CONFIG="${GITLAB_GITALY_INSTALL_DIR}/config.toml"
32+
GITLAB_KAS_CONFIG="${GITLAB_AGENT_INSTALL_DIR}/gitlab-kas_config.yaml"
3233

3334
# Compares two version strings `a` and `b`
3435
# Returns
@@ -398,23 +399,24 @@ gitlab_configure_gitlab_kas() {
398399
GITLAB_KAS_INTERNAL \
399400
GITLAB_KAS_PROXY
400401

402+
printf "Configuring gitlab-agent::KAS (enabled: %s)\n" "${GITLAB_AGENT_BUILTIN_KAS_ENABLED}"
401403
update_template ${GITLAB_KAS_CONFIG} \
402404
GITLAB_RELATIVE_URL_ROOT \
403405
GITLAB_KAS_SECRET \
404-
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE \
405-
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE \
406+
GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE \
407+
GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE \
406408
REDIS_HOST \
407409
REDIS_PORT \
408-
GITLAB_KAS_REDIS_PASSWORD_FILE
410+
GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE
409411

410-
if [[ ! -f ${GITLAB_KAS_REDIS_PASSWORD_FILE} ]]; then
411-
exec_as_git touch "${GITLAB_KAS_REDIS_PASSWORD_FILE}"
412-
exec_as_git chmod 600 ${GITLAB_KAS_REDIS_PASSWORD_FILE}
412+
if [[ -n ${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE} ]]; then
413+
exec_as_git touch "${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE}"
414+
exec_as_git chmod 600 "${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE}"
413415
# TODO: Once this image supports redis password authentication, write the password to a file here
414416
fi
415417

416-
# enable/disable startup of gitlab-kas : set autostart / autorestart entry in supervisor config using GITLAB_KAS_ENABLED
417-
update_template /etc/supervisor/conf.d/gitlab-kas.conf GITLAB_KAS_ENABLED
418+
# enable/disable startup of gitlab-kas : set autostart entry in supervisor config using GITLAB_AGENT_BUILTIN_KAS_ENABLED
419+
update_template /etc/supervisor/conf.d/gitlab-kas.conf GITLAB_AGENT_BUILTIN_KAS_ENABLED
418420
}
419421

420422
gitlab_configure_gitlab_workhorse() {
@@ -1009,16 +1011,16 @@ gitlab_configure_secrets() {
10091011
chmod 600 ${GITALB_KAS_SECRET}
10101012
fi
10111013

1012-
if [[ ! -f "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
1013-
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
1014-
chmod 600 ${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}
1014+
if [[ ! -f "${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
1015+
exec_as_git openssl rand -base64 -out "${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
1016+
chmod 600 ${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}
10151017
fi
10161018

10171019
# KAS secret for private_api is not required so this can be empty string,
10181020
# but empty string is not match to "is file" condition so we don't care the case
1019-
if [[ ! -f "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
1020-
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
1021-
chmod 600 ${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}
1021+
if [[ ! -f "${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
1022+
exec_as_git openssl rand -base64 -out "${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
1023+
chmod 600 ${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}
10221024
fi
10231025
}
10241026

@@ -2082,7 +2084,7 @@ install_configuration_templates() {
20822084

20832085
install_template ${GITLAB_USER}: gitaly/config.toml ${GITLAB_GITALY_CONFIG}
20842086

2085-
if [[ ${GITLAB_KAS_ENABLED} == true ]]; then
2087+
if [[ ${GITLAB_AGENT_BUILTIN_KAS_ENABLED} == true ]]; then
20862088
install_template ${GITLAB_USER}: gitlab-agent/gitlab-kas_config.yaml ${GITLAB_KAS_CONFIG} 0640
20872089
fi
20882090
}
@@ -2390,6 +2392,7 @@ execute_raketask() {
23902392
/usr/bin/supervisord -c /etc/supervisor/supervisord.conf
23912393
supervisorctl stop gitlab_extensions:*
23922394
supervisorctl stop gitlab:*
2395+
supervisorctl stop gitlab_kas
23932396
interactive=true
23942397
for arg in $@
23952398
do

0 commit comments

Comments
 (0)