Increase size limit for instance-level variables
What does this MR do?
Setting the limit for ci instance variables to ~10,000 characters unencrypted, since customers complained that they could not set ca certs globally for the instance.
encrypted value to 13,579 based on the computation below (depends on using 'aes-256-gcm' algorithm):
[18] pry(main)>value = SecureRandom.alphanumeric(10_000)
[18] pry(main)>iv = Ci::InstanceVariable.new(variable_type: 1, masked: false, protected: false, key: 'hi', value: value)
[18] pry(main)> iv.encrypted_value.length
=> 13579
Relates to #220028 (closed)
Database
$ bundle exec rails db:migrate:up VERSION=20200625193358
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: migrating ========
-- transaction_open?()
-> 0.0000s
-- execute("ALTER TABLE ci_instance_variables\nADD CONSTRAINT check_956afd70f1\nCHECK ( char_length(encrypted_value) <= 13579 )\nNOT VALID;\n")
-> 0.0029s
-- execute("ALTER TABLE ci_instance_variables VALIDATE CONSTRAINT check_956afd70f1;")
-> 0.0007s
-- execute("ALTER TABLE ci_instance_variables\nDROP CONSTRAINT IF EXISTS check_5ebd0515a0\n")
-> 0.0033s
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: migrated (0.0198s)
$ bundle exec rails db:migrate:down VERSION=20200625193358
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: reverting ========
-- execute("ALTER TABLE ci_instance_variables\nDROP CONSTRAINT IF EXISTS check_956afd70f1\n")
-> 0.0007s
== 20200625193358 IncreaseSizeOnInstanceLevelVariableValues: reverted (0.0041s)
Screenshots
Tested on my dev stack with docker alpine:latest runner to confirm variable fits on the system and crosses the wire.
Does this MR meet the acceptance criteria?
Conformity
-
Changelog entry -
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides - [-] Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. - [-] Tested in all supported browsers
- [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
- [-] Label as security and @ mention
@gitlab-com/gl-security/appsec
- [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
- [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Allison Browne