From bbf4d27a5c046f95b6fda109dcda109fd00298b1 Mon Sep 17 00:00:00 2001 From: Tomasz Maczukin Date: Wed, 15 Mar 2017 00:27:10 +0100 Subject: Make runner's veryfication working again In APIv1 we were using UpdateJob to verify if the runner exists. It was the only method that was using Runner's token and used in special way had no side effects (like scheduling a new job or unregisterring a Runner). In APIv4 we've change UpdateJob to use job's token as authentication credentials, and that way we've removed the only endpoint that could be used to verify if the Runner with a certain token exists in target GitLab installation. This commit adds `POST /api/v4/runners/verify` endpoint whose only responsibility is to respond if Runner with posted credentials exists or not. --- lib/api/runner.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'lib') diff --git a/lib/api/runner.rb b/lib/api/runner.rb index c700d2ef4a1..b80f7284735 100644 --- a/lib/api/runner.rb +++ b/lib/api/runner.rb @@ -47,6 +47,17 @@ module API authenticate_runner! Ci::Runner.find_by_token(params[:token]).destroy end + + desc 'Validates authentication credentials' do + http_codes [[200, 'Credentials are valid'], [403, 'Forbidden']] + end + params do + requires :token, type: String, desc: %q(Runner's authentication token) + end + post '/verify' do + authenticate_runner! + status 200 + end end resource :jobs do -- cgit v1.2.1 From e79ab1115bf6ab4776678a379f7d507455d867c0 Mon Sep 17 00:00:00 2001 From: Tomasz Maczukin Date: Thu, 16 Mar 2017 03:31:09 +0100 Subject: Remove legacy Runners support in /api/v4/jobs/request In Runner v1.3.0 we've started to send User-Agent header with Runner's version data. Since GitLab v8.12.0 we've started to use this header to check if used Runner's version supports 204 status code instead of 404 as a response when there is no jobs to execute by a Runner. In APIv4 (introduced in GitLab 9.0.0) will require Runner v9.0.0. And writing more accurately: GitLab Runner v9.0.0 will require GitLab at least 9.0.0. Because of such breaking change we are able to switch entirely to 204 response code and there is no need to do check of User-Agent. This commit removes useless code and complexity. --- lib/api/helpers/runner.rb | 8 -------- lib/api/runner.rb | 9 ++++++--- 2 files changed, 6 insertions(+), 11 deletions(-) (limited to 'lib') diff --git a/lib/api/helpers/runner.rb b/lib/api/helpers/runner.rb index ec2bcaed929..74848a6e144 100644 --- a/lib/api/helpers/runner.rb +++ b/lib/api/helpers/runner.rb @@ -41,14 +41,6 @@ module API (Time.now - current_runner.contacted_at) >= contacted_at_max_age end - def job_not_found! - if headers['User-Agent'].to_s =~ /gitlab(-ci-multi)?-runner \d+\.\d+\.\d+(~beta\.\d+\.g[0-9a-f]+)? / - no_content! - else - not_found! - end - end - def validate_job!(job) not_found! unless job diff --git a/lib/api/runner.rb b/lib/api/runner.rb index b80f7284735..4c9db2c8716 100644 --- a/lib/api/runner.rb +++ b/lib/api/runner.rb @@ -63,6 +63,9 @@ module API resource :jobs do desc 'Request a job' do success Entities::JobRequest::Response + http_codes [[201, 'Job was scheduled'], + [204, 'No job for Runner'], + [403, 'Forbidden']] end params do requires :token, type: String, desc: %q(Runner's authentication token) @@ -71,13 +74,13 @@ module API end post '/request' do authenticate_runner! - not_found! unless current_runner.active? + no_content! unless current_runner.active? update_runner_info if current_runner.is_runner_queue_value_latest?(params[:last_update]) header 'X-GitLab-Last-Update', params[:last_update] Gitlab::Metrics.add_event(:build_not_found_cached) - return job_not_found! + return no_content! end new_update = current_runner.ensure_runner_queue_value @@ -91,7 +94,7 @@ module API else Gitlab::Metrics.add_event(:build_not_found) header 'X-GitLab-Last-Update', new_update - job_not_found! + no_content! end else # We received build that is invalid due to concurrency conflict -- cgit v1.2.1 From 9267a9b19d6c7e090c286e9d922c71fe64190a47 Mon Sep 17 00:00:00 2001 From: Tomasz Maczukin Date: Thu, 16 Mar 2017 05:18:37 +0100 Subject: Send token of depenent job Artifacts download for authorization is using a job token of job to which the artifact belongs. In APIv1 the token was sent with dependent jobs details and in APIv4 it was designed to also contain it. However I forgot about this parameter while working on `/api/v4/jobs/request` endpoint. This commit adds a missing parameter which is required for APIv4 to work properly. --- lib/api/entities.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 0a12ee72d49..29c640ddb19 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -768,7 +768,7 @@ module API end class Dependency < Grape::Entity - expose :id, :name + expose :id, :name, :token expose :artifacts_file, using: ArtifactFile, if: ->(job, _) { job.artifacts? } end -- cgit v1.2.1 From c191c1103b37903f2293c2a662cdc616228b9eb7 Mon Sep 17 00:00:00 2001 From: Tomasz Maczukin Date: Thu, 16 Mar 2017 14:45:05 +0100 Subject: Send only defined dependencies In APIv1 we've been sending all jobs from previous stages and a `dependencies` list with names of jobs that user want to download artifacts from. This was selected on Runners side. In APIv1 we've planned to send only jobs that were defined (if any; and all previous jobs by default). However I've missed the fact that it was Runner who selected jobs, not GitLab. And now current version of APIV4 sends all jobs everytime. This commit fixes this. If user will define `dependencies` in his job, then GitLab will send only selected jobs. --- lib/api/entities.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 29c640ddb19..5954aea8041 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -796,7 +796,7 @@ module API expose :artifacts, using: Artifacts expose :cache, using: Cache expose :credentials, using: Credentials - expose :depends_on_builds, as: :dependencies, using: Dependency + expose :dependencies, using: Dependency end end end -- cgit v1.2.1