Add secure setting for IAM gRPC connections

Harsha Muralidharrequested to merge
hm-iam-grpc-secure into master

What does this MR do?

Today the chart writes only a host and port for the IAM gRPC connection into gitlab.yml. GitLab Rails decides whether to encrypt that connection by checking its environment, so an operator cannot choose.

This change adds a secure line under iam_auth_service.grpc and iam_data_access_service.grpc in gitlab.yml. The default is true, which keeps TLS on, so behaviour stays the same for everyone who does not change it.

  • Set global.appConfig.iamAuthService.grpc.secure: false for a plaintext connection.
  • Set global.appConfig.iamDataAccessService.grpc.secure: false for the data access service.

Author checklist

Required

  • Merge Request Title and Description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • MR has a green pipeline.
  • Documentation created/updated.
  • Tests added/updated.
  • Have you validated that your change works end-to-end on a real cluster deployment?
    • Verified so far by rendering the templates locally. spec/configuration/iam_auth_service_spec.rb, spec/configuration/iam_data_access_service_spec.rb, spec/configuration/gitlab-yml-erb_spec.rb and spec/integration/check_config/iam_auth_spec.rb pass with 83 examples and 0 failures. Happy to deploy on a rig if a reviewer would like that before merge.
  • Equivalent MR/issue for omnibus-gitlab opened.
    • The IAM services reach chart based installations only for now, so an Omnibus equivalent can follow when they ship there.

Reviewers checklist

References

Edited by Jason Plum

Merge request reports