Skip to content

Need to remove cert/key from secrets file for auto-generated pairs

Asmaa Hassan requested to merge asmaa.hassan-master-patch-71780 into master

What does this MR do and why?

Describe in detail what your merge request does and why.

While working on testing external registry, we added the internal key to gitlab.rb. Trying to rollback to use GitLab container registry, we encountered this issue, ending up with unmatched crt/key.

Removing the crt and key files then reconfiguring didn't work, as they seem to be created with the same old non-matching values.

We could see that the values are saved in gitlab-secrets.json, and never updated. so removing the registry entry from the secrets file + removing the crt and key files then reconfiguring worked!

Reaching out to the experts, it turns out that this is intentional, to persist auto-generated secrets across reconfigures. When updating secrets that might be stored in gitlab-secrets.json , user has to manually delete them from gitlab-secrets.json for reconfigure to put the new value there.

How to set up and validate locally

  1. Manually change the JWT keypair.
  2. Run gitlab-ctl reconfigure.
  3. Trying to run docker login, you will get failed with status: 401 Unauthorized, and the registry log will have token signed by untrusted key.
  4. Remove the crt and files and registry record from gitlab-secrets.json then reconfigure.
  5. You should be able to run docker login successfully now.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Evan Read

Merge request reports