gitlab-qa 5.13.4 → 5.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03d6616c7add937d18759fbccacdd71b5c988986b786b118702534e69148eaf4
-  data.tar.gz: 2c586c2bd61b1562b10b538fb15f5a7d3e3443657a7270bc65381e6af37b2ea3
+  metadata.gz: 80b5afa85b80b6c367a00f9e0077782d761bf5ad69d851aa95e5ea4f7ec4af78
+  data.tar.gz: b6940307fb5981a4f7c4468be522916ae4a01f2e65ddb0a5847037ce7099556f
 SHA512:
-  metadata.gz: bae9f63159c042699b10d8bd0d61abb4254846af3d427d958ca31dd1b0e8fc3e5eef60e735e737814fb8612f5177921cf856f56bd0e4e447dbca09027c621637
-  data.tar.gz: ad061dc8fdfb338710e5286918084303e2eb5c3d2da087b0e79029ed26d913eb65e4deb1711e0025e7b2edb34d188d29bceb44a176b46c9b0f5e0e6a8fafd91d
+  metadata.gz: 95347f6df44ef53110ac29177e3373fecba8d0ea2535f5a642233519c87d4c97edef9120d6a48e22b05739a00e4b01eccd090743894f1f0db52ba6a1ee4e0995
+  data.tar.gz: a688557eb3fb7738f7288dfbd18bf804fbfdbf668ffd1e17f155f1df3fce5b38b5618af10460355f516e26091e93f290651f364ac5f09531827c6a06b4b0fee5

data/.gitlab-ci.yml

@@ -31,6 +31,8 @@ workflow:
     - if: '$CI_COMMIT_BRANCH == "master"'
     # For tags, create a pipeline.
     - if: '$CI_COMMIT_TAG'
+    # For triggers from GitLab MR pipelines (and pipelines from other projects), create a pipeline
+    - if: '$CI_PIPELINE_SOURCE == "pipeline"'
 
 .default-rules:
   rules:

data/docs/run_qa_against_gdk.md

@@ -42,6 +42,9 @@ make a few changes to your `gdk/gitlab/config/gitlab.yml` file.
   $ exe/gitlab-qa Test::Instance::Any gitlab/gitlab-ce:your-custom-tag http://192.168.0.12:3000 -- qa/specs/features/browser_ui/1_manage/login/log_in_spec.rb
   ```
   
+**Note:** The hostname of the URL provided to `gitlab-qa` must match the hostname configured for GDK.
+If they do not match, a test will be signed out when it visits a page directly because the hostname of the URL visited will be different from the hostname that was used when signing in.
+  
 ### Running EE tests
 
 When running EE tests you'll need to have a license available. GitLab engineers can [request a license](https://about.gitlab.com/handbook/developer-onboarding/#working-on-gitlab-ee).

data/docs/what_tests_can_be_run.md

@@ -57,14 +57,14 @@ For more details on the internals, please read the
 | `QA_ARTIFACTS_DIR` |`/tmp/gitlab-qa`| Path to a directory where artifacts (logs and screenshots) for failing tests will be saved. | No|
 | `DOCKER_HOST` |`http://localhost`| Docker host to run tests against. | No|
 | `CHROME_HEADLESS` |-  | When running locally, set to `false` to allow Chrome tests to be visible - watch your tests being run. | No|
-| `QA_ADDITIONAL_REPOSITORY_STORAGE` |-  | The name of additional, non-default storage to be used with tests tagged `repository_storage`, run via the `Test::Instance::RepositoryStorage` scenario. | No|
-| `QA_PRAEFECT_REPOSITORY_STORAGE` |-  | The name of repository storage using Praefect. | No|
+| `QA_ADDITIONAL_REPOSITORY_STORAGE` |-  | The name of additional, non-default storage to be used with tests tagged `repository_storage`, run via the `Test::Instance::RepositoryStorage` scenario.  Note: Admin access is required to change repository storage. | No|
+| `QA_PRAEFECT_REPOSITORY_STORAGE` |-  | The name of repository storage using Praefect. Note: Admin access is required to change repository storage. | No|
 | `QA_COOKIES` |-  | Optionally set to "cookie1=value;cookie2=value" in order to add a cookie to every request. This can be used to set the canary cookie by setting it to "gitlab_canary=true". | No|
 | `QA_DEBUG` |-  | Set to `true` to verbosely log page object actions. Note: if enabled be aware that sensitive data might be logged. If an input element has a QA selector with `password` in the name, data entered into the input element will be masked. If the element doesn't have `password` in its name it won't be masked. | No|
 | `QA_LOG_PATH` |-  | Path to output debug logging to. If not set logging will be output to STDOUT. | No|
-| `QA_CAN_TEST_GIT_PROTOCOL_V2` |-  | Set to `false` to skip tests that require Git protocol v2 if your environment doesn't support it. | No|
-| `QA_CAN_TEST_ADMIN_FEATURES` |-  | Set to `false` to skip tests that require admin access. | No|
-| `QA_CAN_TEST_PRAEFECT` |-  | Set to `false` to skip tests that require Praefect to be running. | No|
+| `QA_CAN_TEST_GIT_PROTOCOL_V2` | `true` | Set to `false` to skip tests that require Git protocol v2 if your environment doesn't support it. | No|
+| `QA_CAN_TEST_ADMIN_FEATURES` | `true` | Set to `false` to skip tests that require admin access. | No|
+| `QA_CAN_TEST_PRAEFECT` | `true` | Set to `false` to skip tests that require Praefect to be running. | No|
 | `QA_DISABLE_RSPEC_RETRY` |-  | Set to `true` to turn off retrying tests on failure. | No|
 | `QA_SIMULATE_SLOW_CONNECTION` |-  | Set to `true` to configure Chrome's network settings to simulate a slow connection. | No|
 | `QA_SLOW_CONNECTION_LATENCY_MS` | `2000` | The additional latency (in ms) of the simulated slow connection. | No|
@@ -618,6 +618,21 @@ $ export QA_ADDITIONAL_REPOSITORY_STORAGE=secondary
 $ gitlab-qa Test::Instance::RepositoryStorage
 ```
 
+### `Test::Instance::Airgapped`
+
+This scenario will run tests from the test suite against an airgapped instance.
+The airgapped instance is set up by using `iptables` in the GitLab container to block network traffic other than testable ports, and by using runners
+in a shared internal network.
+
+Example:
+
+```
+# For EE
+$ export EE_LICENSE=$(cat /path/to/gitlab_license)
+
+$ gitlab-qa Test::Instance::Airgapped EE -- --tag smoke
+```
+
 ----
 
 [Back to README.md](../README.md)

data/lib/gitlab/qa.rb

@@ -29,6 +29,7 @@ module Gitlab
           autoload :Release, 'gitlab/qa/scenario/test/instance/release'
           autoload :Geo, 'gitlab/qa/scenario/test/instance/geo'
           autoload :StagingGeo, 'gitlab/qa/scenario/test/instance/staging_geo'
+          autoload :Airgapped, 'gitlab/qa/scenario/test/instance/airgapped'
         end
 
         module Omnibus

data/lib/gitlab/qa/component/base.rb

@@ -5,7 +5,7 @@ module Gitlab
         include Scenario::Actable
 
         attr_reader :docker
-        attr_accessor :volumes, :network, :environment
+        attr_accessor :volumes, :network, :environment, :runner_network
         attr_writer :name, :exec_commands
 
         def initialize
@@ -67,6 +67,10 @@ module Gitlab
         end
 
         def prepare_network
+          if runner_network && !docker.network_exists?(runner_network)
+            docker.network_create("--driver=bridge --internal #{runner_network}")
+          end
+
           return if docker.network_exists?(network)
 
           docker.network_create(network)

data/lib/gitlab/qa/component/gitlab.rb

@@ -11,7 +11,7 @@ module Gitlab
         extend Forwardable
 
         attr_reader :release
-        attr_accessor :tls, :disable_animations, :skip_availability_check
+        attr_accessor :tls, :disable_animations, :skip_availability_check, :runner_network
         attr_writer :name, :relative_path
 
         def_delegators :release, :tag, :image, :edition
@@ -116,6 +116,7 @@ module Gitlab
               command << "--network-alias #{network_alias}"
             end
           end
+          Docker::Command.execute("network connect --alias #{name}.#{network} --alias #{name}.#{runner_network} #{runner_network} #{name}") if runner_network
         end
 
         def reconfigure

data/lib/gitlab/qa/component/specs.rb

@@ -8,7 +8,7 @@ module Gitlab
       # the `qa/` directory located in GitLab CE / EE repositories.
       #
       class Specs < Scenario::Template
-        attr_accessor :suite, :release, :network, :args, :volumes, :env
+        attr_accessor :suite, :release, :network, :args, :volumes, :env, :runner_network
 
         def initialize
           @docker = Docker::Engine.new
@@ -19,6 +19,8 @@ module Gitlab
         def perform # rubocop:disable Metrics/AbcSize
           raise ArgumentError unless [suite, release].all?
 
+          @docker.login(**release.login_params) if release.login_params
+
           puts "Running test suite `#{suite}` for #{release.project_name}"
 
           name = "#{release.project_name}-qa-#{SecureRandom.hex(4)}"

data/lib/gitlab/qa/docker/engine.rb

@@ -3,13 +3,14 @@ module Gitlab
     module Docker
       class Engine
         DOCKER_HOST = ENV['DOCKER_HOST'] || 'http://localhost'
+        PRIVILEGED_COMMANDS = [/^iptables.*/].freeze
 
         def hostname
           URI(DOCKER_HOST).host
         end
 
         def login(username:, password:, registry:)
-          Docker::Command.execute("login --username '#{username}' --password '#{password}' #{registry}")
+          Docker::Command.execute(%(login --username "#{username}" --password "#{password}" #{registry}))
         end
 
         def pull(image, tag)
@@ -27,8 +28,18 @@ module Gitlab
           end
         end
 
+        def privileged_command?(command)
+          PRIVILEGED_COMMANDS.each do |privileged_regex|
+            return true if command.match(privileged_regex)
+          end
+
+          false
+        end
+
         def exec(name, command)
-          Docker::Command.execute("exec #{name} bash -c '#{command}'")
+          cmd = ['exec']
+          cmd << '--privileged' if privileged_command?(command)
+          Docker::Command.execute("#{cmd.join(' ')} #{name} bash -c '#{command}'")
         end
 
         def read_file(image, tag, path, &block)

data/lib/gitlab/qa/release.rb

@@ -145,11 +145,17 @@ module Gitlab
             registry: DEV_REGISTRY
           }
         elsif omnibus_mirror?
-          Runtime::Env.require_gitlab_bot_multi_project_pipeline_polling_token!
+          username, password = if Runtime::Env.ci_job_token
+                                 ['gitlab-ci-token', Runtime::Env.ci_job_token]
+                               else
+                                 Runtime::Env.require_qa_access_token!
+
+                                 [Runtime::Env.gitlab_username, Runtime::Env.qa_access_token]
+                               end
 
           {
-            username: Runtime::Env.gitlab_username,
-            password: Runtime::Env.gitlab_bot_multi_project_pipeline_polling_token,
+            username: username,
+            password: password,
             registry: COM_REGISTRY
           }
         end

data/lib/gitlab/qa/runtime/env.rb

@@ -104,6 +104,10 @@ module Gitlab
           ENV['CI_JOB_NAME']
         end
 
+        def ci_job_token
+          ENV['CI_JOB_TOKEN']
+        end
+
         def ci_job_url
           ENV['CI_JOB_URL']
         end
@@ -207,12 +211,6 @@ module Gitlab
           end
         end
 
-        def require_gitlab_bot_multi_project_pipeline_polling_token!
-          return unless ENV['GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN'].to_s.strip.empty?
-
-          raise ArgumentError, "Please provide GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN"
-        end
-
         def skip_pull?
           enabled?(ENV['QA_SKIP_PULL'], default: false)
         end

data/lib/gitlab/qa/scenario/test/instance/airgapped.rb

@@ -0,0 +1,68 @@
+module Gitlab
+  module QA
+    module Scenario
+      module Test
+        module Instance
+          class Airgapped < Scenario::Template
+            require 'resolv'
+            attr_accessor :commands
+
+            def initialize
+              gitlab_ip = Resolv.getaddress('registry.gitlab.com')
+              @commands = <<~AIRGAP_AND_VERIFY_COMMAND.split(/\n+/)
+                # Should not fail before airgapping due to eg. DNS failure
+                # Ping and wget check
+                apt-get update && apt-get install -y iptables netcat
+                nc -zv -w 10 #{gitlab_ip} 80 && (echo \"Regular connectivity netcat check passed.\" && exit 0) || (echo \"Regular connectivity netcat check failed.\" && exit 1)
+                echo "Checking regular connectivity..." \
+                  && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
+                  && (echo "Regular connectivity wget check passed." && exit 0) || (echo "Regular connectivity wget check failed." && exit 1)
+
+                iptables -P INPUT DROP && iptables -P OUTPUT DROP
+                iptables -A INPUT -i lo -j ACCEPT && iptables -A OUTPUT -o lo -j ACCEPT # LOOPBACK
+                iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+                iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+                # Jenkins on port 8080 and 50000
+                iptables -A OUTPUT -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT \
+                  && iptables -A OUTPUT -p tcp -m tcp --dport 50000 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A OUTPUT -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A OUTPUT -p tcp -m tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+                # Should now fail to ping and wget, port 80 should be open
+                nc -zv -w 10 #{gitlab_ip} 80 && (echo \"Airgapped network faulty. Connectivity netcat check failed.\" && exit 1) || (echo \"Connectivity netcat check passed.\" && exit 0)
+                nc -zv -w 10 127.0.0.1 22 && (echo "Airgapped connectivity port 22 check passed." && exit 0) || (echo "Airgapped connectivity port 22 check failed." && exit 1)
+                nc -zv -w 10 127.0.0.1 80 && (echo "Airgapped connectivity port 80 check passed." && exit 0) || (echo "Airgapped connectivity port 80 check failed." && exit 1)
+                echo "Checking airgapped connectivity..." \
+                  && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
+                  && (echo "Airgapped network faulty. Connectivity wget check failed." && exit 1) || (echo "Airgapped network confirmed. Connectivity wget check passed." && exit 0)
+              AIRGAP_AND_VERIFY_COMMAND
+            end
+
+            def perform(release, *rspec_args)
+              Component::Gitlab.perform do |gitlab|
+                gitlab.release = release
+                gitlab.network = 'test'
+                gitlab.runner_network = 'airgapped'
+                gitlab.exec_commands = @commands
+                rspec_args << "--" unless rspec_args.include?('--')
+                rspec_args << %w[--tag ~orchestrated]
+                gitlab.instance do
+                  Component::Specs.perform do |specs|
+                    specs.suite = 'Test::Instance::Airgapped'
+                    specs.release = gitlab.release
+                    specs.network = gitlab.network
+                    specs.runner_network = gitlab.runner_network
+                    specs.args = [gitlab.address, *rspec_args]
+                  end
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/version.rb

@@ -1,5 +1,5 @@
 module Gitlab
   module QA
-    VERSION = '5.13.4'.freeze
+    VERSION = '5.14.1'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 5.13.4
+  version: 5.14.1
 platform: ruby
 authors:
 - Grzegorz Bizon
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-06-02 00:00:00.000000000 Z
+date: 2020-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control
@@ -269,6 +269,7 @@ files:
 - lib/gitlab/qa/scenario/actable.rb
 - lib/gitlab/qa/scenario/cli_commands.rb
 - lib/gitlab/qa/scenario/template.rb
+- lib/gitlab/qa/scenario/test/instance/airgapped.rb
 - lib/gitlab/qa/scenario/test/instance/any.rb
 - lib/gitlab/qa/scenario/test/instance/deployment_base.rb
 - lib/gitlab/qa/scenario/test/instance/geo.rb
@@ -329,7 +330,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.3
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: Integration tests for GitLab