Skip to content

Commit 8dde024

Browse files
kkimurakkkimurak
committed
Add KAS config file, minimal parameterization
also add process to generate secret files for KAS - GITLAB_KAS_SECRET - GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE - GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE
1 parent bde588e commit 8dde024

4 files changed

Lines changed: 164 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -940,6 +940,13 @@ GitLab agent server for Kubernetes (KAS) is disabled by default, but you can ena
940940
By default, built-in `gitlab-kas` is used. But you can use an external installation of KAS by setting internal URL for the GItLab backend. Corresponding configuration parameter is [`GITLAB_KAS_INTERNAL`](#GITLAB_KAS_INTERNAL).
941941
You can specify user-facing URL by setting [`GITLAB_KAS_EXTERNAL`](#GITLAB_KAS_EXTERNAL). If you set up proxy URL, use `GITLAB_KAS_PROXY`.
942942

943+
You can specify custom secret file by setting [`GITLAB_KAS_SECRET`](#GITLAB_KAS_SECRET), [`GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE) and [`GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE). These secret files are automatically generated if they don't exist.
944+
945+
Built-in KAS communicates to redis. The host and ports are set using `REDIS_HOST` and `REDIS_PORT`.
946+
You can specify the password file path in `GITLAB_KAS_REDIS_PASSWORD_FILE`, but please do not set the parameter. We still do not support password authentication for Redis. The password file should contain the redis authentication password, but this is not currently done because there is no way to specify the redis password. So please let this parameter empty. See https://github.com/sameersbn/docker-gitlab/pull/1026
947+
948+
Also note that KAS requires that environment variable `OWN_PRIVATE_API_URL` is set (e.g. `OWN_PRIVATE_API_URL=grpc://127.0.0.1:8155`). If not, the KAS service will keep restarting.
949+
943950
See official documentation : https://docs.gitlab.com/ee/administration/clusters/kas.html
944951

945952
#### Available Configuration Parameters
@@ -1292,6 +1299,20 @@ Internal URL for the GitLab backend. Defaults to `"grpc://localhost:8153"`
12921299

12931300
The URL to the Kubernetes API proxy (used by GitLab users). No default.
12941301

1302+
##### `GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1303+
1304+
An authentication secret file to verify JWT token, for KAS API. If not exist, an secret file will be generated on startup. Defaults to `${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret`
1305+
1306+
##### `GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1307+
1308+
An authentication secret file to verify JWT token, for KAS internal API. If not exists, an secret file will be generated on startup. This is not "required", so please leave blank if you don't need it. No default.
1309+
1310+
##### `GITLAB_KAS_REDIS_PASSWORD_FILE`
1311+
1312+
Path for the file that contains redis password. This is not "required", so please leave blank if you don't need it. No default.
1313+
1314+
NOTE: We currently do not support password authentication between gitlab and redis. See https://github.com/sameersbn/docker-gitlab/pull/1026
1315+
12951316
##### `GITLAB_LFS_ENABLED`
12961317

12971318
Enable/Disable Git LFS support. Defaults to `true`.

‎assets/runtime/config/gitlab-agent/gitlab-kas_config.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# Import from gitlab-org/cluster-integration/gitlab-agent/pkg/kascfg/config_example.yaml
2+
#
3+
# This is a sample configuration file for kas. The source of truth is pkg/kascfg/kascfg.proto. It contains documentation
4+
# for all the fields. Configuration values in this file are the defaults (if set) that are used by kas.
5+
6+
gitlab:
7+
address: http://localhost:8080{{GITLAB_RELATIVE_URL_ROOT}} # required
8+
authentication_secret_file: {{GITLAB_KAS_SECRET}} # required
9+
# ca_certificate_file: /server-ca.pem
10+
api_rate_limit:
11+
refill_rate_per_second: 10.0
12+
bucket_size: 50
13+
agent:
14+
listen:
15+
network: tcp
16+
address: 127.0.0.1:8150
17+
websocket: false
18+
# certificate_file: /server-cert.pem
19+
# key_file: /server-key.pem
20+
connections_per_token_per_minute: 10000
21+
max_connection_age: "1800s"
22+
configuration:
23+
poll_period: "20s"
24+
max_configuration_file_size: 131072
25+
gitops:
26+
poll_period: "20s"
27+
project_info_cache_ttl: "300s"
28+
project_info_cache_error_ttl: "60s"
29+
max_manifest_file_size: 5242880
30+
max_total_manifest_file_size: 20971520
31+
max_number_of_paths: 100
32+
max_number_of_files: 1000
33+
kubernetes_api:
34+
listen:
35+
network: tcp
36+
address: 0.0.0.0:8154
37+
# certificate_file: /server-cert.pem
38+
# key_file: /server-key.pem
39+
url_path_prefix: /
40+
allowed_agent_cache_ttl: "60s"
41+
allowed_agent_cache_error_ttl: "10s"
42+
info_cache_ttl: "300s"
43+
info_cache_error_ttl: "60s"
44+
redis_conn_info_ttl: "300s"
45+
redis_conn_info_refresh: "240s"
46+
redis_conn_info_gc: "600s"
47+
observability:
48+
usage_reporting_period: "60s"
49+
listen:
50+
network: tcp
51+
address: 127.0.0.1:8151
52+
prometheus:
53+
url_path: /metrics
54+
tracing:
55+
connection_string: ""
56+
sentry:
57+
dsn: ""
58+
environment: ""
59+
logging:
60+
level: info
61+
grpc_level: error
62+
google_profiler:
63+
enabled: false
64+
# project_id: ""
65+
# credentials_file: /some/file
66+
# debug_logging: false
67+
liveness_probe:
68+
url_path: /liveness
69+
readiness_probe:
70+
url_path: /readiness
71+
gitaly:
72+
global_api_rate_limit:
73+
refill_rate_per_second: 30.0
74+
bucket_size: 70
75+
per_server_api_rate_limit:
76+
refill_rate_per_second: 15.0
77+
bucket_size: 40
78+
private_api:
79+
listen:
80+
address: 127.0.0.1:8155
81+
authentication_secret_file: {{GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}}
82+
max_connection_age: 1800s
83+
redis:
84+
server:
85+
address: "{{REDIS_HOST}}:{{REDIS_PORT}}" # required
86+
pool_size: 5
87+
dial_timeout: "5s"
88+
read_timeout: "1s"
89+
write_timeout: "1s"
90+
idle_timeout: "50s"
91+
key_prefix: gitlab-kas
92+
password_file: {{GITLAB_KAS_REDIS_PASSWORD_FILE}}
93+
network: "tcp"
94+
api:
95+
listen:
96+
network: tcp
97+
address: 127.0.0.1:8153
98+
authentication_secret_file: {{GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}} # required
99+
# certificate_file: /server-cert.pem
100+
# key_file: /server-key.pem
101+
max_connection_age: "1800s"

‎assets/runtime/env-defaults‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -701,3 +701,6 @@ GITLAB_KAS_SECRET=${GITLAB_KAS_SECRET:-${GITLAB_INSTALL_DIR}/.gitlab_kas_secret}
701701
GITLAB_KAS_EXTERNAL=${GITLAB_KAS_EXTERNAL:-"wss://kas.example.com"}
702702
GITLAB_KAS_INTERNAL=${GITLAB_KAS_INTERNAL:-"grpc://localhost:8153"}
703703
GITLAB_KAS_PROXY=${GITLAB_KAS_PROXY:-}
704+
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret}
705+
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE:-}
706+
GITLAB_KAS_REDIS_PASSWORD_FILE=${GITLAB_KAS_REDIS_PASSWORD_FILE:-}

‎assets/runtime/functions‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,24 @@ gitlab_configure_gitlab_kas() {
397397
GITLAB_KAS_EXTERNAL \
398398
GITLAB_KAS_INTERNAL \
399399
GITLAB_KAS_PROXY
400+
401+
update_template ${GITLAB_KAS_CONFIG} \
402+
GITLAB_RELATIVE_URL_ROOT \
403+
GITLAB_KAS_SECRET \
404+
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE \
405+
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE \
406+
REDIS_HOST \
407+
REDIS_PORT \
408+
GITLAB_KAS_REDIS_PASSWORD_FILE
409+
410+
if [[ ! -f ${GITLAB_KAS_REDIS_PASSWORD_FILE} ]]; then
411+
exec_as_git touch "${GITLAB_KAS_REDIS_PASSWORD_FILE}"
412+
exec_as_git chmod 600 ${GITLAB_KAS_REDIS_PASSWORD_FILE}
413+
# TODO: Once this image supports redis password authentication, write the password to a file here
414+
fi
415+
416+
# enable/disable startup of gitlab-kas : set autostart / autorestart entry in supervisor config using GITLAB_KAS_ENABLED
417+
update_template /etc/supervisor/conf.d/gitlab-kas.conf GITLAB_KAS_ENABLED
400418
}
401419

402420
gitlab_configure_gitlab_workhorse() {
@@ -985,6 +1003,23 @@ gitlab_configure_secrets() {
9851003
exec_as_git openssl rand -base64 -out "${pages_secret}" 32
9861004
chmod 600 "${pages_secret}"
9871005
fi
1006+
1007+
if [[ ! -f "${GITLAB_KAS_SECRET}" ]]; then
1008+
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_SECRET}" 32
1009+
chmod 600 ${GITALB_KAS_SECRET}
1010+
fi
1011+
1012+
if [[ ! -f "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
1013+
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
1014+
chmod 600 ${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}
1015+
fi
1016+
1017+
# KAS secret for private_api is not required so this can be empty string,
1018+
# but empty string is not match to "is file" condition so we don't care the case
1019+
if [[ ! -f "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
1020+
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
1021+
chmod 600 ${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}
1022+
fi
9881023
}
9891024

9901025
gitlab_configure_sidekiq() {
@@ -2046,6 +2081,10 @@ install_configuration_templates() {
20462081
fi
20472082

20482083
install_template ${GITLAB_USER}: gitaly/config.toml ${GITLAB_GITALY_CONFIG}
2084+
2085+
if [[ ${GITLAB_KAS_ENABLED} == true ]]; then
2086+
install_template ${GITLAB_USER}: gitlab-agent/gitlab-kas_config.yaml ${GITLAB_KAS_CONFIG} 0640
2087+
fi
20492088
}
20502089

20512090
configure_gitlab() {

0 commit comments

Comments
 (0)