Skip to content

Commit de9206e

Browse files
kkimurakkkimurak
committed
Add built-in KAS
- build KAS on build, enable via GITLAB_AGENT_KAS_ENABLED (automatically enabled if GITLAB_KAS_ENABLED=true) - Add built-in KAS config file kas config: import upstream (v15.10.0 - d88f4b89) - minimal parameterization gitlab side: - GITLAB_KAS_ENABLED gitlab_rails['gitlab_kas_enabled'] for omnibus installation - GITLAB_KAS_INTERNAL gitlab_rails['gitlab_kas_internal_url'] for omnibus installation - GITLAB_KAS_EXTERNAL gitlab_rails['gitlab_kas_external_url'] for omnibus installation - GITLAB_KAS_PROXY gitlab_rails['gitlab_kas_external_k8s_proxy_url'] for omnibus installation kas side: - GITLAB_AGENT_KAS_ENABLED gitlab_kas['enabled'] for omnibus installation - GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE gitlab_kas['internal_api_listen_authentication_secret_file'] - GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE used by both: - GITLAB_KAS_SECRET used as a value for - gitlabhq/gitlab.yml : production.gitlab_kas.secret_file - gitlab-agent/gitlab-kas_config.yaml : gitlab.authentication_secret_file Prefix for parameters that only used by gitlab-agent/kas is "GITLAB_AGENT_KAS_" Also add process to generate secret files for KAS Update built-in KAS to 16.10.1, sync config Update built-in gitlab-kas to v17.0.2, sync configuration - Bump to v17.0.0, sync configuration GitOps module have been removed. See upstream change: https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent/-/merge_requests/1436 - Bump: gitlab-kas 17.0.1 no change in configuration file - Bump: gitlab-kas 17.0.2 no change in configuration file Personal note: I am still unable to successfully connect the agent from the WebUI. The problem is that I don't know the correct way to do it in the first place, so I have to check it out. Stop gitlab_kas before restoring backup It seems that kas has DB connection and blocks restoration - Bump: gitlab-kas 18.1.0 reference configuration file have been renamed to kascfg_defaults.yaml and does not contain full configurations So I have to search a way to generate full configuration from .proto or docs
1 parent 5d1827b commit de9206e

6 files changed

Lines changed: 100 additions & 56 deletions

File tree

‎Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ ENV GITLAB_VERSION=${VERSION} \
1010
GITLAB_SHELL_VERSION=14.45.5 \
1111
GITLAB_PAGES_VERSION=18.7.0 \
1212
GITALY_SERVER_VERSION=18.7.0 \
13+
GITLAB_AGENT_VERSION=18.1.0 \
1314
GITLAB_USER="git" \
1415
GITLAB_HOME="/home/git" \
1516
GITLAB_LOG_DIR="/var/log/gitlab" \
@@ -21,6 +22,7 @@ ENV GITLAB_VERSION=${VERSION} \
2122
ENV GITLAB_INSTALL_DIR="${GITLAB_HOME}/gitlab" \
2223
GITLAB_SHELL_INSTALL_DIR="${GITLAB_HOME}/gitlab-shell" \
2324
GITLAB_GITALY_INSTALL_DIR="${GITLAB_HOME}/gitaly" \
25+
GITLAB_AGENT_INSTALL_DIR="${GITLAB_HOME}/gitlab-agent" \
2426
GITLAB_DATA_DIR="${GITLAB_HOME}/data" \
2527
GITLAB_BUILD_DIR="${GITLAB_CACHE_DIR}/build" \
2628
GITLAB_RUNTIME_DIR="${GITLAB_CACHE_DIR}/runtime"

‎README.md‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -917,18 +917,24 @@ Configuring gitlab::feature_flags...
917917

918918
#### Gitlab KAS
919919

920-
GitLab agent server for Kubernetes (KAS) is disabled by default, but you can enable it by setting configuration parameter [`GITLAB_KAS_ENABLED`](#GITLAB_KAS_ENABLED) to true.
921-
By default, built-in `gitlab-kas` is used. But you can use an external installation of KAS by setting internal URL for the GItLab backend. Corresponding configuration parameter is [`GITLAB_KAS_INTERNAL`](#GITLAB_KAS_INTERNAL).
922-
You can specify user-facing URL by setting [`GITLAB_KAS_EXTERNAL`](#GITLAB_KAS_EXTERNAL). If you set up proxy URL, use `GITLAB_KAS_PROXY`.
920+
GitLab agent server for Kubernetes (KAS) is disabled by default, but you can enable it by setting configuration parameter [`GITLAB_KAS_ENABLED`](#gitlab_kas_enabled) to true.
921+
By default, built-in `gitlab-kas` is also enabled once you enable KAS feature. But you can use an external installation of KAS by setting internal URL for the GitLab backend. Corresponding configuration parameter is [`GITLAB_KAS_INTERNAL`](#gitlab_kas_internal).
922+
You can specify user-facing URL by setting [`GITLAB_KAS_EXTERNAL`](#gitlab_kas_external). If you set up proxy URL, use `GITLAB_KAS_PROXY`.
923923

924-
You can specify custom secret file by setting [`GITLAB_KAS_SECRET`](#GITLAB_KAS_SECRET), [`GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_API_AUTHENTICATION_SECRET_FILE) and [`GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE`](#GITLAB_KAS_PRIVATE_API_AUTHENTICATION_SECRET_FILE). These secret files are automatically generated if they don't exist.
924+
You can specify custom secret file by setting [`GITLAB_KAS_SECRET`](#gitlab_kas_secret). This secret file will be generated if they don't exist.
925+
926+
#### Built-in GitLab-Agent KAS
927+
928+
To control whether launch built-in `gitlab-kas` on container startup or not, you can use configuration parameter [`GITLAB_AGENT_KAS_ENABLED`](#gitlab_agent_kas_enabled).
929+
930+
You can specify custom secret file by setting [`GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`](#gitlab_agent_kas_api_listen_authentication_secret_file) and [`GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`](#gitlab_agent_kas_private_api_listen_authentication_secret_file). These secret files also be generated if they don't exist.
925931

926932
Built-in KAS communicates to redis. The host and ports are set using `REDIS_HOST` and `REDIS_PORT`.
927-
You can specify the password file path in `GITLAB_KAS_REDIS_PASSWORD_FILE`, but please do not set the parameter. We still do not support password authentication for Redis. The password file should contain the redis authentication password, but this is not currently done because there is no way to specify the redis password. So please let this parameter empty. See https://github.com/sameersbn/docker-gitlab/pull/1026
933+
You can specify the password file path in `GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE`, but please do not set the parameter. We still do not support password authentication for Redis. The password file should contain the redis authentication password, but this is not currently done because there is no way to specify the redis password. So please let this parameter empty. See [sameersbn/gitlab#1026](https://github.com/sameersbn/docker-gitlab/pull/1026)
928934

929935
Also note that KAS requires that environment variable `OWN_PRIVATE_API_URL` is set (e.g. `OWN_PRIVATE_API_URL=grpc://127.0.0.1:8155`). If not, the KAS service will keep restarting.
930936

931-
See official documentation : https://docs.gitlab.com/ee/administration/clusters/kas.html
937+
See [official documentation](https://docs.gitlab.com/ee/administration/clusters/kas.html) for more detail.
932938

933939
#### Available Configuration Parameters
934940

@@ -1272,19 +1278,23 @@ Internal URL for the GitLab backend. Defaults to `"grpc://localhost:8153"`
12721278

12731279
The URL to the Kubernetes API proxy (used by GitLab users). No default.
12741280

1275-
##### `GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1281+
##### `GITLAB_AGENT_KAS_ENABLED`
1282+
1283+
Control startup behavior of built-in KAS. `autostart` value in supervisor configuration for KAS will be set to this value. Default to [`GITLAB_KAS_ENABLED`](#gitlab_kas_enabled)
1284+
1285+
##### `GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE`
12761286

1277-
An authentication secret file to verify JWT token, for KAS API. If not exist, an secret file will be generated on startup. Defaults to `${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret`
1287+
An authentication secret file to verify JWT token, for built-in KAS API. If not exist, an secret file will be generated on startup. Defaults to `${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret`
12781288

1279-
##### `GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`
1289+
##### `GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE`
12801290

1281-
An authentication secret file to verify JWT token, for KAS internal API. If not exists, an secret file will be generated on startup. This is not "required", so please leave blank if you don't need it. No default.
1291+
An authentication secret file to verify JWT token, for built-in KAS internal API. If not exists, an secret file will be generated on startup. This is not "required", so please leave blank if you don't need it. No default.
12821292

1283-
##### `GITLAB_KAS_REDIS_PASSWORD_FILE`
1293+
##### `GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE`
12841294

1285-
Path for the file that contains redis password. This is not "required", so please leave blank if you don't need it. No default.
1295+
Path for the file that contains redis password to be used by built-in KAS. This is not "required", so please leave blank if you don't need it. No default.
12861296

1287-
NOTE: We currently do not support password authentication between gitlab and redis. See https://github.com/sameersbn/docker-gitlab/pull/1026
1297+
NOTE: We currently do not support password authentication between gitlab and redis. See [sameersbn/gitlab#1026](https://github.com/sameersbn/docker-gitlab/pull/1026)
12881298

12891299
##### `GITLAB_LFS_ENABLED`
12901300

‎assets/build/install.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,12 @@ GITLAB_CLONE_URL=https://gitlab.com/gitlab-org/gitlab-foss.git
55
GITLAB_SHELL_URL=https://gitlab.com/gitlab-org/gitlab-shell/-/archive/v${GITLAB_SHELL_VERSION}/gitlab-shell-v${GITLAB_SHELL_VERSION}.tar.bz2
66
GITLAB_PAGES_URL=https://gitlab.com/gitlab-org/gitlab-pages.git
77
GITLAB_GITALY_URL=https://gitlab.com/gitlab-org/gitaly.git
8+
GITLAB_AGENT_URL=https://gitlab.com/gitlab-org/cluster-integration/gitlab-agent.git
89

910
GITLAB_WORKHORSE_BUILD_DIR=${GITLAB_INSTALL_DIR}/workhorse
1011
GITLAB_PAGES_BUILD_DIR=/tmp/gitlab-pages
1112
GITLAB_GITALY_BUILD_DIR=/tmp/gitaly
13+
GITLAB_AGENT_BUILD_DIR=/tmp/gitlab-agent
1214

1315
RUBY_SRC_URL=https://cache.ruby-lang.org/pub/ruby/${RUBY_VERSION%.*}/ruby-${RUBY_VERSION}.tar.gz
1416

@@ -171,6 +173,18 @@ make -C ${GITLAB_GITALY_BUILD_DIR} git GIT_PREFIX=/usr/local
171173
# clean up
172174
rm -rf ${GITLAB_GITALY_BUILD_DIR}
173175

176+
# download gitlab-agent (KAS)
177+
echo "Downloading gitlab-agent v.${GITLAB_AGENT_VERSION}..."
178+
git clone -q -b v${GITLAB_AGENT_VERSION} --depth 1 ${GITLAB_AGENT_URL} ${GITLAB_AGENT_BUILD_DIR}
179+
180+
# install gitlab-agent (KAS)
181+
mkdir -p "${GITLAB_AGENT_INSTALL_DIR}"
182+
make -C ${GITLAB_AGENT_BUILD_DIR} kas TARGET_DIRECTORY=/usr/local/bin
183+
chown -R ${GITLAB_USER}: ${GITLAB_AGENT_INSTALL_DIR}
184+
185+
# clean up
186+
rm -rf ${GITLAB_AGENT_BUILD_DIR}
187+
174188
# remove go
175189
go clean --modcache
176190
rm -rf ${GITLAB_BUILD_DIR}/go${GOLANG_VERSION}.linux-amd64.tar.gz ${GOROOT}
@@ -411,6 +425,20 @@ stdout_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
411425
stderr_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
412426
EOF
413427

428+
# configure superisord to start gitlab-agent (KAS)
429+
cat > /etc/supervisor/conf.d/gitlab-kas.conf <<EOF
430+
[program:gitlab_kas]
431+
priority=5
432+
directory=${GITLAB_AGENT_INSTALL_DIR}
433+
environment=HOME=${GITLAB_HOME}
434+
command=/usr/local/bin/kas --configuration-file="${GITLAB_AGENT_INSTALL_DIR}/gitlab-kas_config.yaml"
435+
user=git
436+
autostart={{GITLAB_AGENT_BUILTIN_KAS_ENABLED}}
437+
autorestart=true
438+
stdout_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
439+
stderr_logfile=${GITLAB_LOG_DIR}/supervisor/%(program_name)s.log
440+
EOF
441+
414442
# configure supervisord to start mail_room
415443
cat > /etc/supervisor/conf.d/mail_room.conf <<EOF
416444
[program:mail_room]

‎assets/runtime/config/gitlab-agent/gitlab-kas_config.yaml‎

Lines changed: 23 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -8,34 +8,29 @@ gitlab:
88
authentication_secret_file: {{GITLAB_KAS_SECRET}} # required
99
# ca_certificate_file: /server-ca.pem
1010
api_rate_limit:
11-
refill_rate_per_second: 10.0
12-
bucket_size: 50
11+
bucket_size: 250
12+
refill_rate_per_second: 50
1313
agent:
1414
listen:
1515
network: tcp
1616
address: 127.0.0.1:8150
1717
websocket: false
1818
# certificate_file: /server-cert.pem
1919
# key_file: /server-key.pem
20-
connections_per_token_per_minute: 10000
21-
max_connection_age: "1800s"
20+
connections_per_token_per_minute: 40000
21+
max_connection_age: "7200s"
22+
listen_grace_period: "5s"
2223
configuration:
23-
poll_period: "20s"
24+
poll_period: "300s"
2425
max_configuration_file_size: 131072
25-
gitops:
26-
poll_period: "20s"
27-
project_info_cache_ttl: "300s"
28-
project_info_cache_error_ttl: "60s"
29-
max_manifest_file_size: 5242880
30-
max_total_manifest_file_size: 20971520
31-
max_number_of_paths: 100
32-
max_number_of_files: 1000
3326
kubernetes_api:
3427
listen:
3528
network: tcp
3629
address: 0.0.0.0:8154
3730
# certificate_file: /server-cert.pem
3831
# key_file: /server-key.pem
32+
listen_grace_period: "5s"
33+
shutdown_grace_period: "3600s"
3934
url_path_prefix: /
4035
allowed_agent_cache_ttl: "60s"
4136
allowed_agent_cache_error_ttl: "10s"
@@ -45,14 +40,16 @@ agent:
4540
redis_conn_info_refresh: "240s"
4641
redis_conn_info_gc: "600s"
4742
observability:
48-
usage_reporting_period: "60s"
43+
usage_reporting_period: "10s"
4944
listen:
5045
network: tcp
5146
address: 127.0.0.1:8151
5247
prometheus:
5348
url_path: /metrics
54-
tracing:
55-
connection_string: ""
49+
# tracing:
50+
# otlp_endpoint: "https://localhost:4317/traces/foo/bar"
51+
# otlp_token_secret_file: "/some/path"
52+
# otlp_ca_certificate_file: "/some/path/ca.crt"
5653
sentry:
5754
dsn: ""
5855
environment: ""
@@ -68,6 +65,7 @@ observability:
6865
url_path: /liveness
6966
readiness_probe:
7067
url_path: /readiness
68+
event_reporting_period: "10s"
7169
gitaly:
7270
global_api_rate_limit:
7371
refill_rate_per_second: 30.0
@@ -77,25 +75,25 @@ gitaly:
7775
bucket_size: 40
7876
private_api:
7977
listen:
78+
network: tcp
8079
address: 127.0.0.1:8155
81-
authentication_secret_file: {{GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}}
82-
max_connection_age: 1800s
80+
authentication_secret_file: {{GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}}
81+
max_connection_age: 7200s
82+
listen_grace_period: "5s"
8383
redis:
8484
server:
8585
address: "{{REDIS_HOST}}:{{REDIS_PORT}}" # required
86-
pool_size: 5
8786
dial_timeout: "5s"
88-
read_timeout: "1s"
89-
write_timeout: "1s"
90-
idle_timeout: "50s"
87+
write_timeout: "3s"
9188
key_prefix: gitlab-kas
92-
password_file: {{GITLAB_KAS_REDIS_PASSWORD_FILE}}
89+
password_file: {{GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE}}
9390
network: "tcp"
9491
api:
9592
listen:
9693
network: tcp
9794
address: 127.0.0.1:8153
98-
authentication_secret_file: {{GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}} # required
95+
authentication_secret_file: {{GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}} # required
9996
# certificate_file: /server-cert.pem
10097
# key_file: /server-key.pem
101-
max_connection_age: "1800s"
98+
max_connection_age: "7200s"
99+
listen_grace_period: "5s"

‎assets/runtime/env-defaults‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -689,6 +689,9 @@ GITLAB_KAS_SECRET=${GITLAB_KAS_SECRET:-${GITLAB_INSTALL_DIR}/.gitlab_kas_secret}
689689
GITLAB_KAS_EXTERNAL=${GITLAB_KAS_EXTERNAL:-"wss://kas.example.com"}
690690
GITLAB_KAS_INTERNAL=${GITLAB_KAS_INTERNAL:-"grpc://localhost:8153"}
691691
GITLAB_KAS_PROXY=${GITLAB_KAS_PROXY:-}
692-
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret}
693-
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE:-}
694-
GITLAB_KAS_REDIS_PASSWORD_FILE=${GITLAB_KAS_REDIS_PASSWORD_FILE:-}
692+
693+
## gitlab-agent KAS (built-in one)
694+
GITLAB_AGENT_KAS_ENABLED=${GITLAB_AGENT_KAS_ENABLED:-${GITLAB_KAS_ENABLED}}
695+
GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_api_secret}
696+
GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE=${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE:-${GITLAB_INSTALL_DIR}/.gitlab_kas_private_api_secret}
697+
GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE=${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE:-}

‎assets/runtime/functions‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ GITLAB_REGISTRY_NGINX_CONFIG="/etc/nginx/conf.d/gitlab-registry.conf"
2929
GITLAB_PAGES_NGINX_CONFIG="/etc/nginx/conf.d/gitlab-pages.conf"
3030
GITLAB_PAGES_CONFIG="${GITLAB_INSTALL_DIR}/gitlab-pages-config"
3131
GITLAB_GITALY_CONFIG="${GITLAB_GITALY_INSTALL_DIR}/config.toml"
32+
GITLAB_KAS_CONFIG="${GITLAB_AGENT_INSTALL_DIR}/gitlab-kas_config.yaml"
3233

3334
# Compares two version strings `a` and `b`
3435
# Returns
@@ -373,23 +374,24 @@ gitlab_configure_gitlab_kas() {
373374
GITLAB_KAS_INTERNAL \
374375
GITLAB_KAS_PROXY
375376

377+
printf "Configuring gitlab-agent::KAS (enabled: %s)\n" "${GITLAB_AGENT_BUILTIN_KAS_ENABLED}"
376378
update_template ${GITLAB_KAS_CONFIG} \
377379
GITLAB_RELATIVE_URL_ROOT \
378380
GITLAB_KAS_SECRET \
379-
GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE \
380-
GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE \
381+
GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE \
382+
GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE \
381383
REDIS_HOST \
382384
REDIS_PORT \
383-
GITLAB_KAS_REDIS_PASSWORD_FILE
385+
GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE
384386

385-
if [[ ! -f ${GITLAB_KAS_REDIS_PASSWORD_FILE} ]]; then
386-
exec_as_git touch "${GITLAB_KAS_REDIS_PASSWORD_FILE}"
387-
exec_as_git chmod 600 ${GITLAB_KAS_REDIS_PASSWORD_FILE}
387+
if [[ -n ${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE} ]]; then
388+
exec_as_git touch "${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE}"
389+
exec_as_git chmod 600 "${GITLAB_AGENT_KAS_REDIS_PASSWORD_FILE}"
388390
# TODO: Once this image supports redis password authentication, write the password to a file here
389391
fi
390392

391-
# enable/disable startup of gitlab-kas : set autostart / autorestart entry in supervisor config using GITLAB_KAS_ENABLED
392-
update_template /etc/supervisor/conf.d/gitlab-kas.conf GITLAB_KAS_ENABLED
393+
# enable/disable startup of gitlab-kas : set autostart entry in supervisor config using GITLAB_AGENT_BUILTIN_KAS_ENABLED
394+
update_template /etc/supervisor/conf.d/gitlab-kas.conf GITLAB_AGENT_BUILTIN_KAS_ENABLED
393395
}
394396

395397
gitlab_configure_gitlab_workhorse() {
@@ -966,16 +968,16 @@ gitlab_configure_secrets() {
966968
chmod 600 ${GITALB_KAS_SECRET}
967969
fi
968970

969-
if [[ ! -f "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
970-
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
971-
chmod 600 ${GITLAB_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}
971+
if [[ ! -f "${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
972+
exec_as_git openssl rand -base64 -out "${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
973+
chmod 600 ${GITLAB_AGENT_KAS_API_LISTEN_AUTHENTICATION_SECRET_FILE}
972974
fi
973975

974976
# KAS secret for private_api is not required so this can be empty string,
975977
# but empty string is not match to "is file" condition so we don't care the case
976-
if [[ ! -f "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
977-
exec_as_git openssl rand -base64 -out "${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
978-
chmod 600 ${GITLAB_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}
978+
if [[ ! -f "${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" ]]; then
979+
exec_as_git openssl rand -base64 -out "${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}" 32
980+
chmod 600 ${GITLAB_AGENT_KAS_PRIVATE_API_LISTEN_AUTHENTICATION_SECRET_FILE}
979981
fi
980982
}
981983

@@ -2027,7 +2029,7 @@ install_configuration_templates() {
20272029

20282030
install_template ${GITLAB_USER}: gitaly/config.toml ${GITLAB_GITALY_CONFIG}
20292031

2030-
if [[ ${GITLAB_KAS_ENABLED} == true ]]; then
2032+
if [[ ${GITLAB_AGENT_BUILTIN_KAS_ENABLED} == true ]]; then
20312033
install_template ${GITLAB_USER}: gitlab-agent/gitlab-kas_config.yaml ${GITLAB_KAS_CONFIG} 0640
20322034
fi
20332035
}
@@ -2334,6 +2336,7 @@ execute_raketask() {
23342336
/usr/bin/supervisord -c /etc/supervisor/supervisord.conf
23352337
supervisorctl stop gitlab_extensions:*
23362338
supervisorctl stop gitlab:*
2339+
supervisorctl stop gitlab_kas
23372340
interactive=true
23382341
for arg in $@
23392342
do

0 commit comments

Comments
 (0)