Skip to content

Track registry events

What does this MR do?

Adds an endpoint POST /-/container_registry_events that can persist notification events from the docker container registry.

Are there points in the code the reviewer needs to double check?

  • Where should we store the auth token? Is this auth approach appropriate? How can we make sure they don't need to do any configuration in local dev for the auth to work?
  • Would it be better matching GitLab conventions or improve readability to extract a class that is responsible for transforming/persisting the events?
  • Should we set up a foreign key to users? Is it always possible to do this? Is the performance cost worth it?
  • Is there some type of event I haven't considered with the null constraints? I found that tag was null sometimes but maybe there are others.
  • Should we just persist the entire event in a json column so we can collect all the data?
  • Does it make sense to use ContainerRegistryEvent.find_or_create_by. I wasn't sure if there were certain configurations that may lead to "at least once" delivery and thus maybe the same event may be delivered twice so I was trying to avoid any errors coming up.
  • Should the route be namespaced somewhere else? Currently it is /-/container_registry_events.
  • Should the model be namespaced?

Why was this MR needed?

Screenshots (if relevant)

Does this MR meet the acceptance criteria?

What are the relevant issue numbers?

#40981 (moved)

Local Testing

You will need to apply the following in GDK then gdk reconfigure:

diff --git a/registry/config.yml.example b/registry/config.yml.example
index 47e3afc..8f184fd 100644
--- a/registry/config.yml.example
+++ b/registry/config.yml.example
@@ -29,3 +29,12 @@ auth:
     service: container_registry
     issuer: gitlab-issuer
     rootcertbundle: /root/certs/certbundle
+notifications:
+  endpoints:
+    - name: gitlab
+      url: http://docker.for.mac.localhost:3000/-/container_registry_events
+      headers:
+        Authorization: [Token token=container-registry-token]
+      timeout: 20000ms
+      threshold: 5
+      backoff: 1s

I want to make sure this is merged only after we've finalised the new endpoint.

Edited by Dylan Griffith

Merge request reports