From 90a06a20be61bb6d48d77746091492831153e075 Mon Sep 17 00:00:00 2001 From: GitLab Bot Date: Thu, 7 Nov 2019 15:06:33 +0000 Subject: Add latest changes from gitlab-org/gitlab@master --- config/gitlab.yml.example | 14 ++++--- config/initializers/1_settings.rb | 7 +++- config/initializers/7_prometheus_metrics.rb | 7 ++++ config/initializers/health_check.rb | 12 ++++++ config/initializers/rack_attack_new.rb | 59 +++++++++++++++++++---------- 5 files changed, 73 insertions(+), 26 deletions(-) (limited to 'config') diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example index 43e3315a870..a5486e450d4 100644 --- a/config/gitlab.yml.example +++ b/config/gitlab.yml.example @@ -1032,12 +1032,6 @@ production: &base # enabled: true # address: localhost # port: 8083 - # # blackout_seconds: - # # defines an interval to block healthcheck, - # # but continue accepting application requests - # # this allows Load Balancer to notice service - # # being shutdown and not interrupt any of the clients - # blackout_seconds: 10 ## Prometheus settings # Do not modify these settings here. They should be modified in /etc/gitlab/gitlab.rb @@ -1049,6 +1043,14 @@ production: &base # enable: true # listen_address: 'localhost:9090' + shutdown: + # # blackout_seconds: + # # defines an interval to block healthcheck, + # # but continue accepting application requests + # # this allows Load Balancer to notice service + # # being shutdown and not interrupt any of the clients + # blackout_seconds: 10 + # # 5. Extra customization # ========================== diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index 12ba56a15e9..df4f49524bc 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -676,7 +676,12 @@ Settings.monitoring['web_exporter'] ||= Settingslogic.new({}) Settings.monitoring.web_exporter['enabled'] ||= false Settings.monitoring.web_exporter['address'] ||= 'localhost' Settings.monitoring.web_exporter['port'] ||= 8083 -Settings.monitoring.web_exporter['blackout_seconds'] ||= 10 + +# +# Shutdown settings +# +Settings['shutdown'] ||= Settingslogic.new({}) +Settings.shutdown['blackout_seconds'] ||= 10 # # Testing settings diff --git a/config/initializers/7_prometheus_metrics.rb b/config/initializers/7_prometheus_metrics.rb index 5d444b19a45..d40049970c1 100644 --- a/config/initializers/7_prometheus_metrics.rb +++ b/config/initializers/7_prometheus_metrics.rb @@ -70,6 +70,13 @@ if defined?(::Unicorn) || defined?(::Puma) Gitlab::Metrics::Exporter::WebExporter.instance.start end + # DEPRECATED: TO BE REMOVED + # This is needed to implement blackout period of `web_exporter` + # https://gitlab.com/gitlab-org/gitlab/issues/35343#note_238479057 + Gitlab::Cluster::LifecycleEvents.on_before_blackout_period do + Gitlab::Metrics::Exporter::WebExporter.instance.mark_as_not_running! + end + Gitlab::Cluster::LifecycleEvents.on_before_graceful_shutdown do # We need to ensure that before we re-exec or shutdown server # we do stop the exporter diff --git a/config/initializers/health_check.rb b/config/initializers/health_check.rb index 9f466dc39de..1496f20afc1 100644 --- a/config/initializers/health_check.rb +++ b/config/initializers/health_check.rb @@ -8,3 +8,15 @@ HealthCheck.setup do |config| end end end + +Gitlab::Cluster::LifecycleEvents.on_before_fork do + Gitlab::HealthChecks::MasterCheck.register_master +end + +Gitlab::Cluster::LifecycleEvents.on_before_blackout_period do + Gitlab::HealthChecks::MasterCheck.finish_master +end + +Gitlab::Cluster::LifecycleEvents.on_worker_start do + Gitlab::HealthChecks::MasterCheck.register_worker +end diff --git a/config/initializers/rack_attack_new.rb b/config/initializers/rack_attack_new.rb index b0f7febe427..5efff0579ba 100644 --- a/config/initializers/rack_attack_new.rb +++ b/config/initializers/rack_attack_new.rb @@ -39,45 +39,62 @@ module Gitlab::Throttle end class Rack::Attack + # Order conditions by how expensive they are: + # 1. The most expensive is the `req.unauthenticated?` and + # `req.authenticated_user_id` as it performs an expensive + # DB/Redis query to validate the request + # 2. Slightly less expensive is the need to query DB/Redis + # to unmarshal settings (`Gitlab::Throttle.settings`) + # + # We deliberately skip `/-/health|liveness|readiness` + # from Rack Attack as they need to always be accessible + # by Load Balancer and additional measure is implemented + # (token and whitelisting) to prevent abuse. throttle('throttle_unauthenticated', Gitlab::Throttle.unauthenticated_options) do |req| - Gitlab::Throttle.settings.throttle_unauthenticated_enabled && - req.unauthenticated? && - !req.should_be_skipped? && + if !req.should_be_skipped? && + Gitlab::Throttle.settings.throttle_unauthenticated_enabled && + req.unauthenticated? req.ip + end end throttle('throttle_authenticated_api', Gitlab::Throttle.authenticated_api_options) do |req| - Gitlab::Throttle.settings.throttle_authenticated_api_enabled && - req.api_request? && + if req.api_request? && + Gitlab::Throttle.settings.throttle_authenticated_api_enabled req.authenticated_user_id([:api]) + end end throttle('throttle_authenticated_web', Gitlab::Throttle.authenticated_web_options) do |req| - Gitlab::Throttle.settings.throttle_authenticated_web_enabled && - req.web_request? && + if req.web_request? && + Gitlab::Throttle.settings.throttle_authenticated_web_enabled req.authenticated_user_id([:api, :rss, :ics]) + end end throttle('throttle_unauthenticated_protected_paths', Gitlab::Throttle.protected_paths_options) do |req| - Gitlab::Throttle.protected_paths_enabled? && - req.unauthenticated? && - !req.should_be_skipped? && - req.protected_path? && + if !req.should_be_skipped? && + req.protected_path? && + Gitlab::Throttle.protected_paths_enabled? && + req.unauthenticated? req.ip + end end throttle('throttle_authenticated_protected_paths_api', Gitlab::Throttle.protected_paths_options) do |req| - Gitlab::Throttle.protected_paths_enabled? && - req.api_request? && - req.protected_path? && + if req.api_request? && + Gitlab::Throttle.protected_paths_enabled? && + req.protected_path? req.authenticated_user_id([:api]) + end end throttle('throttle_authenticated_protected_paths_web', Gitlab::Throttle.protected_paths_options) do |req| - Gitlab::Throttle.protected_paths_enabled? && - req.web_request? && - req.protected_path? && + if req.web_request? && + Gitlab::Throttle.protected_paths_enabled? && + req.protected_path? req.authenticated_user_id([:api, :rss, :ics]) + end end class Request @@ -97,12 +114,16 @@ class Rack::Attack path =~ %r{^/api/v\d+/internal/} end + def health_check_request? + path =~ %r{^/-/(health|liveness|readiness)} + end + def should_be_skipped? - api_internal_request? + api_internal_request? || health_check_request? end def web_request? - !api_request? + !api_request? && !health_check_request? end def protected_path? -- cgit v1.2.1