Serve the GitLab vhost on the OAK network address

Jason Plumrequested to merge
jp/oak-nginx-listen-address-fix into master

What does this MR do?

When oak['enable'] is set and oak['network_address'] has a value, NGINX serves every request on that address from one OAK component server block and ignores the Host header. GitLab is not reachable on that address at all.

This MR gives the GitLab server block the same listen directive as the component server blocks, so NGINX can select between them by Host.

The defect is on master and applies to any OAK deployment that sets a network address. No component and no exposure request is needed. OpenBao never calls back into GitLab, so it breaks other traffic silently. Artifact Registry is the first component that reports it, through a 404 on the JWKS fetch, which crash-loops the service.

The regression test converges the GitLab and the OpenBao server blocks together and asserts the listen directive on each. It fails on the parent commit.

Related issues

Closes #10073

Found while verifying the Artifact Registry component in #10053.

Checklist

See Definition of done.

Required

  • MR title and description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • Latest Merge Result pipeline is green.
  • When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
  • The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable. Not applicable.

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes. The regression test is the test plan: it fails on the parent commit and passes on this one.
  • Documentation created/updated. No operator-visible setting changes, so no documentation change.
  • Tests added.
  • Integration tests added to GitLab QA. NGINX server-block selection is not reachable from the QA suite.
  • Equivalent MR/issue for the GitLab Chart opened. Not applicable, OAK is a Linux package feature.
  • Validate potential values for new configuration settings. No new settings.

Merge request reports