Skip to content

Commit 5af9e6f

Browse files
kkimurakkkimurak
committed
Add KAS config file, minimal parameterization
also add process to generate secret files for KAS - GITLAB_KAS_SECRET - GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE - GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE
1 parent aad6f09 commit 5af9e6f

4 files changed

Lines changed: 164 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -921,6 +921,13 @@ GitLab agent server for Kubernetes (KAS) is disabled by default, but you can ena
921921
By default, built-in `gitlab-kas` is used. But you can use an external installation of KAS by setting internal URL for the GItLab backend. Corresponding configuration parameter is [`GITLAB_KAS_INTERNAL`](#GITLAB_KAS_INTERNAL).
922922
You can specify user-facing URL by setting [`GITLAB_KAS_EXTERNAL`](#GITLAB_KAS_EXTERNAL). If you set up proxy URL, use `GITLAB_KAS_PROXY`.
923923

924+
You can specify custom secret file by setting [`GITLAB_KAS_SECRET`](#GITLAB_KAS_SECRET), [`GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE) and [`GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE). These secret files are automatically generated if they don't exist.
925+
926+
Built-in KAS communicates to redis. The host and ports are set using `REDIS_HOST` and `REDIS_PORT`.
927+
You can specify the password file path in `GITLAB_KAS_REDIS_PASSWORD_FILE`, but please do not set the parameter. We still do not support password authentication for Redis. The password file should contain the redis authentication password, but this is not currently done because there is no way to specify the redis password. So please let this parameter empty. See https://github.com/sameersbn/docker-gitlab/pull/1026
928+
929+
Also note that KAS requires that environment variable `OWN_PRIVATE_API_URL` is set (e.g. `OWN_PRIVATE_API_URL=grpc://127.0.0.1:8155`). If not, the KAS service will keep restarting.
930+
924931
See official documentation : https://docs.gitlab.com/ee/administration/clusters/kas.html
925932

926933
#### Available Configuration Parameters
@@ -1265,6 +1272,20 @@ Internal URL for the GitLab backend. Defaults to `"grpc://localhost:8153"`
12651272

12661273
The URL to the Kubernetes API proxy (used by GitLab users). No default.
12671274

1275+
##### `GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1276+
1277+
An authentication secret file to verify JWT token, for KAS API. If not exist, an secret file will be generated on startup. Defaults to `${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret`
1278+
1279+
##### `GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1280+
1281+
An authentication secret file to verify JWT token, for KAS internal API. If not exists, an secret file will be generated on startup. This is not "required", so please leave blank if you don't need it. No default.
1282+
1283+
##### `GITLAB_KAS_REDIS_PASSWORD_FILE`
1284+
1285+
Path for the file that contains redis password. This is not "required", so please leave blank if you don't need it. No default.
1286+
1287+
NOTE: We currently do not support password authentication between gitlab and redis. See https://github.com/sameersbn/docker-gitlab/pull/1026
1288+
12681289
##### `GITLAB_LFS_ENABLED`
12691290

12701291
Enable/Disable Git LFS support. Defaults to `true`.

‎assets/runtime/config/gitlab-agent/gitlab-kas_config.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Import from gitlab-org/cluster-integration/gitlab-agent/pkg/kascfg/config_example.yaml
2+
#
3+
# This is a sample configuration file for kas. The source of truth is pkg/kascfg/kascfg.proto. It contains documentation
4+
# for all the fields. Configuration values in this file are the defaults (if set) that are used by kas.
5+
6+
gitlab:
7+
address: http://localhost:8080{{GITLAB_RELATIVE_URL_ROOT}} # required
8+
authentication_secret_file: {{GITLAB_KAS_SECRET}} # required
9+
# ca_certificate_file: /server-ca.pem
10+
api_rate_limit:
11+
refill_rate_per_second: 10.0
12+
bucket_size: 50
13+
agent:
14+
listen:
15+
network: tcp
16+
address: 127.0.0.1:8150
17+
websocket: false
18+
# certificate_file: /server-cert.pem
19+
# key_file: /server-key.pem
20+
connections_per_token_per_minute: 10000
21+
max_connection_age: "1800s"
22+
configuration:
23+
poll_period: "20s"
24+
max_configuration_file_size: 131072
25+
gitops:
26+
poll_period: "20s"
27+
project_info_cache_ttl: "300s"
28+
project_info_cache_error_ttl: "60s"
29+
max_manifest_file_size: 5242880
30+
max_total_manifest_file_size: 20971520
31+
max_number_of_paths: 100
32+
max_number_of_files: 1000
33+
kubernetes_api:
34+
listen:
35+
network: tcp
36+
address: 0.0.0.0:8154
37+
# certificate_file: /server-cert.pem
38+
# key_file: /server-key.pem
39+
url_path_prefix: /
40+
allowed_agent_cache_ttl: "60s"
41+
allowed_agent_cache_error_ttl: "10s"
42+
info_cache_ttl: "300s"
43+
info_cache_error_ttl: "60s"
44+
redis_conn_info_ttl: "300s"
45+
redis_conn_info_refresh: "240s"
46+
redis_conn_info_gc: "600s"
47+
observability:
48+
usage_reporting_period: "60s"
49+
listen:
50+
network: tcp
51+
address: 127.0.0.1:8151
52+
prometheus:
53+
url_path: /metrics
54+
tracing:
55+
connection_string: ""
56+
sentry:
57+
dsn: ""
58+
environment: ""
59+
logging:
60+
level: info
61+
grpc_level: error
62+
google_profiler:
63+
enabled: false
64+
# project_id: ""
65+
# credentials_file: /some/file
66+
# debug_logging: false
67+
liveness_probe:
68+
url_path: /liveness
69+
readiness_probe:
70+
url_path: /readiness
71+
gitaly:
72+
global_api_rate_limit:
73+
refill_rate_per_second: 30.0
74+
bucket_size: 70
75+
per_server_api_rate_limit:
76+
refill_rate_per_second: 15.0
77+
bucket_size: 40
78+
private_api:
79+
listen:
80+
address: 127.0.0.1:8155
81+
authentication_secret_file: {{GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}}
82+
max_connection_age: 1800s
83+
redis:
84+
server:
85+
address: "{{REDIS_HOST}}:{{REDIS_PORT}}" # required
86+
pool_size: 5
87+
dial_timeout: "5s"
88+
read_timeout: "1s"
89+
write_timeout: "1s"
90+
idle_timeout: "50s"
91+
key_prefix: gitlab-kas
92+
password_file: {{GITLAB_KAS_REDIS_PASSWORD_FILE}}
93+
network: "tcp"
94+
api:
95+
listen:
96+
network: tcp
97+
address: 127.0.0.1:8153
98+
authentication_secret_file: {{GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}} # required
99+
# certificate_file: /server-cert.pem
100+
# key_file: /server-key.pem
101+
max_connection_age: "1800s"

‎assets/runtime/env-defaults‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -689,3 +689,6 @@ GITLAB_KAS_SECRET=${GITLAB_KAS_SECRET:-${GITLAB_INSTALL_DIR}/.gitlab_kas_secret}
689689
GITLAB_KAS_EXTERNAL=${GITLAB_KAS_EXTERNAL:-"wss://kas.example.com"}
690690
GITLAB_KAS_INTERNAL=${GITLAB_KAS_INTERNAL:-"grpc://localhost:8153"}
691691
GITLAB_KAS_PROXY=${GITLAB_KAS_PROXY:-}
692+
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret}
693+
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE:-}
694+
GITLAB_KAS_REDIS_PASSWORD_FILE=${GITLAB_KAS_REDIS_PASSWORD_FILE:-}

‎assets/runtime/functions‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,6 +372,24 @@ gitlab_configure_gitlab_kas() {
372372
GITLAB_KAS_EXTERNAL \
373373
GITLAB_KAS_INTERNAL \
374374
GITLAB_KAS_PROXY
375+
376+
update_template ${GITLAB_KAS_CONFIG} \
377+
GITLAB_RELATIVE_URL_ROOT \
378+
GITLAB_KAS_SECRET \
379+
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE \
380+
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE \
381+
REDIS_HOST \
382+
REDIS_PORT \
383+
GITLAB_KAS_REDIS_PASSWORD_FILE
384+
385+
if [[ ! -f ${GITLAB_KAS_REDIS_PASSWORD_FILE} ]]; then
386+
exec_as_git touch "${GITLAB_KAS_REDIS_PASSWORD_FILE}"
387+
exec_as_git chmod 600 ${GITLAB_KAS_REDIS_PASSWORD_FILE}
388+
# TODO: Once this image supports redis password authentication, write the password to a file here
389+
fi
390+
391+
# enable/disable startup of gitlab-kas : set autostart / autorestart entry in supervisor config using GITLAB_KAS_ENABLED
392+
update_template /etc/supervisor/conf.d/gitlab-kas.conf GITLAB_KAS_ENABLED
375393
}
376394

377395
gitlab_configure_gitlab_workhorse() {
@@ -942,6 +960,23 @@ gitlab_configure_secrets() {
942960
exec_as_git openssl rand -base64 -out "${pages_secret}" 32
943961
chmod 600 "${pages_secret}"
944962
fi
963+
964+
if [[ ! -f "${GITLAB_KAS_SECRET}" ]]; then
965+
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_SECRET}" 32
966+
chmod 600 ${GITALB_KAS_SECRET}
967+
fi
968+
969+
if [[ ! -f "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
970+
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
971+
chmod 600 ${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}
972+
fi
973+
974+
# KAS secret for private_api is not required so this can be empty string,
975+
# but empty string is not match to "is file" condition so we don't care the case
976+
if [[ ! -f "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
977+
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
978+
chmod 600 ${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}
979+
fi
945980
}
946981

947982
gitlab_configure_sidekiq() {
@@ -1991,6 +2026,10 @@ install_configuration_templates() {
19912026
fi
19922027

19932028
install_template ${GITLAB_USER}: gitaly/config.toml ${GITLAB_GITALY_CONFIG}
2029+
2030+
if [[ ${GITLAB_KAS_ENABLED} == true ]]; then
2031+
install_template ${GITLAB_USER}: gitlab-agent/gitlab-kas_config.yaml ${GITLAB_KAS_CONFIG} 0640
2032+
fi
19942033
}
19952034

19962035
configure_gitlab() {

0 commit comments

Comments
 (0)