Implement OAK cookbook with base library and Nginx templating

What does this MR do?

Implement OAK library and extend Nginx config for Omnibus.

What's added:

• New oak cookbook with a core library (Oak module) that provides helpers to:
  • Check if OAK is enabled and which components are active
• Network binding extensions for Nginx when OAK is enabled
• Default configuration added to gitlab.rb.template as a reference
• Tests covering the core OAK library and Nginx changes

---

Local Test Plan (Docker)

This is what I used to be able to validate the changes locally. I think there are different ways of setting this up but this is what worked for me.

I included a Dockerfile and a entrypoint bash script that I used after struggling to get Omnibus to run locally inside a Docker container and also trying to override some of the OAK values. I think the init container was exiting and the Omnibus container wasn't starting because the gitlab.rb file wasn't created, my understanding is that the problem was from a previous run I tried where the gitlab.rb file was still there and the init container was not generating a new one / not updating the EXTERNAL_URL. Either that or the init container doesn't take into account the EXTERNAL_URL env var. (I am sure someone who understands Omnibus better can explain it in a way that makes more sense)

Prerequisites

• Docker

Files required

Dockerfile.dev — builds a dev image on top of gitlab-ce:nightly, overlaying the local OAK cookbooks and a custom entrypoint:

FROM gitlab/gitlab-ce:nightly

COPY files/gitlab-config-template/gitlab.rb.template \
/opt/gitlab/etc/gitlab.rb.template

RUN rm -f /etc/gitlab/gitlab.rb

COPY docker-entrypoint.sh /docker-entrypoint.sh RUN chmod +x /docker-entrypoint.sh

COPY files/gitlab-cookbooks/oak/ \
/opt/gitlab/embedded/cookbooks/oak/

COPY files/gitlab-cookbooks/gitlab/libraries/ \
/opt/gitlab/embedded/cookbooks/gitlab/libraries/

COPY files/gitlab-cookbooks/gitlab/recipes/default.rb \
/opt/gitlab/embedded/cookbooks/gitlab/recipes/default.rb

COPY files/gitlab-cookbooks/package/libraries/config/gitlab.rb \
/opt/gitlab/embedded/cookbooks/package/libraries/config/gitlab.rb

COPY files/gitlab-cookbooks/gitlab/metadata.rb \
/opt/gitlab/embedded/cookbooks/gitlab/metadata.rb

CMD \["/docker-entrypoint.sh"\]

docker-entrypoint.sh pre-creates gitlab.rb from the template before handing off to the upstream init:

#!/bin/bash
set -e

if [[ ! -f /etc/gitlab/gitlab.rb ]]; then
  echo "Installing gitlab.rb config with EXTERNAL_URL=${EXTERNAL_URL}..."
  cp /opt/gitlab/etc/gitlab.rb.template /etc/gitlab/gitlab.rb
  chmod 0600 /etc/gitlab/gitlab.rb
  if [[ -n "$EXTERNAL_URL" ]]; then
    sed -i "s|GENERATED_EXTERNAL_URL|${EXTERNAL_URL}|g" /etc/gitlab/gitlab.rb
  fi
fi

exec /assets/init-container

---

1. Build the dev image

docker build -f Dockerfile.dev -t gitlab-oak-dev .

2. Run the container with OAK config

docker run --rm -d \
--name gitlab-oak-test \
-p 80:80 \
-e EXTERNAL_URL="http://localhost" \
gitlab-oak-dev

3. Wait for reconfigure to finish

docker logs -f gitlab-oak-test 2\> &1 | grep -E "gitlab Reconfigure|ERROR"

Wait until you see gitlab Reconfigure complete.

4. Update /etc/gitlab/gitlab.rb and enable oak but don't provide a network_address. The gitlab-ctl command should fail. Set a network_address and it should pass

oak['enabled'] = true
# oak['network_address'] = '10.0.0.1'

Related issues

#9685

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion.

Required

• MR title and description are up to date, accurate, and descriptive.
• MR targeting the appropriate branch.
• Latest Merge Result pipeline is green.
• When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.

For GitLab team members

If you don't have access to this, the reviewer should trigger these jobs for you during the review process.

• The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
• If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded.
• If you are changing anything SSL related, then the Trigger:package:fips manual job within the Trigger:ee-package downstream pipeline must succeed.
• If CI configuration is changed, the branch must be pushed to dev.gitlab.org to confirm regular branch builds aren't broken.

Expected (please provide an explanation if not completing)

• Test plan indicating conditions for success has been posted and passes.
• Documentation created/updated.
• Tests added.
• Integration tests added to GitLab QA.
• Equivalent MR/issue for the GitLab Chart opened.
• Validate potential values for new configuration settings. Formats such as integer 10, duration 10s, URI scheme://user:passwd@host:port may require quotation or other special handling when rendered in a template and written to a configuration file.