Louis opened issue #2535: Disabling LDAP in chart produce configmap with missing elements at GitLab.org / charts / GitLab Chart

Louis
2021-01-25T17:44:51Z

Summary

After disabling LDAP (moving from AD to AzureAD for SSO). The configMap generated is missing a node causing the webservice to fail and return 500.

Deployment gitlab-webservice-default container webservice show the error below:

Settingslogic::MissingSetting (Missing setting 'servers' in 'ldap' section in /srv/gitlab/config/gitlab.yml):

relevant extract from ConfigMap gitlab-webservice (key: gitlab.yml.erb)

[...]
mattermost:
enabled: false
gitlab_ci:
ldap:
enabled: false

omniauth:
enabled: true
auto_sign_in_with_provider: "azure_oauth2"
sync_profile_from_provider: ["azure_oauth2"]
sync_profile_attributes: ["name","email","location"]
allow_single_sign_on: ["azure_oauth2"]
block_auto_created_users: false
auto_link_ldap_user: true
auto_link_saml_user: true
auto_link_user: true
external_providers: []
providers:
- <%= YAML.load_file("/etc/gitlab/omniauth/azuread-secret/provider").to_json() %>
kerberos:
enabled: false
[...]

This can be worked around by passing dummy values, but in this case the LDAP setting is stuck enabled despite being set to false in the config.

Steps to reproduce

Install Gitlab Chart 4.8.0 using --set global.appConfig.ldap.enabled=false

Configuration used

Causing the issue:

USER-SUPPLIED VALUES:
' gitlab':
task-runner:
backups:
cron:
extraArgs: --skip registry
certmanager-issuer:
email: gitlab.admin@$$$$$$
gitlab:
gitaly:
persistence:
enabled: true
size: 512Gi
storageClass: ssd
task-runner:
backups:
cron:
enabled: true
persistence:
enabled: true
size: 2150Gi
storageClass: ssd
schedule: 5 2 * * *
objectStorage:
backend: gcs
config:
gcpProject: $$$-gitlab-prod
key: config
secret: storage-config
persistence:
enabled: true
size: 2150Gi
storageClass: ssd
webservice:
ingress:
annotations:
'"nginx.ingress.kubernetes.io/proxy-body-size"': 2048m
'"nginx.ingress.kubernetes.io/proxy-connect-timeout"': 60
gitlab-runner:
checkInterval: 10
concurrent: 10
install: true
metrics:
enabled: true
rbac:
create: true
runners:
builds:
cpuLimit: "2"
cpuRequests: 500m
memoryLimit: 4096Mi
memoryRequests: 1024Mi
cache:
cacheShared: true
cacheType: gcs
gcsBucketname: gitlab-runner-cache-*******
secretName: google-application-credentials
helpers:
cpuLimit: 200m
cpuRequests: 25m
image: gitlab/gitlab-runner-helper:x86_64-latest
memoryLimit: 512Mi
memoryRequests: 256Mi
locked: false
outputLimit: 16384
privileged: false
requestConcurrency: 25
runUntagged: true
services:
cpuLimit: 200m
cpuRequests: 50m
memoryLimit: 512Mi
memoryRequests: 128Mi
tags: cloud
unregisterRunners: true
global:
appConfig:
artifacts:
bucket: gitlab-artifacts-*******
connection:
key: connection
secret: gitlab-rails-storage
backups:
bucket: gitlab-backups-*******
tmpBucket: gitlab-tmp-storage-*******
dependencyProxy:
bucket: gitlab-dependency-proxy-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
enableUsagePing: true
externalDiffs:
bucket: gitlab-external-diffs-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
proxy_download: true
when: outdated
extra:
googleAnalyticsId: UA-162428810-1
incomingEmail:
address: gitlab@$$$$$$
enabled: false
host: 10.30.20.138
password:
secret: gitlab-smtp
port: 143
ssl: false
ldap:
enabled: false
preventSignin: true
lfs:
bucket: gitlab-lfs-*******
connection:
key: connection
secret: gitlab-rails-storage
omniauth:
allowBypassTwoFactor: []
allowSingleSignOn:
- azure_oauth2
autoLinkLdapUser: true
autoLinkSamlUser: true
autoLinkUser: true
autoSignInWithProvider: azure_oauth2
blockAutoCreatedUsers: false
enabled: true
externalProviders: []
providers:
- key: provider
secret: azuread-secret
syncProfileAttributes:
- name
- email
- location
syncProfileFromProvider:
- azure_oauth2
packages:
bucket: gitlab-packages-*******
connection:
key: connection
secret: gitlab-rails-storage
pseudonymizer:
bucket: gitlab-pseudonymizer-*******
connection:
key: connection
secret: gitlab-rails-storage
terraformState:
bucket: gitlab-terraform-states-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
uploads:
bucket: gitlab-uploads-*******
connection:
key: connection
secret: gitlab-rails-storage
edition: ee
email:
from: gitlab@gitlab.$$$$$$
reply_to: gitlab@$$$$$$
gitaly:
internal:
names:
- default
- large
grafana:
enabled: true
hosts:
domain: $$$$$$
externalIP: $$$$$$$$
https: true
registry:
name: registry.gitlab.$$$$$$
ssh: null
ingress:
configureCertmanager: true
enabled: true
tls:
enabled: true
minio:
enabled: false
operator:
enabled: false
pages:
accessControl: false
apiSecret: {}
artifactsServer: true
enabled: true
externalHttp: []
externalHttps: []
host: pages.gitlab.$$$$$$
https: true
objectStore:
bucket: gitlab-pages-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
proxy_download: true
ports: 443
prometheus:
persistence:
enabled: true
storageClass: ssd
psql:
database: gitlabhq-prod
host: 10.128.2.5
password:
key: password
secret: gitlab-pg
port: 5432
username: psql_user
rails:
bootsnap:
enabled: true
redis:
host: 10.128.0.4
password:
enabled: false
registry:
bucket: gitlab-registry-*******
smtp:
address: smtp.eu.mailgun.org
authentication: plain
enabled: true
openssl_verify_mode: none
password:
secret: gitlab-smtp
port: 587
starttls_auto: true
user_name: postmaster@mg.gitlab.$$$$$$
webservice:
replicaCount: 4
kas:
enabled: true
nginx-ingress:
controller:
service:
externalTrafficPolicy: Cluster
postgresql:
install: false
prometheus:
install: true
redis:
install: false
registry:
ingress:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: 0
nginx.ingress.kubernetes.io/proxy-buffering: "off"
nginx.ingress.kubernetes.io/proxy-connect-timeout: 180
nginx.ingress.kubernetes.io/proxy-read-timeout: 900
nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
storage:
extraKey: gcs.json
key: storage
secret: gitlab-registry-storage

Using dummy value for workaround

USER-SUPPLIED VALUES:
' gitlab':
task-runner:
backups:
cron:
extraArgs: --skip registry
certmanager-issuer:
email: gitlab.admin@$$$$$$
gitlab:
gitaly:
persistence:
enabled: true
size: 512Gi
storageClass: ssd
task-runner:
backups:
cron:
enabled: true
persistence:
enabled: true
size: 2150Gi
storageClass: ssd
schedule: 5 2 * * *
objectStorage:
backend: gcs
config:
gcpProject: $$$-gitlab-prod
key: config
secret: storage-config
persistence:
enabled: true
size: 2150Gi
storageClass: ssd
webservice:
ingress:
annotations:
'"nginx.ingress.kubernetes.io/proxy-body-size"': 2048m
'"nginx.ingress.kubernetes.io/proxy-connect-timeout"': 60
gitlab-runner:
checkInterval: 10
concurrent: 10
install: true
metrics:
enabled: true
rbac:
create: true
runners:
builds:
cpuLimit: "2"
cpuRequests: 500m
memoryLimit: 4096Mi
memoryRequests: 1024Mi
cache:
cacheShared: true
cacheType: gcs
gcsBucketname: gitlab-runner-cache-*******
secretName: google-application-credentials
helpers:
cpuLimit: 200m
cpuRequests: 25m
image: gitlab/gitlab-runner-helper:x86_64-latest
memoryLimit: 512Mi
memoryRequests: 256Mi
locked: false
outputLimit: 16384
privileged: false
requestConcurrency: 25
runUntagged: true
services:
cpuLimit: 200m
cpuRequests: 50m
memoryLimit: 512Mi
memoryRequests: 128Mi
tags: cloud
unregisterRunners: true
global:
appConfig:
artifacts:
bucket: gitlab-artifacts-*******
connection:
key: connection
secret: gitlab-rails-storage
backups:
bucket: gitlab-backups-*******
tmpBucket: gitlab-tmp-storage-*******
dependencyProxy:
bucket: gitlab-dependency-proxy-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
enableUsagePing: true
externalDiffs:
bucket: gitlab-external-diffs-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
proxy_download: true
when: outdated
extra:
googleAnalyticsId: UA-162428810-1
incomingEmail:
address: gitlab@$$$$$$
enabled: false
host: 10.30.20.138
password:
secret: gitlab-smtp
port: 143
ssl: false
ldap:
enabled: false
preventSignin: true
servers:
main:
label: AD
lfs:
bucket: gitlab-lfs-*******
connection:
key: connection
secret: gitlab-rails-storage
omniauth:
allowBypassTwoFactor: []
allowSingleSignOn:
- azure_oauth2
autoLinkLdapUser: true
autoLinkSamlUser: true
autoLinkUser: true
autoSignInWithProvider: azure_oauth2
blockAutoCreatedUsers: false
enabled: true
externalProviders: []
providers:
- key: provider
secret: azuread-secret
syncProfileAttributes:
- name
- email
- location
syncProfileFromProvider:
- azure_oauth2
packages:
bucket: gitlab-packages-*******
connection:
key: connection
secret: gitlab-rails-storage
pseudonymizer:
bucket: gitlab-pseudonymizer-*******
connection:
key: connection
secret: gitlab-rails-storage
terraformState:
bucket: gitlab-terraform-states-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
uploads:
bucket: gitlab-uploads-*******
connection:
key: connection
secret: gitlab-rails-storage
edition: ee
email:
from: gitlab@gitlab.$$$$$$
reply_to: gitlab@$$$$$$
gitaly:
internal:
names:
- default
- large
grafana:
enabled: true
hosts:
domain: $$$$$$
externalIP: $$$$$$$$
https: true
registry:
name: registry.gitlab.$$$$$$
ssh: null
ingress:
configureCertmanager: true
enabled: true
tls:
enabled: true
minio:
enabled: false
operator:
enabled: false
pages:
accessControl: false
apiSecret: {}
artifactsServer: true
enabled: true
externalHttp: []
externalHttps: []
host: pages.gitlab.$$$$$$
https: true
objectStore:
bucket: gitlab-pages-*******
connection:
key: connection
secret: gitlab-rails-storage
enabled: true
proxy_download: true
ports: 443
prometheus:
persistence:
enabled: true
storageClass: ssd
psql:
database: gitlabhq-prod
host: 10.128.2.5
password:
key: password
secret: gitlab-pg
port: 5432
username: psql_user
rails:
bootsnap:
enabled: true
redis:
host: 10.128.0.4
password:
enabled: false
registry:
bucket: gitlab-registry-*******
smtp:
address: smtp.eu.mailgun.org
authentication: plain
enabled: true
openssl_verify_mode: none
password:
secret: gitlab-smtp
port: 587
starttls_auto: true
user_name: postmaster@mg.gitlab.$$$$$$
webservice:
replicaCount: 4
kas:
enabled: true
nginx-ingress:
controller:
service:
externalTrafficPolicy: Cluster
postgresql:
install: false
prometheus:
install: true
redis:
install: false
registry:
ingress:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: 0
nginx.ingress.kubernetes.io/proxy-buffering: "off"
nginx.ingress.kubernetes.io/proxy-connect-timeout: 180
nginx.ingress.kubernetes.io/proxy-read-timeout: 900
nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
storage:
extraKey: gcs.json
key: storage
secret: gitlab-registry-storage

Current behavior

User receive error 500 when login in (user already logged in have no issues)

Expected behavior

User can login.

Versions

Chart: 4.8.0

Platform:

Cloud: GKE

Kubernetes: (kubectl version)

Client: v1.19.3

Server: v1.18.12-gke.1205

Helm: (helm version)

Client: v3.4.2

Relevant logs