Commit 1322042b authored by Achilleas Pipinellis's avatar Achilleas Pipinellis

Split docs on IP whitelist for monitoring access

parent e1339d94
# IP whitelist
> Introduced in GitLab 9.4.
GitLab provides some [monitoring endpoints] that provide health check information
when probed.
To control access to those endpoints via IP whitelisting, you can add single
hosts or use IP ranges:
**For Omnibus installations**
1. Open `/etc/gitlab/gitlab.rb` and add or uncomment the following:
```ruby
gitlab_rails['monitoring_whitelist'] = ['127.0.0.0/8', '192.168.0.1']
```
1. Save the file and [reconfigure] GitLab for the changes to take effect.
---
**For installations from source**
1. Edit `config/gitlab.yml`:
```yaml
monitoring:
# by default only local IPs are allowed to access monitoring resources
ip_whitelist:
- 127.0.0.0/8
- 192.168.0.1
```
1. Save the file and [restart] GitLab for the changes to take effect.
[reconfigure]: ../restart_gitlab.md#omnibus-gitlab-reconfigure
[restart]: ../restart_gitlab.md#installations-from-source
[monitoring endpoints]: ../../user/admin_area/monitoring/health_check.md
# GitLab Prometheus metrics # GitLab Prometheus metrics
>**Note:** >**Note:**
Available since [Omnibus GitLab 9.3][29118]. Currently experimental. For installations from source Available since [Omnibus GitLab 9.3][29118]. Currently experimental. For
you'll have to configure it yourself. installations from source you'll have to configure it yourself.
GitLab monitors its own internal service metrics, and makes them available at the `/-/metrics` endpoint. Unlike other [Prometheus] exporters, this endpoint requires authentication as it is available on the same URL and port as user traffic.
To enable the GitLab Prometheus metrics: To enable the GitLab Prometheus metrics:
...@@ -15,9 +13,14 @@ To enable the GitLab Prometheus metrics: ...@@ -15,9 +13,14 @@ To enable the GitLab Prometheus metrics:
## Collecting the metrics ## Collecting the metrics
Since the metrics endpoint is available on the same host and port as other traffic, it requires authentication. The token and URL to access is displayed on the [Health Check][health-check] page. GitLab monitors its own internal service metrics, and makes them available at the
`/-/metrics` endpoint. Unlike other [Prometheus] exporters, in order to access
it, the client IP needs to be [included in a whitelist][whitelist].
Currently the embedded Prometheus server is not automatically configured to collect metrics from this endpoint. We recommend setting up another Prometheus server, because the embedded server configuration is overwritten one every reconfigure of GitLab. In the future this will not be required. Currently the embedded Prometheus server is not automatically configured to
collect metrics from this endpoint. We recommend setting up another Prometheus
server, because the embedded server configuration is overwritten once every
[reconfigure of GitLab][reconfigure]. In the future this will not be required.
## Metrics available ## Metrics available
...@@ -47,4 +50,5 @@ In this experimental phase, only a few metrics are available: ...@@ -47,4 +50,5 @@ In this experimental phase, only a few metrics are available:
[29118]: https://gitlab.com/gitlab-org/gitlab-ce/issues/29118 [29118]: https://gitlab.com/gitlab-org/gitlab-ce/issues/29118
[Prometheus]: https://prometheus.io [Prometheus]: https://prometheus.io
[restart]: ../../restart_gitlab.md#omnibus-gitlab-restart [restart]: ../../restart_gitlab.md#omnibus-gitlab-restart
[health-check]: ../../../user/admin_area/monitoring/health_check.md [whitelist]: ../ip_whitelist.md
[reconfigure]: ../../restart_gitlab.md#omnibus-gitlab-reconfigure
...@@ -17,34 +17,8 @@ traffic until the system is ready or restart the container as needed. ...@@ -17,34 +17,8 @@ traffic until the system is ready or restart the container as needed.
## IP whitelist ## IP whitelist
To access monitoring resources, the client IP needs to be included in a whitelist. To access monitoring resources, the client IP needs to be included in a whitelist.
You can add single hosts or use IP ranges.
**For Omnibus installations** [Read how to add IPs to a whitelist for the monitoring endpoints.][admin].
1. Open `/etc/gitlab/gitlab.rb` and add or uncomment the following:
```ruby
gitlab_rails['monitoring_whitelist'] = ['127.0.0.0/8']
```
1. Save the file and [reconfigure] GitLab for the changes to take effect.
---
**For installations from source**
1. Edit `config/gitlab.yml`:
```yaml
monitoring:
ip_whitelist:
- 127.0.0.0/8 # by default only local IPs are allowed to access monitoring resources
```
1. Save the file and [restart] GitLab for the changes to take effect.
[reconfigure]: ../../../administration/gitlab_restart.md#omnibus-gitlab-reconfigure
[restart]: ../../../administration/gitlab_restart.md#installations-from-source
## Using the endpoint ## Using the endpoint
...@@ -137,3 +111,4 @@ https://gitlab.example.com/-/readiness?token=ACCESS_TOKEN ...@@ -137,3 +111,4 @@ https://gitlab.example.com/-/readiness?token=ACCESS_TOKEN
[nagios-health]: https://nagios-plugins.org/doc/man/check_http.html [nagios-health]: https://nagios-plugins.org/doc/man/check_http.html
[newrelic-health]: https://docs.newrelic.com/docs/alerts/alert-policies/downtime-alerts/availability-monitoring [newrelic-health]: https://docs.newrelic.com/docs/alerts/alert-policies/downtime-alerts/availability-monitoring
[kubernetes]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ [kubernetes]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
[admin]: ../../../administration/monitoring/ip_whitelist.md
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment