Add latest changes from gitlab-org/gitlab@master
This commit is contained in:
parent
7a5409764a
commit
3e1ab18831
|
@ -252,7 +252,8 @@ input[type='checkbox']:hover {
|
|||
|
||||
.btn-search,
|
||||
.btn-success,
|
||||
.dropdown-menu-toggle {
|
||||
.dropdown-menu-toggle,
|
||||
.gl-new-dropdown {
|
||||
width: 100%;
|
||||
margin-top: 5px;
|
||||
|
||||
|
@ -270,7 +271,8 @@ input[type='checkbox']:hover {
|
|||
}
|
||||
}
|
||||
|
||||
.dropdown-menu-toggle {
|
||||
.dropdown-menu-toggle,
|
||||
.gl-new-dropdown {
|
||||
@include media-breakpoint-up(sm) {
|
||||
width: 180px;
|
||||
margin-top: 0;
|
||||
|
|
|
@ -2,6 +2,7 @@
|
|||
|
||||
class Admin::UsersController < Admin::ApplicationController
|
||||
include RoutableActions
|
||||
include SortingHelper
|
||||
|
||||
before_action :user, except: [:index, :new, :create]
|
||||
before_action :check_impersonation_availability, only: :impersonate
|
||||
|
@ -18,7 +19,8 @@ class Admin::UsersController < Admin::ApplicationController
|
|||
@users = User.filter_items(params[:filter]).order_name_asc
|
||||
@users = @users.search(params[:search_query], with_private_emails: true) if params[:search_query].present?
|
||||
@users = users_with_included_associations(@users)
|
||||
@users = @users.sort_by_attribute(@sort = params[:sort])
|
||||
@sort = params[:sort].presence || sort_value_name
|
||||
@users = @users.sort_by_attribute(@sort)
|
||||
@users = @users.page(params[:page])
|
||||
@users = @users.without_count if paginate_without_count?
|
||||
end
|
||||
|
|
|
@ -328,6 +328,16 @@ module SortingHelper
|
|||
|
||||
sort_direction_button(url, reverse_sort, sort_value)
|
||||
end
|
||||
|
||||
def admin_users_sort_options(path_params)
|
||||
users_sort_options_hash.map do |value, text|
|
||||
{
|
||||
value: value,
|
||||
text: text,
|
||||
href: admin_users_path(sort: value, **path_params)
|
||||
}
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
SortingHelper.prepend_mod_with('SortingHelper')
|
||||
|
|
|
@ -60,17 +60,9 @@
|
|||
= hidden_field_tag :sort, @sort
|
||||
= sprite_icon('search', css_class: 'search-icon')
|
||||
= button_tag s_('AdminUsers|Search users') if Rails.env.test?
|
||||
.dropdown.gl-ml-3
|
||||
= label_tag 'Sort by', nil, class: 'label-bold'
|
||||
- toggle_text = @sort.present? ? users_sort_options_hash[@sort] : sort_title_name
|
||||
= dropdown_toggle(toggle_text, { toggle: 'dropdown' })
|
||||
%ul.dropdown-menu.dropdown-menu-right
|
||||
%li.dropdown-header
|
||||
= s_('AdminUsers|Sort by')
|
||||
%li
|
||||
- users_sort_options_hash.each do |value, title|
|
||||
= link_to admin_users_path(sort: value, filter: params[:filter], search_query: params[:search_query]) do
|
||||
= title
|
||||
.dropdown.gl-sm-ml-3
|
||||
= label_tag s_('AdminUsers|Sort by')
|
||||
= gl_redirect_listbox_tag admin_users_sort_options(filter: params[:filter], search_query: params[:search_query]), @sort, data: { right: true }
|
||||
|
||||
#js-admin-users-app{ data: admin_users_data_attributes(@users) }
|
||||
.gl-spinner-container.gl-my-7
|
||||
|
|
|
@ -33,7 +33,7 @@
|
|||
.table-mobile-header{ role: 'rowheader' }= _('Projects')
|
||||
.table-mobile-content
|
||||
- if runner.group_type?
|
||||
= _('n/a')
|
||||
\-
|
||||
- else
|
||||
= runner.runner_projects.count(:all)
|
||||
|
||||
|
|
|
@ -14,7 +14,7 @@
|
|||
announcement_milestone: "14.8" # The milestone when this feature was first announced as deprecated.
|
||||
announcement_date: "2022-02-22" # The date of the milestone release when this feature was first announced as deprecated. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
|
||||
removal_milestone: "15.0" # The milestone when this feature is planned to be removed
|
||||
removal_date: # The date of the milestone release when this feature is planned to be removed. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
|
||||
removal_date: "2022-05-22" # The date of the milestone release when this feature is planned to be removed. This should almost always be the 22nd of a month (YYYY-MM-22), unless you did an out of band blog post.
|
||||
breaking_change: true # If this deprecation is a breaking change, set this value to true
|
||||
reporter: dhershkovitch # GitLab username of the person reporting the deprecation
|
||||
body: | # Do not modify this line, instead modify the lines below.
|
|
@ -48,7 +48,7 @@ changes to your code, settings, or workflow.
|
|||
|
||||
The `CI_JOB_JWT` will be updated to support a wider variety of cloud providers. It will be changed to match [`CI_JOB_JWT_V2`](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html), but this change may not be backwards compatible for all users, including Hashicorp Vault users. To maintain the current behavior, users can switch to using `CI_JOB_JWT_V1`, or update their configuration in GitLab 15.0 to use the improved `CI_JOB_JWT`.
|
||||
|
||||
**Planned removal milestone: 15.0 ()**
|
||||
**Planned removal milestone: 15.0 (2022-05-22)**
|
||||
|
||||
### Configurable Gitaly `per_repository` election strategy
|
||||
|
||||
|
|
|
@ -4,66 +4,74 @@ group: Configure
|
|||
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
|
||||
---
|
||||
|
||||
# Inventory object **(PREMIUM)**
|
||||
# Tracking cluster resources managed by GitLab **(PREMIUM)**
|
||||
|
||||
> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/332227) in GitLab 14.0.
|
||||
|
||||
An inventory object is a `ConfigMap` object for keeping track of the set of objects applied to a cluster.
|
||||
When you remove objects from a manifest repository, the agent uses a corresponding inventory object to
|
||||
prune (delete) objects from the cluster.
|
||||
GitLab uses an inventory object to track the resources you deploy to your cluster.
|
||||
The inventory object is a `ConfigMap` that contains a list of controlled objects.
|
||||
The managed resources use the `cli-utils.sigs.k8s.io/inventory-id` annotation.
|
||||
|
||||
The agent creates an inventory object for each manifest project specified in the
|
||||
`gitops.manifest_projects` configuration section. The inventory object has to be stored somewhere in the cluster.
|
||||
The default behavior is:
|
||||
## Default location of the inventory object
|
||||
|
||||
- The `namespace` used comes from `gitops.manifest_projects[].default_namespace`. If you don't specify this parameter
|
||||
explicitly, the inventory object is stored in the `default` namespace.
|
||||
- The `name` is generated from the numeric project ID of the manifest project and the numeric agent ID.
|
||||
|
||||
This way, the agent constructs the name and location where the inventory object is
|
||||
stored in the cluster.
|
||||
|
||||
The agent cannot locate the existing inventory object if you:
|
||||
|
||||
- Change `gitops.manifest_projects[].default_namespace` parameter.
|
||||
- Move manifests into another project.
|
||||
|
||||
## Inventory object template
|
||||
|
||||
The inventory object template is a `ConfigMap` object that allows you to configure the namespace and the name of the inventory
|
||||
object. Store this template with manifest files as a single logical group.
|
||||
|
||||
Example inventory object template:
|
||||
In the agent configuration file, you specify a list of projects. For example:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
gitops:
|
||||
manifest_projects:
|
||||
- id: gitlab-org/cluster-integration/gitlab-agent
|
||||
default_namespace: my-ns
|
||||
```
|
||||
|
||||
The agent creates an inventory object for every item in the `manifest_projects` list.
|
||||
The inventory object is stored in the namespace you specify for `default_namespace`.
|
||||
|
||||
The name and location of the inventory object is based on:
|
||||
|
||||
- The `default_namespace`. If you don't specify this parameter,
|
||||
the inventory object is stored in the `default` namespace.
|
||||
- The `name`, which is the ID of the project with the manifest and the ID of the agent.
|
||||
|
||||
WARNING:
|
||||
The agent cannot locate the existing inventory object if you change
|
||||
the `default_namespace` parameter or move manifests to another project.
|
||||
|
||||
## Change the location of the inventory object
|
||||
|
||||
You can configure the namespace and the name of the inventory object.
|
||||
This action changes the location of the object in the cluster.
|
||||
|
||||
1. Create an inventory object template, which is a `ConfigMap` object.
|
||||
For example:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: unique-name-for-the-inventory
|
||||
namespace: my-project-namespace
|
||||
labels:
|
||||
cli-utils.sigs.k8s.io/inventory-id: unique-name-for-the-inventory
|
||||
```
|
||||
```
|
||||
|
||||
- The `namespace` and `name` fields configure where the real inventory object is created.
|
||||
- The `cli-utils.sigs.k8s.io/inventory-id` label with its corresponding value is set on the inventory object, created
|
||||
from this template. Make sure that the value is unique (for example, a string of random characters) and doesn't clash
|
||||
with any existing or future inventory object templates.
|
||||
- Objects tracked by this inventory object have the `config.k8s.io/owning-inventory` annotation set to the value of
|
||||
the `cli-utils.sigs.k8s.io/inventory-id` label.
|
||||
- The label's value doesn't have to match the `name` but it's convenient to have them set to the same value.
|
||||
- Make sure that the `name` is unique so that it doesn't conflict with another inventory object in the same
|
||||
namespace in the future.
|
||||
1. Specify a `namespace` and `name`. Ensure that the `name` is unique so it doesn't conflict with other
|
||||
inventory objects in the same namespace in the future.
|
||||
1. Ensure the value for `cli-utils.sigs.k8s.io/inventory-id` is unique. This value is used for objects
|
||||
tracked by this inventory object. Their `config.k8s.io/owning-inventory` annotation is set to this value.
|
||||
|
||||
## Using GitOps with pre-existing Kubernetes objects
|
||||
The value doesn't have to match the `name` but it's convenient to set them to the same value.
|
||||
|
||||
The agent treats manifest files in the manifest repository as the source of truth. When it applies
|
||||
objects from the files to the cluster, it tracks them in an inventory object. If an object already exists,
|
||||
The agent behaves differently based on the `gitops.manifest_projects[].inventory_policy` configuration.
|
||||
Check the table below with the available options and when to use them.
|
||||
1. Save the file with the manifest files as a single logical group.
|
||||
|
||||
## `inventory_policy` options
|
||||
|
||||
Sometimes your manifest changes affect resources that aren't tracked by the GitLab inventory object.
|
||||
|
||||
To change how the agent behaves when it overwrites existing and previously untracked resources,
|
||||
change the `inventory_policy` value.
|
||||
|
||||
`inventory_policy` value | Description |
|
||||
------------------------ | ------------------------------------------------------------------------------------------- |
|
||||
`must_match` | This is the default policy. A live object must have the `config.k8s.io/owning-inventory` annotation set to the same value as the `cli-utils.sigs.k8s.io/inventory-id` label on the corresponding inventory object to be updated. Object is not updated and an error is reported if the values don't match or the object doesn't have the annotation. |
|
||||
`adopt_if_no_inventory` | This mode allows to "adopt" an object if it doesn't have the `config.k8s.io/owning-inventory` annotation. Use this mode if you want to start managing existing objects using the GitOps feature. Once all objects have been "adopted", we recommend you to put the setting back into the default `must_match` mode to avoid any unexpected adoptions. |
|
||||
`adopt_all` | This mode allows to "adopt" an object even if it has the `config.k8s.io/owning-inventory` annotation set to a different value. This mode can be useful if you want to migrate a set of objects from one agent to another one or from some other tool to the agent. Once all objects have been "adopted", we recommend you to put the setting back into the default `must_match` mode to avoid any unexpected adoptions. |
|
||||
`must_match` | The default policy. To be updated, a live object must have the `config.k8s.io/owning-inventory` annotation set to the same value as the `cli-utils.sigs.k8s.io/inventory-id` label on the corresponding inventory object. If the values don't match or the object doesn't have the annotation, the object is not updated and an error is reported. |
|
||||
`adopt_if_no_inventory` | Adopt an object if it doesn't have the `config.k8s.io/owning-inventory` annotation. Use this mode if you want to start managing existing objects by using the GitOps feature. To avoid unexpected adoptions, after all objects have been adopted, put the setting back to the default `must_match` mode. |
|
||||
`adopt_all` | Adopt an object even if it has the `config.k8s.io/owning-inventory` annotation set to a different value. Use this mode if you want to migrate a set of objects from one agent to another, or from some other tool to the agent. To avoid unexpected adoptions, after all objects have been adopted, put the setting back to the default `must_match` mode. |
|
||||
|
|
|
@ -5,6 +5,10 @@ module Gitlab
|
|||
extend self
|
||||
PathTraversalAttackError ||= Class.new(StandardError)
|
||||
|
||||
private_class_method def logger
|
||||
@logger ||= Gitlab::AppLogger
|
||||
end
|
||||
|
||||
# Ensure that the relative path will not traverse outside the base directory
|
||||
# We url decode the path to avoid passing invalid paths forward in url encoded format.
|
||||
# Also see https://gitlab.com/gitlab-org/gitlab/-/merge_requests/24223#note_284122580
|
||||
|
@ -16,6 +20,7 @@ module Gitlab
|
|||
path_regex = %r{(\A(\.{1,2})\z|\A\.\.[/\\]|[/\\]\.\.\z|[/\\]\.\.[/\\]|\n)}
|
||||
|
||||
if path.match?(path_regex)
|
||||
logger.warn(message: "Potential path traversal attempt detected", path: "#{path}")
|
||||
raise PathTraversalAttackError, 'Invalid path'
|
||||
end
|
||||
|
||||
|
|
|
@ -35,7 +35,10 @@ module QA
|
|||
source_group.add_member(member, Resource::Members::AccessLevel::DEVELOPER)
|
||||
end
|
||||
|
||||
it 'member retains indirect membership in imported project' do
|
||||
it(
|
||||
'member retains indirect membership in imported project',
|
||||
testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/354416'
|
||||
) do
|
||||
expect_import_finished
|
||||
|
||||
aggregate_failures do
|
||||
|
@ -52,7 +55,10 @@ module QA
|
|||
source_project.add_member(member, Resource::Members::AccessLevel::DEVELOPER)
|
||||
end
|
||||
|
||||
it 'member retains direct membership in imported project' do
|
||||
it(
|
||||
'member retains direct membership in imported project',
|
||||
testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/354417'
|
||||
) do
|
||||
expect_import_finished
|
||||
|
||||
aggregate_failures do
|
||||
|
|
|
@ -132,7 +132,7 @@ RSpec.describe 'Admin::Users' do
|
|||
end
|
||||
|
||||
it 'searches with respect of sorting' do
|
||||
visit admin_users_path(sort: 'Name')
|
||||
visit admin_users_path(sort: 'name_asc')
|
||||
|
||||
fill_in :search_query, with: 'Foo'
|
||||
click_button('Search users')
|
||||
|
@ -604,8 +604,8 @@ RSpec.describe 'Admin::Users' do
|
|||
|
||||
def sort_by(option)
|
||||
page.within('.filtered-search-block') do
|
||||
find('.dropdown-menu-toggle').click
|
||||
click_link option
|
||||
find('.gl-new-dropdown').click
|
||||
find('.gl-new-dropdown-item', text: option).click
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
@ -10,6 +10,18 @@ RSpec.describe SortingHelper do
|
|||
allow(self).to receive(:request).and_return(double(path: 'http://test.com', query_parameters: { label_name: option }))
|
||||
end
|
||||
|
||||
describe '#admin_users_sort_options' do
|
||||
it 'returns correct link attributes in array' do
|
||||
options = admin_users_sort_options(filter: 'filter', search_query: 'search')
|
||||
|
||||
expect(options[0][:href]).to include('filter')
|
||||
expect(options[0][:href]).to include('search')
|
||||
options.each do |option|
|
||||
expect(option[:href]).to include(option[:value])
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe '#issuable_sort_option_title' do
|
||||
it 'returns correct title for issuable_sort_option_overrides key' do
|
||||
expect(issuable_sort_option_title('created_asc')).to eq('Created date')
|
||||
|
|
|
@ -53,6 +53,16 @@ RSpec.describe Gitlab::Utils do
|
|||
expect(check_path_traversal!('dir/.foo.rb')).to eq('dir/.foo.rb')
|
||||
end
|
||||
|
||||
it 'logs potential path traversal attempts' do
|
||||
expect(Gitlab::AppLogger).to receive(:warn).with(message: "Potential path traversal attempt detected", path: "..")
|
||||
expect { check_path_traversal!('..') }.to raise_error(/Invalid path/)
|
||||
end
|
||||
|
||||
it 'logs does nothing for a safe string' do
|
||||
expect(Gitlab::AppLogger).not_to receive(:warn).with(message: "Potential path traversal attempt detected", path: "dir/.foo.rb")
|
||||
expect(check_path_traversal!('dir/.foo.rb')).to eq('dir/.foo.rb')
|
||||
end
|
||||
|
||||
it 'does nothing for a non-string' do
|
||||
expect(check_path_traversal!(nil)).to be_nil
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue