Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/app/models/clusters
diff options
context:
space:
mode:
Diffstat (limited to 'app/models/clusters')
-rw-r--r--app/models/clusters/applications/fluentd.rb121
-rw-r--r--app/models/clusters/applications/ingress.rb101
-rw-r--r--app/models/clusters/applications/knative.rb4
-rw-r--r--app/models/clusters/applications/runner.rb2
-rw-r--r--app/models/clusters/cluster.rb33
-rw-r--r--app/models/clusters/clusters_hierarchy.rb9
6 files changed, 19 insertions, 251 deletions
diff --git a/app/models/clusters/applications/fluentd.rb b/app/models/clusters/applications/fluentd.rb
deleted file mode 100644
index 91aa422b859..00000000000
--- a/app/models/clusters/applications/fluentd.rb
+++ /dev/null
@@ -1,121 +0,0 @@
-# frozen_string_literal: true
-
-module Clusters
- module Applications
- class Fluentd < ApplicationRecord
- VERSION = '2.4.0'
- CILIUM_CONTAINER_NAME = 'cilium-monitor'
-
- self.table_name = 'clusters_applications_fluentd'
-
- include ::Clusters::Concerns::ApplicationCore
- include ::Clusters::Concerns::ApplicationStatus
- include ::Clusters::Concerns::ApplicationVersion
- include ::Clusters::Concerns::ApplicationData
-
- default_value_for :version, VERSION
- default_value_for :port, 514
- default_value_for :protocol, :tcp
-
- enum protocol: { tcp: 0, udp: 1 }
-
- validate :has_at_least_one_log_enabled?
-
- def chart
- 'fluentd/fluentd'
- end
-
- def repository
- 'https://gitlab-org.gitlab.io/cluster-integration/helm-stable-archive'
- end
-
- def install_command
- helm_command_module::InstallCommand.new(
- name: 'fluentd',
- repository: repository,
- version: VERSION,
- rbac: cluster.platform_kubernetes_rbac?,
- chart: chart,
- files: files
- )
- end
-
- def values
- content_values.to_yaml
- end
-
- private
-
- def has_at_least_one_log_enabled?
- if !waf_log_enabled && !cilium_log_enabled
- errors.add(:base, _("At least one logging option is required to be enabled"))
- end
- end
-
- def content_values
- YAML.load_file(chart_values_file).deep_merge!(specification)
- end
-
- def specification
- {
- "configMaps" => {
- "output.conf" => output_configuration_content,
- "general.conf" => general_configuration_content
- }
- }
- end
-
- def output_configuration_content
- <<~EOF
- <match kubernetes.**>
- @type remote_syslog
- @id out_kube_remote_syslog
- host #{host}
- port #{port}
- program fluentd
- hostname ${kubernetes_host}
- protocol #{protocol}
- packet_size 131072
- <buffer kubernetes_host>
- </buffer>
- <format>
- @type ltsv
- </format>
- </match>
- EOF
- end
-
- def general_configuration_content
- <<~EOF
- <match fluent.**>
- @type null
- </match>
- <source>
- @type http
- port 9880
- bind 0.0.0.0
- </source>
- <source>
- @type tail
- @id in_tail_container_logs
- path #{path_to_logs}
- pos_file /var/log/fluentd-containers.log.pos
- tag kubernetes.*
- read_from_head true
- <parse>
- @type json
- time_format %Y-%m-%dT%H:%M:%S.%NZ
- </parse>
- </source>
- EOF
- end
-
- def path_to_logs
- path = []
- path << "/var/log/containers/*#{Ingress::MODSECURITY_LOG_CONTAINER_NAME}*.log" if waf_log_enabled
- path << "/var/log/containers/*#{CILIUM_CONTAINER_NAME}*.log" if cilium_log_enabled
- path.join(',')
- end
- end
- end
-end
diff --git a/app/models/clusters/applications/ingress.rb b/app/models/clusters/applications/ingress.rb
index e7d4d737b8e..3a8c314efe4 100644
--- a/app/models/clusters/applications/ingress.rb
+++ b/app/models/clusters/applications/ingress.rb
@@ -7,10 +7,6 @@ module Clusters
class Ingress < ApplicationRecord
VERSION = '1.40.2'
INGRESS_CONTAINER_NAME = 'nginx-ingress-controller'
- MODSECURITY_LOG_CONTAINER_NAME = 'modsecurity-log'
- MODSECURITY_MODE_LOGGING = "DetectionOnly"
- MODSECURITY_MODE_BLOCKING = "On"
- MODSECURITY_OWASP_RULES_FILE = "/etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf"
self.table_name = 'clusters_applications_ingress'
@@ -20,22 +16,18 @@ module Clusters
include ::Clusters::Concerns::ApplicationData
include AfterCommitQueue
include UsageStatistics
+ include IgnorableColumns
default_value_for :ingress_type, :nginx
- default_value_for :modsecurity_enabled, true
default_value_for :version, VERSION
- default_value_for :modsecurity_mode, :logging
+
+ ignore_column :modsecurity_enabled, remove_with: '14.2', remove_after: '2021-07-22'
+ ignore_column :modsecurity_mode, remove_with: '14.2', remove_after: '2021-07-22'
enum ingress_type: {
nginx: 1
}
- enum modsecurity_mode: { logging: 0, blocking: 1 }
-
- scope :modsecurity_not_installed, -> { where(modsecurity_enabled: nil) }
- scope :modsecurity_enabled, -> { where(modsecurity_enabled: true) }
- scope :modsecurity_disabled, -> { where(modsecurity_enabled: false) }
-
FETCH_IP_ADDRESS_DELAY = 30.seconds
state_machine :status do
@@ -92,96 +84,13 @@ module Clusters
private
- def specification
- return {} unless modsecurity_enabled
-
- {
- "controller" => {
- "config" => {
- "enable-modsecurity" => "true",
- "enable-owasp-modsecurity-crs" => "false",
- "modsecurity-snippet" => modsecurity_snippet_content,
- "modsecurity.conf" => modsecurity_config_content
- },
- "extraContainers" => [
- {
- "name" => MODSECURITY_LOG_CONTAINER_NAME,
- "image" => "busybox",
- "args" => [
- "/bin/sh",
- "-c",
- "tail -F /var/log/modsec/audit.log"
- ],
- "volumeMounts" => [
- {
- "name" => "modsecurity-log-volume",
- "mountPath" => "/var/log/modsec",
- "readOnly" => true
- }
- ],
- "livenessProbe" => {
- "exec" => {
- "command" => [
- "ls",
- "/var/log/modsec/audit.log"
- ]
- }
- }
- }
- ],
- "extraVolumeMounts" => [
- {
- "name" => "modsecurity-template-volume",
- "mountPath" => "/etc/nginx/modsecurity/modsecurity.conf",
- "subPath" => "modsecurity.conf"
- },
- {
- "name" => "modsecurity-log-volume",
- "mountPath" => "/var/log/modsec"
- }
- ],
- "extraVolumes" => [
- {
- "name" => "modsecurity-template-volume",
- "configMap" => {
- "name" => "ingress-#{INGRESS_CONTAINER_NAME}",
- "items" => [
- {
- "key" => "modsecurity.conf",
- "path" => "modsecurity.conf"
- }
- ]
- }
- },
- {
- "name" => "modsecurity-log-volume",
- "emptyDir" => {}
- }
- ]
- }
- }
- end
-
- def modsecurity_config_content
- File.read(modsecurity_config_file_path)
- end
-
- def modsecurity_config_file_path
- Rails.root.join('vendor', 'ingress', 'modsecurity.conf')
- end
-
def content_values
- YAML.load_file(chart_values_file).deep_merge!(specification)
+ YAML.load_file(chart_values_file)
end
def application_jupyter_installed?
cluster.application_jupyter&.installed?
end
-
- def modsecurity_snippet_content
- sec_rule_engine = logging? ? MODSECURITY_MODE_LOGGING : MODSECURITY_MODE_BLOCKING
- "SecRuleEngine #{sec_rule_engine}\nInclude #{MODSECURITY_OWASP_RULES_FILE}"
- end
end
end
end
diff --git a/app/models/clusters/applications/knative.rb b/app/models/clusters/applications/knative.rb
index 6867d7b6934..0e7cbb35e47 100644
--- a/app/models/clusters/applications/knative.rb
+++ b/app/models/clusters/applications/knative.rb
@@ -141,13 +141,13 @@ module Clusters
end
def install_knative_metrics
- return [] unless cluster.application_prometheus_available?
+ return [] unless cluster.application_prometheus&.available?
[Gitlab::Kubernetes::KubectlCmd.apply_file(METRICS_CONFIG)]
end
def delete_knative_istio_metrics
- return [] unless cluster.application_prometheus_available?
+ return [] unless cluster.application_prometheus&.available?
[Gitlab::Kubernetes::KubectlCmd.delete("--ignore-not-found", "-f", METRICS_CONFIG)]
end
diff --git a/app/models/clusters/applications/runner.rb b/app/models/clusters/applications/runner.rb
index e8d56072b89..49840e3a2e7 100644
--- a/app/models/clusters/applications/runner.rb
+++ b/app/models/clusters/applications/runner.rb
@@ -3,7 +3,7 @@
module Clusters
module Applications
class Runner < ApplicationRecord
- VERSION = '0.28.0'
+ VERSION = '0.29.0'
self.table_name = 'clusters_applications_runners'
diff --git a/app/models/clusters/cluster.rb b/app/models/clusters/cluster.rb
index 4877ced795c..2fff0a69a26 100644
--- a/app/models/clusters/cluster.rb
+++ b/app/models/clusters/cluster.rb
@@ -21,7 +21,6 @@ module Clusters
Clusters::Applications::Jupyter.application_name => Clusters::Applications::Jupyter,
Clusters::Applications::Knative.application_name => Clusters::Applications::Knative,
Clusters::Applications::ElasticStack.application_name => Clusters::Applications::ElasticStack,
- Clusters::Applications::Fluentd.application_name => Clusters::Applications::Fluentd,
Clusters::Applications::Cilium.application_name => Clusters::Applications::Cilium
}.freeze
DEFAULT_ENVIRONMENT = '*'
@@ -68,7 +67,6 @@ module Clusters
has_one_cluster_application :jupyter
has_one_cluster_application :knative
has_one_cluster_application :elastic_stack
- has_one_cluster_application :fluentd
has_one_cluster_application :cilium
has_many :kubernetes_namespaces
@@ -104,8 +102,8 @@ module Clusters
delegate :available?, to: :application_helm, prefix: true, allow_nil: true
delegate :available?, to: :application_ingress, prefix: true, allow_nil: true
delegate :available?, to: :application_knative, prefix: true, allow_nil: true
- delegate :available?, to: :application_elastic_stack, prefix: true, allow_nil: true
delegate :available?, to: :integration_elastic_stack, prefix: true, allow_nil: true
+ delegate :available?, to: :integration_prometheus, prefix: true, allow_nil: true
delegate :external_ip, to: :application_ingress, prefix: true, allow_nil: true
delegate :external_hostname, to: :application_ingress, prefix: true, allow_nil: true
@@ -138,11 +136,10 @@ module Clusters
scope :gcp_installed, -> { gcp_provided.joins(:provider_gcp).merge(Clusters::Providers::Gcp.with_status(:created)) }
scope :aws_installed, -> { aws_provided.joins(:provider_aws).merge(Clusters::Providers::Aws.with_status(:created)) }
- scope :with_enabled_modsecurity, -> { joins(:application_ingress).merge(::Clusters::Applications::Ingress.modsecurity_enabled) }
scope :with_available_elasticstack, -> { joins(:application_elastic_stack).merge(::Clusters::Applications::ElasticStack.available) }
scope :with_available_cilium, -> { joins(:application_cilium).merge(::Clusters::Applications::Cilium.available) }
scope :distinct_with_deployed_environments, -> { joins(:environments).merge(::Deployment.success).distinct }
- scope :preload_elasticstack, -> { preload(:application_elastic_stack) }
+ scope :preload_elasticstack, -> { preload(:integration_elastic_stack) }
scope :preload_environments, -> { preload(:environments) }
scope :managed, -> { where(managed: true) }
@@ -171,18 +168,16 @@ module Clusters
state_machine :cleanup_status, initial: :cleanup_not_started do
state :cleanup_not_started, value: 1
- state :cleanup_uninstalling_applications, value: 2
state :cleanup_removing_project_namespaces, value: 3
state :cleanup_removing_service_account, value: 4
state :cleanup_errored, value: 5
event :start_cleanup do |cluster|
- transition [:cleanup_not_started, :cleanup_errored] => :cleanup_uninstalling_applications
+ transition [:cleanup_not_started, :cleanup_errored] => :cleanup_removing_project_namespaces
end
event :continue_cleanup do
transition(
- cleanup_uninstalling_applications: :cleanup_removing_project_namespaces,
cleanup_removing_project_namespaces: :cleanup_removing_service_account)
end
@@ -195,13 +190,7 @@ module Clusters
cluster.cleanup_status_reason = status_reason if status_reason
end
- after_transition [:cleanup_not_started, :cleanup_errored] => :cleanup_uninstalling_applications do |cluster|
- cluster.run_after_commit do
- Clusters::Cleanup::AppWorker.perform_async(cluster.id)
- end
- end
-
- after_transition cleanup_uninstalling_applications: :cleanup_removing_project_namespaces do |cluster|
+ after_transition [:cleanup_not_started, :cleanup_errored] => :cleanup_removing_project_namespaces do |cluster|
cluster.run_after_commit do
Clusters::Cleanup::ProjectNamespaceWorker.perform_async(cluster.id)
end
@@ -325,7 +314,7 @@ module Clusters
end
def elastic_stack_adapter
- application_elastic_stack || integration_elastic_stack
+ integration_elastic_stack
end
def elasticsearch_client
@@ -333,11 +322,7 @@ module Clusters
end
def elastic_stack_available?
- if application_elastic_stack_available? || integration_elastic_stack_available?
- true
- else
- false
- end
+ !!integration_elastic_stack_available?
end
def kubernetes_namespace_for(environment, deployable: environment.last_deployable)
@@ -391,12 +376,8 @@ module Clusters
end
end
- def application_prometheus_available?
- integration_prometheus&.available? || application_prometheus&.available?
- end
-
def prometheus_adapter
- integration_prometheus || application_prometheus
+ integration_prometheus
end
private
diff --git a/app/models/clusters/clusters_hierarchy.rb b/app/models/clusters/clusters_hierarchy.rb
index 125783e6ee1..162a1a3290d 100644
--- a/app/models/clusters/clusters_hierarchy.rb
+++ b/app/models/clusters/clusters_hierarchy.rb
@@ -4,9 +4,8 @@ module Clusters
class ClustersHierarchy
DEPTH_COLUMN = :depth
- def initialize(clusterable, include_management_project: true)
+ def initialize(clusterable)
@clusterable = clusterable
- @include_management_project = include_management_project
end
# Returns clusters in order from deepest to highest group
@@ -25,7 +24,7 @@ module Clusters
private
- attr_reader :clusterable, :include_management_project
+ attr_reader :clusterable
def recursive_cte
cte = Gitlab::SQL::RecursiveCTE.new(:clusters_cte)
@@ -39,7 +38,7 @@ module Clusters
raise ArgumentError, "unknown type for #{clusterable}"
end
- if clusterable.is_a?(::Project) && include_management_project
+ if clusterable.is_a?(::Project)
cte << same_namespace_management_clusters_query
end
@@ -71,7 +70,7 @@ module Clusters
# Only applicable if the clusterable is a project (most especially when
# requesting project.deployment_platform).
def depth_order_clause
- return { DEPTH_COLUMN => :asc } unless clusterable.is_a?(::Project) && include_management_project
+ return { DEPTH_COLUMN => :asc } unless clusterable.is_a?(::Project)
order = <<~SQL
(CASE clusters.management_project_id
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-11 07:25:24 +0300