Allowlist various callsites for cross-database queries

Together these callsites are called about 500 times in CI

app/controllers/groups/runners_controller.rb

@@ -10,9 +10,11 @@ class Groups::RunnersController < Groups::ApplicationController
   feature_category :runner
 
   def index
+    ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336433') do
       finder = Ci::RunnersFinder.new(current_user: current_user, params: { group: @group })
       @group_runners_limited_count = finder.execute.except(:limit, :offset).page.total_count_with_limit(:all, limit: 1000)
     end
+  end
 
   def runner_list_group_view_vue_ui_enabled
     return render_404 unless Feature.enabled?(:runner_list_group_view_vue_ui, group, default_enabled: :yaml)
@@ -61,10 +63,12 @@ class Groups::RunnersController < Groups::ApplicationController
   private
 
   def runner
+    ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336433') do
       @runner ||= Ci::RunnersFinder.new(current_user: current_user, params: { group: @group }).execute
         .except(:limit, :offset)
         .find(params[:id])
     end
+  end
 
   def runner_params
     params.require(:runner).permit(Ci::Runner::FORM_EDITABLE)

app/controllers/groups/settings/ci_cd_controller.rb

@@ -23,6 +23,11 @@ module Groups
         @group_runners = runners_finder.execute.page(params[:page]).per(NUMBER_OF_RUNNERS_PER_PAGE)
 
         @sort = runners_finder.sort_key
+
+        # Allow sql generated by the two relations above, @all_group_runners and @group_runners
+        ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336433') do
+          render
+        end
       end
 
       def update

app/controllers/projects/merge_requests_controller.rb

@@ -192,6 +192,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
 
     Gitlab::PollingInterval.set_header(response, interval: 10_000)
 
+    ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336891') do
       render json: {
         pipelines: PipelineSerializer
           .new(project: @project, current_user: @current_user)
@@ -202,6 +203,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
           }
       }
     end
+  end
 
   def sast_reports
     reports_response(merge_request.compare_sast_reports(current_user), head_pipeline)

app/controllers/projects/settings/ci_cd_controller.rb

@@ -25,6 +25,11 @@ module Projects
             @project.triggers, current_user: current_user, project: @project
           ).to_json
         end
+
+        # @assignable_runners is using ci_owned_runners
+        ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/336436') do
+          render
+        end
       end
 
       def update

app/models/ci/runner.rb

@@ -280,8 +280,10 @@ module Ci
     end
 
     def belongs_to_more_than_one_project?
+      ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659') do
         self.projects.limit(2).count(:all) > 1
       end
+    end
 
     def assigned_to_group?
       runner_namespaces.any?
@@ -309,8 +311,10 @@ module Ci
     end
 
     def only_for?(project)
+      ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659') do
         projects == [project]
       end
+    end
 
     def short_sha
       token[0...8] if token
@@ -444,16 +448,20 @@ module Ci
     end
 
     def any_project
+      ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659') do
         unless projects.any?
           errors.add(:runner, 'needs to be assigned to at least one project')
         end
       end
+    end
 
     def exactly_one_group
+      ::Gitlab::Database.allow_cross_joins_across_databases(url: 'https://gitlab.com/gitlab-org/gitlab/-/issues/338659') do
         unless groups.one?
           errors.add(:runner, 'needs to be assigned to exactly one group')
         end
       end
+    end
 
     def matches_build?(build)
       runner_matcher.matches?(build.build_matcher)

spec/support/database/cross-join-allowlist.yml

@@ -67,7 +67,6 @@
 - "./spec/features/projects/pipelines/pipeline_spec.rb"
 - "./spec/features/projects/pipelines/pipelines_spec.rb"
 - "./spec/features/projects/settings/pipelines_settings_spec.rb"
-- "./spec/features/runners_spec.rb"
 - "./spec/features/security/project/internal_access_spec.rb"
 - "./spec/features/security/project/private_access_spec.rb"
 - "./spec/features/security/project/public_access_spec.rb"