Merge branch 'gitaly-deny-disk-access' into 'master'

EE-specific repository disk access exceptions, part 1

See merge request gitlab-org/gitlab-ee!6151

ee/app/models/ee/repository.rb

@@ -11,12 +11,17 @@ module EE
     end
 
     # Transiently sets a configuration variable
+    # Gitaly migration: https://gitlab.com/gitlab-org/gitaly/issues/1241
     def with_config(values = {})
-      values.each { |k, v| rugged.config[k] = v }
+      ::Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+        values.each { |k, v| rugged.config[k] = v }
+      end
 
       yield
     ensure
-      values.keys.each { |key| rugged.config.delete(key) }
+      ::Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+        values.keys.each { |key| rugged.config.delete(key) }
+      end
     end
 
     # Runs code after a repository has been synced.
@@ -25,5 +30,10 @@ module EE
       expire_branch_cache if exists?
       expire_content_cache
     end
+
+    def upstream_branches
+      # Gitaly migration: https://gitlab.com/gitlab-org/gitaly/issues/1243
+      ::Gitlab::GitalyClient::StorageSettings.allow_disk_access { super }
+    end
   end
 end

ee/lib/elasticsearch/git/repository.rb

@@ -374,7 +374,8 @@ module Elasticsearch
         def repository_for_indexing(repo_path = nil)
           return @rugged_repo_indexer if defined? @rugged_repo_indexer
 
-          @path_to_repo ||= repo_path || path_to_repo
+          # Gitaly: how are we going to migrate ES code search? https://gitlab.com/gitlab-org/gitaly/issues/760
+          @path_to_repo ||= allow_disk_access { repo_path || path_to_repo }
 
           set_repository_id
 
@@ -384,6 +385,19 @@ module Elasticsearch
         def client_for_indexing
           @client_for_indexing ||= Elasticsearch::Client.new retry_on_failure: 5
         end
+
+        def allow_disk_access
+          # Sometimes this code runs as part of a bin/elastic_repo_indexer
+          # process. When that is the case Gitlab::GitalyClient::StorageSettings
+          # is not defined.
+          if defined?(Gitlab::GitalyClient::StorageSettings)
+            Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+              yield
+            end
+          else
+            yield
+          end
+        end
       end
 
       module ClassMethods

ee/lib/gitlab/elastic/indexer.rb

@@ -56,7 +56,9 @@ module Gitlab
       end
 
       def run_indexer!(from_sha, to_sha)
-        command = [path_to_indexer, project.id.to_s, repository.path_to_repo]
+        command = ::Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+          [path_to_indexer, project.id.to_s, repository.path_to_repo]
+        end
         vars = @vars.merge('FROM_SHA' => from_sha, 'TO_SHA' => to_sha)
 
         output, status = Gitlab::Popen.popen(command, nil, vars)

ee/spec/lib/gitlab/checks/change_access_spec.rb

@@ -420,7 +420,9 @@ describe Gitlab::Checks::ChangeAccess do
         #
         # That means only the merge commit should be validated.
         let(:newrev) do
-          rugged = project.repository.raw_repository.rugged
+          rugged = Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+            project.repository.raw_repository.rugged
+          end
           base = oldrev
           to_merge = '2d1096e3a0ecf1d2baf6dee036cc80775d4940ba'
 

ee/spec/lib/gitlab/elastic/indexer_spec.rb

@@ -47,7 +47,7 @@ describe Gitlab::Elastic::Indexer do
         [
           File.join(Rails.root, 'bin/elastic_repo_indexer'),
           project.id.to_s,
-          project.repository.path_to_repo
+          Gitlab::GitalyClient::StorageSettings.allow_disk_access { project.repository.path_to_repo }
         ],
         nil,
         hash_including(

ee/spec/migrations/drop_repository_storage_events_for_geo_events_spec.rb

@@ -97,6 +97,8 @@ describe DropRepositoryStorageEventsForGeoEvents, :migration do
   end
 
   def legacy_disk_path(name)
-    Gitlab.config.repositories.storages[name].legacy_disk_path
+    Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+      Gitlab.config.repositories.storages[name].legacy_disk_path
+    end
   end
 end

ee/spec/services/geo/move_repository_service_spec.rb

@@ -10,12 +10,19 @@ describe Geo::MoveRepositoryService, :geo do
     subject(:service) { described_class.new(project, old_path, new_path) }
 
     it 'renames the project repositories' do
-      old_disk_path = project.repository.path_to_repo
-      old_wiki_disk_path = project.wiki.repository.path_to_repo
-      full_new_path = File.join(
-        Gitlab.config.repositories.storages[project.repository_storage].legacy_disk_path,
-        new_path
-      )
+      old_disk_path = Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+        project.repository.path_to_repo
+      end
+      old_wiki_disk_path = Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+        project.wiki.repository.path_to_repo
+      end
+
+      full_new_path = Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+        File.join(
+          Gitlab.config.repositories.storages[project.repository_storage].legacy_disk_path,
+          new_path
+        )
+      end
 
       expect(File.directory?(old_disk_path)).to be_truthy
       expect(File.directory?(old_wiki_disk_path)).to be_truthy

ee/spec/services/projects/update_mirror_service_spec.rb

@@ -222,7 +222,9 @@ describe Projects::UpdateMirrorService do
   end
 
   def fetch_mirror(repository)
-    rugged = repository.rugged
+    rugged = Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+      repository.rugged
+    end
     masterrev = repository.find_branch('master').dereferenced_target.id
 
     parentrev = repository.commit(masterrev).parent_id

ee/spec/services/projects/update_repository_storage_service_spec.rb

@@ -17,7 +17,9 @@ describe Projects::UpdateRepositoryStorageService do
 
       context 'when the move succeeds' do
         it 'moves the repository to the new storage and unmarks the repository as read only' do
-          old_path = project.repository.path_to_repo
+          old_path = Gitlab::GitalyClient::StorageSettings.allow_disk_access do
+            project.repository.path_to_repo
+          end
 
           expect_any_instance_of(Gitlab::Git::Repository).to receive(:fetch_repository_as_mirror)
             .with(project.repository.raw).and_return(true)