Part 1 of Allow Geo sync requests even if Git over HTTP is disabled
Proposal
Geo requires the HTTP(S) git access protocol to be enabled to work. If the HTTP(S) git access protocol is disabled, Geo stops working. As per our Geo requirements:
Geo synchronizes repositories over HTTP/HTTPS, and therefore requires this clone method to be enabled.
GitLab Runners however aren't affected by this limitation (as per the comment in this section)
GitLab versions 10.7 and later, allow the HTTP(S) protocol for Git clone or fetch requests done by GitLab Runner from CI/CD jobs, even if you select Only SSH.
If an admin decides to disable the HTTP(S) git access protocol, then Geo replication should still work.
#348360 (closed) can be closed if this issue is addressed.
Relevant files:
- https://gitlab.com/gitlab-org/gitlab/-/blob/v14.4.2-ee/lib/gitlab/git_access.rb#L185-191 - this is where the git protocol check is performed. It also shows how incoming Runner requests are dealt with
- https://gitlab.com/gitlab-org/gitlab/-/blob/v17.10.0-ee/ee/lib/system_check/geo/http_clone_enabled_check.rb - the HTTP clone access check
Implementation plan
- Adjacent to https://gitlab.com/gitlab-org/gitlab/-/blob/v17.10.0-ee/ee/lib/ee/gitlab/git_access.rb#L84-89, override
check_protocol!
in the same way as e.g.check_download_access!
-- short-circuit itif geo?
. - Test it yourself locally (see Steps to reproduce problem)
- Add more unit tests in the "Geo git pull for a primary" context: https://gitlab.com/gitlab-org/gitlab/-/blob/v17.10.0-ee/ee/spec/lib/gitlab/git_access_spec.rb#L582
Then do Part 2: #538871
Steps to reproduce problem
- Set up Geo with GDK (actually this is broken as of April 15 but hopefully should be resolved in this MR)
- Disable Git over HTTP protocol in Admin > Settings
- Push to a project Git repo
- Geo syncing of the Git repository should succeed (wait a couple minutes and visit Admin > Geo > Sites)
Edited by 🤖 GitLab Bot 🤖