833-gitlab-object-storage-use_iam_role

Summary

With the current way the Big Bang chart is set up, the users are unable to use an iam profile for their aws object storage in the gitlab chart. The chart will include the accesskey and secretkey with empty values and no use_iam_profile key.

Resolution

Following these docs

Added a new key and logic into the gitlab template to handle use of an iam profile for gitlab.

Closes #833 (closed)

chart/templates/gitlab/secret-objectstore.yaml

 {{- if or .Values.addons.gitlab.enabled .Values.addons.gitlabRunner.enabled }}
 {{- if .Values.addons.gitlab.objectStorage.endpoint }}
+{{- if and (ne .Values.addons.gitlab.objectStorage.iamProfile "") (ne .Values.addons.gitlab.objectStorage.accessKey "") }}{{- fail "Must chose to use an IAM profile OR an AWS accessKey/accessSecret at .Values.addons.gitlab.objectStorage" }}{{- end }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -10,8 +11,12 @@ stringData:
     rails: |-
       provider: AWS
       region: {{ .Values.addons.gitlab.objectStorage.region }}
+      {{- if ne .Values.addons.gitlab.objectStorage.iamProfile "" }}
+      use_iam_profile: {{ .Values.addons.gitlab.objectStorage.iamProfile }}
+      {{- else if eq .Values.addons.gitlab.objectStorage.iamProfile "" }}
       aws_access_key_id: {{ .Values.addons.gitlab.objectStorage.accessKey }}
       aws_secret_access_key: {{ .Values.addons.gitlab.objectStorage.accessSecret }}
+      {{- end }}
       {{- if eq .Values.addons.gitlab.objectStorage.type "minio" }}
       aws_signature_version: 4
       host: {{ regexReplaceAll "http(s{0,1})://(.*):(\\d+)" .Values.addons.gitlab.objectStorage.endpoint "${2}" }}
@@ -29,8 +34,10 @@ stringData:
         {{- else }}
         bucket: gitlab-registry
         {{- end }}
+        {{- if eq .Values.addons.gitlab.objectStorage.iamProfile "" }}
         accesskey: {{ .Values.addons.gitlab.objectStorage.accessKey }}
         secretkey: {{ .Values.addons.gitlab.objectStorage.accessSecret }}
+        {{- end }}
         region: {{ .Values.addons.gitlab.objectStorage.region }}
         {{- if eq .Values.addons.gitlab.objectStorage.type "s3" }}
         v4auth: true
@@ -43,8 +50,10 @@ stringData:
         {{- end }}
     backups: |-
       [default]
+      {{- if eq .Values.addons.gitlab.objectStorage.iamProfile "" }} 
       access_key = {{ .Values.addons.gitlab.objectStorage.accessKey }}
       secret_key = {{ .Values.addons.gitlab.objectStorage.accessSecret }}
+      {{- end }}
       bucket_location = {{ .Values.addons.gitlab.objectStorage.region }}
       host_bucket = %(bucket)s.{{ regexReplaceAll "http(s*)://" .Values.addons.gitlab.objectStorage.endpoint "" }}
       multipart_chunk_size_mb = 128