Remove GitLab WAF related models/services and workers
Why are we doing this work
More information about deprecation: #271276 (closed)
We have to remove all code related to GitLab WAF feature from gitlab-org/gitlab
codebase.
Relevant links
Non-functional requirements
- [-] Documentation
- [-] Feature flag:
- [-] Performance:
-
Testing: -
Test if Ingress can be installed and is working properly, -
Test if Fluentd can be installed and is working properly
-
Implementation plan
-
backend remove modsecurity_enabled
,modsecurity_mode
,waf_log_enabled
from permitted params in methodcluster_application_params
inapp/controllers/clusters/applications_controller.rb
-
backend remove extending log path to modsecurity logs in path_to_logs
method and remove conditionwaf_log_enabled
in methodhas_at_least_one_log_enabled?
inapp/models/clusters/applications/fluentd.rb
-
backend remove all consts that are matching MODSECURITY_*
, default value definitions formodsecurity_enabled
,modsecurity_mode
;modsecurity_mode
enum;modsecurity_not_installed
,modsecurity_enabled
modsecurity_disabled
scopes;specification
,modsecurity_config_content
,modsecurity_config_file_path
,modsecurity_snippet_content
methods and modifycontent_values
to not mergespecification
inapp/models/clusters/applications/ingress.rb
-
backend remove with_enabled_modsecurity
scope fromapp/models/clusters/cluster.rb
, -
backend remove modsecurity_enabled
,modsecurity_mode
,waf_log_enabled
from exposed fields inapp/serializers/cluster_application_entity.rb
-
backend remove waf_log_enabled
fromFLUENTD_KNOWN_ATTRS
constant, and references tomodsecurity_enabled
andmodsecurity_mode
inexpose
method in app/services/clusters/applications/base_service.rb -
backend remove ingress_mod_security_help_path
fromstatus_path
variable in app/views/clusters/clusters/show.html.haml -
backend remove web_application_firewall_metrics_worker
fromSettings.cron_jobs
inconfig/initializers/1_settings.rb
-
backend remove :waf_anomalies
fromsecurity
namespace inee/config/routes/project.rb
-
backend remove ::Gitlab::UsageDataCounters::IngressModsecurityCounter
fromusage_data_counters
method fromee/lib/ee/gitlab/usage_data.rb
-
backend remove ingress_modsecurity_usage
method,ingress_modsecurity_enabled
key fromfeatures_usage_data_ce
method andingress_modsecurity_usage
fromsystem_usage_data
method inlib/gitlab/usage_data.rb
-
backend remove modsecurity_blocking
,modsecurity_logging
,modsecurity_disabled
,modsecurity_not_installed
traits and settings value formodsecurity_enabled
fromspec/factories/clusters/applications/helm.rb
-
backend remove specs for counts.ingress_modsecurity_logging
joined relations inspec/lib/gitlab/usage/metrics/names_suggestions/generator_spec.rb
-
backend remove specs for ingress_modsecurity_usage
inspec/lib/gitlab/usage_data_spec.rb
-
backend remove settings value for waf_log_enabled
and update specs to check if log paths can contain onlycilium_log_path
inspec/models/clusters/applications/fluentd_spec.rb
-
backend remove context for when modsecurity_enabled is enabled
and modify context to ensure thatmodsecurity_enabled is disabled
inspec/models/clusters/applications/ingress_spec.rb
-
backend remove specs for with_enabled_modsecurity
context inspec/models/clusters/cluster_spec.rb
-
backend remove checking for waf_log_enabled
value infor fluentd application
context in spec/serializers/cluster_application_entity_spec.rb -
backend remove settings and checking for modsecurity_enabled
value inspec/services/clusters/applications/create_service_spec.rb
-
backend remove ingress_modsecurity_enabled
fromCOUNTS_KEYS
const inspec/support/helpers/usage_data_helpers.rb
-
backend remove decode_json_fields
processor fromfilebeat -> enabled -> filebeatConfig -> filebeat.yml
invendor/elastic_stack/values.yaml
-
backend remove WAF related information from ingress on auto-deploy-app assets/auto-deploy-app/templates/ingress.yaml
ingitlab-org/cluster-integration/auto-deploy-image
project -
backend remove reference to gitlab-waf.yaml.gotml
insrc/default-data/ingress/helmfile.yaml
ingitlab-org/cluster-integration/cluster-applications
project -
backend remove gitlab-waf.yaml.gotmpl
fromvalues
section inhelmfile.yaml
-
backend remove file config/feature_flags/development/ingress_modsecurity.yml
-
backend remove file ee/app/controllers/projects/security/waf_anomalies_controller.rb
-
backend remove file ee/app/services/ee/security/ingress_modsecurity_usage_service.rb
-
backend remove file ee/app/services/security/waf_anomaly_summary_service.rb
-
backend remove file ee/app/workers/ingress_modsecurity_counter_metrics_worker.rb
-
backend remove file ee/config/feature_flags/development/usage_ingress_modsecurity_counter.yml
-
backend remove file ee/lib/gitlab/usage_data_counters/ingress_modsecurity_counter.rb
-
backend remove file ee/spec/controllers/projects/security/waf_anomalies_controller_spec.rb
-
backend remove file ee/spec/lib/gitlab/usage_data_counters/ingress_modsecurity_counter_spec.rb
-
backend remove file ee/spec/services/ee/security/ingress_modsecurity_usage_service_spec.rb
-
backend remove file ee/spec/services/security/waf_anomaly_summary_service_spec.rb
-
backend remove file ee/spec/workers/ingress_modsecurity_counter_metrics_worker_spec.rb
-
backend remove file vendor/ingress/modsecurity.conf
-
backend remove file src/default-data/ingress/gitlab-waf.yaml.gotmpl
fromgitlab-org/cluster-integration/cluster-applications
project
Edited by Alan (Maciej) Paruszewski