Org Mover configuration for Cells (Development Only)

Use these settings to configure the public keys that GitLab trusts for the internal Org Mover API. The Org Mover control plane signs each request with an ES256 JSON Web Token (JWT). GitLab verifies the token against the configured public keys. Without public keys, GitLab rejects every Org Mover API request with 401 Unauthorized.

The Org Mover API is part of GitLab Cells. GitLab also rejects Org Mover requests when global.appConfig.cell.enabled is false, or when the request is for a cell other than global.appConfig.cell.id.

Configure the public keys

yaml
global:
  appConfig:
    orgMover:
      publicKeys:
        - secret: org-mover-public-key
          key: public.pem

Name	Type	Default	Description
`publicKeys`	List	`[]`	Public keys trusted to verify Org Mover API requests.
`publicKeys[].secret`	String		Name of the Kubernetes secret that contains the PEM-encoded public key. Required.
`publicKeys[].key`	String	`public.pem`	Key within the secret that holds the public key.

The chart makes each key available read-only in the Webservice pods at /etc/gitlab/org-mover/<index>.pem, and sets org_mover.public_key_files in gitlab.yml. Only Webservice serves the Org Mover API, so the chart does not mount the keys into other pods.

Store only the public half of each key pair in these secrets. GitLab refuses to load a file that contains a private key, and Org Mover requests then fail.

To create a secret from a public key file:

shell
kubectl create secret generic org-mover-public-key --from-file=public.pem=<path_to_public_key>

The Webservice pods read the keys from the secrets when they start. When you change publicKeys and upgrade the release, the Webservice pod template changes, and Kubernetes restarts the pods. When you update the contents of an existing secret, restart the Webservice pods yourself.

Rotate the Org Mover public key

Use a list of keys to rotate keys without downtime. GitLab accepts a request signed by any key in the list.

To rotate the key:

Create a secret that contains the new public key.
Add the new secret to publicKeys, and upgrade the release. The Webservice pods restart and trust both keys.
Configure the Org Mover control plane to sign requests with the new private key.
Remove the old secret from publicKeys, and upgrade the release. The Webservice pods restart and trust only the new key.

Was this page helpful?