Add latest changes from gitlab-org/gitlab@master
This commit is contained in:
GitLab Bot
parent
5cf4cf3425
commit
3c988b99e6
|
|
@ -529,6 +529,7 @@ class ApplicationSetting < ApplicationRecord
|
|||
attr_encrypted :akismet_api_key, encryption_options_base_32_aes_256_gcm
|
||||
attr_encrypted :spam_check_api_key, encryption_options_base_32_aes_256_gcm.merge(encode: false)
|
||||
attr_encrypted :elasticsearch_aws_secret_access_key, encryption_options_base_32_aes_256_gcm
|
||||
attr_encrypted :elasticsearch_password, encryption_options_base_32_aes_256_gcm.merge(encode: false)
|
||||
attr_encrypted :recaptcha_private_key, encryption_options_base_32_aes_256_gcm
|
||||
attr_encrypted :recaptcha_site_key, encryption_options_base_32_aes_256_gcm
|
||||
attr_encrypted :slack_app_secret, encryption_options_base_32_aes_256_gcm
|
||||
|
|
|
|||
|
|
@ -0,0 +1,5 @@
|
|||
---
|
||||
title: Add username and password fields for Advanced Search
|
||||
merge_request: 60710
|
||||
author:
|
||||
type: changed
|
||||
|
|
@ -84,6 +84,7 @@ module Gitlab
|
|||
# Rake tasks ignore the eager loading settings, so we need to set the
|
||||
# autoload paths explicitly
|
||||
config.autoload_paths = config.eager_load_paths.dup
|
||||
config.autoload_paths.push("#{config.root}/lib/generators")
|
||||
|
||||
# Only load the plugins named here, in the order given (default is alphabetical).
|
||||
# :all can be used as a placeholder for all plugins not explicitly named.
|
||||
|
|
@ -145,6 +146,7 @@ module Gitlab
|
|||
encrypted_key
|
||||
import_url
|
||||
elasticsearch_url
|
||||
elasticsearch_password
|
||||
search
|
||||
jwt
|
||||
otp_attempt
|
||||
|
|
|
|||
|
|
@ -0,0 +1,13 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
class AddElasticsearchUsernamePasswordToApplicationSettings < ActiveRecord::Migration[6.0]
|
||||
def change
|
||||
# rubocop:disable Migration/AddLimitToTextColumns
|
||||
# limit is added in 20210505124816_add_text_limit_to_elasticsearch_username
|
||||
add_column :application_settings, :elasticsearch_username, :text
|
||||
# rubocop:enable Migration/AddLimitToTextColumns
|
||||
|
||||
add_column :application_settings, :encrypted_elasticsearch_password, :binary
|
||||
add_column :application_settings, :encrypted_elasticsearch_password_iv, :binary
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
class AddTextLimitToElasticsearchUsername < ActiveRecord::Migration[6.0]
|
||||
include Gitlab::Database::MigrationHelpers
|
||||
|
||||
disable_ddl_transaction!
|
||||
|
||||
def up
|
||||
add_text_limit :application_settings, :elasticsearch_username, 255
|
||||
end
|
||||
|
||||
def down
|
||||
remove_text_limit :application_settings, :elasticsearch_username
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1 @@
|
|||
c8875e02134542370cc5a792bdaefc77b66f58a33a46720f5ef562c33c5b8f41
|
||||
|
|
@ -0,0 +1 @@
|
|||
56aa9590f4bc37d8f8c4ed869a4b095ba39925fb06ab58500eead895d19ee336
|
||||
|
|
@ -9514,6 +9514,9 @@ CREATE TABLE application_settings (
|
|||
encrypted_spam_check_api_key bytea,
|
||||
encrypted_spam_check_api_key_iv bytea,
|
||||
floc_enabled boolean DEFAULT false NOT NULL,
|
||||
elasticsearch_username text,
|
||||
encrypted_elasticsearch_password bytea,
|
||||
encrypted_elasticsearch_password_iv bytea,
|
||||
CONSTRAINT app_settings_container_reg_cleanup_tags_max_list_size_positive CHECK ((container_registry_cleanup_tags_service_max_list_size >= 0)),
|
||||
CONSTRAINT app_settings_ext_pipeline_validation_service_url_text_limit CHECK ((char_length(external_pipeline_validation_service_url) <= 255)),
|
||||
CONSTRAINT app_settings_registry_exp_policies_worker_capacity_positive CHECK ((container_registry_expiration_policies_worker_capacity >= 0)),
|
||||
|
|
@ -9529,6 +9532,7 @@ CREATE TABLE application_settings (
|
|||
CONSTRAINT check_a5704163cc CHECK ((char_length(secret_detection_revocation_token_types_url) <= 255)),
|
||||
CONSTRAINT check_d03919528d CHECK ((char_length(container_registry_vendor) <= 255)),
|
||||
CONSTRAINT check_d820146492 CHECK ((char_length(spam_check_endpoint_url) <= 255)),
|
||||
CONSTRAINT check_e5024c8801 CHECK ((char_length(elasticsearch_username) <= 255)),
|
||||
CONSTRAINT check_e5aba18f02 CHECK ((char_length(container_registry_version) <= 255)),
|
||||
CONSTRAINT check_ef6176834f CHECK ((char_length(encrypted_cloud_license_auth_token_iv) <= 255))
|
||||
);
|
||||
|
|
|
|||
|
|
@ -277,7 +277,9 @@ listed in the descriptions of the relevant settings.
|
|||
| `elasticsearch_namespace_ids` | array of integers | no | **(PREMIUM)** The namespaces to index via Elasticsearch if `elasticsearch_limit_indexing` is enabled. |
|
||||
| `elasticsearch_project_ids` | array of integers | no | **(PREMIUM)** The projects to index via Elasticsearch if `elasticsearch_limit_indexing` is enabled. |
|
||||
| `elasticsearch_search` | boolean | no | **(PREMIUM)** Enable Elasticsearch search. |
|
||||
| `elasticsearch_url` | string | no | **(PREMIUM)** The URL to use for connecting to Elasticsearch. Use a comma-separated list to support cluster (for example, `http://localhost:9200, http://localhost:9201"`). If your Elasticsearch instance is password protected, pass the `username:password` in the URL (for example, `http://<username>:<password>@<elastic_host>:9200/`). |
|
||||
| `elasticsearch_url` | string | no | **(PREMIUM)** The URL to use for connecting to Elasticsearch. Use a comma-separated list to support cluster (for example, `http://localhost:9200, http://localhost:9201"`). |
|
||||
| `elasticsearch_username` | string | no | **(PREMIUM)** The `username` of your Elasticsearch instance. |
|
||||
| `elasticsearch_password` | string | no | **(PREMIUM)** The password of your Elasticsearch instance. |
|
||||
| `email_additional_text` | string | no | **(PREMIUM)** Additional text added to the bottom of every email for legal/auditing/compliance reasons. |
|
||||
| `email_author_in_body` | boolean | no | Some email servers do not support overriding the email sender name. Enable this option to include the name of the author of the issue, merge request or comment in the email body instead. |
|
||||
| `enabled_git_access_protocol` | string | no | Enabled protocols for Git access. Allowed values are: `ssh`, `http`, and `nil` to allow both protocols. |
|
||||
|
|
|
|||
|
|
@ -229,7 +229,9 @@ The following Elasticsearch settings are available:
|
|||
| `Elasticsearch indexing` | Enables or disables Elasticsearch indexing and creates an empty index if one does not already exist. You may want to enable indexing but disable search in order to give the index time to be fully completed, for example. Also, keep in mind that this option doesn't have any impact on existing data, this only enables/disables the background indexer which tracks data changes and ensures new data is indexed. |
|
||||
| `Pause Elasticsearch indexing` | Enables or disables temporary indexing pause. This is useful for cluster migration/reindexing. All changes are still tracked, but they are not committed to the Elasticsearch index until resumed. |
|
||||
| `Search with Elasticsearch enabled` | Enables or disables using Elasticsearch in search. |
|
||||
| `URL` | The URL to use for connecting to Elasticsearch. Use a comma-separated list to support clustering (e.g., `http://host1, https://host2:9200`). If your Elasticsearch instance is password protected, pass the `username:password` in the URL (e.g., `http://<username>:<password>@<elastic_host>:9200/`). Special characters in the username or password should use [percentage encoding](https://en.wikipedia.org/wiki/Percent-encoding). |
|
||||
| `URL` | The URL of your Elasticsearch instance. Use a comma-separated list to support clustering (for example, `http://host1, https://host2:9200`). If your Elasticsearch instance is password-protected, use the `Username` and `Password` fields described below. Alternatively, use inline credentials such as `http://<username>:<password>@<elastic_host>:9200/`. |
|
||||
| `Username` | The `username` of your Elasticsearch instance. |
|
||||
| `Password` | The password of your Elasticsearch instance. |
|
||||
| `Number of Elasticsearch shards` | Elasticsearch indexes are split into multiple shards for performance reasons. In general, you should use at least 5 shards, and indexes with tens of millions of documents need to have more shards ([see below](#guidance-on-choosing-optimal-cluster-configuration)). Changes to this value do not take effect until the index is recreated. You can read more about tradeoffs in the [Elasticsearch documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/scalability.html). |
|
||||
| `Number of Elasticsearch replicas` | Each Elasticsearch shard can have a number of replicas. These are a complete copy of the shard, and can provide increased query performance or resilience against hardware failure. Increasing this value will greatly increase total disk space required by the index. |
|
||||
| `Limit namespaces and projects that can be indexed` | Enabling this will allow you to select namespaces and projects to index. All other namespaces and projects will use database search instead. Please note that if you enable this option but do not select any namespaces or projects, none will be indexed. [Read more below](#limiting-namespaces-and-projects).
|
||||
|
|
@ -326,16 +328,57 @@ index alias to it which becomes the new `primary` index. At the end, we resume t
|
|||
|
||||
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/34069) in GitLab 13.2.
|
||||
> - A scheduled index deletion and the ability to cancel it was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/38914) in GitLab 13.3.
|
||||
> - Support for retries during reindexing was [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/55681) in GitLab 13.12.
|
||||
|
||||
Under **Admin Area > Settings > Advanced Search > Elasticsearch zero-downtime reindexing**, click on **Trigger cluster reindexing**.
|
||||
To trigger the reindexing process:
|
||||
|
||||
1. Sign in to your GitLab instance as an administrator.
|
||||
1. Go to **Admin Area > Settings > Advanced Search > Elasticsearch zero-downtime reindexing**.
|
||||
1. Select **Trigger cluster reindexing**.
|
||||
|
||||
Reindexing can be a lengthy process depending on the size of your Elasticsearch cluster.
|
||||
|
||||
WARNING:
|
||||
After the reindexing is completed, the original index will be scheduled to be deleted after 14 days. You can cancel this action by pressing the cancel button.
|
||||
After this process is completed, the original index is scheduled to be deleted after
|
||||
14 days. You can cancel this action by pressing the **Cancel** button on the same
|
||||
page you triggered the reindexing process.
|
||||
|
||||
While the reindexing is running, you will be able to follow its progress under that same section.
|
||||
|
||||
#### Elasticsearch zero-downtime reindexing
|
||||
|
||||
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/55681) in GitLab 13.12.
|
||||
|
||||
The following reindex settings are available in **Admin Area > Settings > Advanced Search > Elasticsearch zero-downtime reindexing**:
|
||||
|
||||
- [Slice multiplier](#slice-multiplier)
|
||||
- [Maximum running slices](#maximum-running-slices)
|
||||
|
||||
##### Slice multiplier
|
||||
|
||||
The slice multiplier calculates the [number of slices during reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html#docs-reindex-slice).
|
||||
|
||||
GitLab uses [manual slicing](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html#docs-reindex-manual-slice)
|
||||
to control the reindex efficiently and safely, which enables users to retry only
|
||||
failed slices.
|
||||
|
||||
The multiplier defaults to `2` and applies to the number of shards per index.
|
||||
For example, if this value is `2` and your index has 20 shards, then the
|
||||
reindex task is split into 40 slices.
|
||||
|
||||
##### Maximum running slices
|
||||
|
||||
The maximum running slices parameter defaults to `60` and corresponds to the
|
||||
maximum number of slices allowed to run concurrently during Elasticsearch
|
||||
reindexing.
|
||||
|
||||
Setting this value too high can have adverse performance impacts as your cluster
|
||||
may become heavily saturated with searches and writes. Setting this value too
|
||||
low may lead the reindexing process to take a very long time to complete.
|
||||
|
||||
The best value for this will depend on your cluster size, whether you're willing
|
||||
to accept some degraded search performance during reindexing, and how important
|
||||
it is for the reindex to finish quickly and unpause indexing.
|
||||
|
||||
### Mark the most recent reindex job as failed and resume the indexing
|
||||
|
||||
Sometimes, you might want to abandon the unfinished reindex job and resume the indexing. You can achieve this via the following steps:
|
||||
|
|
|
|||
|
|
@ -460,11 +460,14 @@ configured to act as a remote proxy and add the `Gitlab-DAST-Permission` header.
|
|||
|
||||
### API scan
|
||||
|
||||
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10928) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.10.
|
||||
> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10928) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 12.10.
|
||||
> - A new DAST API scanning engine was introduced in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.10.
|
||||
|
||||
Using an API specification as a scan's target is a useful way to seed URLs for scanning an API.
|
||||
Vulnerability rules in an API scan are different than those in a normal website scan.
|
||||
|
||||
A new DAST API scanning engine is available in GitLab 13.12 and later. For more details, see [DAST API scanning engine](../dast_api). The new scanning engine supports REST, SOAP, GraphQL, and generic APIs using forms, XML, and JSON. Testing can be performed using OpenAPI, Postman Collections, and HTTP Archive (HAR) documents.
|
||||
|
||||
#### Specification format
|
||||
|
||||
API scans support OpenAPI V2 and OpenAPI V3 specifications. You can define these specifications using `JSON` or `YAML`.
|
||||
|
|
|
|||
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
File diff suppressed because it is too large
Load Diff
|
|
@ -37,6 +37,7 @@ GitLab uses the following tools to scan and report known vulnerabilities found i
|
|||
| [Dependency List](dependency_list/index.md) **(ULTIMATE)** | View your project's dependencies and their known vulnerabilities. |
|
||||
| [Dependency Scanning](dependency_scanning/index.md) **(ULTIMATE)** | Analyze your dependencies for known vulnerabilities. |
|
||||
| [Dynamic Application Security Testing (DAST)](dast/index.md) **(ULTIMATE)** | Analyze running web applications for known vulnerabilities. |
|
||||
| [DAST API](dast_api/index.md) **(ULTIMATE)** | Analyze running web APIs for known vulnerabilities. |
|
||||
| [API fuzzing](api_fuzzing/index.md) **(ULTIMATE)** | Find unknown bugs and vulnerabilities in web APIs with fuzzing. |
|
||||
| [Secret Detection](secret_detection/index.md) | Analyze Git history for leaked secrets. |
|
||||
| [Security Dashboard](security_dashboard/index.md) **(ULTIMATE)** | View vulnerabilities in all your projects and groups. |
|
||||
|
|
@ -104,19 +105,6 @@ rules:
|
|||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
```
|
||||
|
||||
## Security Scanning with Auto DevOps
|
||||
|
||||
When [Auto DevOps](../../topics/autodevops/) is enabled, all GitLab Security scanning tools are configured using default settings.
|
||||
|
||||
- [Auto SAST](../../topics/autodevops/stages.md#auto-sast)
|
||||
- [Auto Secret Detection](../../topics/autodevops/stages.md#auto-secret-detection)
|
||||
- [Auto DAST](../../topics/autodevops/stages.md#auto-dast)
|
||||
- [Auto Dependency Scanning](../../topics/autodevops/stages.md#auto-dependency-scanning)
|
||||
- [Auto License Compliance](../../topics/autodevops/stages.md#auto-license-compliance)
|
||||
- [Auto Container Scanning](../../topics/autodevops/stages.md#auto-container-scanning)
|
||||
|
||||
While you cannot directly customize Auto DevOps, you can [include the Auto DevOps template in your project's `.gitlab-ci.yml` file](../../topics/autodevops/customize.md#customizing-gitlab-ciyml).
|
||||
|
||||
## Default behavior of GitLab security scanning tools
|
||||
|
||||
### Secure jobs in your pipeline
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
# frozen_string_literal: true
|
||||
|
||||
require 'rails/generators'
|
||||
require_relative '../usage_metric_definition_generator'
|
||||
|
||||
module Gitlab
|
||||
module UsageMetricDefinition
|
||||
|
|
|
|||
|
|
@ -243,23 +243,13 @@ module Gitlab
|
|||
# pool_size - The size of the DB pool.
|
||||
# host - An optional host name to use instead of the default one.
|
||||
def self.create_connection_pool(pool_size, host = nil, port = nil)
|
||||
env = Rails.env
|
||||
original_config = ActiveRecord::Base.configurations.to_h
|
||||
original_config = Gitlab::Database.config
|
||||
|
||||
env_config = original_config[env].with_indifferent_access.merge(pool: pool_size)
|
||||
env_config = original_config.merge(pool: pool_size)
|
||||
env_config[:host] = host if host
|
||||
env_config[:port] = port if port
|
||||
|
||||
config = ActiveRecord::DatabaseConfigurations.new(
|
||||
original_config.merge(env => env_config)
|
||||
)
|
||||
|
||||
spec =
|
||||
ActiveRecord::
|
||||
ConnectionAdapters::
|
||||
ConnectionSpecification::Resolver.new(config).spec(env.to_sym)
|
||||
|
||||
ActiveRecord::ConnectionAdapters::ConnectionPool.new(spec)
|
||||
ActiveRecord::ConnectionAdapters::ConnectionHandler.new.establish_connection(env_config)
|
||||
end
|
||||
|
||||
def self.connection
|
||||
|
|
|
|||
|
|
@ -2777,9 +2777,6 @@ msgstr ""
|
|||
msgid "Advanced Search"
|
||||
msgstr ""
|
||||
|
||||
msgid "Advanced Search with Elasticsearch"
|
||||
msgstr ""
|
||||
|
||||
msgid "Advanced Settings"
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -8425,6 +8422,9 @@ msgstr ""
|
|||
msgid "Configure repository mirroring."
|
||||
msgstr ""
|
||||
|
||||
msgid "Configure settings for Advanced Search with Elasticsearch."
|
||||
msgstr ""
|
||||
|
||||
msgid "Configure specific limits for Packages API requests that supersede the general user and IP rate limits."
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -11945,6 +11945,9 @@ msgstr ""
|
|||
msgid "Elasticsearch reindexing triggered"
|
||||
msgstr ""
|
||||
|
||||
msgid "Elasticsearch reindexing was not started: %{errors}"
|
||||
msgstr ""
|
||||
|
||||
msgid "Elasticsearch returned status code: %{status_code}"
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -20266,6 +20269,9 @@ msgstr ""
|
|||
msgid "Maximum push size (MB)"
|
||||
msgstr ""
|
||||
|
||||
msgid "Maximum running slices"
|
||||
msgstr ""
|
||||
|
||||
msgid "Maximum size limit for a single commit."
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -23650,6 +23656,9 @@ msgstr ""
|
|||
msgid "Password"
|
||||
msgstr ""
|
||||
|
||||
msgid "Password (for password-protected Elasticsearch servers)"
|
||||
msgstr ""
|
||||
|
||||
msgid "Password (optional)"
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -26985,7 +26994,7 @@ msgstr ""
|
|||
msgid "Regulate approvals by authors/committers. Affects all projects."
|
||||
msgstr ""
|
||||
|
||||
msgid "Reindexing Status: %{status}"
|
||||
msgid "Reindexing Status: %{status} (Slice multiplier: %{multiplier}, Maximum running slices: %{max_slices})"
|
||||
msgstr ""
|
||||
|
||||
msgid "Rejected (closed)"
|
||||
|
|
@ -30110,6 +30119,9 @@ msgstr ""
|
|||
msgid "SlackService|This service allows users to perform common operations on this project by entering slash commands in Slack."
|
||||
msgstr ""
|
||||
|
||||
msgid "Slice multiplier"
|
||||
msgstr ""
|
||||
|
||||
msgid "Smartcard"
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -32282,6 +32294,9 @@ msgstr ""
|
|||
msgid "The maximum file size is %{size}."
|
||||
msgstr ""
|
||||
|
||||
msgid "The maximum number of slices allowed to run concurrently during Elasticsearch reindexing. Learn more about %{max_slices_running_link_start}maximum running slices configuration%{max_slices_link_end}."
|
||||
msgstr ""
|
||||
|
||||
msgid "The maximum number of tags that a single worker accepts for cleanup. If the number of tags goes above this limit, the list of tags to delete is truncated to this number. To remove this limit, set it to 0."
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -33041,9 +33056,6 @@ msgstr ""
|
|||
msgid "This feature requires local storage to be enabled"
|
||||
msgstr ""
|
||||
|
||||
msgid "This feature should be used with an index that was created after 13.0"
|
||||
msgstr ""
|
||||
|
||||
msgid "This field is required."
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -34241,6 +34253,9 @@ msgstr ""
|
|||
msgid "Trigger cluster reindexing"
|
||||
msgstr ""
|
||||
|
||||
msgid "Trigger cluster reindexing. This feature should be used with an index that was created after 13.0."
|
||||
msgstr ""
|
||||
|
||||
msgid "Trigger manual job"
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -35201,6 +35216,9 @@ msgstr ""
|
|||
msgid "Used programming language"
|
||||
msgstr ""
|
||||
|
||||
msgid "Used to calculate the number of slices during reindexing. The multiplier will be applied to the number of shards per index. Learn more about %{slice_multiplier_link_start}slice multiplier configuration%{slice_multiplier_link_end}."
|
||||
msgstr ""
|
||||
|
||||
msgid "Used to help configure your identity provider"
|
||||
msgstr ""
|
||||
|
||||
|
|
@ -35462,6 +35480,9 @@ msgstr ""
|
|||
msgid "UserProfile|made a private contribution"
|
||||
msgstr ""
|
||||
|
||||
msgid "Username (for password-protected Elasticsearch servers)"
|
||||
msgstr ""
|
||||
|
||||
msgid "Username (optional)"
|
||||
msgstr ""
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue