gitlab-exporter 17.2.0 → 18.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f67afb938a5a207bd67f7402559c6bf2c62e8c48e2d24660c052361727e862a
-  data.tar.gz: ec77e34ad3640e64d368a00a844d91e651d64d1c300a8f8a82de3c4c0567fb8b
+  metadata.gz: eeb80abff6288b4494ab0633c290b45d97398f27e9d45c66efeb7a5e712d1ae4
+  data.tar.gz: 24e9c2d111a136700998c2a853fb09410f80f5385bf40dad240c80f9e707130c
 SHA512:
-  metadata.gz: 17a4dd08119dc1f47eb6f6867b466e91090ff3b673ed3d703792e11764dff5a8686c84ad22cc19168bdd9ec66759260956286138bef79bbcece8fc3928c476c9
-  data.tar.gz: bad62ae9548056c970ce2b4c0fb84aa3d60879e397f17e7e97fa0c1a98116174ae7ea6b6d684972b01d1d4f4301fa1c892ec733850ef1fccde08fb0367d15f0f
+  metadata.gz: a33dbd9cb98fa81c22228a74d416e9ee46ee9cb71a27ae3e9ff81f428032ee11c7e6baa4d88109a85735a347b373962c62ad00bfee79e0a5e97a8efb6d020b84
+  data.tar.gz: 3d70ed949a88f0fbde889333231dc0c4072d6602970ebec0eb6f6c8568b762d9af155df5e398c748f8532474fd5456649b4b6bf1cdaef6cb3bc0dd4a656a0213

data/.gitlab-ci.yml

@@ -62,6 +62,9 @@ rspec_integration:
   services:
     - name: redis:${REDIS_VERSION}
       alias: redis-master
+    - name: redis:${REDIS_VERSION}
+      alias: redis-auth
+      command: ["redis-server", "--requirepass", "test-token-secret"]
     - name: bitnamilegacy/redis-sentinel:${REDIS_SENTINEL_VERSION}
       alias: redis-sentinel
       command:
@@ -82,6 +85,8 @@ rspec_integration:
     REDIS_URL: "redis://redis"
     REDIS_SENTINEL_URL: "redis://mymaster"
     REDIS_SENTINELS: "redis-sentinel:26379"
+    REDIS_AUTH_URL: "redis://redis-auth:6379"
+    REDIS_AUTH_PASSWORD: "test-token-secret"
     REDIS_VERSION: latest
     REDIS_SENTINEL_VERSION: latest
     REDIS_SENTINEL_USERNAME: "my-sentinel-username"

data/Gemfile.lock

@@ -1,22 +1,27 @@
 PATH
   remote: .
   specs:
-    gitlab-exporter (17.2.0)
+    gitlab-exporter (18.0.0)
+      az-identity (~> 0.1)
       base64 (= 0.3.0)
       connection_pool (= 2.5.5)
       deep_merge (~> 1.2.2)
       faraday (= 2.15.1)
       pg (= 1.6.3)
       quantile (= 0.2.1)
-      redis (= 4.8.1)
-      redis-namespace (= 1.11.0)
-      sidekiq (= 6.5.12)
+      redis (>= 5, < 6)
+      redis-cloud-auth (~> 0.1)
+      redis-namespace (~> 1.11)
+      sidekiq (>= 7, < 8)
       webrick (~> 1.9)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.3)
+    az-identity (0.1.0)
+      base64
+      faraday (~> 2.0)
     base64 (0.3.0)
     connection_pool (2.5.5)
     deep_merge (1.2.2)
@@ -38,9 +43,15 @@ GEM
     prism (1.9.0)
     quantile (0.2.1)
     racc (1.8.1)
-    rack (2.2.15)
+    rack (2.2.25)
     rainbow (3.1.1)
-    redis (4.8.1)
+    redis (5.4.1)
+      redis-client (>= 0.22.0)
+    redis-client (0.31.0)
+      connection_pool
+    redis-cloud-auth (0.1.1)
+      logger
+      redis-client (>= 0.14)
     redis-namespace (1.11.0)
       redis (>= 4)
     regexp_parser (2.13.1)
@@ -72,10 +83,12 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
-    sidekiq (6.5.12)
-      connection_pool (>= 2.2.5, < 3)
-      rack (~> 2.0)
-      redis (>= 4.5.0, < 5)
+    sidekiq (7.3.10)
+      base64
+      connection_pool (>= 2.3.0, < 3)
+      logger
+      rack (>= 2.2.4, < 3.3)
+      redis-client (>= 0.23.0, < 1)
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
     unicode-emoji (4.2.0)

data/README.md

@@ -11,6 +11,13 @@ gitlab-exporter is a [Prometheus Web exporter] that does the following:
 A central Prometheus process is configured to poll exporters at a specified
 frequency.
 
+### Requirements
+
+The Sidekiq probe uses Sidekiq 7, which talks to Redis through `redis-client`
+and requires a **Redis server version of 6.2 or newer**. This raises the
+minimum Redis version from the 4.0+ that Sidekiq 6 supported; Redis servers
+older than 6.2 are no longer supported.
+
 ### Supported Probes
 
 Below is a list of probes added by this exporter, and their corresponding

data/config/gitlab-exporter.yml.example

@@ -106,6 +106,14 @@ probes:
       # Uncomment if username or password is not part of the redis_url specified above
       # redis_username: 'redis-username'
       # redis_password: 'redis-password'
+      # Uncomment to authenticate with a short-lived, rotating token (for
+      # example Microsoft Entra on Azure Managed Redis) instead of a static
+      # password. redis_username is the AUTH username (the identity object ID);
+      # the token is fetched and refreshed automatically, so omit redis_password.
+      # redis_username: '<identity-object-id>'
+      # redis_credentials_provider:
+      #   provider: azure
+      #   resource: 'https://redis.azure.com'
       redis_enable_client: true
       # Uncomment if Redis Sentinels are needed
       # redis_sentinels:

data/gitlab-exporter.gemspec

@@ -25,15 +25,17 @@ Gem::Specification.new do |s|
   # base64 is required by sidekiq but not declared by it, and is no longer a
   # default gem as of Ruby 3.4. It used to be pulled in transitively via
   # sinatra -> rack-protection; declare it directly now that those are gone.
+  s.add_runtime_dependency "az-identity", "~> 0.1"
   s.add_runtime_dependency "base64", "0.3.0"
   s.add_runtime_dependency "connection_pool", "2.5.5"
   s.add_runtime_dependency "deep_merge", "~> 1.2.2"
   s.add_runtime_dependency "faraday", "2.15.1"
   s.add_runtime_dependency "pg", "1.6.3"
   s.add_runtime_dependency "quantile", "0.2.1"
-  s.add_runtime_dependency "redis", "4.8.1"
-  s.add_runtime_dependency "redis-namespace", "1.11.0"
-  s.add_runtime_dependency "sidekiq", "6.5.12"
+  s.add_runtime_dependency "redis", ">= 5", "< 6"
+  s.add_runtime_dependency "redis-cloud-auth", "~> 0.1"
+  s.add_runtime_dependency "redis-namespace", "~> 1.11"
+  s.add_runtime_dependency "sidekiq", ">= 7", "< 8"
   s.add_runtime_dependency "webrick", "~> 1.9"
 
   s.add_development_dependency "rspec", "~> 3.12.0"

data/lib/gitlab_exporter/sidekiq.rb

@@ -29,12 +29,19 @@ module GitLab
       PrometheusMetrics.describe("sidekiq_enqueued_jobs",
                                  "Total number of jobs enqueued by class name. Only inspects the first #{PROBE_JOBS_LIMIT} jobs per queue.") # rubocop:disable Layout/LineLength
 
+      # Sidekiq 7 memoizes a single Redis pool on the global config, so
+      # config.redis= cannot switch targets once the pool is built. Keep a
+      # pool per target here and run each probe through Sidekiq::Client.via.
       def self.connection_pool
-        @@connection_pool ||= Hash.new do |h, connection_hash| # rubocop:disable Style/ClassVars
-          config = connection_hash.merge(pool_timeout: POOL_TIMEOUT, size: POOL_SIZE)
+        @connection_pool ||= {}
+      end
 
-          h[connection_hash] = Sidekiq::RedisConnection.create(config)
-        end
+      def self.credentials_provider_registered?
+        @credentials_provider_registered
+      end
+
+      def self.credentials_provider_registered!
+        @credentials_provider_registered = true
       end
 
       def initialize(metrics: PrometheusMetrics.new, logger: nil, **opts)
@@ -89,7 +96,11 @@ module GitLab
               # Default to 0; if all jobs are due in the future, there is no "negative" delay.
               delay = 0
 
-              _job, timestamp = conn.zrangebyscore(set, "-inf", now.to_s, limit: [0, 1], withscores: true).first
+              # redis-client cannot serialize the keyword-argument form
+              # (limit:/withscores:), so issue the raw command. RESP3 parses
+              # WITHSCORES into [[member, score]] with a Float score.
+              _job, timestamp = conn.call("ZRANGEBYSCORE", set, "-inf", now.to_s,
+                                          "LIMIT", 0, 1, "WITHSCORES").first
               delay = now - timestamp if timestamp
 
               @metrics.add("sidekiq_#{set}_set_processing_delay_seconds", delay)
@@ -135,7 +146,9 @@ module GitLab
           worker_stats = Hash.new(0)
 
           Sidekiq::Workers.new.map do |_pid, _tid, work|
-            job_klass = work["payload"]["class"]
+            # Sidekiq 7 wraps the work hash in Sidekiq::Work and deprecates the
+            # Hash accessor; use #job when present, fall back for older Sidekiq.
+            job_klass = work.respond_to?(:job) ? work.job.klass : work["payload"]["class"]
 
             worker_stats[job_klass] += 1
           end
@@ -183,33 +196,78 @@ module GitLab
 
       def with_sidekiq
         SIDEKIQ_REDIS_LOCK.synchronize {
-          Sidekiq.configure_client do |config|
-            config.redis = self.class.connection_pool[redis_options]
+          # Sidekiq::Client.via sets a thread-local pool that Sidekiq.redis,
+          # Stats and Queue all read first, so each prober talks to its own
+          # Redis instead of the one that happened to build the global pool.
+          Sidekiq::Client.via(pool) do
+            return unless connected?
+
+            yield
           end
+        }
+      end
 
-          return unless connected?
+      # Build and cache one pool per Redis target. The cache key omits the
+      # token :password, which is a fresh callable on every call; the re-auth
+      # middleware refreshes the token per connection.
+      def pool
+        options = redis_options
+        key = options.reject { |k, _| k == :password }
 
-          yield
-        }
+        self.class.connection_pool[key] ||=
+          Sidekiq::RedisConnection.create(options.merge(pool_timeout: POOL_TIMEOUT, size: POOL_SIZE))
       end
 
       def redis_options
         options = {
           url: @opts[:redis_url],
-          sentinels: redis_sentinel_options,
           connect_timeout: 1,
           reconnect_attempts: 0
         }
 
+        # redis-client treats a `sentinels` key as Sentinel mode, so only set it
+        # when sentinels are actually configured.
+        sentinels = redis_sentinel_options
+        options[:sentinels] = sentinels if sentinels.is_a?(Array) && sentinels.any?
+
         %i[username password].each do |credential|
           options[credential] = @opts[:"redis_#{credential}"] if @opts.key?(:"redis_#{credential}")
         end
 
         options[:ssl_params] = parse_ssl_params(@opts[:redis_ssl_params]) if @opts.key?(:redis_ssl_params)
         options[:id] = nil unless redis_enable_client?
+        configure_credentials_provider(options)
         options
       end
 
+      # Authenticate with a short-lived, rotating token (for example Microsoft
+      # Entra) instead of a static password when a credentials_provider is set.
+      # Sets a callable token password and the middleware descriptor, which
+      # Sidekiq passes through to redis-client.
+      def configure_credentials_provider(options)
+        provider = @opts[:redis_credentials_provider]
+        return unless provider
+
+        require "redis_cloud_auth"
+        register_credentials_provider_middleware!
+
+        descriptor = provider.transform_keys(&:to_sym)
+        descriptor[:username] ||= @opts[:redis_username] if @opts[:redis_username]
+
+        options[:password] = RedisCloudAuth.credential(descriptor)
+        options[:custom] = { credentials_provider: descriptor }
+      end
+
+      # RedisClient.register appends on each call, so register the re-auth
+      # middleware only once per process.
+      def register_credentials_provider_middleware!
+        return if self.class.credentials_provider_registered?
+
+        RedisCloudAuth.logger = @logger if @logger
+        RedisCloudAuth.register!
+        self.class.credentials_provider_registered!
+      end
+
       def redis_sentinel_options
         sentinels = @opts[:redis_sentinels]
 
@@ -259,10 +317,11 @@ module GitLab
         Sidekiq.redis do |conn|
           @connected = (conn.ping == "PONG")
         end
-      rescue Redis::BaseConnectionError => e
+      rescue RedisClient::Error => e
+        # Sidekiq 7 talks to Redis through redis-client, which raises
+        # RedisClient::Error (not Redis::BaseConnectionError) on connection
+        # failures. redis-client reconnects on the next command, so just log.
         @logger&.error "Error connecting to the Redis: #{e}"
-        pool = self.class.connection_pool[redis_options]
-        pool.reload(&:close)
         @connected = false
       end
     end

data/lib/gitlab_exporter/version.rb

@@ -1,5 +1,5 @@
 module GitLab
   module Exporter
-    VERSION = "17.2.0".freeze
+    VERSION = "18.0.0".freeze
   end
 end

data/spec/integration/sidekiq_credentials_provider_spec.rb

@@ -0,0 +1,66 @@
+require "spec_helper"
+require "gitlab_exporter/sidekiq"
+require "redis_cloud_auth"
+
+module GitLab
+  module Exporter
+    describe SidekiqProber, :integration do
+      describe "with a credentials_provider against an auth-protected Redis" do
+        let(:password) { ENV.fetch("REDIS_AUTH_PASSWORD", "test-token-secret") }
+        # The URL carries no password; the credentials_provider supplies it via a
+        # callable, exercising the full rotating-token path end to end.
+        let(:redis_url) { ENV.fetch("REDIS_AUTH_URL", "redis://localhost:6380") }
+        let(:metrics) { PrometheusMetrics.new }
+
+        # Stands in for a cloud-identity provider: returns a fixed token so the
+        # callable password + re-auth middleware run against a real Redis that
+        # requires AUTH.
+        let(:provider) do
+          pw = password
+          Class.new do
+            define_method(:call) do [nil, pw] end
+            define_method(:expires_at) { Time.now + 3600 }
+          end.new
+        end
+
+        before do
+          # Each prober builds its own pool, so clear any pool cached by an
+          # earlier example to force a fresh connection for this target.
+          SidekiqProber.connection_pool.clear
+          RedisCloudAuth.register!
+          RedisCloudAuth::Registry.store({ provider: :static_test }, provider)
+        end
+
+        after do RedisCloudAuth::Registry.clear! end
+
+        it "reaches the auth-protected Redis only when the callable password is supplied" do
+          prober = described_class.new(
+            metrics: metrics,
+            redis_url: redis_url,
+            redis_credentials_provider: { provider: :static_test }
+          )
+
+          prober.probe_stats
+          prober.probe_future_sets
+
+          # A populated metric proves the probe authenticated and ran against
+          # the target Redis; without the token it never gets this far.
+          expect(metrics.to_s).to include("sidekiq_jobs_processed_total")
+          expect(metrics.to_s).to include("sidekiq_schedule_set_backlog_count")
+        end
+
+        it "does not connect to the auth-protected Redis without a token" do
+          SidekiqProber.connection_pool.clear
+
+          prober = described_class.new(metrics: metrics, redis_url: redis_url)
+
+          # Guards against a hollow test: the target really rejects unauthenticated
+          # clients, so the probe above only passes because of the callable password.
+          prober.probe_stats
+
+          expect(metrics.to_s).not_to include("sidekiq_jobs_processed_total")
+        end
+      end
+    end
+  end
+end

data/spec/integration/sidekiq_future_sets_spec.rb

@@ -0,0 +1,35 @@
+require "spec_helper"
+require "gitlab_exporter/sidekiq"
+require "redis_client"
+
+module GitLab
+  module Exporter
+    # Exercises probe_future_sets end to end. It issues a raw ZRANGEBYSCORE
+    # (redis-client cannot serialize the limit:/withscores: keyword form), so
+    # this guards that the command and its RESP3 [[member, score]] parsing keep
+    # working on the Sidekiq 7 / redis-client stack.
+    describe SidekiqProber, :integration do
+      let(:redis_url) { ENV.fetch("REDIS_URL", "redis://localhost:6379") }
+      let(:metrics) { PrometheusMetrics.new }
+      let(:seed) { RedisClient.new(url: redis_url) }
+
+      before do
+        seed.call("DEL", "schedule", "retry")
+        # A job due two minutes ago, so the set has a positive processing delay.
+        seed.call("ZADD", "schedule", (Time.now - 120).to_f.to_s, '{"class":"SomeWorker"}')
+      end
+
+      after do seed.call("DEL", "schedule", "retry") end
+
+      it "emits backlog and delay metrics from the raw ZRANGEBYSCORE path" do
+        described_class.new(metrics: metrics, redis_url: redis_url).probe_future_sets
+
+        output = metrics.to_s
+        expect(output).to match(/^sidekiq_schedule_set_backlog_count 1\b/)
+        # A due job yields a non-zero delay, proving [member, score] was parsed.
+        delay = output[/^sidekiq_schedule_set_processing_delay_seconds (\S+)/, 1].to_f
+        expect(delay).to be > 0
+      end
+    end
+  end
+end

data/spec/sidekiq_spec.rb

@@ -90,5 +90,72 @@ describe GitLab::Exporter::SidekiqProber do
       expect(options[:username]).to eq("user")
       expect(options[:password]).to eq("pass")
     end
+
+    it "uses a rotating-token callable password and middleware descriptor with a credentials_provider" do
+      prober = described_class.new(
+        metrics: metrics,
+        redis_url: "rediss://cache.example.com:10000",
+        redis_username: "identity-object-id",
+        redis_credentials_provider: { provider: "azure", resource: "https://redis.azure.com" }
+      )
+
+      options = prober.send(:redis_options)
+
+      expect(options[:username]).to eq("identity-object-id")
+      expect(options[:password]).to be_a(RedisCloudAuth::TokenCredential)
+      expect(options[:custom][:credentials_provider]).to eq(
+        provider: "azure", resource: "https://redis.azure.com", username: "identity-object-id"
+      )
+    end
+
+    it "omits username from the descriptor when no redis_username is set" do
+      prober = described_class.new(
+        metrics: metrics,
+        redis_url: "rediss://cache.example.com:10000",
+        redis_credentials_provider: { provider: "azure", resource: "https://redis.azure.com" }
+      )
+
+      options = prober.send(:redis_options)
+
+      # A nil username would not match the provider registered under
+      # { provider: "azure", resource: ... } by exact Hash equality.
+      expect(options[:custom][:credentials_provider]).not_to have_key(:username)
+    end
+
+    it "sets sentinels (and carries the master name in the URL) when configured" do
+      prober = described_class.new(
+        metrics: metrics,
+        redis_url: "redis://mymaster",
+        redis_sentinels: [{ host: "localhost", port: 26_379 }]
+      )
+
+      options = prober.send(:redis_options)
+
+      # redis-client derives the Sentinel master name from the URL host, which
+      # is how Omnibus and CNG pass it, so no separate :name key is needed.
+      expect(options[:url]).to eq("redis://mymaster")
+      expect(options[:sentinels]).to eq([{ host: "localhost", port: 26_379 }])
+    end
+
+    it "omits sentinels when none are configured" do
+      prober = described_class.new(metrics: metrics, redis_url: "redis://localhost:6379")
+
+      options = prober.send(:redis_options)
+
+      expect(options).not_to have_key(:sentinels)
+    end
+  end
+
+  describe "#connected?" do
+    let(:prober) { described_class.new(metrics: metrics, redis_url: "redis://localhost:6379") }
+
+    it "returns false without raising when Redis is unreachable" do
+      # Sidekiq 7 raises RedisClient::Error (not Redis::BaseConnectionError).
+      allow(Sidekiq).to receive(:redis).and_raise(RedisClient::ConnectionError.new("down"))
+
+      result = nil
+      expect { result = prober.send(:connected?) }.not_to raise_error
+      expect(result).to be(false)
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-exporter
 version: !ruby/object:Gem::Version
-  version: 17.2.0
+  version: 18.0.0
 platform: ruby
 authors:
 - Pablo Carranza
@@ -10,6 +10,20 @@ bindir: bin
 cert_chain: []
 date: 2016-07-27 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: az-identity
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -98,44 +112,70 @@ dependencies:
   name: redis
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 4.8.1
+        version: '6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6'
+- !ruby/object:Gem::Dependency
+  name: redis-cloud-auth
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.8.1
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: redis-namespace
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: '1.11'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: '1.11'
 - !ruby/object:Gem::Dependency
   name: sidekiq
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 6.5.12
+        version: '8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 6.5.12
+        version: '8'
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -243,6 +283,8 @@ files:
 - spec/git_process_proper_spec.rb
 - spec/git_spec.rb
 - spec/integration/cli_spec.rb
+- spec/integration/sidekiq_credentials_provider_spec.rb
+- spec/integration/sidekiq_future_sets_spec.rb
 - spec/memstats_spec.rb
 - spec/prometheus_metrics_spec.rb
 - spec/ruby_spec.rb
@@ -289,6 +331,8 @@ test_files:
 - spec/git_process_proper_spec.rb
 - spec/git_spec.rb
 - spec/integration/cli_spec.rb
+- spec/integration/sidekiq_credentials_provider_spec.rb
+- spec/integration/sidekiq_future_sets_spec.rb
 - spec/memstats_spec.rb
 - spec/prometheus_metrics_spec.rb
 - spec/ruby_spec.rb