Skip to content

Increase size limit for instance-level variables

What does this MR do?

Setting the limit for ci instance variables to ~10,000 characters unencrypted, since customers complained that they could not set ca certs globally for the instance.

encrypted value to 13,579 based on the computation below (depends on using 'aes-256-gcm' algorithm):

[18] pry(main)>value = SecureRandom.alphanumeric(10_000)

[18] pry(main)>iv = Ci::InstanceVariable.new(variable_type: 1, masked: false, protected: false, key: 'hi', value: value)

[18] pry(main)> iv.encrypted_value.length
=> 13579

Relates to #220028 (closed)

Database

$ bundle exec rails db:migrate:up VERSION=20200625193358
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: migrating ========
-- transaction_open?()
   -> 0.0000s
-- execute("ALTER TABLE ci_instance_variables\nADD CONSTRAINT check_956afd70f1\nCHECK ( char_length(encrypted_value) <= 13579 )\nNOT VALID;\n")
   -> 0.0029s
-- execute("ALTER TABLE ci_instance_variables VALIDATE CONSTRAINT check_956afd70f1;")
   -> 0.0007s
-- execute("ALTER TABLE ci_instance_variables\nDROP CONSTRAINT IF EXISTS check_5ebd0515a0\n")
   -> 0.0033s
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: migrated (0.0198s) 

$ bundle exec rails db:migrate:down VERSION=20200625193358
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: reverting ========
-- execute("ALTER TABLE ci_instance_variables\nDROP CONSTRAINT IF EXISTS check_956afd70f1\n")
   -> 0.0007s
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: reverted (0.0041s) 

Screenshots

Tested on my dev stack with docker alpine:latest runner to confirm variable fits on the system and crosses the wire.

Screen_Shot_2020-07-17_at_2.48.13_PM

Screen_Shot_2020-07-17_at_2.44.32_PM

Screen_Shot_2020-07-17_at_2.50.11_PM

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Allison Browne

Merge request reports