Skip to content
Snippets Groups Projects

Add basic auth to Zoekt client

Merged Dylan Griffith requested to merge 389749-zoekt-basic-auth into master

What does this MR do and why?

Add basic auth to Zoekt client

As part of #389749 (closed) we want HTTP requests from Zoekt -> GitLab to be authenticated. This MR adds the ability to configure a zoekt.username_file and zoekt.password_file (that default to .gitlab_zoekt_username and .gitlab_zoekt_password respectively) in your config/gitlab.yml . If present these files will be used to populate basic auth credentials in the HTTP requests to Zoekt. We likely won't use this in GDK because basic authentication relies on an nginx proxy in front of Zoekt (this is configured in the helm chart in gitlab-org/cloud-native/charts/gitlab-zoekt!14 (merged)). The indexer and webserver we run in GDK don't actually support basic auth but I've verified locally that these changes do indeed send the credentials.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

Before After

How to set up and validate locally

How to test
  1. Setup zoekt https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/zoekt.md
  2. Run a transparent proxy in front of port 6080 and 6090 that validates basic auth using nginx.
    1. Create .htpasswd file:
      htpasswd -c /tmp/.htpasswd user1 # set password to password1
    2. Create /tmp/nginx.conf with:
    worker_processes 1;
    daemon off;
    
    events {
      worker_connections  4096;
    }
    
    http {
    	server {
    		listen 6081;
    		auth_basic           "Authentication required";
    		auth_basic_user_file /tmp/.htpasswd;
    
    		location / {
    			proxy_pass      http://localhost:6080;
    		}
    	}
    
    	server {
    		listen 6091;
    		auth_basic           "Authentication required";
    		auth_basic_user_file /tmp/.htpasswd;
    
    		location / {
    			proxy_pass      http://localhost:6090;
    		}
    	}
    }
    1. Run nginx with nginx -c /tmp/nginx.conf
  3. Reconfigure from rails console to use this proxy
    ::Zoekt::Shard.first.update!(index_base_url: 'http://127.0.0.1:6081', search_base_url: 'http://127.0.0.1:6091')
  4. Create the files for username and password:
    echo 'user1' > .gitlab_zoekt_username
    echo 'password1' > .gitlab_zoekt_password
  5. gdk restart
  6. Do a search from GitLab UI and confirm they still work. Update the code and confirm indexing still works.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #389749 (closed)

Edited by Dylan Griffith

Merge request reports

Merged results pipeline #946285009 passed

Pipeline: GitLab

#946308766

    Pipeline: TRIGGERED_EE_PIPELINE

    #946308787

      Pipeline: E2E GDK

      #946315020

        +2

        Merged results pipeline passed for 2e0239d5

        Test coverage 82.49% (15.89%) from 2 jobs

        Merged by John MasonJohn Mason 1 year ago (Jul 26, 2023 5:16pm UTC)

        Loading

        Pipeline #946386721 passed

        Pipeline passed for 822b6c39 on master

        Test coverage 66.60% (15.89%) from 2 jobs
        10 environments impacted.

        Activity

        Filter activity
        • Approvals
        • Assignees & reviewers
        • Comments (from bots)
        • Comments (from users)
        • Commits & branches
        • Edits
        • Labels
        • Lock status
        • Mentions
        • Merge request status
        • Tracking
        • Loading
        • Loading
        • Loading
        • Loading
        • Loading
        • Loading
        • Loading
        • Loading
        • Loading
        • Loading
        Please register or sign in to reply
        Loading