From 1eb82b65c554f21d83447f895a6208905fabe112 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Wed, 18 Sep 2019 14:14:39 +0000 Subject: Add latest changes from gitlab-org/gitlab@12-3-auto-deploy-20190916 --- .../container_scanning/index.md | 35 +-- .../dependency_scanning/index.md | 2 +- doc/user/clusters/applications.md | 33 +- doc/user/group/clusters/index.md | 4 + doc/user/group/dependency_proxy/index.md | 77 ++++- doc/user/group/index.md | 4 +- doc/user/index.md | 4 +- doc/user/packages/container_registry/index.md | 158 ---------- .../img/group_dependency_proxy.png | Bin 40162 -> 0 bytes doc/user/packages/dependency_proxy/index.md | 74 ----- doc/user/packages/index.md | 19 -- .../maven_repository/img/maven_package_view.png | Bin 16105 -> 0 bytes doc/user/packages/maven_repository/index.md | 340 -------------------- .../packages/npm_registry/img/npm_package_view.png | Bin 10349 -> 0 bytes doc/user/packages/npm_registry/index.md | 147 --------- doc/user/permissions.md | 4 +- doc/user/profile/index.md | 2 +- doc/user/profile/personal_access_tokens.md | 2 +- doc/user/project/container_registry.md | 320 ++++++++++++++++++- doc/user/project/deploy_tokens/index.md | 2 +- doc/user/project/img/mitmproxy-docker.png | Bin 0 -> 142591 bytes doc/user/project/index.md | 6 +- .../project/issues/img/link_zoom_call_in_issue.png | Bin 0 -> 69554 bytes .../project/issues/img/zoom-quickaction-button.png | Bin 117097 -> 0 bytes doc/user/project/issues/issue_data_and_actions.md | 25 +- doc/user/project/maven_packages.md | 4 +- doc/user/project/operations/feature_flags.md | 2 - doc/user/project/packages/maven.md | 4 +- doc/user/project/packages/maven_packages.md | 4 +- doc/user/project/packages/maven_repository.md | 343 ++++++++++++++++++++- doc/user/project/packages/npm_registry.md | 150 ++++++++- doc/user/project/pipelines/job_artifacts.md | 6 +- doc/user/project/settings/index.md | 2 +- .../wiki/img/wiki_create_new_page_modal.png | Bin 0 -> 5831 bytes doc/user/project/wiki/index.md | 10 +- 35 files changed, 953 insertions(+), 830 deletions(-) delete mode 100644 doc/user/packages/container_registry/index.md delete mode 100644 doc/user/packages/dependency_proxy/img/group_dependency_proxy.png delete mode 100644 doc/user/packages/dependency_proxy/index.md delete mode 100644 doc/user/packages/index.md delete mode 100644 doc/user/packages/maven_repository/img/maven_package_view.png delete mode 100644 doc/user/packages/maven_repository/index.md delete mode 100644 doc/user/packages/npm_registry/img/npm_package_view.png delete mode 100644 doc/user/packages/npm_registry/index.md create mode 100644 doc/user/project/img/mitmproxy-docker.png create mode 100644 doc/user/project/issues/img/link_zoom_call_in_issue.png delete mode 100644 doc/user/project/issues/img/zoom-quickaction-button.png create mode 100644 doc/user/project/wiki/img/wiki_create_new_page_modal.png (limited to 'doc/user') diff --git a/doc/user/application_security/container_scanning/index.md b/doc/user/application_security/container_scanning/index.md index 7c24edb8558..c3f80c6a0fd 100644 --- a/doc/user/application_security/container_scanning/index.md +++ b/doc/user/application_security/container_scanning/index.md @@ -11,7 +11,7 @@ in [GitLab Ultimate](https://about.gitlab.com/pricing/) 10.4. If you are using [GitLab CI/CD](../../../ci/README.md), you can check your Docker images (or more precisely the containers) for known vulnerabilities by using -[Clair](https://github.com/coreos/clair) and [klar](https://github.com/optiopay/klar), +[Clair](https://github.com/coreos/clair) and [clair-scanner](https://github.com/arminc/clair-scanner), two open source tools for Vulnerability Static Analysis for containers. You can take advantage of Container Scanning by either [including the CI job](#configuration) in @@ -48,7 +48,7 @@ To enable Container Scanning in your pipeline, you need: running. If you're using the shared Runners on GitLab.com, this is already the case. - To [build and push](../../../ci/docker/using_docker_build.md#container-registry-examples) - your Docker image to your project's [Container Registry](../../packages/container_registry/index.md). + your Docker image to your project's [Container Registry](../../project/container_registry.md). The name of the Docker image should match the following scheme: ```text @@ -79,7 +79,7 @@ The included template will: 1. Create a `container_scanning` job in your CI/CD pipeline. 1. Pull the already built Docker image from your project's - [Container Registry](../../packages/container_registry/index.md) (see [requirements](#requirements)) + [Container Registry](../../project/container_registry.md) (see [requirements](#requirements)) and scan it for possible vulnerabilities. The results will be saved as a @@ -90,6 +90,10 @@ artifact available. Behind the scenes, the [GitLab Container Scanning analyzer](https://gitlab.com/gitlab-org/security-products/container-scanning) is used and runs the scans. +If you want to whitelist some specific vulnerabilities, you can do so by defining +them in a YAML file named `clair-whitelist.yml`. Read more in the +[Clair documentation](https://github.com/arminc/clair-scanner/blob/master/README.md#example-whitelist-yaml-file). + ## Example The following is a sample `.gitlab-ci.yml` that will build your Docker Image, push it to the container registry and run Container Scanning. @@ -120,31 +124,6 @@ build: - docker push $IMAGE ``` -## Vulnerability Whitelisting - -If you want to whitelist specific vulnerabilities, you'll need to: - - 1. Set `GIT_STRATEGY: fetch` in your `.gitlab-ci.yml` file by following the instructions described in the - [overriding the Container Scanning template](#overriding-the-container-scanning-template) section of this document. - 1. Define the whitelisted vulnerabilities in a YAML file named `clair-whitelist.yml` which must use the format described - in the [following whitelist example file](https://github.com/arminc/clair-scanner/blob/v12/example-whitelist.yaml). - 1. Add the `clair-whitelist.yml` file to the git repository of your project - -### Overriding the Container Scanning template - -If you want to override the job definition (for example, change properties like -`variables`), you need to declare a `container_scanning` job after the -template inclusion and specify any additional keys under it. For example: - -```yaml -include: - - template: Container-Scanning.gitlab-ci.yml - -container_scanning: - variables: - GIT_STRATEGY: fetch -``` - ## Security Dashboard The Security Dashboard is a good place to get an overview of all the security diff --git a/doc/user/application_security/dependency_scanning/index.md b/doc/user/application_security/dependency_scanning/index.md index 5baaa92d3d8..166a71b6fbe 100644 --- a/doc/user/application_security/dependency_scanning/index.md +++ b/doc/user/application_security/dependency_scanning/index.md @@ -58,7 +58,7 @@ The following languages and dependency managers are supported. | JavaScript ([npm](https://www.npmjs.com/), [yarn](https://yarnpkg.com/en/)) | yes | [gemnasium](https://gitlab.com/gitlab-org/security-products/gemnasium), [Retire.js](https://retirejs.github.io/retire.js) | | Go ([Golang](https://golang.org/)) | not currently ([issue](https://gitlab.com/gitlab-org/gitlab-ee/issues/7132 "Dependency Scanning for Go")) | not available | | PHP ([Composer](https://getcomposer.org/)) | yes | [gemnasium](https://gitlab.com/gitlab-org/security-products/gemnasium) | -| Python ([pip](https://pip.pypa.io/en/stable/)) | yes | [gemnasium](https://gitlab.com/gitlab-org/security-products/gemnasium) | +| Python ([pip](https://pip.pypa.io/en/stable/)) (only `requirements.txt` supported) | yes | [gemnasium](https://gitlab.com/gitlab-org/security-products/gemnasium) | | Python ([Pipfile](https://docs.pipenv.org/en/latest/basics/)) | not currently ([issue](https://gitlab.com/gitlab-org/gitlab-ee/issues/11756 "Pipfile.lock support for Dependency Scanning"))| not available | | Python ([poetry](https://poetry.eustace.io/)) | not currently ([issue](https://gitlab.com/gitlab-org/gitlab-ee/issues/7006 "Support Poetry in Dependency Scanning")) | not available | | Ruby ([gem](https://rubygems.org/)) | yes | [gemnasium](https://gitlab.com/gitlab-org/security-products/gemnasium), [bundler-audit](https://github.com/rubysec/bundler-audit) | diff --git a/doc/user/clusters/applications.md b/doc/user/clusters/applications.md index 17d430cf1f2..197a1fc61c1 100644 --- a/doc/user/clusters/applications.md +++ b/doc/user/clusters/applications.md @@ -67,11 +67,6 @@ required to install all the other applications. It is installed in its own pod inside the cluster which can run the `helm` CLI in a safe environment. -NOTE: **Note:** -Installing Helm as a GitLab-managed App behind a proxy is not supported, -but a [workaround](../../topics/autodevops/index.md#installing-helm-behind-a-proxy) -is available. - ### Cert-Manager > Introduced in GitLab 11.6 for project- and group-level clusters. @@ -129,6 +124,34 @@ chart is used to install this application with a [`values.yaml`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/vendor/ingress/values.yaml) file. +#### Modsecurity Application Firewall + +> [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/issues/65192) in GitLab 12.3 (enabled using `ingress_modsecurity` [feature flag](../../development/feature_flags/development.md#enabling-a-feature-flag-in-development)). + +GitLab supports +[`modsecurity`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#modsecurity) +to check requests against [OWASP's Core Rule Set](https://www.modsecurity.org/CRS/Documentation/). +This feature: + +- Runs in "Detection-only mode" unless configured otherwise. +- Is viewable by checking your ingress controller's `modsec` log for rule violations. + For example: + + ```sh + kubectl -n gitlab-managed-apps exec -it $(kubectl get pods -n gitlab-managed-apps | grep 'ingress-controller' | awk '{print $1}') -- tail -f /var/log/modsec_audit.log + ``` + +There is a small performance overhead by enabling `modsecurity`. However, if this is +considered significant for your application, you can toggle the feature flag back to +false by running the following command within the Rails console: + +```ruby +Feature.disable(:ingress_modsecurity) +``` + +Once disabled, you must reinstall your ingress application for the changes to +take effect. + ### JupyterHub > - Introduced in GitLab 11.0 for project-level clusters. diff --git a/doc/user/group/clusters/index.md b/doc/user/group/clusters/index.md index d41f44f85cc..53229f5c286 100644 --- a/doc/user/group/clusters/index.md +++ b/doc/user/group/clusters/index.md @@ -137,6 +137,10 @@ The result will then be: - The Staging cluster will be used for the `deploy to staging` job. - The Production cluster will be used for the `deploy to production` job. +## Cluster environments **(PREMIUM)** + +Please see the documentation for [cluster environments](../../clusters/environments.md). + ## Security of Runners For important information about securely configuring GitLab Runners, see diff --git a/doc/user/group/dependency_proxy/index.md b/doc/user/group/dependency_proxy/index.md index f735ec0214f..771468fbba8 100644 --- a/doc/user/group/dependency_proxy/index.md +++ b/doc/user/group/dependency_proxy/index.md @@ -1,5 +1,74 @@ ---- -redirect_to: '../../packages/dependency_proxy/index.md' ---- +# Dependency Proxy **(PREMIUM)** -This document was moved to [another location](../../packages/dependency_proxy/index.md). +> [Introduced](https://gitlab.com/gitlab-org/gitlab-ee/issues/7934) in [GitLab Premium](https://about.gitlab.com/pricing/) 11.11. + +NOTE: **Note:** +This is the user guide. In order to use the dependency proxy, an administrator +must first [configure it](../../../administration/dependency_proxy.md). + +For many organizations, it is desirable to have a local proxy for frequently used +upstream images/packages. In the case of CI/CD, the proxy is responsible for +receiving a request and returning the upstream image from a registry, acting +as a pull-through cache. + +The dependency proxy is available in the group level. To access it, navigate to +a group's **Overview > Dependency Proxy**. + +![Dependency Proxy group page](img/group_dependency_proxy.png) + +## Supported dependency proxies + +NOTE: **Note:** +For a list of the upcoming additions to the proxies, visit the +[direction page](https://about.gitlab.com/direction/package/dependency_proxy/#top-vision-items). + +The following dependency proxies are supported. + +| Dependency proxy | GitLab version | +| ---------------- | -------------- | +| Docker | 11.11+ | + +## Using the Docker dependency proxy + +With the Docker dependency proxy, you can use GitLab as a source for a Docker image. +To get a Docker image into the dependency proxy: + +1. Find the proxy URL on your group's page under **Overview > Dependency Proxy**, + for example `gitlab.com/groupname/dependency_proxy/containers`. +1. Trigger GitLab to pull the Docker image you want (e.g., `alpine:latest` or + `linuxserver/nextcloud:latest`) and store it in the proxy storage by using + one of the following ways: + + - Manually pulling the Docker image: + + ```bash + docker pull gitlab.com/groupname/dependency_proxy/containers/alpine:latest + ``` + + - From a `Dockerfile`: + + ```bash + FROM gitlab.com/groupname/dependency_proxy/containers/alpine:latest + ``` + + - In [`.gitlab-ci.yml`](../../../ci/yaml/README.md#image): + + ```bash + image: gitlab.com/groupname/dependency_proxy/containers/alpine:latest + ``` + +GitLab will then pull the Docker image from Docker Hub and will cache the blobs +on the GitLab server. The next time you pull the same image, it will get the latest +information about the image from Docker Hub but will serve the existing blobs +from GitLab. + +The blobs are kept forever, and there is no hard limit on how much data can be +stored. + +## Limitations + +The following limitations apply: + +- Only public groups are supported (authentication is not supported yet). +- Only Docker Hub is supported. +- This feature requires Docker Hub being available. diff --git a/doc/user/group/index.md b/doc/user/group/index.md index a0bdb737466..c09acd36e31 100644 --- a/doc/user/group/index.md +++ b/doc/user/group/index.md @@ -285,7 +285,7 @@ To change your group path: CAUTION: **Caution:** It is currently not possible to rename a namespace if it contains a -project with [Container Registry](../packages/container_registry/index.md) tags, +project with [Container Registry](../project/container_registry.md) tags, because the project cannot be moved. TIP: **TIP:** @@ -461,7 +461,7 @@ With [GitLab Issues Analytics](issues_analytics/index.md), you can see a bar cha ## Dependency Proxy **(PREMIUM)** -Use GitLab as a [dependency proxy](../packages/dependency_proxy/index.md) for upstream Docker images. +Use GitLab as a [dependency proxy](dependency_proxy/index.md) for upstream Docker images.