Commit 827594ab authored by Evan Read's avatar Evan Read

Merge branch 'docs-remove-air-gapped' into 'master'

Changing offline terminology to offline environments

See merge request gitlab-org/gitlab!28594
parents 006814da d4e1e8f3
...@@ -64,7 +64,7 @@ source projects, GitLab grants access to **Gold** features for all GitLab.com ...@@ -64,7 +64,7 @@ source projects, GitLab grants access to **Gold** features for all GitLab.com
#### Self-managed #### Self-managed
A self-managed subscription uses a hybrid model. You pay for a subscription according to the maximum number of users enabled during the subscription period. For instances that aren't air-gapped or on a closed network, the maximum number of simultaneous users in the self-managed installation is checked each quarter, using [Seat Link](#seat-link). A self-managed subscription uses a hybrid model. You pay for a subscription according to the maximum number of users enabled during the subscription period. For instances that aren't offline or on a closed network, the maximum number of simultaneous users in the self-managed installation is checked each quarter, using [Seat Link](#seat-link).
Every occupied seat, whether by person, job, or bot is counted in the subscription, with the following exceptions: Every occupied seat, whether by person, job, or bot is counted in the subscription, with the following exceptions:
...@@ -255,7 +255,7 @@ Seat Link provides **only** the following information to GitLab: ...@@ -255,7 +255,7 @@ Seat Link provides **only** the following information to GitLab:
- Historical maximum user count - Historical maximum user count
- Active users count - Active users count
For air-gapped or closed network customers, the existing [true-up model](#users-over-license) will be used. Prorated charges are not possible without user count data. For offline or closed network customers, the existing [true-up model](#users-over-license) will be used. Prorated charges are not possible without user count data.
<details> <details>
<summary>Click here to view example content of a Seat Link POST request.</summary> <summary>Click here to view example content of a Seat Link POST request.</summary>
......
# Air-gapped GitLab # Offline GitLab
Computers in an air-gapped network are isolated from the public internet as a security measure. Computers in an offline environment are isolated from the public internet as a security measure. This
This page lists all the information available for running GitLab in an air-gapped environment. page lists all the information available for running GitLab in an offline environment.
## Quick start ## Quick start
...@@ -14,7 +14,7 @@ Follow these best practices to use GitLab's features in an offline environment: ...@@ -14,7 +14,7 @@ Follow these best practices to use GitLab's features in an offline environment:
- [Operating the GitLab Secure scanners in an offline environment](../../user/application_security/offline_deployments/index.md). - [Operating the GitLab Secure scanners in an offline environment](../../user/application_security/offline_deployments/index.md).
## Loading Docker images onto your air-gapped host ## Loading Docker images onto your offline host
To use many GitLab features, including To use many GitLab features, including
[security scans](../../user/application_security/index.md#working-in-an-offline-environment) [security scans](../../user/application_security/index.md#working-in-an-offline-environment)
...@@ -22,13 +22,13 @@ and [Auto Devops](../autodevops/), the GitLab Runner must be able to fetch the ...@@ -22,13 +22,13 @@ and [Auto Devops](../autodevops/), the GitLab Runner must be able to fetch the
relevant Docker images. relevant Docker images.
The process for making these images available without direct access to the public internet The process for making these images available without direct access to the public internet
involves downloading the images then packaging and transferring them to the air-gapped host. involves downloading the images then packaging and transferring them to the offline host. Here's an
Here's an example of such a transfer: example of such a transfer:
1. Download Docker images from public internet. 1. Download Docker images from public internet.
1. Package Docker images as tar archives. 1. Package Docker images as tar archives.
1. Transfer images to air-gapped environment. 1. Transfer images to offline environment.
1. Load transferred images into air-gapped Docker registry. 1. Load transferred images into offline Docker registry.
### Example image packager script ### Example image packager script
...@@ -51,7 +51,7 @@ done ...@@ -51,7 +51,7 @@ done
### Example image loader script ### Example image loader script
This example loads the images from a bastion host to an air-gapped host. In certain configurations, This example loads the images from a bastion host to an offline host. In certain configurations,
physical media may be needed for such a transfer: physical media may be needed for such a transfer:
```sh ```sh
......
# Getting started with an air-gapped GitLab Installation # Getting started with an offline GitLab Installation
This is a step-by-step guide that helps you install, configure, and use a self-managed GitLab This is a step-by-step guide that helps you install, configure, and use a self-managed GitLab
instance entirely offline. instance entirely offline.
......
...@@ -180,7 +180,7 @@ using environment variables. ...@@ -180,7 +180,7 @@ using environment variables.
| `CLAIR_DB_CONNECTION_STRING` | This variable represents the [connection string](https://www.postgresql.org/docs/9.3/libpq-connect.html#AEN39692) to the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db) database and **shouldn't be changed** unless you're running the image locally as described in the [Running the standalone Container Scanning Tool](#running-the-standalone-container-scanning-tool) section. The host value for the connection string must match the [alias](https://gitlab.com/gitlab-org/gitlab/-/blob/898c5da43504eba87b749625da50098d345b60d6/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml#L23) value of the `Container-Scanning.gitlab-ci.yml` template file, which defaults to `clair-vulnerabilities-db`. | `postgresql://postgres:password@clair-vulnerabilities-db:5432/postgres?sslmode=disable&statement_timeout=60000` | | `CLAIR_DB_CONNECTION_STRING` | This variable represents the [connection string](https://www.postgresql.org/docs/9.3/libpq-connect.html#AEN39692) to the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db) database and **shouldn't be changed** unless you're running the image locally as described in the [Running the standalone Container Scanning Tool](#running-the-standalone-container-scanning-tool) section. The host value for the connection string must match the [alias](https://gitlab.com/gitlab-org/gitlab/-/blob/898c5da43504eba87b749625da50098d345b60d6/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml#L23) value of the `Container-Scanning.gitlab-ci.yml` template file, which defaults to `clair-vulnerabilities-db`. | `postgresql://postgres:password@clair-vulnerabilities-db:5432/postgres?sslmode=disable&statement_timeout=60000` |
| `CI_APPLICATION_REPOSITORY` | Docker repository URL for the image to be scanned. | `$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG` | | `CI_APPLICATION_REPOSITORY` | Docker repository URL for the image to be scanned. | `$CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG` |
| `CI_APPLICATION_TAG` | Docker respository tag for the image to be scanned. | `$CI_COMMIT_SHA` | | `CI_APPLICATION_TAG` | Docker respository tag for the image to be scanned. | `$CI_COMMIT_SHA` |
| `CLAIR_DB_IMAGE` | The Docker image name and tag for the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db). It can be useful to override this value with a specific version, for example, to provide a consistent set of vulnerabilities for integration testing purposes, or to refer to a locally hosted vulnerabilities database for an on-premise air-gapped installation. | `arminc/clair-db:latest` | | `CLAIR_DB_IMAGE` | The Docker image name and tag for the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db). It can be useful to override this value with a specific version, for example, to provide a consistent set of vulnerabilities for integration testing purposes, or to refer to a locally hosted vulnerabilities database for an on-premise offline installation. | `arminc/clair-db:latest` |
| `CLAIR_DB_IMAGE_TAG` | (**DEPRECATED - use `CLAIR_DB_IMAGE` instead**) The Docker image tag for the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db). It can be useful to override this value with a specific version, for example, to provide a consistent set of vulnerabilities for integration testing purposes. | `latest` | | `CLAIR_DB_IMAGE_TAG` | (**DEPRECATED - use `CLAIR_DB_IMAGE` instead**) The Docker image tag for the [PostgreSQL server hosting the vulnerabilities definitions](https://hub.docker.com/r/arminc/clair-db). It can be useful to override this value with a specific version, for example, to provide a consistent set of vulnerabilities for integration testing purposes. | `latest` |
| `DOCKERFILE_PATH` | The path to the `Dockerfile` to be used for generating remediations. By default, the scanner will look for a file named `Dockerfile` in the root directory of the project, so this variable should only be configured if your `Dockerfile` is in a non-standard location, such as a subdirectory. See [Solutions for vulnerabilities](#solutions-for-vulnerabilities-auto-remediation) for more details. | `Dockerfile` | | `DOCKERFILE_PATH` | The path to the `Dockerfile` to be used for generating remediations. By default, the scanner will look for a file named `Dockerfile` in the root directory of the project, so this variable should only be configured if your `Dockerfile` is in a non-standard location, such as a subdirectory. See [Solutions for vulnerabilities](#solutions-for-vulnerabilities-auto-remediation) for more details. | `Dockerfile` |
| `ADDITIONAL_CA_CERT_BUNDLE` | Bundle of CA certs that you want to trust. | "" | | `ADDITIONAL_CA_CERT_BUNDLE` | Bundle of CA certs that you want to trust. | "" |
...@@ -210,7 +210,7 @@ If you want to whitelist specific vulnerabilities, you'll need to: ...@@ -210,7 +210,7 @@ If you want to whitelist specific vulnerabilities, you'll need to:
in the [whitelist example file](https://github.com/arminc/clair-scanner/blob/v12/example-whitelist.yaml). in the [whitelist example file](https://github.com/arminc/clair-scanner/blob/v12/example-whitelist.yaml).
1. Add the `clair-whitelist.yml` file to the Git repository of your project. 1. Add the `clair-whitelist.yml` file to the Git repository of your project.
### Running Container Scanning in an offline environment deployment ### Running Container Scanning in an offline environment
Container Scanning can be executed on an offline GitLab Ultimate installation by using the following process: Container Scanning can be executed on an offline GitLab Ultimate installation by using the following process:
......
...@@ -461,7 +461,7 @@ dast: ...@@ -461,7 +461,7 @@ dast:
The DAST job does not require the project's repository to be present when running, so by default The DAST job does not require the project's repository to be present when running, so by default
[`GIT_STRATEGY`](../../../ci/yaml/README.md#git-strategy) is set to `none`. [`GIT_STRATEGY`](../../../ci/yaml/README.md#git-strategy) is set to `none`.
## Running DAST in an offline environment deployment ## Running DAST in an offline environment
DAST can be executed on an offline GitLab Ultimate installation by using the following process: DAST can be executed on an offline GitLab Ultimate installation by using the following process:
......
...@@ -167,7 +167,7 @@ The following variables are used for configuring specific analyzers (used for a ...@@ -167,7 +167,7 @@ The following variables are used for configuring specific analyzers (used for a
| `DS_PIP_DEPENDENCY_PATH` | `gemnasium-python` | | Path to load Python pip dependencies from. ([Introduced](https://gitlab.com/gitlab-org/gitlab/issues/12412) in GitLab 12.2) | | `DS_PIP_DEPENDENCY_PATH` | `gemnasium-python` | | Path to load Python pip dependencies from. ([Introduced](https://gitlab.com/gitlab-org/gitlab/issues/12412) in GitLab 12.2) |
| `DS_PYTHON_VERSION` | `retire.js` | | Version of Python. If set to 2, dependencies are installed using Python 2.7 instead of Python 3.6. ([Introduced](https://gitlab.com/gitlab-org/gitlab/issues/12296) in GitLab 12.1)| | `DS_PYTHON_VERSION` | `retire.js` | | Version of Python. If set to 2, dependencies are installed using Python 2.7 instead of Python 3.6. ([Introduced](https://gitlab.com/gitlab-org/gitlab/issues/12296) in GitLab 12.1)|
| `MAVEN_CLI_OPTS` | `gemnasium-maven` | `"-DskipTests --batch-mode"` | List of command line arguments that will be passed to `maven` by the analyzer. See an example for [using private repos](#using-private-maven-repos). | | `MAVEN_CLI_OPTS` | `gemnasium-maven` | `"-DskipTests --batch-mode"` | List of command line arguments that will be passed to `maven` by the analyzer. See an example for [using private repos](#using-private-maven-repos). |
| `BUNDLER_AUDIT_UPDATE_DISABLED` | `bundler-audit` | `false` | Disable automatic updates for the `bundler-audit` analyzer. Useful if you're running Dependency Scanning in an offline, air-gapped environment.| | `BUNDLER_AUDIT_UPDATE_DISABLED` | `bundler-audit` | `false` | Disable automatic updates for the `bundler-audit` analyzer. Useful if you're running Dependency Scanning in an offline environment. |
| `BUNDLER_AUDIT_ADVISORY_DB_URL` | `bundler-audit` | `https://github.com/rubysec/ruby-advisory-db` | URL of the advisory database used by bundler-audit. | | `BUNDLER_AUDIT_ADVISORY_DB_URL` | `bundler-audit` | `https://github.com/rubysec/ruby-advisory-db` | URL of the advisory database used by bundler-audit. |
| `BUNDLER_AUDIT_ADVISORY_DB_REF_NAME` | `bundler-audit` | `master` | Git ref for the advisory database specified by `BUNDLER_AUDIT_ADVISORY_DB_URL`. | | `BUNDLER_AUDIT_ADVISORY_DB_REF_NAME` | `bundler-audit` | `master` | Git ref for the advisory database specified by `BUNDLER_AUDIT_ADVISORY_DB_URL`. |
| `RETIREJS_JS_ADVISORY_DB` | `retire.js` | `https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json` | Path or URL to Retire.js js vulnerability data file. | | `RETIREJS_JS_ADVISORY_DB` | `retire.js` | `https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json` | Path or URL to Retire.js js vulnerability data file. |
......
...@@ -2,15 +2,15 @@ ...@@ -2,15 +2,15 @@
type: reference, howto type: reference, howto
--- ---
# Offline environment deployments # Offline environments
It is possible to run most of the GitLab security scanners when not It's possible to run most of the GitLab security scanners when not connected to the internet.
connected to the internet.
This document describes how to operate Secure Categories (that is, scanner types) in an offline environment. These instructions also apply to This document describes how to operate Secure Categories (that is, scanner types) in an offline
self-managed installations that are secured, have security policies (for example, firewall policies), or are otherwise restricted from environment. These instructions also apply to self-managed installations that are secured, have
accessing the full internet. GitLab refers to these deployments as _offline environment deployments_. security policies (for example, firewall policies), or are otherwise restricted from accessing the
Other common names include: full internet. GitLab refers to these environments as _offline environments_. Other common names
include:
- Air-gapped environments - Air-gapped environments
- Limited connectivity environments - Limited connectivity environments
...@@ -21,13 +21,13 @@ These environments have physical barriers or security policies (for example, fir ...@@ -21,13 +21,13 @@ These environments have physical barriers or security policies (for example, fir
or limit internet access. These instructions are designed for physically disconnected networks, but or limit internet access. These instructions are designed for physically disconnected networks, but
can also be followed in these other use cases. can also be followed in these other use cases.
## Offline environments ## Defining offline environments
In this situation, the GitLab instance can be one or more servers and services that can communicate In an offline environment, the GitLab instance can be one or more servers and services that can
on a local network, but with no or very restricted access to the internet. Assume anything within communicate on a local network, but with no or very restricted access to the internet. Assume
the GitLab instance and supporting infrastructure (for example, a private Maven repository) can be anything within the GitLab instance and supporting infrastructure (for example, a private Maven
accessed through a local network connection. Assume any files from the internet must come in through repository) can be accessed through a local network connection. Assume any files from the internet
physical media (USB drive, hard drive, writeable DVD, etc.). must come in through physical media (USB drive, hard drive, writeable DVD, etc.).
## Overview ## Overview
...@@ -43,7 +43,7 @@ an internet-connected GitLab installation, GitLab checks the GitLab.com-hosted ...@@ -43,7 +43,7 @@ an internet-connected GitLab installation, GitLab checks the GitLab.com-hosted
container registry to check that you have the latest versions of these Docker images container registry to check that you have the latest versions of these Docker images
and possibly connect to package repositories to install necessary dependencies. and possibly connect to package repositories to install necessary dependencies.
In an air-gapped environment, these checks must be disabled so that GitLab.com is not In an offline environment, these checks must be disabled so that GitLab.com isn't
queried. Because the GitLab.com registry and repositories are not available, queried. Because the GitLab.com registry and repositories are not available,
you must update each of the scanners to either reference a different, you must update each of the scanners to either reference a different,
internally-hosted registry or provide access to the individual scanner images. internally-hosted registry or provide access to the individual scanner images.
...@@ -55,9 +55,11 @@ mirroring the packages inside your own offline network. ...@@ -55,9 +55,11 @@ mirroring the packages inside your own offline network.
### Interacting with the vulnerabilities ### Interacting with the vulnerabilities
Once a vulnerability is found, you can interact with it. Read more on how to [interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities). Once a vulnerability is found, you can interact with it. Read more on how to
[interact with the vulnerabilities](../index.md#interacting-with-the-vulnerabilities).
Please note that in some cases the reported vulnerabilities provide metadata that can contain external links exposed in the UI. These links might not be accessible within an air-gapped (or offline) environment. Please note that in some cases the reported vulnerabilities provide metadata that can contain
external links exposed in the UI. These links might not be accessible within an offline environment.
### Scanner signature and rule updates ### Scanner signature and rule updates
...@@ -73,6 +75,6 @@ hosted within your network. ...@@ -73,6 +75,6 @@ hosted within your network.
Each individual scanner may be slightly different than the steps described Each individual scanner may be slightly different than the steps described
above. You can find more info at each of the pages below: above. You can find more info at each of the pages below:
- [Container scanning offline directions](../container_scanning/index.md#running-container-scanning-in-an-offline-environment-deployment) - [Container scanning offline directions](../container_scanning/index.md#running-container-scanning-in-an-offline-environment)
- [SAST offline directions](../sast/index.md#gitlab-sast-in-an-offline-environment-deployment) - [SAST offline directions](../sast/index.md#gitlab-sast-in-an-offline-environment)
- [DAST offline directions](../dast/index.md#running-dast-in-an-offline-environment-deployment) - [DAST offline directions](../dast/index.md#running-dast-in-an-offline-environment)
...@@ -491,10 +491,10 @@ Once a vulnerability is found, you can interact with it. Read more on how to ...@@ -491,10 +491,10 @@ Once a vulnerability is found, you can interact with it. Read more on how to
For more information about the vulnerabilities database update, check the For more information about the vulnerabilities database update, check the
[maintenance table](../index.md#maintenance-and-update-of-the-vulnerabilities-database). [maintenance table](../index.md#maintenance-and-update-of-the-vulnerabilities-database).
## GitLab SAST in an offline environment deployment ## GitLab SAST in an offline environment
For self-managed GitLab instances in an environment with limited, restricted, or intermittent access For self-managed GitLab instances in an environment with limited, restricted, or intermittent access
to external resources via the internet, some adjustments are required for the SAST job to to external resources through the internet, some adjustments are required for the SAST job to
successfully run. successfully run.
### Requirements for offline SAST ### Requirements for offline SAST
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment