Merge pull request #1 from Perun-Engineering/fix/gitlab-registry-configuration

fix: GitLab registry configuration

Author: babychm

.github/workflows/release.yml

@@ -36,6 +36,7 @@ jobs:
         uses: cycjimmy/semantic-release-action@v4
         with:
           semantic_version: 23.0.2
+          branches: main
           extra_plugins: |
             @semantic-release/changelog@6.0.3
             @semantic-release/git@10.0.1

README.md

@@ -28,7 +28,7 @@ In the above diagram, you can see the components and their relations (PostgreSQL
 |------|---------|
 | <a name="provider_aws"></a> [aws](#provider\_aws) | 5.36.0 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.11.0 |
-| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.36.0 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.37.1 |
 
 ## Modules
 
@@ -45,6 +45,7 @@ In the above diagram, you can see the components and their relations (PostgreSQL
 | [kubernetes_namespace.gitlab](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
 | [kubernetes_secret.gitlab_omniauth_providers](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
 | [kubernetes_secret.gitlab_rails_storage](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
+| [kubernetes_secret.gitlab_registry_storage](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
 | [kubernetes_secret.ldap](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
 | [kubernetes_secret.postgres](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
 | [kubernetes_secret.redis](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
@@ -57,6 +58,7 @@ In the above diagram, you can see the components and their relations (PostgreSQL
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_bucket_prefix"></a> [bucket\_prefix](#input\_bucket\_prefix) | Prefix used for S3 buckets | `string` | `""` | no |
 | <a name="input_buckets_lifecycles"></a> [buckets\_lifecycles](#input\_buckets\_lifecycles) | Lifecycle rules for buckets | `map(string)` | `{}` | no |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name where you want to deploy the release | `string` | n/a | yes |
 | <a name="input_database_password"></a> [database\_password](#input\_database\_password) | Password to access PostgreSQL database | `string` | n/a | yes |

examples/main.tf

@@ -14,6 +14,7 @@ args:
     ]
   }
 EOF
+  bucket_prefix        = "gitlab-mycompany"
 }
 
 module "gitlab" {
@@ -31,6 +32,7 @@ module "gitlab" {
     "gitlab-omniauth-saml" = local.saml_google_provider
   }
 
+  bucket_prefix = local.bucket_prefix
   buckets_lifecycles = {
     artifacts = <<EOF
 {
@@ -71,7 +73,7 @@ EOF
       redis_host        = "master.gitlab.xxxxxx.euc1.cache.amazonaws.com"
       redis_port        = "6379"
       release_name      = "gitlab"
-      bucket_prefix     = "gitlab-mycompany"
+      bucket_prefix     = local.bucket_prefix
       domain            = "example.com"
       smtp_address      = "smtp.gmail.com"
     })

examples/values.yaml

@@ -192,6 +192,9 @@ gitlab:
 registry:
   enabled: true
   bucket: ${bucket_prefix}-registry
+  storage:
+    secret: ${release_name}-registry-storage
+    key: config
   redis:
     cache:
       password:

main.tf

@@ -105,6 +105,22 @@ resource "kubernetes_secret" "ldap" {
   type = "Opaque"
 }
 
+resource "kubernetes_secret" "gitlab_registry_storage" {
+  metadata {
+    name      = "${var.release_name}-registry-storage"
+    namespace = local.release_namespace
+  }
+
+  data = {
+    config = <<EOF
+s3:
+  bucket: ${var.bucket_prefix}-registry
+  region: ${data.aws_region.current.name}
+  v4auth: true
+EOF
+  }
+}
+
 data "aws_iam_policy_document" "s3_bucket_policy" {
   for_each = local.buckets_list
 
@@ -162,6 +178,28 @@ data "aws_iam_policy_document" "s3_bucket_policy" {
     actions   = ["s3:GetObjectAcl"]
     resources = ["arn:aws:s3:::${each.value}/*"]
   }
+
+  statement {
+    sid    = "AllowListBucketMultipartUploads"
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [module.gitlab_role.iam_role_arn]
+    }
+    actions   = ["s3:ListBucketMultipartUploads"]
+    resources = ["arn:aws:s3:::${each.value}"]
+  }
+
+  statement {
+    sid    = "AllowListMultipartUploadParts"
+    effect = "Allow"
+    principals {
+      type        = "AWS"
+      identifiers = [module.gitlab_role.iam_role_arn]
+    }
+    actions   = ["s3:ListMultipartUploadParts"]
+    resources = ["arn:aws:s3:::${each.value}/*"]
+  }
 }
 
 module "s3_bucket" {

variables.tf

@@ -76,6 +76,12 @@ variable "namespace_labels" {
   default     = {}
 }
 
+variable "bucket_prefix" {
+  description = "Prefix used for S3 buckets"
+  type        = string
+  default     = ""
+}
+
 variable "buckets_lifecycles" {
   description = "Lifecycle rules for buckets"
   type        = map(string)