Limit the size and number of job variables

Oleg Yakovenkorequested to merge
613417-limit-job-variables into master

What does this MR do and why?

Job variable counts and value sizes are unbounded. A caller can attach any number of variables, of any size, to a single job.

This MR adds one plan limit, ci_job_variables_count, and points job variables at the two shared size limits. The limits are checked when a user runs or retries a manual job with variables. A job over a limit does not run. The error names the limit, or the variable for a size limit, and links to the docs.

Plan limit Added by Default GitLab.com
ci_job_variables_count this MR 0 200
ci_variable_value_size !253433 (merged) 0 128 KiB
ci_variable_file_value_size !253433 (merged) 0 1 MiB

Every column defaults to 0, which means the limit is not enforced, so GitLab Self-Managed and GitLab Dedicated enforce nothing on upgrade. The GitLab.com values are set through the plan limits API, separately from this MR. The docs changes here publish the same three values.

The count of 200 is based on GitLab.com usage. The highest number of caller-supplied job variables observed on a single job is 64.

Only variables the caller supplies are checked. Variables copied from the source job on retry are not, so a job already holding more than the limit stays retryable.

Why the size limits are shared, and why the check is a service

The size limits encode a kernel cap, so they apply to every kind of CI/CD variable. !253433 (merged) added ci_variable_value_size and ci_variable_file_value_size for all of them, and this MR reuses that pair instead of adding job-specific copies.

Ci::JobVariables::ValidateLimitsService runs from Ci::PlayBuildService and Ci::RetryJobService before anything is written. A validation on Ci::JobVariable would never run on the retry path, which bulk inserts through BulkInsertableAssociations with validations off. On the play path it would fail quietly: a validation error makes job.enqueue! raise StateMachines::InvalidTransition, which Ci::PlayBuildService rescues by retrying the build with no variables, so the user gets a job that looks fine and is missing the variable they typed.

References

GitLab team members can see the full GitLab.com usage figures in the internal notes on the work item.

Screenshots or screen recordings

Admin > Settings > CI/CD gains one field under CI/CD limits, Maximum number of job variables in a single job, with the note Set to 0 to disable the limit.

How to set up and validate locally

  1. Plan.default.actual_limits.update!(ci_job_variables_count: 2, ci_variable_value_size: 10)
  2. Run a manual job supplying three variables. The job does not run, and the error gives the count limit.
  3. Run a manual job supplying one variable whose value is over 10 bytes. The error names the variable.
  4. Retry a manual job with variables through the jobRetry GraphQL mutation. The same checks apply.
  5. Set either limit back to 0 and confirm nothing is enforced.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Oleg Yakovenko

Merge request reports