Add Artifact Registry configuration for hybrid deployments

Narendranrequested to merge
nkannan/ar-hybrid-config-rails into master

What does this MR do?

Adds gitlab.rb configuration that lets operators point GitLab Rails at an Artifact Registry service running separately from the Linux package.

Artifact Registry is not installed or packaged by the Linux package, and this MR does not change that. It is for hybrid deployments only: GitLab Rails runs on a Linux package installation, and Artifact Registry runs as its own service elsewhere. This gap was identified in charts!5294 (comment): AR is not packaged, but Rails still needs to be configured to reach it.

New settings

gitlab_rails['artifact_registry_api_url'] = 'https://artifact-registry.example.com'
gitlab_rails['artifact_registry_service_token_file'] = '/etc/gitlab/artifact-registry/.gitlab_artifact_registry_secret'

These render into gitlab.yml as the stanza GitLab Rails reads:

artifact_registry:
  api_url: "https://artifact-registry.example.com"
  service_token:
    secret_file: "/etc/gitlab/artifact-registry/.gitlab_artifact_registry_secret"

matching the Rails settings added in gitlab!252017 (merged) (Settings.artifact_registry.api_url and the nested Settings.artifact_registry.service_token['secret_file']).

Behavior

  • The whole artifact_registry: block renders only when artifact_registry_api_url is set. An install that sets neither key renders no stanza and connects to no service.
  • service_token.secret_file renders only when the token file key is set. An install may set api_url alone; the Rails service path then fails closed (no credential) while the per-user path is unaffected.
  • The token file is operator-supplied. The Linux package does not create, generate, or manage it, and does not mint the token.

Implementation notes

  • The keys are flat gitlab_rails['artifact_registry_*'] attributes, mirroring the existing gitlab_rails['gitlab_kas_*'] block. The recipe needs no change because gitlab-rails.rb already splats node['gitlab']['gitlab_rails'].to_hash into the template. The nested service_token.secret_file shape lives in the gitlab.yml.erb template, not in the input key name.

Related issues

Closes #10080 (closed)

Related:

Test plan

spec/chef/cookbooks/gitlab/recipes/gitlab-rails_spec.rb covers the rendered gitlab.yml across four states: neither key set (no stanza), api_url only (no service_token), both set (nested service_token.secret_file), and token file without api_url (no stanza). All four pass.

Merge request reports