Protected packages: Helm chart push protection

Gerardo Navarrorequested to merge
gitlab-community/gitlab-org/gitlab:538372-gerardo-navarro-protected-packages-helm-chart-push-protection into master

What does this MR do and why?

  • Add new package type Helm to the PackageProtection::Rule model
  • Integrate push package protection for package format helm
  • Allow creation of helm package protection rule in frontend
  • This commit adds the feature flag :packages_protected_packages_helm

🛠️ with ❤️ at Siemens

Background context information

Helm packages (helm charts) are tar-compressed archives, e.g. deis-workflow-0.1.0.tgz. The helm chart includes the file Chart.yml which itself contains the specification (metadata), e.g. name, version, description.

This means, the helm chart archive needs to be decompressed (etc. untar) in order to retrieve the Helm chart specification. This metadata extraction happens in the background.

This is why the package protection is applied Packages::Helm::ProcessFileService as part of the Packages::Helm::ExtractionWorker background job.

Integrating the package protection in the helm-specific endpoint is not possible because the necessary metadata are not available, e.g. package name. See also comment: !189801 (comment 2487282950)

References

Screenshots or screen recordings

Before

When pushing a Helm chart to the GitLab package registry (via curl) the enpoint returns a success status code (201).

Click to expand console log from `curl` command 
e45a21dcb18e:/charts# curl     --fail-with-body --request POST --form 'chart=@other-deis-workflow-0.1.0.tgz' --user $PAT_PROJECT_DEVELOPER_USERNAME:$PAT_PROJECT_DEVELOPER_TOKEN http://gdk.test:3000/api/v4/projects/7/packages/helm/api/stable/charts
{"message":"201 Created"}

The background worker extracts the metadata and processed the helm chart withouth an error.

image

After

The changes in this MR do not affect the initial upload (push) of the Helm chart to the GitLab package registry (via curl). The endpoint still returns a success status code (201).

But with these MR changes, the background worker checks for existing package protection rules and stores the error and shows it to the user.

image

How to set up and validate locally

  1. In rails console, enable the feature flag :packages_protected_packages_helm 
    Feature.enable(:packages_protected_packages_helm)
  2. Go to the package settings page of the seeded project "flightjs/Flight": http://gdk.test:3000/flightjs/Flight/-/settings/packages_and_registries
  3. Create a new package protection rule for the package type 'Helm':
    • Field "Package name pattern": deis-workflow
    • Field "Package type": Helm
    • Field "Minimum access level for push": Administrator
    • Field "Minimum access level for delete ": Administrator
  4. Download this Helm package deis-workflow-0.1.0.tgz or create new helm chart as explained in the helm quickstart guide
  5. Use curl to publish the helm package to your local gdk instance 
    curl --fail-with-body --request POST --form 'chart=@deis-workflow-0.1.0.tgz' --user $PAT_PROJECT_DEVELOPER_USERNAME:$PAT_PROJECT_DEVELOPER_TOKEN http://gdk.test:3000/api/v4/projects/7/packages/helm/api/stable/charts
  6. Pushing the helm chart should fail because the chart is protected, see console output above 💥
  7. Change the package protection rule to another package name pattern, e.g. other-deis-workflow and push it again
  8. Now, the helm chart should have been successfully pushed because it is not protected anymore
Click to expand the console output 
root@e2622ca19fa4:~/AppLogger# dotnet helm push bin/Debug/flight-helm-protected-test.0.0.2.nupkg --source gdk_test --api-key ({personal_access_token_of_project_developer})
warn : You are running the 'push' operation with an 'HTTP' source, 'http://gdk.test:3000/api/v4/projects/7/packages/helm/index.json'. Non-HTTPS access will be removed in a future version. Consider migrating to an 'HTTPS' source.
Pushing flight-helm-protected-test.0.0.2.nupkg to 'http://gdk.test:3000/api/v4/projects/7/packages/helm'...
warn : You are running the 'push' operation with an 'HTTP' source, 'http://gdk.test:3000/api/v4/projects/7/packages/helm/'. Non-HTTPS access will be removed in a future version. Consider migrating to an 'HTTPS' source.
  PUT http://gdk.test:3000/api/v4/projects/7/packages/helm/
  Created http://gdk.test:3000/api/v4/projects/7/packages/helm/ 2189ms
Your package was pushed.

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

MR Checklist (@gerardo-navarro)

Related to #538372

Edited by Gerardo Navarro

Merge request reports