GitLab Distribution Team Demos, 20 Oct 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Distribution Demo Oct 20, 2020

Description

Demo of the psql client cert options in gitlab omnibus

A

All right, my camera's off a bit sorry, my my monitor's moved a bit my camera's screwing, but all right so welcome to uh the weekly distribution demo. uh Today, I'm going to be demoing the certificates authentication for postgres that ian had done so I figured I'd start out with just bringing up regular omnibus without any of the certificate authentication, and we can see what that looks like I'm going to get that started.

A

Oh, I should share screenshots. Sorry, let me get that.

A

Going so I'll give that a minute or so to start up that will uh bring up omnibus. I am actually using the package built off of the uh mr, so I'm not certain that the the change is actually in master yet or into the latest docker image. Yet so I thought I'd done a test last night and I thought it was successful, but I can't ver wasn't sure if it was or not. So I decided to move back to the the uh darker container from the branch.

A

A

And then here we'll see the container actually start up and then so after or two minutes three minutes after that, we'll have it fully up and running.

A

A

A

And while that's still starting up I'll jump into the container.

A

A little bit more time make sure gets far enough where I can get into the db.

A

Console uh for those uh also the uh the vs code window- that's on the side here. This is the actual docker compose file that I'm using and right now I do have the additional parameters for turn on the authentication turned off effect. I I removed the certificates earlier, so we can generate them fresh and when we restart.

A

All right by now the postgres should be up and.

A

Running yeah looks like we're good.

A

A

A

And hopefully, at some point here, the lab rails will start up and we'll be able to continue.

A

Yeah we're fully up and.

A

Running there we go finally, all right see the database connections specifically.

A

The ssl connections, we look at a database table.

A

So we see a number of connections, but none of them are using the certificates. You know just not even using ssl at this point: they're just plain connections with password authentication. So that's that's what you normally see today now, let's, uh let's go ahead and generate our.

A

A

All right, all those all those shell scripts, all they really do is just run open. Ssh.

A

That's going to open ssl to create the csr and then get it signed by the ca that was created in the first command. So all fairly standard openness to sell commands.

A

Just creates a number of certificates and a number of keys, there's nothing, nothing magical there.

A

And then, if we enable.

A

All these guys.

A

I'll restart the.

A

A

Writers cannot connect I'll, still shut down. Okay, that's why.

A

One of the things I did find when I was uh saying up this demo is our documentation, treats this value here. The uh cert auth addresses as a basically a json blob, so it looks like a json blob in the config file, but uh here I actually had to put all a single line and quote it to be able to get it to be recognized.

A

I tried escaping it with backslashes and a variety of other things. This is the only way I was able to get it to be recognized within the compose file. So just a word of warning for anybody. That's.

A

A

A

Okay, that's time back up while we're waiting, why don't we jump back in the.

A

A

A

A

Okay, so I think I'm seeing.

B

Yeah, it looks like it's.

A

B

A

B

I think it's uh it looks like it's.

A

Complete, I didn't change anything here. Looked like it was complaining about the cert auth addresses line here, still quoted with everything.

A

Correctly, all right, let's.

A

Questions restarting, I think it's restarting the container each time, yeah, okay,.

A

I have to stream the arrows, so we can catch it having it, instead of it scroll off.

A

And that's going another thing I noticed last night it seemed like docker was.

A

That is on the branch. Okay it looked like daca was, uh even though I told to use the branch it was stuck on the uh latest tag for some reason, but that looks like that's working now.

B

A

A

Says the sequence for history.

B

There was an error there about undefined method, each for string there. It is yeah, so it is expecting that certain auth addresses to be a.

A

Hat, I'm sorry to be a what hash.

B

Or match, depending on how you want to get, but not a.

A

B

It is expecting it to be an object that you can iterate over.

A

And I really ran it. I ran it multiple times like this yesterday and it seemed to be fine. So if I go back to um are you saying just without the quotes.

B

A

Yeah that okay.

B

A

How I would expect it to.

B

A

I thought I tried that yesterday and I thought it bombed on me so I'll give that a try again.

B

I'm not saying it didn't unexpected.

A

I'm not saying you're wrong either. I don't know.

A

It just seemed, like my experience just says: I had to make it a string to get it to work correctly.

A

And at one point I had uh stringified the next two, the the percent w options to make arrays. I thought okay. Well, this is a issue and that that failed too. So it's like okay. It was a interesting diversion into trying to understand like what needed to be quoted. What.

C

Didn't this may be one of those instances where the fact that we're passing this through environment just confuses the poor thing.

A

That that was my feeling when I started getting the demo running it's just. What we have documented was actually correct, but then trying to understand how the different environments interpreted those values and represented them was a little.

C

Questionable, sometimes, an alternative method for the future is to actually just directly mount the gitlab.rb file, and then you can actually edit that and just run reconfigure. That's.

C

C

Still have we lost the full method of above where the error message was because I saw some red message.

A

C

No, we should be able to get back to it.

A

Yeah, I saw some red too.

A

Well, that's if it was within 10 000.

C

C

Say it was red coated, so we'll know when we see it.

C

A

Coming up on my limit here.

A

That's it: okay, let me restart and I'll just.

C

C

You can always check the rendered file.

A

uh Well, I think by the problem, is the containers restart so quickly and not be able to get in there and.

C

But we should be able to check the content of gitlab.rb as long as the container is up and past the point where it renders that file. We should be able to check the content, whether it's in the middle of the startup or not.

C

We should be able to.

B

C

B

You're also mounting the the logs as an external volume, so you can just look at the those files and not have to worry about it.

A

uh That's true, ha I do have my external, so we can look at that here in a second I'll, take half a moment to.

A

A

uh Is that going to be under the rails.

A

Or probably reconfigured.

B

A

So reconfigure: oh, there is a reconfigure.

A

A

20Th last one: that's.

A

That might be more interesting, but let's.

A

Let me say: oh, I am I'm missing a uh close price somewhere. I got deleted.

C

Yep you get the feeling that if that's code code was being.

A

A

All right that should be restarted one there. It.

A

A

Okay, databases should be up by now, since we're doing our.

A

A

Fully up and running yet.

A

So tanner just exit.

A

A

Not connect to server and I need time to run the db.

A

A

Okay, what are we failing on the migrations.

A

Here it seems like it's not connected. It's almost like database is not running at all at any.

C

A

A

A

That's the config now.

A

That's gonna be inside the container.

A

1826, that's right! Oh invalid! Yes, start what.

B

Oh, the key should be a cider, not just an ip address.

A

Really that's interesting that worked and it seemed to be working yesterday.

A

I think our documentation well that documentation is like the address. It's interesting. Okay. We should probably update.

C

C

I wonder what that generated file looks like if we just had a render failure.

A

um Well, once the container is up and stable, you can take a look at it, real, quick watch it see if it dies again.

C

Well, it's a rendered config file. So as long as the the thing's running at all, you should be able to try it.

A

Well, a bit of the problem is that the container is exiting out and tilt is restarting and restarting the container entirely.

A

It does look like we're moving forward again: okay, good.

C

Yeah just fired through the postgres configuration, so you should be able to try and grab that now.

A

C

A

ah So, let's start right here.

B

Yeah, I think that can be a specific ip address, but it can't be a network address without the subnet, but not now.

A

A

uh I don't know what I'll call this range for the moment, but.

A

Okay, so let's stay enough, that's.

A

A

A

I suppose I could have put in 127.0.0.1 in place of the 0.0.0 for the for that key that should have worked.

B

Yeah we may hit the truss line first before we get to the hostess, the cell, so we may not. This may not even kick in right.

A

Now that's going.

A

Still on the reconfigure.

A

C

Yeah, uh because this is actually set for host ssl, it should be taking action for any connection that attempts ssl, whether or not you're, hitting the trusts for localhost or just host or anything else so long as so long as we're actively attempting ssl instead of upgrade to ssl. This should be tripping.

A

A

B

And we did get this.

A

And there we go now we get our s cell information, it's more specifically the client dn.

A

I was wondering too, if I should just cut this out and put it into the documentation, because the documentation doesn't show any connections with the client dn. I was thinking that might be a worthwhile thing to do.

B

That'll be valuable.

A

Yeah I'll uh I'll copy it into the notes for now and then we can work on getting it into the documentation actually 26.

A

C

You probably don't need all of them, but.

A

Well, we can little down some, but it's just I'll capture everything that we can decide how much we put.

A

A

That's ugly, but oh at least it's saved. I can grab it later on and work on that and take it back out of here so uh and that's about all I really had. uh Is there any questions or anything anybody wants to see? Actually, you can actually see that actually is coming up now.

A

A

A

Any questions or anything anybody wants me to try.

A

Not hearing anything, I think that's about it. I know we're slightly over time. Sorry about that, but uh that's all I had for the demo.

A

I hope everybody has a good good week.

A

A

A