Gitlab因存在漏洞，必须进行升级。
https://help.aliyun.com/noticelist/articleid/1060824788.html
https://help.aliyun.com/noticelist/articleid/1060819310.html
本文以Gitlab的Omnibus方便版本来说明从低版本10.8.7 升级到13.10.3 的步骤
官方升级文档：https://docs.gitlab.com/omnibus/update/
重点在这里，版本升级要按部就班，不能步子迈的太大，扯到蛋：
https://docs.gitlab.com/ee/policy/maintenance.html#upgrade-recommendations
于是最终决定的升级路径：
10.8.7 -> 11.11.8 -> 12.0.12 -> 12.1.17 -> 12.10.14 -> 13.0.14 -> 13.1.11 -> 13.5.4 -> 13.10.3
从下载地址把上面所有的安装包下载下来：
https://packages.gitlab.com/gitlab/gitlab-ce
例如我的下载列表：
gitlab-ce-10.8.7-ce.0.el7.x86_64.rpm
gitlab-ce-12.10.14-ce.0.el7.x86_64.rpm
gitlab-ce-13.10.3-ce.0.el7.x86_64.rpm
gitlab-ce-11.11.8-ce.0.el7.x86_64.rpm
gitlab-ce-12.1.17-ce.0.el7.x86_64.rpm
gitlab-ce-13.1.11-ce.0.el7.x86_64.rpm
gitlab-ce-12.0.12-ce.0.el7.x86_64.rpm
gitlab-ce-13.0.14-ce.0.el7.x86_64.rpm
gitlab-ce-13.5.4-ce.0.el7.x86_64.rpm
在你有能力升级之前，请确定你先有能力备份恢复，并且亲自测试！
备份恢复的文档： https://docs.gitlab.com/ee/raketasks/backup_restore.html
备份恢复的重点是这些配置文件：
For Omnibus:
/etc/gitlab/gitlab-secrets.json
/etc/gitlab/gitlab.rb
####### 备份命令需要注意！，不同版本的命令不一样！ #########
在使用 Omnibus package的情况下：
GitLab 12.2 or later:
gitlab-backup create
GitLab 12.1 and earlier:
gitlab-rake gitlab:backup:create
##############################################
如果你现在版本是10.8之前的，需要升级PostgreSQL数据库：
10.0 GitLab requires the version of PostgreSQL to be 9.6 or higher.
执行操作：gitlab-ctl pg-upgrade
确定升级后的PostgreSQL版本是9.6：
/opt/gitlab/embedded/bin/psql –version
#################### 升级到10.8.7 ##########################
现在开始升级，先关几个服务：
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
开始升级：
#yum update gitlab-ce-10.8.7-ce.0.el7.x86_64.rpm
可能有些参数报错，是因为有些参数更改或者不需要了，根据提示修改 /etc/gitlab/gitlab.rb
重新生成配置文件：
# gitlab-ctl reconfigure
再次执行升级命令：
#yum update gitlab-ce-10.8.7-ce.0.el7.x86_64.rpm
升级成功后，查看最新版本：
cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
################## 从10.8.7 升级到 11.11.8 #######################
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
根据：https://docs.gitlab.com/omnibus/update/gitlab_11_changes.html
11.11.8大版本需要修改 gitlab.rb的2个地方：
1、增加 nginx[‘ssl_protocols’] = “TLSv1.2”
2、旧格式去掉 git_data_dir “/data/git-data” 增加新格式 git_data_dirs({ “default” => { “path” => “/data/git-data” } })
然后执行：
gitlab-ctl reconfigure
开始升级：大概2分钟
rpm -Uvh gitlab-ce-11.11.8-ce.0.el7.x86_64.rpm
升级完成，有提示：
Warnings:
The version of the running postgresql service is different than what is installed.
Please restart postgresql to start the new version.
sudo gitlab-ctl restart postgresql
按提示执行：gitlab-ctl restart postgresql
gitlab-ctl restart
gitlab-ctl status 查看应该正常了。
查看版本号：
[root@gitlab soft]# rpm -qa|grep gitlab
gitlab-ce-11.11.8-ce.0.el7.x86_64
[root@gitlab soft]# cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
11.11.8
############ 11.11.8 升级到 12.0.12 ##############
Sidekiq 是Ruby 和Rails 项目中常用的后台任务处理系统，查看方法：https://你的gitlab域名.com/admin/sidekiq
记录一下PostgreSQL的版本为9.6:
# /opt/gitlab/embedded/bin/psql –version
psql (PostgreSQL) 9.6.11
开始升级，照例停几个服务：
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
这个版本需要升级prometheus，大概15分钟
[root@gitlab ~]# gitlab-ctl prometheus-upgrade
Converting existing data to new format is a time consuming process and can take hours.
If you prefer not to migrate existing data, press Ctrl-C now and re-run the command with –skip-data-migration flag.
Waiting for 30 seconds for input.
Please hit Ctrl-C now if you want to cancel the operation.
…………………………
会人性化显示大概的时间倒计时：(120G 数据量，预估1个半小时)
326 / 1440 22.64% 1h11m39s
。。。
Running handlers:
Running handlers complete
Chef Client finished, 11/663 resources updated in 10 seconds
Starting prometheus
ok: run: prometheus: (pid 32372) 0s
Prometheus upgrade completed. You are now running Prometheus version 2
Old data directory has been backed up to /var/opt/gitlab/prometheus/data_tmp.
prometheus升级完成，看到已经运行版本2.
执行：
gitlab-ctl reconfigure
正式开始升级：
[root@gitlab soft]# rpm -Uvh gitlab-ce-12.0.12-ce.0.el7.x86_64.rpm
。。。
==== Upgrade has completed ====
Please verify everything is working and run the following if so
rm -rf /var/opt/gitlab/postgresql/data.9.6
。。。
完成。
查看版本号：
[root@gitlab soft]# rpm -qa|grep gitlab
gitlab-ce-12.0.12-ce.0.el7.x86_64
[root@gitlab soft]# cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
12.0.12
Gitlab-ctl restart 如果遇到报错 FATAL: terminating connection due to administrator command
重启 gitlab-ctl restart unicorn
这个版本注意，要关闭runner的自动运行，否则任何项目都会使用runner：
settings CI/CD auto devops，关闭《Default to Auto DevOps pipeline》和《Enable shared runners for new projects》。
如果使用runner，必须升级相应的gitlab-runner
############################## 12.0.12 升级到 12.1.17 测试 #####################
查看PostgreSQL的版本：
[root@gitlab soft]# /opt/gitlab/embedded/bin/psql –version
psql (PostgreSQL) 10.7
开始升级：
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
gitlab-ctl stop nginx
rpm -Uvh gitlab-ce-12.1.17-ce.0.el7.x86_64.rpm
大概2分钟后完成。
查看版本：
[root@gitlab soft]# rpm -qa|grep gitlab
gitlab-ce-12.1.17-ce.0.el7.x86_64
[root@gitlab soft]# cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
12.1.17
########################## 12.1.17 升级到 12.10.14 测试 ###############
当前PostgreSQL的版本：
[root@gitlab soft]# /opt/gitlab/embedded/bin/psql –version
psql (PostgreSQL) 10.7
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
gitlab-ctl stop nginx
这个版本的PostgreSQL会自动升级：PostgreSQL will automatically be upgraded to 11.x
开始升级：
rpm -Uvh gitlab-ce-12.10.14-ce.0.el7.x86_64.rpm
gitlab-ctl restart
升级后的PostgreSQL 的版本：
[root@gitlab soft]# /opt/gitlab/embedded/bin/psql –version
psql (PostgreSQL) 11.7
同时注意！！！！ 12.2版本以后备份的命令变为 gitlab-backup create
######################### 12.10.14 升级到 13.0.14 #########################
此版本变动如下：
1、Puma becoming default web server instead of Unicorn
2、PostgreSQL 11 becoming minimum required version，这个我们搞定了已经。
开始升级：
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
gitlab-ctl stop nginx
rpm -Uvh gitlab-ce-13.0.14-ce.0.el7.x86_64.rpm
gitlab-ctl restart
查看版本：
[root@gitlab soft]# cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
13.0.14
[root@gitlab ~]# rpm -qa|grep gitlab
gitlab-ce-13.0.14-ce.0.el7.x86_64
升级后运行check脚本：
gitlab-rake gitlab:check SANITIZE=true
。。。。。
818/4072 … yes
819/4073 … yes
484/4074 … yes
153/4075 … yes
Redis version >= 4.0.0? … yes
Ruby version >= 2.5.3 ? … yes (2.6.6)
Git version >= 2.22.0 ? … yes (2.26.2)
Git user has default SSH configuration? … yes
Active users: … 561
Is authorized keys file accessible? … yes
GitLab configured to store new projects in hashed storage? … yes
All projects are in hashed storage? … no
Try fixing it:
Please migrate all projects to hashed storage
as legacy storage is deprecated in 13.0 and support will be removed in 14.0.
For more information see:
doc/administration/repository_storage_types.md
Checking GitLab App … Finished
Checking GitLab subtasks … Finished
一切正常，Git version显示为2.26.2
########################## 13.0.14 升级到 13.1.11 #################
关闭服务
gitlab-ctl stop unicorn
gitlab-ctl stop puma
gitlab-ctl stop sidekiq
升级：
rpm -Uvh gitlab-ce-13.1.11-ce.0.el7.x86_64.rpm
执行check：
gitlab-rake gitlab:check SANITIZE=true
。。。。
825/4100 … yes
825/4101 … yes
521/4102 … yes
Redis version >= 4.0.0? … yes
Ruby version >= 2.5.3 ? … yes (2.6.6)
Git version >= 2.22.0 ? … yes (2.27.0)
Git user has default SSH configuration? … yes
Active users: … 560
Is authorized keys file accessible? … yes
GitLab configured to store new projects in hashed storage? … yes
All projects are in hashed storage? … no
Try fixing it:
Please migrate all projects to hashed storage
as legacy storage is deprecated in 13.0 and support will be removed in 14.0.
For more information see:
doc/administration/repository_storage_types.md
Checking GitLab App … Finished
Checking GitLab subtasks … Finished
一切正常，Git version显示为2.27.0
################## 13.1.11 升级到 13.5.4 #############
gitlab-ctl stop puma
gitlab-ctl stop sidekiq
rpm -Uvh gitlab-ce-13.5.4-ce.0.el7.x86_64.rpm
安装完成后
gitlab-rake gitlab:check SANITIZE=true
153/4075 … yes
Redis version >= 4.0.0? … yes
Ruby version >= 2.5.3 ? … yes (2.6.6)
Git version >= 2.24.0 ? … yes (2.28.0)
Git user has default SSH configuration? … yes
Active users: … 561
Is authorized keys file accessible? … yes
GitLab configured to store new projects in hashed storage? … yes
All projects are in hashed storage? … no
Try fixing it:
Please migrate all projects to hashed storage
as legacy storage is deprecated in 13.0 and support will be removed in 14.0.
For more information see:
doc/administration/repository_storage_types.md
Checking GitLab App … Finished
Checking GitLab subtasks … Finished
一切正常，Git version显示为2.27.0
####### 13.5.4 升级到 13.10.3 #########
gitlab-ctl stop puma
gitlab-ctl stop sidekiq
rpm -Uvh gitlab-ce-13.10.3-ce.0.el7.x86_64.rpm
[root@gitlab soft]# /opt/gitlab/embedded/bin/psql –version
psql (PostgreSQL) 12.6
[root@gitlab soft]# cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
13.10.3
执行检查：
[root@gitlab soft]# gitlab-rake gitlab:check SANITIZE=true
819/4073 … yes
484/4074 … yes
153/4075 … yes
Redis version >= 4.0.0? … yes
Ruby version >= 2.7.2 ? … yes (2.7.2)
Git version >= 2.29.0 ? … yes (2.29.0)
Git user has default SSH configuration? … yes
Active users: … 561
Is authorized keys file accessible? … yes
GitLab configured to store new projects in hashed storage? … yes
All projects are in hashed storage? … yes
Checking GitLab App … Finished
Checking GitLab subtasks … Finished
一切正常，Git version显示为2.28.0 ，同时存储变为 hashed storage