feat: disable v1 svcs but keep internal gitlab (#772)

Author: olevski

internal/config/config.yaml

@@ -24,6 +24,7 @@ sessions:
       authorizedParty: renku-cli
 revproxy:
   enableV1Services: true
+  enableInternalGitlab: true
   renkuBaseUrl: "https://renkulab.io"
   externalGitlabUrl:
   k8sNamespace:
@@ -41,6 +42,7 @@ revproxy:
     search:
 login:
   enableV1Services: true
+  enableInternalGitlab: true
   endpointsBasePath:
   renkuBaseURL: "https://renkulab.io"
   tokenEncryption:

internal/config/login.go

@@ -11,6 +11,7 @@ type TokenEncryptionConfig struct {
 }
 
 type LoginConfig struct {
+	EnableInternalGitlab        bool
 	EnableV1Services            bool
 	RenkuBaseURL                *url.URL
 	LoginRoutesBasePath         string
@@ -36,7 +37,7 @@ type OIDCClient struct {
 
 func (c LoginConfig) Validate(e RunningEnvironment) error {
 	// Fix the login config when EnableV1Services is false
-	if !c.EnableV1Services {
+	if !c.EnableInternalGitlab {
 		delete(c.Providers, "gitlab")
 	}
 	if c.TokenEncryption.Enabled && len(c.TokenEncryption.SecretKey) != 32 {
@@ -55,5 +56,8 @@ func (c LoginConfig) Validate(e RunningEnvironment) error {
 			}
 		}
 	}
+	if c.EnableV1Services && !c.EnableInternalGitlab {
+		return fmt.Errorf("enabling V1 (legacy) services but disabling the internal Gitlab is not supported in the login config")
+	}
 	return nil
 }

internal/config/revproxy.go

@@ -15,11 +15,12 @@ type RenkuServicesConfig struct {
 }
 
 type RevproxyConfig struct {
-	EnableV1Services  bool
-	RenkuBaseURL      *url.URL
-	ExternalGitlabURL *url.URL
-	K8sNamespace      string
-	RenkuServices     RenkuServicesConfig
+	EnableV1Services     bool
+	EnableInternalGitlab bool
+	RenkuBaseURL         *url.URL
+	ExternalGitlabURL    *url.URL
+	K8sNamespace         string
+	RenkuServices        RenkuServicesConfig
 }
 
 type CoreSvcConfig struct {
@@ -39,6 +40,9 @@ func (r *RevproxyConfig) Validate() error {
 	if r.RenkuServices.UIServer == nil {
 		return fmt.Errorf("the proxy config is missing the url to ui-server")
 	}
+	if r.EnableV1Services && !r.EnableInternalGitlab {
+		return fmt.Errorf("enabling V1 (legacy) services but disabling the internal Gitlab is not supported in the reverse proxy config")
+	}
 
 	// Check v1 services if needed
 	if r.EnableV1Services {

internal/config/revproxy_test.go

@@ -15,10 +15,11 @@ func getValidRevproxyConfig(t *testing.T) RevproxyConfig {
 	require.NoError(t, err)
 	renkuServicesConfig := getValidRenkuServicesConfig(t)
 	return RevproxyConfig{
-		EnableV1Services:  true,
-		RenkuBaseURL:      renkuBaseURL,
-		ExternalGitlabURL: externalGitlabURL,
-		RenkuServices:     renkuServicesConfig,
+		EnableV1Services:     true,
+		EnableInternalGitlab: true,
+		RenkuBaseURL:         renkuBaseURL,
+		ExternalGitlabURL:    externalGitlabURL,
+		RenkuServices:        renkuServicesConfig,
 	}
 }
 

internal/login/login_server_routes.go

@@ -244,7 +244,7 @@ func (l *LoginServer) nextAuthStep(
 }
 
 func (l *LoginServer) getLoginSequence() (loginSequence []string) {
-	if l.config.EnableV1Services {
+	if l.config.EnableInternalGitlab {
 		return defaultLoginSequence[:]
 	} else {
 		return v2OnlyLoginSequence[:]

internal/login/login_server_routes_test.go

@@ -48,15 +48,18 @@ func getTestConfig(loginServerPort int, authServers ...testAuthServer) (config.L
 
 	// Toggle `EnableV1Services` on if we authenticate with GitLab
 	enableV1Services := false
+	enableInternalGitlab := false
 	for _, auth := range authServers {
 		if auth.ClientID == "gitlab" {
 			enableV1Services = true
+			enableInternalGitlab = true
 		}
 	}
 
 	testConfig := config.LoginConfig{
-		EnableV1Services: enableV1Services,
-		RenkuBaseURL:     renkuBaseURL,
+		EnableInternalGitlab: enableInternalGitlab,
+		EnableV1Services:     enableV1Services,
+		RenkuBaseURL:         renkuBaseURL,
 		TokenEncryption: config.TokenEncryptionConfig{
 			Enabled:   true,
 			SecretKey: "1b195c6329ba7df1c1adf6975c71910d",

internal/revproxy/main.go

@@ -54,8 +54,10 @@ func (r *Revproxy) RegisterHandlers(e *echo.Echo, commonMiddlewares ...echo.Midd
 	sk := e.Group("/api/data/user/secret_key", commonMiddlewares...)
 	sk.GET("/", echo.NotFoundHandler)
 
-	// Middlewares and routing is configured depending on `EnableV1Services`
+	// Middlewares and routing is configured depending on `EnableV1Services` and `EnableInternalGitlab`
 	if r.config.EnableV1Services {
+		// Means that the V1Services and the internal Gitlab are enabled
+		// This whole branch of else-if should be removed when the Gitlab is retired.
 		// Initialize common authentication middleware
 		coreSvcIdToken := r.coreSvcIdTokenAuth.Middleware()
 		dataGitlabAccessToken := r.dataGitlabAccessTokenAuth.Middleware()
@@ -107,7 +109,26 @@ func (r *Revproxy) RegisterHandlers(e *echo.Echo, commonMiddlewares ...echo.Midd
 		e.Group("/ui-server/api/last-projects/:length", append(commonMiddlewares, renkuAccessToken, uiServerProxy)...)
 		e.Group("/ui-server/api/renku/cache.files_upload", uiServerUpstreamCoreLocation(r.config.RenkuServices.Core.ServiceNames[0]), uiServerProxy)
 		e.Group("/ui-server/api/kg/entities", append(commonMiddlewares, uiServerUpstreamKgLocation(r.config.RenkuServices.KG.Host), renkuAccessToken, dataGitlabAccessToken, uiServerProxy)...)
+	} else if r.config.EnableInternalGitlab {
+		// This whole branch of else-if should be removed when the Gitlab is retired.
+		// Initialize common authentication middleware
+		notebooksRenkuRefreshToken := r.notebooksRenkuRefreshTokenAuth.Middleware()
+		renkuAccessToken := r.renkuAccessTokenAuth.Middleware()
+		dataGitlabAccessToken := r.dataGitlabAccessTokenAuth.Middleware()
+
+		// Routing for Renku services
+		// Notebooks is being routed to data service now
+		e.Group("/api/notebooks", append(commonMiddlewares, renkuAccessToken, dataGitlabAccessToken, notebooksRenkuRefreshToken, notebooksAnonymousID(r.sessions), regexRewrite("^/api/notebooks(.*)", "/api/data/notebooks$1"), dataServiceProxy)...)
+		e.Group("/api/data", append(commonMiddlewares, renkuAccessToken, dataGitlabAccessToken, notebooksRenkuRefreshToken, notebooksAnonymousID(r.sessions), dataServiceProxy)...)
+		// /api/kc is used only by the ui and no one else, will be removed when the gateway is in charge of user sessions
+		e.Group("/api/kc", append(commonMiddlewares, stripPrefix("/api/kc"), renkuAccessToken, keycloakProxyHost, keycloakProxy)...)
+
+		// UI server webssockets
+		e.Group("/ui-server/ws", append(commonMiddlewares, ensureSession(r.sessions), renkuAccessToken, uiServerProxy)...)
+		// Some routes need to go to the UI server before they go to the specific Renku service
+		e.Group("/ui-server/api/allows-iframe", append(commonMiddlewares, uiServerProxy)...)
 	} else {
+		// Both the v1 services and internal gitlab are disabled
 		// Initialize common authentication middleware
 		notebooksRenkuRefreshToken := r.notebooksRenkuRefreshTokenAuth.Middleware()
 		renkuAccessToken := r.renkuAccessTokenAuth.Middleware()
@@ -142,6 +163,13 @@ func (r *Revproxy) initializeAuth() error {
 		return err
 	}
 
+	if !r.config.EnableV1Services && r.config.EnableInternalGitlab {
+		r.dataGitlabAccessTokenAuth, err = NewAuth(AuthWithSessionStore(r.sessions), WithTokenType(models.AccessTokenType), WithProviderID("gitlab"), WithTokenInjector(dataServiceGitlabAccessTokenInjector))
+		if err != nil {
+			return err
+		}
+	}
+
 	// Initialize auth for v1 services if needed
 	if r.config.EnableV1Services {
 		r.coreSvcIdTokenAuth, err = NewAuth(AuthWithSessionStore(r.sessions), WithTokenType(models.IDTokenType), WithProviderID("renku"), WithTokenInjector(coreSvcRenkuIdTokenInjector))