Skip to content

Failed gitlab_root user creation due to lack of ansible assertion/check for gitlab_root_password requirements for first time setup

Problem description:

  • GET version: 3.4.0
  • Cloud Provider: AWS
  • Environment configuration: 1k_aws reference deployment as per example

Gitlab rails require a the gitlab_root_password to be of minimum password complexity (i.e min length of 8 and not of commonly used word combinations)

when deploying via the ansible roles, it did not check for password complexity and this ended up with a deployed GitLab setup where the root user is not created as shown in the image:

image

I have ran this a few times using the 1K_aws setup and have gotten the same outcome.

steps to reproduce: use the following as input for the ansible secrets:

all:
  vars:
    ...
    # Passwords / Secrets (Replace values accordingly)
    gitlab_root_password: 'testroot123' # just 1 of the combinations i ended up that could reproduce the issue

I have also ran a basic system check to ensure all services are fine:

image

possible solution:

  • To have a pre-validation ansible task that performs password complexity checks/assertions against the provided secret variables.
  • This would catch the issue before proceeding with the full set of deployment which could take up to 30-40mins (as per my testing so far)
  • This could be expanded for all the expected secrets as well (i.e. redis, postgresql, gitaly and etc) for better coverage

I would be happy to create an MR for this if the approach is okay.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information