- Tutorial: Connect a new feature using Cloud Connector
- Testing
Cloud Connector
GitLab Cloud Connector is a way to access services common to multiple GitLab deployments, instances, and cells. As of now, Cloud Connector is not a dedicated service itself, but rather a collection of APIs and code that standardizes the approach to authentication and other items when integrating Cloud based services with the GitLab instance. This page aims to explain how to use Cloud Connector to link GitLab Rails to a service.
See the architecture page for more information about Cloud Connector. See terms for a list of terms used throughout the document. Also see configuration for the information on how paid features are bundled into GitLab tiers and add-ons.
Tutorial: Connect a new feature using Cloud Connector
The following sections will cover the following use cases:
- The new feature is introduced through the existing backend service that is already connected to Cloud Connector (that is, the AiGateway).
- The new feature is introduced through new backend service that needs to be connected to Cloud Connector.
The new feature is introduced through the existing backend service
The Ai Gateway is currently the only backend service that is connected with the CloudConnector. To add new feature to the existing backend service (Ai Gateway):
- Register new feature in the JWT issuer.
- Implement permission checks in GitLab Rails.
- Implement authorization checks in backend service.
Optional: If the backend service the token is used for requires additional claims to be embedded in the service access token, contact #g_cloud_connector (Slack, internal only) because we do not currently have interfaces in place to self-service this.
Register the new feature in the JWT issuer
- For GitLab Dedicated and self-managed GitLab instances, the CustomersDot is the JWT issuer.
- For GitLab.com deployment, GitLab.com is the JWT issuer, because it’s able to self-sign and create JWTs for every request to a Cloud Connector feature.
Register new feature for Self-Managed, Dedicated and GitLab.com customers
Because the CustomersDot is the JWT issuer for GitLab Dedicated and self-managed GitLab instances, to register new feature, we need to update CustomersDot configuration.
Since the GitLab.com is the JWT issuer, because it’s able to self-sign and create JWTs, to register new feature, we need to update GitLab.com configuration as well.
So, in total, you need to open two separate merge requests: one to CustomersDot and another to GitLab.com. No synchronization between when they are merged is needed.
The new feature needs to be added as a new unit primitive, so you can include it in the JWT (Service Access token).
The new feature is delivered in several ways:
-
Some features (such as
documentation_search
) are delivered as part of the existing (Duo Chat
) service. -
Others are delivered as a stand-alone service (
code_suggestions
). -
It is possible to move existing features (
explain_vulnerability
) to become a part of an existing (Duo Chat
) service. -
It is also possible to deliver a feature to be both part of a Duo Chat service, and also to act as a stand-alone service.
Terms:
-
feature -
documentation_search
, registered as new unit primitive so it could be included in JWT. -
existing service -
Duo Chat
- The feature is delivered as part ofDuo Chat
service. -
stand-alone service -
code_suggestions
, the feature is accessible as a separate service, probably through its own interface. -
backend service -
Ai Gateway
, the backend where the feature is hosted.
Register a new feature to the existing service (DuoChat)
The new feature is delivered as part of an existing service (Duo Chat).
As an example, the new feature is:
- Named
new_feature
- Delivered as part of the existing
duo chat
service and accessible only through the Duo Chat window - Sold only through the
duo_enterprise
add-on
Update cloud_connector.yml
(for Self-Managed and Dedicated) and access_data.yml
(for GitLab.com),
by registering the new_feature_up
unit primitive under the duo chat
service:
defaults: &defaults
services:
duo_chat:
cut_off_date: 2024-7-15 00:00:00 UTC
min_gitlab_version: 16.8
min_gitlab_version_for_free_access: 16.8
bundled_with:
duo_pro:
unit_primitives:
- duo_chat
- documentation_search
duo_enterprise:
unit_primitives:
- duo_chat
- documentation_search
+ - new_feature_up
- The feature is delivered as part of existing service (Duo Chat), so we are registering new
new_feature_up
unit primitive under theduo_chat
service. -
The feature is sold only through
duo_enterprise
, so we need to addnew_feature_up
as a unit primitive, under bundled with only forduo_enterprise
add-on.See configuration for more information about configuration structure.
cut_off_date
or min_gitlab_version
per unit primitive if the unit primitive is delivered as part of the existing service (Duo Chat
).
Issue 465221 proposes restructuring the current configuration structure and adding cut_off_date
support per unit primitive.Register a new stand-alone service
The new feature is delivered as stand-alone service.
As an example, the new feature is:
- Named
new_feature
- Delivered as a stand-alone service and not part of the
Duo Chat
service. - Sold through both the
duo_pro
andduo_enterprise
add-ons. - Should not be accessible for free.
- Minimum required GitLab version is 17.1.
Update cloud_connector.yml
(for Self-Managed and Dedicated) and access_data.yml
(for GitLab.com)
by registering the new_feature
as a service
. See configuration.
defaults: &defaults
services:
+ new_feature:
+ cut_off_date: 2024-1-1 00:00:00 UTC
+ min_gitlab_version: 17.1
+ bundled_with:
+ duo_pro:
+ unit_primitives:
+ - new_feature_up
+ duo_enterprise:
+ unit_primitives:
+ - new_feature_up
- The feature is accessible as a new stand-alone service, probably through its own interface,
so we are registering a new
new_feature
service. - The feature should not be accessible for free, so we need to set the
cut_off_date
in the past. - The feature is sold through both
duo_pro
andduo_enterprise
, so we need to addnew_feature_up
as a unit primitive, under bundled with for bothduo_pro
andduo_enterprise
add-ons.
See configuration for more information about configuration structure.
Register a feature as combination of existing service and stand-alone feature
The new feature is accessible through an existing service (Duo Chat
) and also through its own user interface.
As an example, the new feature is:
- Named
new_feature
. - Delivered as part of the existing
duo chat
service and accessible only through the Duo Chat window. - Also delivered as a stand-alone service. That is, it is also used outside of Duo Chat through its own interface.
-
Sold only through the
duo_enterprise
add-on.Update
cloud_connector.yml
(for Self-Managed and Dedicated) andaccess_data.yml
(for GitLab.com):
defaults: &defaults
services:
+ new_feature:
+ bundled_with:
+ duo_enterprise:
+ unit_primitives:
+ - new_feature
duo_chat:
bundled_with:
duo_pro:
unit_primitives:
- duo_chat
- documentation_search
duo_enterprise:
unit_primitives:
- duo_chat
- documentation_search
+ - new_feature_up
- The feature is delivered as part of an existing service (Duo Chat), so we are registering
new
new_feature_up
unit primitive under theduo_chat
service. - The feature is also delivered as a stand-alone service, so we need to register
new_feature
as a newservice
. - The feature is sold only through
duo_enterprise
, so we need to addnew_feature_up
as a unit primitive, under bundled with only forduo_enterprise
add-on for both services.
See configuration for more information about configuration structure.
Implement Permission checks in GitLab Rails
New feature is delivered as stand-alone service
Access Token
As an example, the feature is delivered as a stand-alone service called new_feature
.
-
Call
CloudConnector::AvailableServices.find_by_name(:new_feature).access_token(user_or_namespace)
and include this token in theAuthorization
HTTP header field.- On GitLab.com, it will self-issue a token with scopes that depend on the provided resource:
- For a user: scopes will be based on the user’s seat assignment
- For a namespace: scopes will be based on purchased add-ons for this namespace
- If a service can be accessed for free, the token will include all available scopes for that service.
- For Duo Chat, the JWT would include the
documentation_search
andduo_chat
scopes.
- On self-managed, it will always return
::CloudConnector::ServiceAccessToken
JWT token.- Provided parameters such as user, namespace or extra claims would be ignored for Self managed instances. Refer to this section to see how custom claims are handled for self-managed instances.
The backend service (i.e. Ai Gateway) must validate this token and any scopes it carries when receiving the request.
- On GitLab.com, it will self-issue a token with scopes that depend on the provided resource:
-
If you need to embed additional claims in the token specific to your use case, you can pass these in the
extra_claims
argument. -
Ensure your request sends the required headers to the backend service.
Primary header fields that should be sent to any backend service:
-
X-Gitlab-Instance-Id
: A globally unique instance ID string. -
X-Gitlab-Global-User-Id
: A globally unique anonymous user ID string. -
X-Gitlab-Realm
: One ofsaas
,self-managed
. -
X-Gitlab-Version
: Version of the GitLab instance. -
X-Gitlab-Host-Name
: The hostname of the current GitLab instance. -
Authorization
: Contains the Base64-encoded JWT as aBearer
token obtained from theaccess_token
method in step 1.
AI-specific header fields:
-
X-Gitlab-Duo-Seat-Count
: The number of either duo pro or duo enterprise seats the customer purchased. When both add-ons are present, it will take the highest number of seats.
Some of these headers can be injected by merging the result of the
::CloudConnector#headers
method to your payload. For AI uses cases and requests targeting the AI gateway, use::CloudConnector#ai_headers
instead. -
Permission checks
To decide if the service is available or visible to the end user, we need to:
-
Optional. On self-managed GitLab, if the new feature is introduced as a new enterprise feature, check to determine if user has access to the feature by following the EE feature guideline.
next true if ::Gitlab::Saas.feature_available?(:new_feature_on_saas) ::License.feature_available?(:new_feature)
- On self-managed GitLab, check if the customer is using an online cloud license
- Cloud connector currently only support online cloud license for self-managed customers.
- Trials or legacy licenses are not supported.
- GitLab.com is using a legacy license.
::License.current&.online_cloud_license?
- On GitLab.com and self-managed GitLab, check if the service has free access.
- The feature is considered free, if the cut-off date is not set, or it is set in the future.
# Returns whether the service is free to access (no addon purchases is required) CloudConnector::AvailableServices.find_by_name(:new_feature).free_access?
- Optional. If the service has free access, this usually means that the experimental features are subject to the Testing Agreement.
- For GitLab Duo features, the customer needs to enable experimental toggle in order to use experimental features for free.
-
On GitLab.com and self-managed GitLab, if the service is not accessible for free, check if the add-on bundled with this service has been purchased by the customer (for the group/namespace)
# Returns true if at least one add-on that is bundled with the service is purchased. # # - For provided namespace, it will check if add-on is purchased for the provided group/project or its ancestors. # - For SM, it would ignore namespace as AddOns are not purchased per namespace for self managed customers. CloudConnector::AvailableServices.find_by_name(:new_feature).purchased?(namespace)
-
On GitLab.com and self-managed GitLab, check if the customer’s end-user has been assigned to the proper seat.
# Returns true if service is allowed to be used. # # For provided user, it will check if user is assigned to a proper seat. current_user.allowed_to_use?(:new_feature)
Example
The following example is for a request to the service called :new_feature
.
Here we assume your backend service is called foo
and is already reachable at https://cloud.gitlab.com/foo
.
We also assume that the backend service exposes the service using a /new_feature_endpoint
endpoint.
This allows clients to access the service at https://cloud.gitlab.com/foo/new_feature_endpoint
.
Add a new policy rule in ee/global_policy.rb:
condition(:new_feature_licensed) do
next true if ::Gitlab::Saas.feature_available?(:new_feature_on_saas)
next false unless ::License.current.online_cloud_license?
::License.feature_available?(:new_feature)
end
condition(:user_allowed_to_use_new_feature) do
@user.allowed_to_use?(:new_feature)
end
rule { new_feature_licensed & user_allowed_to_use_new_feature }.enable :access_new_feature
The request
include API::Helpers::CloudConnector
# Check if the service is available for the given user based on seat assignment, add-on purchases
return unauthorized! unless current_user.can?(:access_new_feature)
# For Gitlab.com it will self-issue a token with scopes based on provided resource:
# - For provided user, it will self-issue a token with scopes based on user assigment permissions
# - For provided namespace, it will self-issue a token with scopes based on add-on purchased permissions
# - If service has free_access?, it will self-issue a token with all available scopes
#
# For SM, it will return :CloudConnector::ServiceAccessToken instance token, ignoring provided user, namespace and extra claims
token = ::CloudConnector::AvailableServices.find_by_name(:new_feature).access_token(current_user)
Gitlab::HTTP.post(
"https://cloud.gitlab.com/foo/new_feature_endpoint",
headers: {
'Authorization' => "Bearer #{token}",
}.merge(cloud_connector_headers(current_user))
)
The introduced policy can be used to control if the front-end is visible. Add a new_feature_helper.rb
:
def show_new_feature?
current_user.can?(:access_new_feature)
end
New feature is delivered as part of the existing service (Duo Chat)
Access Token
If the feature is delivered as part of the existing service, like Duo Chat
,
calling CloudConnector::AvailableServices.find_by_name(:duo_chat).access_token(user_or_namespace)
would return an IJWT with
access scopes including all authorized features (unit primitives).
The backend service (AI gateway) would prevent access to the specific feature (unit primitive) if the token scope is not included in the JWT.
Permission checks
If the feature is delivered as part of the existing service, like Duo Chat
, no additional permission checks are needed.
We can rely on existing global policy rule user.can?(:access_duo_chat)
.
If end-user has access to at least one feature (unit primitive), end-user can access the service.
Access to the individual feature (unit primitive), is governed by the IJWT scopes, that will be validated by the backend service (Ai Gateway).
See access token
Implement authorization checks in backend service
GitLab Rails calls a backend service to deliver functionality that would otherwise be unavailable to Self-managed and Dedicated instances. For GitLab Rails to be able to call this, there has to be an endpoint exposed. The backend service must verify each JWT sent by GitLab Rails in the Authorization header.
For more information and examples on the AI gateway authorization process, check the Authorization in AI gateway documentation.
The new feature is introduced via new backend service
To integrate a new backend service that isn’t already accessible by Cloud Connector features:
Set up JWT validation
As mentioned in the Implement authorization checks in backend service for services that already use Cloud Connector, each service must verify that the JWT sent by a GitLab instance is legitimate.
To accomplish this, a backend service must:
For a detailed explanation of the mechanism behind this, refer to Architecture: Access control.
We strongly suggest to use existing software libraries to handle JWKS and JWT authentication. Examples include:
Maintain JWKS for token validation
JWTs are cryptographically signed by the token authority when first issued. GitLab instances then attach the JWTs in requests made to backend services.
To validate JWT service access tokens, the backend service must first obtain the JWKS containing the public validation key that corresponds to the private signing key used to sign the token. Because both GitLab.com and CustomersDot issue tokens, the backend service must fetch the JWKS from both.
To fetch the JWKS, use the OIDC discovery endpoints exposed by GitLab.com and CustomersDot. For each of these token authorities:
-
GET /.well-known/openid-configuration
Example response:
{ "issuer": "https://customers.gitlab.com/", "jwks_uri": "https://customers.gitlab.com/oauth/discovery/keys", "id_token_signing_alg_values_supported": [ "RS256" ] }
-
GET <jwks_uri>
Example response:
{ "keys": [ { "kty": "RSA", "n": "sGy_cbsSmZ_Y4XV80eK_ICmz46XkyWVf6O667-mhDcN5FcSfPW7gqhyn7s052fWrZYmJJZ4PPyh6ZzZ_gZAaQM7Oe2VrpbFdCeJW0duR51MZj52FwShLfi-NOBz2GH9XuUsRBKnXt7wwKQTabH4WW7XL23Hi0eDjc9dyQmsr2-AbH05yVsrgvEYSsWiCGEgobPgNc51DwBoIcsJ-kFN591aO_qAkbpf1j7yAuAVG7TUxaditQhyZKkourPXXyx1R-u0Lx9UJyAV8ySqFxq3XDE_pg6ZuJ7M0zS0XnGI82g3Js5zAughrQyJMhKd8j5c8UfSGxhRBQh58QNl3UwoMjQ", "e": "AQAB", "kid": "ZoObkdsnUfqW_C_EfXp9DM6LUdzl0R-eXj6Hrb2lrNU", "use": "sig", "alg": "RS256" } ] }
-
Cache the response. We suggest to let the cache expire once a day.
The keys obtained this way can be used to validate JWTs issued by the respective token authority. Exactly how this works depends on the programming language and libraries used. General instructions can be found in Locate JSON Web Key Sets. Backend services may merge responses from both token authorities into a single cached result set.
Validate JWTs with JWKS
To validate a JWT:
- Read the token string from the HTTP
Authorization
header. - Validate it using a JWT library object and the JWKS obtained previously.
When validating a token, ensure that:
- The token signature is correct.
- The
aud
claim equals or contains the backend service (this field can be a string or an array). - The
iss
claim matches the issuer URL of the key used to validate it. - The
scopes
claim covers the functionality exposed by the requested endpoint (see Implement authorization checks in backend service).
Add a new Cloud Connector route
All Cloud Connector features must be accessed through cloud.gitlab.com
, a global load-balancer that
routes requests into backend services based on paths prefixes. For example, AI features must be requested
from cloud.gitlab.com/ai/<AI-specific-path>
. The load-balancer then routes <AI-specific-path>
to the AI gateway.
To connect a new backend service to Cloud Connector, you must claim a new path-prefix to route requests to your
service. For example, if you connect foo-service
, a new route must be added that routes cloud.gitlab.com/foo
to foo-service
.
Adding new routes requires access to production infrastructure configuration. If you require a new route to be
added, open an issue in the gitlab-org/gitlab
issue tracker
and assign it to the Cloud Connector group.
Testing
An example for how to set up an end-to-end integration with the AI gateway as the backend service can be found here.