gitlab-qa 15.10.1 → 15.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e921902d91ded31ce0003274106b20236f6b71231508fe4236ae926cbae8db26
-  data.tar.gz: 23e8702dd725cd0f8cbd3d2105da4b5f6799f9eac1a19093f3d0c277cd957385
+  metadata.gz: 84dd5f52a5315b76b1fddcf578afa77b71699744f6c9250edd82c103a74c8e66
+  data.tar.gz: a6abb8d04101eac27f5289e705d54f257ca2bad9e451b039c53e9fbc86621509
 SHA512:
-  metadata.gz: c599a048d4937a6f01c0b5a469f59c2377ead8e85cf301f8d2332efafdbc076779fd245afa74bd6b073fb8e9bd2a87e59c37c0a579e68d6461a509b4bffd6813
-  data.tar.gz: 55c98ba9302e97e8c2d1b4f269fe81d0de926be93840cb9b0b0c04389c8d3f8e632c3001eecb2de57060d41ad3e447c5fc81f53aeb75303cb9ec3739ae72255b
+  metadata.gz: a78f8366d7779dc733b81cbde2a6ca07ca3241558424a8b3a3a1944909eeafcebd7c0e942a5d9aadccc461a0f8d7e6ccce6a597b36f2dab39c041d94075d7662
+  data.tar.gz: 80b60afd84ec9b1d9aeb470b89cccb97d92d2086ee2c5658446d8db166c52457ad9e438c831a1358a1bc57b8c41d8562b226af01e1a3c0db933ef7365e2e0a06

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-qa (15.10.1)
+    gitlab-qa (15.10.2)
       activesupport (>= 6.1, < 8)
       ffi (~> 1.17)
       gitlab (~> 4.19)

data/docs/what_tests_can_be_run.md

@@ -1008,6 +1008,9 @@ This scenario will run tests from the test suite against an airgapped instance.
 The airgapped instance is set up by using `iptables` in the GitLab container to block network traffic other than testable ports, and by using runners
 in a shared internal network.
 
+After the rules are applied, the job fails if the container can connect to gitlab.com on port 443, to example.com on port 80 or 443, or to dns.google on port 53.
+The job also logs whether gitlab.com port 8080 is reachable, which the rules allow, and how many packets the `OUTPUT` policy dropped. Neither log line fails the job.
+
 Example:
 
 ```shell

data/lib/gitlab/qa/scenario/test/instance/airgapped.rb

@@ -39,6 +39,7 @@ module Gitlab
                 rspec_args << "--" unless rspec_args.include?('--')
                 rspec_args << "--tag ~orchestrated"
                 gitlab.instance do
+                  report_gitlab_port_8080(gitlab)
                   Component::Specs.perform do |specs|
                     specs.suite = 'Test::Instance::Airgapped'
                     specs.release = gitlab.release
@@ -46,14 +47,42 @@ module Gitlab
                     specs.runner_network = gitlab.runner_network
                     specs.args = [gitlab.address, *rspec_args]
                   end
+                ensure
+                  report_dropped_packets(gitlab)
                 end
               end
             end
 
             private
 
+            def report_dropped_packets(gitlab)
+              chain = gitlab.docker.exec(gitlab.name, 'iptables -nvxL OUTPUT')
+              Runtime::Logger.info("Airgapped packets dropped by the OUTPUT policy: #{chain[/policy DROP \d+ packets, \d+ bytes/]}")
+            rescue Support::ShellCommand::StatusError => e
+              Runtime::Logger.warn("Unable to read the airgapped OUTPUT chain counters: #{e.message}")
+            end
+
+            def report_gitlab_port_8080(gitlab)
+              address = Resolv.getaddress('gitlab.com')
+              state = gitlab.docker.exec(gitlab.name, "ncat -zv -w 10 #{address} 8080 > /dev/null 2>&1 && echo open || echo closed")
+              if state.include?('open')
+                Runtime::Logger.warn("Airgapped finding: gitlab.com port 8080 is reachable")
+              else
+                Runtime::Logger.info("Airgapped gitlab.com port 8080 is not reachable")
+              end
+            rescue Resolv::ResolvError, Support::ShellCommand::StatusError => e
+              Runtime::Logger.warn("Unable to probe gitlab.com port 8080: #{e.message}")
+            end
+
+            def unreachable_check(ip, port)
+              reachable = "echo 'Airgapped network faulty. #{ip} port #{port} is reachable.'; exit 1;"
+              "if ncat -zv -w 10 #{ip} #{port}; then #{reachable} else echo 'Airgapped connectivity #{ip} port #{port} check passed.'; fi;"
+            end
+
             def airgap_gitlab_commands
               gitlab_ip = Resolv.getaddress('gitlab.com')
+              outside_ip = Resolv.getaddress('example.com')
+              resolver_ip = Resolv.getaddress('dns.google')
               gitlab_registry_ip = Resolv.getaddress(QA::Release::COM_REGISTRY)
               dev_gitlab_registry_ip = Resolv.getaddress(QA::Release::DEV_REGISTRY.split(':')[0])
               praefect_ip = config.praefect_ip
@@ -62,6 +91,7 @@ module Gitlab
                 # Ping and wget check
                 apt-get update && apt-get install -y iptables ncat
                 if ncat -zv -w 10 #{gitlab_ip} 80; then echo 'Airgapped connectivity check passed.'; else echo 'Airgapped connectivity check failed - should be able to access gitlab_ip'; exit 1; fi;
+                if ncat -zv -w 10 #{outside_ip} 443; then echo 'Airgapped connectivity outside_ip check passed.'; else echo 'Airgapped connectivity check failed - should be able to access outside_ip'; exit 1; fi;
 
                 echo "Checking regular connectivity..." \
                   && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
@@ -92,9 +122,10 @@ module Gitlab
                 if ncat -zv -w 10 127.0.0.1 80; then echo 'Airgapped connectivity port 80 check passed.'; else echo 'Airgapped connectivity port 80 check failed.'; exit 1 ; fi;
                 if ncat -zv -w 10 #{gitlab_registry_ip} 80; then echo 'Airgapped connectivity port gitlab_registry_ip check passed.'; else echo 'Airgapped connectivity port 80 check failed.'; exit 1; fi;
 
-                echo "Checking airgapped connectivity..." \
-                  && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
-                  && (echo "Airgapped network faulty. Connectivity wget check failed." && exit 1) || (echo "Airgapped network confirmed. Connectivity wget check passed." && exit 0)
+                #{unreachable_check(gitlab_ip, 443)}
+                #{unreachable_check(outside_ip, 80)}
+                #{unreachable_check(outside_ip, 443)}
+                #{unreachable_check(resolver_ip, 53)}
               AIRGAP_AND_VERIFY_COMMAND
             end
 

data/lib/gitlab/qa/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module QA
-    VERSION = '15.10.1'
+    VERSION = '15.10.2'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 15.10.1
+  version: 15.10.2
 platform: ruby
 authors:
 - GitLab Quality
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-27 00:00:00.000000000 Z
+date: 2026-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control