Upgrade GitLab to Amazon Linux 2023 (#6160, #4890) #7533
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
from
abf0975 to
ca1e450
Compare
This was
linked to
issues
Oct 30, 2025
achave11-ucsc
added
deploy:gitlab
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #7533 +/- ##
========================================
Coverage 84.82% 84.82%
========================================
Files 156 156
Lines 22862 22862
========================================
Hits 19393 19393
Misses 3469 3469 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
5 times, most recently
from
44956c3 to
b7c3e3a
Compare
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
6 times, most recently
from
73a1c8f to
186a22e
Compare
nadove-ucsc
requested changes
Dec 3, 2025
Contributor
nadove-ucsc
left a comment
nadove-ucsc
left a comment
There was a problem hiding this comment.
I would shorten the first commit title to "Add logging in resolve_container_path script"
Subject: [PATCH] REVIEW
---
Index: scripts/resolve_container_path.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/scripts/resolve_container_path.py b/scripts/resolve_container_path.py
--- a/scripts/resolve_container_path.py (revision 186a22e1acdc5a14bb6bbc6c9057d761e31269c6)
+++ b/scripts/resolve_container_path.py (date 1764793320467)
@@ -33,33 +33,38 @@
log.info('Found %s', mountinfo)
# Entries in /proc/self/mountinfo look like this:
# 752 744 259:2 /docker/containers/dc61d93…ID…/hosts …
+ # REVIEW: some of these changes should go in a fixup! to your first
+ # commit, others to the last commit.
prefix = '/docker/containers'
- contents = csv.reader(f, delimiter=' ')
- for line in contents:
+ log.info('cgroup v2 prefix is %s', prefix)
+ for line in csv.reader(f, delimiter=' '):
path = line[3]
if path.startswith(prefix):
- log.info('Extracting the container ID from %s', path)
- parts = path.rsplit('/', maxsplit=2)[:-1]
- assert len(parts) == 2 and parts[0] == prefix, parts
+ log.info('Extracting container ID from %s', path)
+ parts = path.rsplit('/', maxsplit=2)
+ assert len(parts) == 3 and parts[0] == prefix and parts[2] == 'hosts', parts
container_id = parts[1]
except FileNotFoundError:
log.info('Did not find %s', mountinfo)
- pass
else:
- log.info('cgroup v2 prefix is %s', prefix)
api = docker.client.from_env().api
for mount in api.inspect_container(container_id)['Mounts']:
if container_path.startswith(mount['Destination']):
tail = os.path.relpath(container_path, mount['Destination'])
host_path = os.path.normpath(os.path.join(mount['Source'], tail))
- log.info('Resolving %s to %s', container_path, host_path)
+ log.info('Resolved %s to %s', container_path, host_path)
return host_path
- log.error('Cannot resolve container path: %s', container_path)
+ log.error('Failed to resolve container path %s', container_path)
return None
-if __name__ == '__main__':
- configure_script_logging(log)
- container_path = sys.argv[1]
+# REVIEW: separate commit for this change, before any other changes
+def main(argv):
+ container_path = argv[0]
host_path = resolve_container_path(container_path)
print(container_path if host_path is None else host_path)
+
+
+if __name__ == '__main__':
+ configure_script_logging(log)
+ main(sys.argv[1:])
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
from
186a22e to
773028d
Compare
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
3 times, most recently
from
a3bd082 to
7e558c8
Compare
hannes-ucsc
previously approved these changes
Dec 16, 2025
Member
Security design review
|
Member
|
Security design review This change upgrades CIS-hardened Amazon Linux AMI used for GitLab instances to the latest version available, ensuring long-term support and security patches. |
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
3 times, most recently
from
080cf2b to
c6ad178
Compare
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
from
c6ad178 to
d02f275
Compare
Member
Author
|
This PR still contains items to be addressed, and cannot be merged as is.
|
Use Amazon Linux 2023 AMI
Drop flushing of ruleset from gitlab.service
Enable FIPS and associated reboot dependencies
Change resolve_container_path.py to work with new instance use of cgroup v2
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6160-7218-amazon-linux-2023
branch
from
d02f275 to
cadaa02
Compare
achave11-ucsc
changed the title
Member
Author
|
After fixing the reboot problem (bbb3b65) and dropping the changes associated with #7218 (comment), the GitLab test job succeeded for this branch (commit c05f252). |
hannes-ucsc
requested changes
Jan 6, 2026
Comment on lines
+7
to
+9
| from more_itertools import ( | ||
| one, | ||
| ) |
Member
There was a problem hiding this comment.
False positive. It is used in line 56 below.
|
|
||
| if __name__ == '__main__': | ||
| container_path = sys.argv[1] | ||
| def main(argv): |
Member
There was a problem hiding this comment.
Suggested change
| def main(argv): | |
| def main(container_path): |
| if __name__ == '__main__': | ||
| container_path = sys.argv[1] | ||
| def main(argv): | ||
| container_path = argv[0] |
Member
There was a problem hiding this comment.
Suggested change
| container_path = argv[0] |
|
|
||
| if __name__ == '__main__': | ||
| configure_script_logging(log) | ||
| main(sys.argv[1:]) |
Member
There was a problem hiding this comment.
Suggested change
| main(sys.argv[1:]) | |
| main(sys.argv[1]) |
| 'ssh_authorized_keys': [] if config.deployment.is_stable else operator_keys, | ||
| 'ssh_genkeytypes': ['rsa', 'dsa', 'ecdsa'], | ||
| 'bootcmd': [ | ||
| "until [ -b /dev/nvme1n1 ]; do echo '/dev/nvme1n1 does not exist, sleeping 1s'; sleep 1; done", |
Member
There was a problem hiding this comment.
Let's use '; '.join(['until [ -b /dev/nvme1n1', … and wrap over multiple lines.
A comment should added before this to refer to the upstream issue this is working around.
Comment on lines
+2212
to
+2217
| # A bug in Amazon's AMI causes 'condition' to depend on | ||
| # the creation of a file that is never created | ||
| # (/run/cloud-init-selinux-reboot), unless Amazon's | ||
| # cc_selinux.py has to modify the SELinux configuration. | ||
| # Luckily our cloud-config takes presedence, so we can | ||
| # just override the condition here. |
Member
There was a problem hiding this comment.
Suggested change
| # A bug in Amazon's AMI causes 'condition' to depend on | |
| # the creation of a file that is never created | |
| # (/run/cloud-init-selinux-reboot), unless Amazon's | |
| # cc_selinux.py has to modify the SELinux configuration. | |
| # Luckily our cloud-config takes presedence, so we can | |
| # just override the condition here. | |
| # A bug in Amazon's AMI causes a 'condition' to be added to the effective cloud-init config. That condition depends on | |
| # the creation of a file that is never created | |
| # (/run/cloud-init-selinux-reboot), except when Amazon's | |
| # cc_selinux.py has to modify the SELinux configuration, which by default, it does not. | |
| # Luckily, our cloud-init config takes precedence, so we can | |
| # just override the condition here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Linked issues: #6160, #4890
Checklist
Author
developissues/<GitHub handle of author>/<issue#>-<slug>1 when the issue title describes a problem, the corresponding PR
title is
Fix:followed by the issue titleAuthor (partiality)
ptag to titles of partial commitspartialor completely resolves all linked issuespartiallabelAuthor (reindex)
rtag to commit title or the changes introduced by this PR will not require reindexing of any deploymentreindex:devor the changes introduced by it will not require reindexing ofdevreindex:anvildevor the changes introduced by it will not require reindexing ofanvildevreindex:anvilprodor the changes introduced by it will not require reindexing ofanvilprodreindex:prodor the changes introduced by it will not require reindexing ofprodreindex:partialand its description documents the specific reindexing procedure fordev,anvildev,anvilprodandprodor requires a full reindex or carries none of the labelsreindex:dev,reindex:anvildev,reindex:anvilprodandreindex:prodAuthor (API changes)
APIor this PR does not modify a REST APIa(A) tag to commit title for backwards (in)compatible changes or this PR does not modify a REST APIapp.pyor this PR does not modify a REST APIAuthor (upgrading deployments)
make docker_images.jsonand committed the resulting changes or this PR does not modifyazul_docker_images, or any other variables referenced in the definition of that variableutag to commit title or this PR does not require upgrading deploymentsupgradeor does not require upgrading deploymentsdeploy:sharedor does not modifydocker_images.json, and does not require deploying thesharedcomponent for any other reasondeploy:gitlabor does not require deploying thegitlabcomponentdeploy:runneror does not require deploying therunnerimageAuthor (hotfixes)
Ftag to main commit title or this PR does not include permanent fix for a temporary hotfixanvilprodandprod) have temporary hotfixes for any of the issues linked to this PRAuthor (before every review)
develop, squashed fixups from prior reviewsmake requirements_updateor this PR does not modifyDockerfile,environment,requirements*.txt,common.mk,Makefileorenvironment.bootRtag to commit title or this PR does not modifyrequirements*.txtreqsor does not modifyrequirements*.txtmake integration_testpasses in personal deployment or this PR does not modify functionality that could affect the IT outcomePeer reviewer (after approval)
Note that when requesting changes, the PR must be assigned back to the author.
System administrator (after approval)
demoorno demono demono sandboxN reviewslabel is accuratetempdevAuthor (after approval)
testjob succeeds in the GitLab pipeline for this PRSystem administrator (after validation)
Operator
reindex:…labels andrcommit title tagno demodevelopOperator (deploy
.sharedand.gitlabcomponents)_select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unusedor this PR is not labeleddeploy:shared_select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab applyor this PR is not labeleddeploy:gitlab_select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unusedor this PR is not labeleddeploy:shared_select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab applyor this PR is not labeleddeploy:gitlabdeploy:gitlabdeploy:gitlabSystem administrator (post-deploy of
.gitlabcomponent)dev.gitlabare complete or this PR is not labeleddeploy:gitlabanvildev.gitlabare complete or this PR is not labeleddeploy:gitlabOperator (deploy runner image)
_select dev.gitlab && make -C terraform/gitlab/runneror this PR is not labeleddeploy:runner_select anvildev.gitlab && make -C terraform/gitlab/runneror this PR is not labeleddeploy:runnerOperator (sandbox build)
sandboxlabel or PR is labeledno sandboxdevor PR is labeledno sandboxanvildevor PR is labeledno sandboxsandboxdeployment or PR is labeledno sandboxanvilboxdeployment or PR is labeledno sandboxsandboxdeployment or PR is labeledno sandboxanvilboxdeployment or PR is labeledno sandboxsandboxor this PR does not remove catalogs or otherwise causes unreferenced indices indevanvilboxor this PR does not remove catalogs or otherwise causes unreferenced indices inanvildevsandboxor this PR is not labeledreindex:devanvilboxor this PR is not labeledreindex:anvildevsandboxor this PR is not labeledreindex:devanvilboxor this PR is not labeledreindex:anvildevOperator (merge the branch)
pif the PR is also labeledpartialOperator (main build)
devanvildevdevdevanvildevanvildev_select dev.shared && make -C terraform/shared applyor this PR is not labeleddeploy:shared_select anvildev.shared && make -C terraform/shared applyor this PR is not labeleddeploy:shareddevanvildevOperator (reindex)
devor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevdevor this PR does not require reindexingdevdeploy_browserjob in the GitLab pipeline for this PR indevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdeploy_browserjob in the GitLab pipeline for this PR inanvildevor this PR does not require reindexinganvildevOperator (mirroring)
devor this PR does not require mirroringdevanvildevor this PR does not require mirroringanvildevdevor this PR does not require mirroringdevanvildevor this PR does not require mirroringanvildevdevor this PR does not require mirroringdevanvildevor this PR does not require mirroringanvildevOperator
deploy:shared,deploy:gitlab,deploy:runner,API,reindex:partial,reindex:anvilprodandreindex:prodlabels to the next promotion PRs or this PR carries none of these labelsdeploy:shared,deploy:gitlab,deploy:runner,API,reindex:partial,reindex:anvilprodandreindex:prodlabels, from the description of this PR to that of the next promotion PRs or this PR carries none of these labelsShorthand for review comments
Lline is too longWline wrapping is wrongQbad quotesFother formatting problem