gitlab-qa 5.13.7 → 5.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 80567a3f14ce823c574bf448dd57339aa9ac95d39514b2c18ec4f8d9094c5e95
-  data.tar.gz: 4aa694b95e7bc667a58d63d7ac4c2606dbbd3d9a5819cd49e160dfae60b919cc
+  metadata.gz: 50cde662fbba863a232e44eacbb2aa7535762949816bd6281e5e0ce4fd916337
+  data.tar.gz: 67a222363326b5ab0767db8e894d56c351dd10a1e5c63aefd84991b009973a9e
 SHA512:
-  metadata.gz: 1a9f28e68a1717e93f7df4dda6de613185b3175417092517d56338d35af67679eed4a8d074e6ee5b6efd1f9d425b761aec3d9a8803d9d993341a9a28b1abde4c
-  data.tar.gz: da4ca897e44bd8c398c42f431370b73bb482fdb032b059053b759eb0c97646500057961b8a378a789b39cf5ab093e00a4a8577c36fbb6ef9353ce9116b24f98a
+  metadata.gz: dcd1486c1b47346d82c1bb5be090ec24ee25e0bd620232b8bbeef32e556cd6a7b8ebad3c5f05132de5ceb90636a78d10f4d5c6d4dd451784eac2d79b69429509
+  data.tar.gz: '0418804183dce1d3e5072381bb0ac6eef32c9eb7c0d98231a8e5ea94cc63255d43e14f94e61a91a6f47a1b3aa8ad44bf628ac7ce77544d80ccb6b13c6f8cccc5'

data/docs/what_tests_can_be_run.md

@@ -618,6 +618,21 @@ $ export QA_ADDITIONAL_REPOSITORY_STORAGE=secondary
 $ gitlab-qa Test::Instance::RepositoryStorage
 ```
 
+### `Test::Instance::Airgapped`
+
+This scenario will run tests from the test suite against an airgapped instance.
+The airgapped instance is set up by using `iptables` in the GitLab container to block network traffic other than testable ports, and by using runners
+in a shared internal network.
+
+Example:
+
+```
+# For EE
+$ export EE_LICENSE=$(cat /path/to/gitlab_license)
+
+$ gitlab-qa Test::Instance::Airgapped EE -- --tag smoke
+```
+
 ----
 
 [Back to README.md](../README.md)

data/lib/gitlab/qa.rb

@@ -29,6 +29,7 @@ module Gitlab
           autoload :Release, 'gitlab/qa/scenario/test/instance/release'
           autoload :Geo, 'gitlab/qa/scenario/test/instance/geo'
           autoload :StagingGeo, 'gitlab/qa/scenario/test/instance/staging_geo'
+          autoload :Airgapped, 'gitlab/qa/scenario/test/instance/airgapped'
         end
 
         module Omnibus

data/lib/gitlab/qa/component/base.rb

@@ -5,7 +5,7 @@ module Gitlab
         include Scenario::Actable
 
         attr_reader :docker
-        attr_accessor :volumes, :network, :environment
+        attr_accessor :volumes, :network, :environment, :runner_network
         attr_writer :name, :exec_commands
 
         def initialize
@@ -67,6 +67,10 @@ module Gitlab
         end
 
         def prepare_network
+          if runner_network && !docker.network_exists?(runner_network)
+            docker.network_create("--driver=bridge --internal #{runner_network}")
+          end
+
           return if docker.network_exists?(network)
 
           docker.network_create(network)

data/lib/gitlab/qa/component/gitlab.rb

@@ -11,7 +11,7 @@ module Gitlab
         extend Forwardable
 
         attr_reader :release
-        attr_accessor :tls, :disable_animations, :skip_availability_check
+        attr_accessor :tls, :disable_animations, :skip_availability_check, :runner_network
         attr_writer :name, :relative_path
 
         def_delegators :release, :tag, :image, :edition
@@ -116,6 +116,7 @@ module Gitlab
               command << "--network-alias #{network_alias}"
             end
           end
+          Docker::Command.execute("network connect --alias #{name}.#{network} --alias #{name}.#{runner_network} #{runner_network} #{name}") if runner_network
         end
 
         def reconfigure

data/lib/gitlab/qa/component/specs.rb

@@ -8,7 +8,7 @@ module Gitlab
       # the `qa/` directory located in GitLab CE / EE repositories.
       #
       class Specs < Scenario::Template
-        attr_accessor :suite, :release, :network, :args, :volumes, :env
+        attr_accessor :suite, :release, :network, :args, :volumes, :env, :runner_network
 
         def initialize
           @docker = Docker::Engine.new

data/lib/gitlab/qa/docker/engine.rb

@@ -3,6 +3,7 @@ module Gitlab
     module Docker
       class Engine
         DOCKER_HOST = ENV['DOCKER_HOST'] || 'http://localhost'
+        PRIVILEGED_COMMANDS = [/^iptables.*/].freeze
 
         def hostname
           URI(DOCKER_HOST).host
@@ -27,8 +28,18 @@ module Gitlab
           end
         end
 
+        def privileged_command?(command)
+          PRIVILEGED_COMMANDS.each do |privileged_regex|
+            return true if command.match(privileged_regex)
+          end
+
+          false
+        end
+
         def exec(name, command)
-          Docker::Command.execute("exec #{name} bash -c '#{command}'")
+          cmd = ['exec']
+          cmd << '--privileged' if privileged_command?(command)
+          Docker::Command.execute("#{cmd.join(' ')} #{name} bash -c '#{command}'")
         end
 
         def read_file(image, tag, path, &block)

data/lib/gitlab/qa/scenario/test/instance/airgapped.rb

@@ -0,0 +1,68 @@
+module Gitlab
+  module QA
+    module Scenario
+      module Test
+        module Instance
+          class Airgapped < Scenario::Template
+            require 'resolv'
+            attr_accessor :commands
+
+            def initialize
+              gitlab_ip = Resolv.getaddress('registry.gitlab.com')
+              @commands = <<~AIRGAP_AND_VERIFY_COMMAND.split(/\n+/)
+                # Should not fail before airgapping due to eg. DNS failure
+                # Ping and wget check
+                apt-get update && apt-get install -y iptables netcat
+                nc -zv -w 10 #{gitlab_ip} 80 && (echo \"Regular connectivity netcat check passed.\" && exit 0) || (echo \"Regular connectivity netcat check failed.\" && exit 1)
+                echo "Checking regular connectivity..." \
+                  && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
+                  && (echo "Regular connectivity wget check passed." && exit 0) || (echo "Regular connectivity wget check failed." && exit 1)
+
+                iptables -P INPUT DROP && iptables -P OUTPUT DROP
+                iptables -A INPUT -i lo -j ACCEPT && iptables -A OUTPUT -o lo -j ACCEPT # LOOPBACK
+                iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+                iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+
+                # Jenkins on port 8080 and 50000
+                iptables -A OUTPUT -p tcp -m tcp --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT \
+                  && iptables -A OUTPUT -p tcp -m tcp --dport 50000 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A OUTPUT -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A OUTPUT -p tcp -m tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+                iptables -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+                # Should now fail to ping and wget, port 80 should be open
+                nc -zv -w 10 #{gitlab_ip} 80 && (echo \"Airgapped network faulty. Connectivity netcat check failed.\" && exit 1) || (echo \"Connectivity netcat check passed.\" && exit 0)
+                nc -zv -w 10 127.0.0.1 22 && (echo "Airgapped connectivity port 22 check passed." && exit 0) || (echo "Airgapped connectivity port 22 check failed." && exit 1)
+                nc -zv -w 10 127.0.0.1 80 && (echo "Airgapped connectivity port 80 check passed." && exit 0) || (echo "Airgapped connectivity port 80 check failed." && exit 1)
+                echo "Checking airgapped connectivity..." \
+                  && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
+                  && (echo "Airgapped network faulty. Connectivity wget check failed." && exit 1) || (echo "Airgapped network confirmed. Connectivity wget check passed." && exit 0)
+              AIRGAP_AND_VERIFY_COMMAND
+            end
+
+            def perform(release, *rspec_args)
+              Component::Gitlab.perform do |gitlab|
+                gitlab.release = release
+                gitlab.network = 'test'
+                gitlab.runner_network = 'airgapped'
+                gitlab.exec_commands = @commands
+                rspec_args << "--" unless rspec_args.include?('--')
+                rspec_args << %w[--tag ~orchestrated]
+                gitlab.instance do
+                  Component::Specs.perform do |specs|
+                    specs.suite = 'Test::Instance::Airgapped'
+                    specs.release = gitlab.release
+                    specs.network = gitlab.network
+                    specs.runner_network = gitlab.runner_network
+                    specs.args = [gitlab.address, *rspec_args]
+                  end
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/version.rb

@@ -1,5 +1,5 @@
 module Gitlab
   module QA
-    VERSION = '5.13.7'.freeze
+    VERSION = '5.14.0'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 5.13.7
+  version: 5.14.0
 platform: ruby
 authors:
 - Grzegorz Bizon
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-06-10 00:00:00.000000000 Z
+date: 2020-06-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control
@@ -269,6 +269,7 @@ files:
 - lib/gitlab/qa/scenario/actable.rb
 - lib/gitlab/qa/scenario/cli_commands.rb
 - lib/gitlab/qa/scenario/template.rb
+- lib/gitlab/qa/scenario/test/instance/airgapped.rb
 - lib/gitlab/qa/scenario/test/instance/any.rb
 - lib/gitlab/qa/scenario/test/instance/deployment_base.rb
 - lib/gitlab/qa/scenario/test/instance/geo.rb