debian-mirror-gitlab/doc/administration/gitaly/index.md

1270 lines
45 KiB
Markdown
Raw Normal View History

2020-06-23 00:09:42 +05:30
---
stage: Create
group: Gitaly
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#designated-technical-writers
type: reference
---
2017-08-17 22:00:37 +05:30
# Gitaly
2020-06-23 00:09:42 +05:30
[Gitaly](https://gitlab.com/gitlab-org/gitaly) is the service that provides high-level RPC access to
Git repositories. Without it, no GitLab components can read or write Git data.
In the Gitaly documentation:
2017-08-17 22:00:37 +05:30
2020-06-23 00:09:42 +05:30
- **Gitaly server** refers to any node that runs Gitaly itself.
- **Gitaly client** refers to any node that runs a process that makes requests of the
Gitaly server. Processes include, but are not limited to:
- [GitLab Rails application](https://gitlab.com/gitlab-org/gitlab).
- [GitLab Shell](https://gitlab.com/gitlab-org/gitlab-shell).
- [GitLab Workhorse](https://gitlab.com/gitlab-org/gitlab-workhorse).
2020-07-28 23:09:34 +05:30
GitLab end users do not have direct access to Gitaly. Gitaly only manages Git
repository access for GitLab. Other types of GitLab data aren't accessed using Gitaly.
2017-08-17 22:00:37 +05:30
2020-05-24 23:13:21 +05:30
CAUTION: **Caution:**
2020-07-28 23:09:34 +05:30
From GitLab 13.0, Gitaly support for NFS is deprecated. In GitLab 14.0, Gitaly support
for NFS is scheduled to be removed. Upgrade to [Gitaly Cluster](praefect.md) as soon as
possible.
2020-05-24 23:13:21 +05:30
2019-12-04 20:38:33 +05:30
## Architecture
2020-06-23 00:09:42 +05:30
The following is a high-level architecture overview of how Gitaly is used.
2019-12-04 20:38:33 +05:30
![Gitaly architecture diagram](img/architecture_v12_4.png)
2020-06-23 00:09:42 +05:30
## Configure Gitaly
2017-08-17 22:00:37 +05:30
2019-12-04 20:38:33 +05:30
The Gitaly service itself is configured via a [TOML configuration file](reference.md).
2017-08-17 22:00:37 +05:30
2020-06-23 00:09:42 +05:30
To change Gitaly settings:
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
2017-08-17 22:00:37 +05:30
2020-06-23 00:09:42 +05:30
1. Edit `/etc/gitlab/gitlab.rb` and add or change the
[Gitaly settings](https://gitlab.com/gitlab-org/omnibus-gitlab/blob/1dd07197c7e5ae23626aad5a4a070a800b670380/files/gitlab-config-template/gitlab.rb.template#L1622-1676).
2019-10-12 21:52:04 +05:30
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
**For installations from source**
2018-03-17 18:26:18 +05:30
2019-10-12 21:52:04 +05:30
1. Edit `/home/git/gitaly/config.toml` and add or change the [Gitaly settings](https://gitlab.com/gitlab-org/gitaly/blob/master/config.toml.example).
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2018-03-17 18:26:18 +05:30
2020-07-28 23:09:34 +05:30
The following configuration options are also available:
- Enabling [TLS support](#enable-tls-support).
- Configuring the [number of `gitaly-ruby` workers](#configure-number-of-gitaly-ruby-workers).
- Limiting [RPC concurrency](#limit-rpc-concurrency).
2020-06-23 00:09:42 +05:30
## Run Gitaly on its own server
By default, Gitaly is run on the same server as Gitaly clients and is
[configured as above](#configure-gitaly). Single-server installations are best served by
this default configuration used by:
2017-08-17 22:00:37 +05:30
2020-06-23 00:09:42 +05:30
- [Omnibus GitLab](https://docs.gitlab.com/omnibus/).
- The GitLab [source installation guide](../../install/installation.md).
2017-08-17 22:00:37 +05:30
2020-06-23 00:09:42 +05:30
However, Gitaly can be deployed to its own server, which can benefit GitLab installations that span
multiple machines.
2017-09-10 17:25:29 +05:30
2020-06-23 00:09:42 +05:30
NOTE: **Note:**
When configured to run on their own servers, Gitaly servers
[must be upgraded](https://docs.gitlab.com/omnibus/update/#upgrading-gitaly-servers) before Gitaly
clients in your cluster.
The process for setting up Gitaly on its own server is:
1. [Install Gitaly](#install-gitaly).
1. [Configure authentication](#configure-authentication).
1. [Configure Gitaly servers](#configure-gitaly-servers).
1. [Configure Gitaly clients](#configure-gitaly-clients).
2020-07-28 23:09:34 +05:30
1. [Disable Gitaly where not required](#disable-gitaly-where-not-required-optional) (optional).
2020-06-23 00:09:42 +05:30
When running Gitaly on its own server, note the following regarding GitLab versions:
- From GitLab 11.4, Gitaly was able to serve all Git requests without requiring a shared NFS mount
for Git repository data, except for the
[Elasticsearch indexer](https://gitlab.com/gitlab-org/gitlab-elasticsearch-indexer).
- From GitLab 11.8, the Elasticsearch indexer uses Gitaly for data access as well. NFS can still be
leveraged for redundancy on block-level Git data, but only has to be mounted on the Gitaly
servers.
- From GitLab 11.8 to 12.2, it is possible to use Elasticsearch in a Gitaly setup that doesn't use
2021-01-03 14:25:43 +05:30
NFS. To use Elasticsearch in these versions, the
2020-06-23 00:09:42 +05:30
[repository indexer](../../integration/elasticsearch.md#elasticsearch-repository-indexer)
must be enabled in your GitLab configuration.
2021-01-03 14:25:43 +05:30
- [In GitLab 12.3 and later](https://gitlab.com/gitlab-org/gitlab/-/issues/6481), the new indexer is
2020-06-23 00:09:42 +05:30
the default and no configuration is required.
2019-10-12 21:52:04 +05:30
2019-03-02 22:35:43 +05:30
### Network architecture
2020-06-23 00:09:42 +05:30
The following list depicts the network architecture of Gitaly:
2019-10-12 21:52:04 +05:30
- GitLab Rails shards repositories into [repository storages](../repository_storage_paths.md).
2020-06-23 00:09:42 +05:30
- `/config/gitlab.yml` contains a map from storage names to `(Gitaly address, Gitaly token)` pairs.
- The `storage name` -\> `(Gitaly address, Gitaly token)` map in `/config/gitlab.yml` is the single
source of truth for the Gitaly network topology.
2019-10-12 21:52:04 +05:30
- A `(Gitaly address, Gitaly token)` corresponds to a Gitaly server.
- A Gitaly server hosts one or more storages.
2020-06-23 00:09:42 +05:30
- A Gitaly client can use one or more Gitaly servers.
- Gitaly addresses must be specified in such a way that they resolve correctly for **all** Gitaly
clients.
- Gitaly clients are:
- Puma or Unicorn.
- Sidekiq.
- GitLab Workhorse.
- GitLab Shell.
- Elasticsearch indexer.
- Gitaly itself.
2019-10-12 21:52:04 +05:30
- A Gitaly server must be able to make RPC calls **to itself** via its own
`(Gitaly address, Gitaly token)` pair as specified in `/config/gitlab.yml`.
2020-06-23 00:09:42 +05:30
- Authentication is done through a static token which is shared among the Gitaly and GitLab Rails
nodes.
2021-01-29 00:20:46 +05:30
DANGER: **Warning:**
2020-06-23 00:09:42 +05:30
Gitaly servers must not be exposed to the public internet as Gitaly's network traffic is unencrypted
by default. The use of firewall is highly recommended to restrict access to the Gitaly server.
2020-07-28 23:09:34 +05:30
Another option is to [use TLS](#enable-tls-support).
2020-06-23 00:09:42 +05:30
In the following sections, we describe how to configure two Gitaly servers with secret token
`abc123secret`:
2017-09-10 17:25:29 +05:30
2020-06-23 00:09:42 +05:30
- `gitaly1.internal`.
- `gitaly2.internal`.
2017-09-10 17:25:29 +05:30
2020-06-23 00:09:42 +05:30
We assume your GitLab installation has three repository storages:
2019-12-26 22:10:19 +05:30
2020-06-23 00:09:42 +05:30
- `default`.
- `storage1`.
- `storage2`.
2019-09-04 21:01:54 +05:30
2020-06-23 00:09:42 +05:30
You can use as few as one server with one repository storage if desired.
2019-09-04 21:01:54 +05:30
2020-06-23 00:09:42 +05:30
NOTE: **Note:**
The token referred to throughout the Gitaly documentation is just an arbitrary password selected by
the administrator. It is unrelated to tokens created for the GitLab API or other similar web API
tokens.
### Install Gitaly
Install Gitaly on each Gitaly server using either Omnibus GitLab or install it from source:
- For Omnibus GitLab, [download and install](https://about.gitlab.com/install/) the Omnibus GitLab
package you want but **do not** provide the `EXTERNAL_URL=` value.
- To install from source, follow the steps at
[Install Gitaly](../../install/installation.md#install-gitaly).
2019-09-04 21:01:54 +05:30
2020-06-23 00:09:42 +05:30
### Configure authentication
2019-09-04 21:01:54 +05:30
2020-06-23 00:09:42 +05:30
Gitaly and GitLab use two shared secrets for authentication:
- One to authenticate gRPC requests to Gitaly.
- A second for authentication callbacks from GitLab Shell to the GitLab internal API.
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
2017-09-10 17:25:29 +05:30
2020-05-24 23:13:21 +05:30
To configure the Gitaly token:
2020-06-23 00:09:42 +05:30
1. On the Gitaly clients, edit `/etc/gitlab/gitlab.rb`:
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
```ruby
gitlab_rails['gitaly_token'] = 'abc123secret'
```
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2020-05-24 23:13:21 +05:30
1. On the Gitaly server, edit `/etc/gitlab/gitlab.rb`:
```ruby
gitaly['auth_token'] = 'abc123secret'
```
1. [Reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2020-06-23 00:09:42 +05:30
There are two ways to configure the GitLab Shell token.
2020-05-24 23:13:21 +05:30
2020-06-23 00:09:42 +05:30
Method 1:
1. Copy `/etc/gitlab/gitlab-secrets.json` from the Gitaly client to same path on the Gitaly servers
(and any other Gitaly clients).
1. [Reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure) on Gitaly servers.
2020-05-24 23:13:21 +05:30
2020-06-23 00:09:42 +05:30
Method 2:
2020-05-24 23:13:21 +05:30
2020-06-23 00:09:42 +05:30
1. On the Gitaly clients, edit `/etc/gitlab/gitlab.rb`:
2020-05-24 23:13:21 +05:30
```ruby
gitlab_shell['secret_token'] = 'shellsecret'
```
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2020-06-23 00:09:42 +05:30
1. On the Gitaly servers, edit `/etc/gitlab/gitlab.rb`:
2020-05-24 23:13:21 +05:30
```ruby
gitlab_shell['secret_token'] = 'shellsecret'
```
1. [Reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2019-10-12 21:52:04 +05:30
**For installations from source**
2020-06-23 00:09:42 +05:30
1. Copy `/home/git/gitlab/.gitlab_shell_secret` from the Gitaly client to the same path on the
Gitaly servers (and any other Gitaly clients).
1. On the Gitaly clients, edit `/home/git/gitlab/config/gitlab.yml`:
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
```yaml
gitlab:
gitaly:
token: 'abc123secret'
```
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2020-06-23 00:09:42 +05:30
1. On the Gitaly servers, edit `/home/git/gitaly/config.toml`:
```toml
[auth]
token = 'abc123secret'
```
2017-09-10 17:25:29 +05:30
2020-06-23 00:09:42 +05:30
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2019-10-12 21:52:04 +05:30
2020-06-23 00:09:42 +05:30
### Configure Gitaly servers
2017-09-10 17:25:29 +05:30
2020-06-23 00:09:42 +05:30
On the Gitaly servers, you must configure storage paths and enable the network listener.
If you want to reduce the risk of downtime when you enable authentication, you can temporarily
disable enforcement. For more information, see the documentation on configuring
[Gitaly authentication](https://gitlab.com/gitlab-org/gitaly/blob/master/doc/configuration/README.md#authentication).
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
1. Edit `/etc/gitlab/gitlab.rb`:
2019-02-15 15:39:39 +05:30
2019-10-12 21:52:04 +05:30
<!--
updates to following example must also be made at
2019-12-04 20:38:33 +05:30
https://gitlab.com/gitlab-org/charts/gitlab/blob/master/doc/advanced/external-gitaly/external-omnibus-gitaly.md#configure-omnibus-gitlab
2019-10-12 21:52:04 +05:30
-->
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
```ruby
# /etc/gitlab/gitlab.rb
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
# Avoid running unnecessary services on the Gitaly server
postgresql['enable'] = false
redis['enable'] = false
nginx['enable'] = false
2020-05-24 23:13:21 +05:30
puma['enable'] = false
2019-10-12 21:52:04 +05:30
sidekiq['enable'] = false
gitlab_workhorse['enable'] = false
2020-04-08 14:13:33 +05:30
grafana['enable'] = false
2020-06-23 00:09:42 +05:30
gitlab_exporter['enable'] = false
2020-04-08 14:13:33 +05:30
2020-05-24 23:13:21 +05:30
# If you run a separate monitoring node you can disable these services
2020-04-08 14:13:33 +05:30
alertmanager['enable'] = false
prometheus['enable'] = false
2020-05-24 23:13:21 +05:30
# If you don't run a separate monitoring node you can
# enable Prometheus access & disable these extra services.
2020-04-08 14:13:33 +05:30
# This makes Prometheus listen on all interfaces. You must use firewalls to restrict access to this address/port.
# prometheus['listen_address'] = '0.0.0.0:9090'
# prometheus['monitor_kubernetes'] = false
2017-09-10 17:25:29 +05:30
2020-03-13 15:44:24 +05:30
# If you don't want to run monitoring services uncomment the following (not recommended)
# node_exporter['enable'] = false
2019-10-12 21:52:04 +05:30
# Prevent database connections during 'gitlab-ctl reconfigure'
gitlab_rails['rake_cache_clear'] = false
gitlab_rails['auto_migrate'] = false
# Configure the gitlab-shell API callback URL. Without this, `git push` will
# fail. This can be your 'front door' GitLab URL or an internal load
# balancer.
2020-06-23 00:09:42 +05:30
# Don't forget to copy `/etc/gitlab/gitlab-secrets.json` from Gitaly client to Gitaly server.
2019-10-12 21:52:04 +05:30
gitlab_rails['internal_api_url'] = 'https://gitlab.example.com'
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
# Make Gitaly accept connections on all network interfaces. You must use
# firewalls to restrict access to this address/port.
2019-12-21 20:55:43 +05:30
# Comment out following line if you only want to support TLS connections
2019-10-12 21:52:04 +05:30
gitaly['listen_addr'] = "0.0.0.0:8075"
2019-12-04 20:38:33 +05:30
```
2020-06-23 00:09:42 +05:30
1. Append the following to `/etc/gitlab/gitlab.rb` for each respective Gitaly server:
2019-12-04 20:38:33 +05:30
2020-03-13 15:44:24 +05:30
<!--
updates to following example must also be made at
https://gitlab.com/gitlab-org/charts/gitlab/blob/master/doc/advanced/external-gitaly/external-omnibus-gitaly.md#configure-omnibus-gitlab
-->
2019-12-21 20:55:43 +05:30
On `gitaly1.internal`:
2019-12-04 20:38:33 +05:30
2020-03-13 15:44:24 +05:30
```ruby
2019-12-26 22:10:19 +05:30
git_data_dirs({
'default' => {
'path' => '/var/opt/gitlab/git-data'
},
'storage1' => {
'path' => '/mnt/gitlab/git-data'
},
})
2019-12-04 20:38:33 +05:30
```
2019-12-21 20:55:43 +05:30
On `gitaly2.internal`:
2017-08-17 22:00:37 +05:30
2020-03-13 15:44:24 +05:30
```ruby
2019-12-26 22:10:19 +05:30
git_data_dirs({
'storage2' => {
'path' => '/srv/gitlab/git-data'
},
})
2019-10-12 21:52:04 +05:30
```
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2021-01-03 14:25:43 +05:30
1. Run `sudo /opt/gitlab/embedded/bin/gitaly-hooks check /var/opt/gitlab/gitaly/config.toml`
2020-06-23 00:09:42 +05:30
to confirm that Gitaly can perform callbacks to the GitLab internal API.
2019-10-12 21:52:04 +05:30
**For installations from source**
2020-06-23 00:09:42 +05:30
1. Edit `/home/git/gitaly/config.toml`:
2019-10-12 21:52:04 +05:30
```toml
listen_addr = '0.0.0.0:8075'
2020-01-01 13:55:28 +05:30
internal_socket_dir = '/var/opt/gitlab/gitaly'
2019-12-26 22:10:19 +05:30
[logging]
format = 'json'
level = 'info'
dir = '/var/log/gitaly'
2019-12-04 20:38:33 +05:30
```
2020-06-23 00:09:42 +05:30
1. Append the following to `/home/git/gitaly/config.toml` for each respective Gitaly server:
2019-10-12 21:52:04 +05:30
2019-12-21 20:55:43 +05:30
On `gitaly1.internal`:
2019-12-04 20:38:33 +05:30
```toml
2019-10-12 21:52:04 +05:30
[[storage]]
name = 'default'
2019-12-26 22:10:19 +05:30
path = '/var/opt/gitlab/git-data/repositories'
2019-10-12 21:52:04 +05:30
[[storage]]
name = 'storage1'
2019-12-26 22:10:19 +05:30
path = '/mnt/gitlab/git-data/repositories'
2019-10-12 21:52:04 +05:30
```
2019-12-21 20:55:43 +05:30
On `gitaly2.internal`:
2019-12-04 20:38:33 +05:30
```toml
[[storage]]
name = 'storage2'
2019-12-26 22:10:19 +05:30
path = '/srv/gitlab/git-data/repositories'
2019-12-04 20:38:33 +05:30
```
2020-06-23 00:09:42 +05:30
1. Edit `/home/git/gitlab-shell/config.yml`:
2020-05-24 23:13:21 +05:30
```yaml
gitlab_url: https://gitlab.example.com
```
2020-06-23 00:09:42 +05:30
1. Save the files and [restart GitLab](../restart_gitlab.md#installations-from-source).
2021-01-03 14:25:43 +05:30
1. Run `sudo -u git /home/git/gitaly/gitaly-hooks check /home/git/gitaly/config.toml`
2020-06-23 00:09:42 +05:30
to confirm that Gitaly can perform callbacks to the GitLab internal API.
### Configure Gitaly clients
2019-10-12 21:52:04 +05:30
2020-06-23 00:09:42 +05:30
As the final step, you must update Gitaly clients to switch from using local Gitaly service to use
the Gitaly servers you just configured.
2019-10-12 21:52:04 +05:30
2020-06-23 00:09:42 +05:30
This can be risky because anything that prevents your Gitaly clients from reaching the Gitaly
2021-01-29 00:20:46 +05:30
servers causes all Gitaly requests to fail. For example, any sort of network, firewall, or name
2020-06-23 00:09:42 +05:30
resolution problems.
2017-09-10 17:25:29 +05:30
2020-10-24 23:57:45 +05:30
Additionally, you must [disable Rugged](../nfs.md#improving-nfs-performance-with-gitlab)
2020-06-23 00:09:42 +05:30
if previously enabled manually.
2019-09-04 21:01:54 +05:30
2020-06-23 00:09:42 +05:30
Gitaly makes the following assumptions:
2019-12-04 20:38:33 +05:30
2020-06-23 00:09:42 +05:30
- Your `gitaly1.internal` Gitaly server can be reached at `gitaly1.internal:8075` from your Gitaly
2021-01-03 14:25:43 +05:30
clients, and that Gitaly server can read, write, and set permissions on `/mnt/gitlab/default` and
2020-06-23 00:09:42 +05:30
`/mnt/gitlab/storage1`.
- Your `gitaly2.internal` Gitaly server can be reached at `gitaly2.internal:8075` from your Gitaly
2021-01-03 14:25:43 +05:30
clients, and that Gitaly server can read, write, and set permissions on `/mnt/gitlab/storage2`.
2020-06-23 00:09:42 +05:30
- Your `gitaly1.internal` and `gitaly2.internal` Gitaly servers can reach each other.
2020-07-28 23:09:34 +05:30
You can't define Gitaly servers with some as a local Gitaly server
(without `gitaly_address`) and some as remote
server (with `gitaly_address`) unless you setup with special
[mixed configuration](#mixed-configuration).
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
1. Edit `/etc/gitlab/gitlab.rb`:
2017-09-10 17:25:29 +05:30
2019-10-12 21:52:04 +05:30
```ruby
git_data_dirs({
2019-12-04 20:38:33 +05:30
'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
'storage1' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },
2019-10-12 21:52:04 +05:30
})
```
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2021-01-03 14:25:43 +05:30
1. Run `sudo gitlab-rake gitlab:gitaly:check` on the Gitaly client (for example, the
Rails application) to confirm it can connect to Gitaly servers.
2019-10-12 21:52:04 +05:30
1. Tail the logs to see the requests:
2020-03-13 15:44:24 +05:30
```shell
2019-10-12 21:52:04 +05:30
sudo gitlab-ctl tail gitaly
```
**For installations from source**
1. Edit `/home/git/gitlab/config/gitlab.yml`:
```yaml
gitlab:
repositories:
storages:
default:
2019-12-04 20:38:33 +05:30
gitaly_address: tcp://gitaly1.internal:8075
2021-01-03 14:25:43 +05:30
path: /some/local/path
2019-10-12 21:52:04 +05:30
storage1:
2019-12-04 20:38:33 +05:30
gitaly_address: tcp://gitaly1.internal:8075
2021-01-03 14:25:43 +05:30
path: /some/local/path
2019-12-04 20:38:33 +05:30
storage2:
gitaly_address: tcp://gitaly2.internal:8075
2021-01-03 14:25:43 +05:30
path: /some/local/path
2019-10-12 21:52:04 +05:30
```
NOTE: **Note:**
2021-01-03 14:25:43 +05:30
`/some/local/path` should be set to a local folder that exists, however no data will be stored in
2020-06-23 00:09:42 +05:30
this folder. This will no longer be necessary after
[this issue](https://gitlab.com/gitlab-org/gitaly/-/issues/1282) is resolved.
2019-10-12 21:52:04 +05:30
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2020-06-23 00:09:42 +05:30
1. Run `sudo -u git -H bundle exec rake gitlab:gitaly:check RAILS_ENV=production` to confirm the
Gitaly client can connect to Gitaly servers.
2019-10-12 21:52:04 +05:30
1. Tail the logs to see the requests:
2020-03-13 15:44:24 +05:30
```shell
2019-10-12 21:52:04 +05:30
tail -f /home/git/gitlab/log/gitaly.log
```
2020-06-23 00:09:42 +05:30
When you tail the Gitaly logs on your Gitaly server, you should see requests coming in. One sure way
to trigger a Gitaly request is to clone a repository from GitLab over HTTP or HTTPS.
2019-10-12 21:52:04 +05:30
2021-01-29 00:20:46 +05:30
DANGER: **Warning:**
2020-06-23 00:09:42 +05:30
If you have [server hooks](../server_hooks.md) configured, either per repository or globally, you
must move these to the Gitaly servers. If you have multiple Gitaly servers, copy your server hooks
to all Gitaly servers.
2019-12-26 22:10:19 +05:30
2020-07-28 23:09:34 +05:30
#### Mixed configuration
GitLab can reside on the same server as one of many Gitaly servers, but doesn't support
configuration that mixes local and remote configuration. The following setup is incorrect, because:
- All addresses must be reachable from the other Gitaly servers.
- `storage1` will be assigned a Unix socket for `gitaly_address` which is
invalid for some of the Gitaly servers.
```ruby
git_data_dirs({
'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
'storage1' => { 'path' => '/mnt/gitlab/git-data' },
'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },
})
```
To combine local and remote Gitaly servers, use an external address for the local Gitaly server. For
example:
```ruby
git_data_dirs({
'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' },
# Address of the GitLab server that has Gitaly running on it
'storage1' => { 'gitaly_address' => 'tcp://gitlab.internal:8075', 'path' => '/mnt/gitlab/git-data' },
'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },
})
2021-01-03 14:25:43 +05:30
# Make Gitaly accept connections on all network interfaces
gitaly['listen_addr'] = "0.0.0.0:8075"
# Or for TLS
gitaly['tls_listen_addr'] = "0.0.0.0:9999"
gitaly['certificate_path'] = "/etc/gitlab/ssl/cert.pem"
gitaly['key_path'] = "/etc/gitlab/ssl/key.pem"
2020-07-28 23:09:34 +05:30
```
`path` can only be included for storage shards on the local Gitaly server.
If it's excluded, default Git storage directory will be used for that storage shard.
2019-10-12 21:52:04 +05:30
2020-07-28 23:09:34 +05:30
### Disable Gitaly where not required (optional)
If you are running Gitaly [as a remote service](#run-gitaly-on-its-own-server) you may want to
disable the local Gitaly service that runs on your GitLab server by default, leaving it only running
where required.
Disabling Gitaly on the GitLab instance only makes sense when you run GitLab in a custom cluster configuration, where
Gitaly runs on a separate machine from the GitLab instance. Disabling Gitaly on all machines in the cluster is not
a valid configuration (some machines much act as Gitaly servers).
2019-10-12 21:52:04 +05:30
2020-06-23 00:09:42 +05:30
To disable Gitaly on a GitLab server:
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
1. Edit `/etc/gitlab/gitlab.rb`:
```ruby
gitaly['enable'] = false
```
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
**For installations from source**
1. Edit `/etc/default/gitlab`:
```shell
gitaly_enabled=false
```
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2017-09-10 17:25:29 +05:30
2020-07-28 23:09:34 +05:30
## Enable TLS support
2019-02-15 15:39:39 +05:30
2020-03-13 15:44:24 +05:30
> [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/22602) in GitLab 11.8.
2019-02-15 15:39:39 +05:30
2020-07-28 23:09:34 +05:30
Gitaly supports TLS encryption. To communicate with a Gitaly instance that listens for secure
connections, you must use `tls://` URL scheme in the `gitaly_address` of the corresponding
storage entry in the GitLab configuration.
2019-02-15 15:39:39 +05:30
2020-07-28 23:09:34 +05:30
You must supply your own certificates as this isn't provided automatically. The certificate
corresponding to each Gitaly server must be installed on that Gitaly server.
2020-06-23 00:09:42 +05:30
2020-07-28 23:09:34 +05:30
Additionally, the certificate (or its certificate authority) must be installed on all:
2019-07-07 11:18:12 +05:30
2021-01-03 14:25:43 +05:30
- Gitaly servers.
2020-07-28 23:09:34 +05:30
- Gitaly clients that communicate with it.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
Note the following:
2021-01-03 14:25:43 +05:30
- The certificate must specify the address you use to access the Gitaly server. You must add the hostname or IP address as a Subject Alternative Name to the certificate.
2020-07-28 23:09:34 +05:30
- You can configure Gitaly servers with both an unencrypted listening address `listen_addr` and an
encrypted listening address `tls_listen_addr` at the same time. This allows you to gradually
transition from unencrypted to encrypted traffic if necessary.
2019-07-07 11:18:12 +05:30
2019-10-12 21:52:04 +05:30
To configure Gitaly with TLS:
2019-07-07 11:18:12 +05:30
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
2019-02-15 15:39:39 +05:30
2020-06-23 00:09:42 +05:30
1. Create certificates for Gitaly servers.
2020-07-28 23:09:34 +05:30
1. On the Gitaly clients, copy the certificates (or their certificate authority) into
`/etc/gitlab/trusted-certs`:
2020-06-23 00:09:42 +05:30
```shell
sudo cp cert.pem /etc/gitlab/trusted-certs/
```
1. On the Gitaly clients, edit `git_data_dirs` in `/etc/gitlab/gitlab.rb` as follows:
2019-02-15 15:39:39 +05:30
2019-10-12 21:52:04 +05:30
```ruby
git_data_dirs({
2019-12-04 20:38:33 +05:30
'default' => { 'gitaly_address' => 'tls://gitaly1.internal:9999' },
'storage1' => { 'gitaly_address' => 'tls://gitaly1.internal:9999' },
'storage2' => { 'gitaly_address' => 'tls://gitaly2.internal:9999' },
2019-10-12 21:52:04 +05:30
})
```
2019-02-15 15:39:39 +05:30
2020-06-23 00:09:42 +05:30
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2020-07-28 23:09:34 +05:30
1. On the Gitaly servers, create the `/etc/gitlab/ssl` directory and copy your key and certificate
there:
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-12-21 20:55:43 +05:30
sudo mkdir -p /etc/gitlab/ssl
2019-12-26 22:10:19 +05:30
sudo chmod 755 /etc/gitlab/ssl
2019-12-21 20:55:43 +05:30
sudo cp key.pem cert.pem /etc/gitlab/ssl/
2020-05-24 23:13:21 +05:30
sudo chmod 644 key.pem cert.pem
2019-12-21 20:55:43 +05:30
```
2020-07-28 23:09:34 +05:30
1. Copy all Gitaly server certificates (or their certificate authority) to
`/etc/gitlab/trusted-certs` so that Gitaly servers will trust the certificate when calling into themselves
or other Gitaly servers:
2020-05-24 23:13:21 +05:30
2020-06-23 00:09:42 +05:30
```shell
sudo cp cert1.pem cert2.pem /etc/gitlab/trusted-certs/
```
2020-05-24 23:13:21 +05:30
2020-06-23 00:09:42 +05:30
1. Edit `/etc/gitlab/gitlab.rb` and add:
2019-12-21 20:55:43 +05:30
<!--
updates to following example must also be made at
https://gitlab.com/gitlab-org/charts/gitlab/blob/master/doc/advanced/external-gitaly/external-omnibus-gitaly.md#configure-omnibus-gitlab
-->
2019-02-15 15:39:39 +05:30
2019-10-12 21:52:04 +05:30
```ruby
gitaly['tls_listen_addr'] = "0.0.0.0:9999"
2019-12-21 20:55:43 +05:30
gitaly['certificate_path'] = "/etc/gitlab/ssl/cert.pem"
gitaly['key_path'] = "/etc/gitlab/ssl/key.pem"
2019-10-12 21:52:04 +05:30
```
2019-02-15 15:39:39 +05:30
2020-06-23 00:09:42 +05:30
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2020-07-28 23:09:34 +05:30
1. Verify Gitaly traffic is being served over TLS by
[observing the types of Gitaly connections](#observe-type-of-gitaly-connections).
1. (Optional) Improve security by:
1. Disabling non-TLS connections by commenting out or deleting `gitaly['listen_addr']` in
`/etc/gitlab/gitlab.rb`.
1. Saving the file.
1. [Reconfiguring GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2019-02-15 15:39:39 +05:30
2019-10-12 21:52:04 +05:30
**For installations from source**
2019-02-15 15:39:39 +05:30
2020-06-23 00:09:42 +05:30
1. Create certificates for Gitaly servers.
1. On the Gitaly clients, copy the certificates into the system trusted certificates:
2020-05-24 23:13:21 +05:30
```shell
sudo cp cert.pem /usr/local/share/ca-certificates/gitaly.crt
sudo update-ca-certificates
```
2020-06-23 00:09:42 +05:30
1. On the Gitaly clients, edit `storages` in `/home/git/gitlab/config/gitlab.yml` as follows:
2019-02-15 15:39:39 +05:30
2019-10-12 21:52:04 +05:30
```yaml
gitlab:
repositories:
storages:
default:
2019-12-04 20:38:33 +05:30
gitaly_address: tls://gitaly1.internal:9999
2021-01-03 14:25:43 +05:30
path: /some/local/path
2019-10-12 21:52:04 +05:30
storage1:
2019-12-04 20:38:33 +05:30
gitaly_address: tls://gitaly1.internal:9999
2021-01-03 14:25:43 +05:30
path: /some/local/path
2019-12-04 20:38:33 +05:30
storage2:
gitaly_address: tls://gitaly2.internal:9999
2021-01-03 14:25:43 +05:30
path: /some/local/path
2019-10-12 21:52:04 +05:30
```
2019-02-15 15:39:39 +05:30
2019-10-12 21:52:04 +05:30
NOTE: **Note:**
2021-01-03 14:25:43 +05:30
`/some/local/path` should be set to a local folder that exists, however no data will be stored
2020-07-28 23:09:34 +05:30
in this folder. This will no longer be necessary after
[Gitaly issue #1282](https://gitlab.com/gitlab-org/gitaly/-/issues/1282) is resolved.
2019-07-07 11:18:12 +05:30
2020-06-23 00:09:42 +05:30
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
1. On the Gitaly servers, create or edit `/etc/default/gitlab` and add:
2020-05-24 23:13:21 +05:30
```shell
export SSL_CERT_DIR=/etc/gitlab/ssl
```
2020-06-23 00:09:42 +05:30
1. On the Gitaly servers, create the `/etc/gitlab/ssl` directory and copy your key and certificate there:
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-12-21 20:55:43 +05:30
sudo mkdir -p /etc/gitlab/ssl
2020-05-24 23:13:21 +05:30
sudo chmod 755 /etc/gitlab/ssl
2019-12-21 20:55:43 +05:30
sudo cp key.pem cert.pem /etc/gitlab/ssl/
2020-05-24 23:13:21 +05:30
sudo chmod 644 key.pem cert.pem
```
2020-07-28 23:09:34 +05:30
1. Copy all Gitaly server certificates (or their certificate authority) to the system trusted
certificates folder so Gitaly server will trust the certificate when calling into itself or other Gitaly
servers.
2020-05-24 23:13:21 +05:30
```shell
sudo cp cert.pem /usr/local/share/ca-certificates/gitaly.crt
sudo update-ca-certificates
2019-12-21 20:55:43 +05:30
```
2020-06-23 00:09:42 +05:30
1. Edit `/home/git/gitaly/config.toml` and add:
2019-07-07 11:18:12 +05:30
2019-10-12 21:52:04 +05:30
```toml
tls_listen_addr = '0.0.0.0:9999'
2019-07-07 11:18:12 +05:30
2019-10-12 21:52:04 +05:30
[tls]
2019-12-21 20:55:43 +05:30
certificate_path = '/etc/gitlab/ssl/cert.pem'
key_path = '/etc/gitlab/ssl/key.pem'
2019-10-12 21:52:04 +05:30
```
2019-07-07 11:18:12 +05:30
2020-06-23 00:09:42 +05:30
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2020-07-28 23:09:34 +05:30
1. Verify Gitaly traffic is being served over TLS by
[observing the types of Gitaly connections](#observe-type-of-gitaly-connections).
1. (Optional) Improve security by:
1. Disabling non-TLS connections by commenting out or deleting `listen_addr` in
`/home/git/gitaly/config.toml`.
1. Saving the file.
1. [Restarting GitLab](../restart_gitlab.md#installations-from-source).
2019-12-21 20:55:43 +05:30
### Observe type of Gitaly connections
2019-07-07 11:18:12 +05:30
2020-07-28 23:09:34 +05:30
[Prometheus](../monitoring/prometheus/index.md) can be used observe what type of connections Gitaly
is serving a production environment. Use the following Prometheus query:
2019-07-07 11:18:12 +05:30
2020-03-13 15:44:24 +05:30
```prometheus
2019-10-12 21:52:04 +05:30
sum(rate(gitaly_connections_total[5m])) by (type)
2019-07-07 11:18:12 +05:30
```
2019-10-12 21:52:04 +05:30
## `gitaly-ruby`
2019-07-07 11:18:12 +05:30
2019-10-12 21:52:04 +05:30
Gitaly was developed to replace the Ruby application code in GitLab.
2019-07-07 11:18:12 +05:30
2020-07-28 23:09:34 +05:30
To save time and avoid the risk of rewriting existing application logic, we chose to copy some
application code from GitLab into Gitaly.
To be able to run that code, `gitaly-ruby` was created, which is a "sidecar" process for the main
Gitaly Go process. Some examples of things that are implemented in `gitaly-ruby` are:
- RPCs that deal with wikis.
- RPCs that create commits on behalf of a user, such as merge commits.
2021-01-03 14:25:43 +05:30
We recommend:
- At least 300MB memory per worker.
- No more than one worker per core.
NOTE: **Note:**
`gitaly-ruby` is planned to be eventually removed. To track progress, see the
[Remove the Gitaly-Ruby sidecar](https://gitlab.com/groups/gitlab-org/-/epics/2862) epic.
2020-07-28 23:09:34 +05:30
### Configure number of `gitaly-ruby` workers
2019-07-07 11:18:12 +05:30
2020-07-28 23:09:34 +05:30
`gitaly-ruby` has much less capacity than Gitaly implemented in Go. If your Gitaly server has to handle lots of
requests, the default setting of having just one active `gitaly-ruby` sidecar might not be enough.
2019-07-07 11:18:12 +05:30
2020-07-28 23:09:34 +05:30
If you see `ResourceExhausted` errors from Gitaly, it's very likely that you have not enough
`gitaly-ruby` capacity.
You can increase the number of `gitaly-ruby` processes on your Gitaly server with the following
settings:
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
**For Omnibus GitLab**
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
1. Edit `/etc/gitlab/gitlab.rb`:
2018-03-27 19:54:05 +05:30
2019-10-12 21:52:04 +05:30
```ruby
# Default is 2 workers. The minimum is 2; 1 worker is always reserved as
# a passive stand-by.
gitaly['ruby_num_workers'] = 4
```
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
1. Save the file and [reconfigure GitLab](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
**For installations from source**
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
1. Edit `/home/git/gitaly/config.toml`:
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
```toml
[gitaly-ruby]
num_workers = 4
```
2017-08-17 22:00:37 +05:30
2019-10-12 21:52:04 +05:30
1. Save the file and [restart GitLab](../restart_gitlab.md#installations-from-source).
2019-02-15 15:39:39 +05:30
2020-07-28 23:09:34 +05:30
## Limit RPC concurrency
Clone traffic can put a large strain on your Gitaly service. The bulk of the work gets done in the
either of the following RPCs:
- `SSHUploadPack` (for Git SSH).
- `PostUploadPack` (for Git HTTP).
2019-12-04 20:38:33 +05:30
2020-07-28 23:09:34 +05:30
To prevent such workloads from overwhelming your Gitaly server, you can set concurrency limits in
Gitaly's configuration file. For example:
2019-12-04 20:38:33 +05:30
```ruby
# in /etc/gitlab/gitlab.rb
gitaly['concurrency'] = [
{
'rpc' => "/gitaly.SmartHTTPService/PostUploadPack",
'max_per_repo' => 20
},
{
'rpc' => "/gitaly.SSHService/SSHUploadPack",
'max_per_repo' => 20
}
]
```
2020-07-28 23:09:34 +05:30
This limits the number of in-flight RPC calls for the given RPCs. The limit is applied per
repository. In the example above:
- Each repository served by the Gitaly server can have at most 20 simultaneous `PostUploadPack` RPC
calls in flight, and the same for `SSHUploadPack`.
- If another request comes in for a repository that has used up its 20 slots, that request gets
queued.
You can observe the behavior of this queue using the Gitaly logs and Prometheus:
2019-12-04 20:38:33 +05:30
2020-07-28 23:09:34 +05:30
- In the Gitaly logs, look for the string (or structured log field) `acquire_ms`. Messages that have
this field are reporting about the concurrency limiter.
- In Prometheus, look for the following metrics:
2019-12-04 20:38:33 +05:30
2020-07-28 23:09:34 +05:30
- `gitaly_rate_limiting_in_progress`.
- `gitaly_rate_limiting_queued`.
- `gitaly_rate_limiting_seconds`.
2019-12-04 20:38:33 +05:30
2020-07-28 23:09:34 +05:30
NOTE: **Note:**
Though the name of the Prometheus metric contains `rate_limiting`, it is a concurrency limiter, not
a rate limiter. If a Gitaly client makes 1000 requests in a row very quickly, concurrency will not
exceed 1 and the concurrency limiter has no effect.
## Rotate Gitaly authentication token
Rotating credentials in a production environment often requires downtime, causes outages, or both.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
However, you can rotate Gitaly credentials without a service interruption. Rotating a Gitaly
authentication token involves:
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
- [Verifying authentication monitoring](#verify-authentication-monitoring).
- [Enabling "auth transitioning" mode](#enable-auth-transitioning-mode).
- [Updating Gitaly authentication tokens](#update-gitaly-authentication-token).
- [Ensuring there are no authentication failures](#ensure-there-are-no-authentication-failures).
- [Disabling "auth transitioning" mode](#disable-auth-transitioning-mode).
- [Verifying authentication is enforced](#verify-authentication-is-enforced).
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
This procedure also works if you are running GitLab on a single server. In that case, "Gitaly
server" and "Gitaly client" refers to the same machine.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
### Verify authentication monitoring
Before rotating a Gitaly authentication token, verify that you can monitor the authentication
behavior of your GitLab installation using Prometheus. Use the following Prometheus query:
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
```prometheus
2019-12-21 20:55:43 +05:30
sum(rate(gitaly_authentications_total[5m])) by (enforced, status)
```
2020-07-28 23:09:34 +05:30
In a system where authentication is configured correctly and where you have live traffic, you will
see something like this:
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
```prometheus
2019-12-21 20:55:43 +05:30
{enforced="true",status="ok"} 4424.985419441742
```
2020-07-28 23:09:34 +05:30
There may also be other numbers with rate 0. We only care about the non-zero numbers.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
The only non-zero number should have `enforced="true",status="ok"`. If you have other non-zero
numbers, something is wrong in your configuration.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
The `status="ok"` number reflects your current request rate. In the example above, Gitaly is
handling about 4000 requests per second.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
Now that you have established that you can monitor the Gitaly authentication behavior of your GitLab
installation, you can begin the rest of the procedure.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
### Enable "auth transitioning" mode
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
Temporarily disable Gitaly authentication on the Gitaly servers by putting them into "auth
transitioning" mode as follows:
2019-12-21 20:55:43 +05:30
```ruby
# in /etc/gitlab/gitlab.rb
gitaly['auth_transitioning'] = true
```
2020-07-28 23:09:34 +05:30
After you have made this change, your [Prometheus query](#verify-authentication-monitoring)
should return something like:
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
```prometheus
2019-12-21 20:55:43 +05:30
{enforced="false",status="would be ok"} 4424.985419441742
```
2020-07-28 23:09:34 +05:30
Because `enforced="false"`, it is safe to start rolling out the new token.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
### Update Gitaly authentication token
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
To update to a new Gitaly authentication token, on each Gitaly client **and** Gitaly server:
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
1. Update the configuration:
```ruby
# in /etc/gitlab/gitlab.rb
gitaly['auth_token'] = '<new secret token>'
```
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
1. Restart Gitaly:
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
```shell
gitlab-ctl restart gitaly
```
If you run your [Prometheus query](#verify-authentication-monitoring) while this change is
being rolled out, you will see non-zero values for the `enforced="false",status="denied"` counter.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
### Ensure there are no authentication failures
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
After the new token is set, and all services involved have been restarted, you will
[temporarily see](#verify-authentication-monitoring) a mix of:
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
- `status="would be ok"`.
- `status="denied"`.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
After the new token has been picked up by all Gitaly clients and Gitaly servers, the
**only non-zero rate** should be `enforced="false",status="would be ok"`.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
### Disable "auth transitioning" mode
To re-enable Gitaly authentication, disable "auth transitioning" mode. Update the configuration on
your Gitaly servers as follows:
2019-12-21 20:55:43 +05:30
```ruby
# in /etc/gitlab/gitlab.rb
gitaly['auth_transitioning'] = false
```
2020-07-28 23:09:34 +05:30
CAUTION: **Caution:**
Without completing this step, you have **no Gitaly authentication**.
### Verify authentication is enforced
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
Refresh your [Prometheus query](#verify-authentication-monitoring). You should now see a similar
result as you did at the start. For example:
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
```prometheus
2019-12-21 20:55:43 +05:30
{enforced="true",status="ok"} 4424.985419441742
```
2020-07-28 23:09:34 +05:30
Note that `enforced="true"` means that authentication is being enforced.
2019-12-21 20:55:43 +05:30
2020-07-28 23:09:34 +05:30
## Direct Git access bypassing Gitaly
2020-01-01 13:55:28 +05:30
2020-07-28 23:09:34 +05:30
While it is possible to access Gitaly repositories stored on disk directly with a Git client,
it is not advisable because Gitaly is being continuously improved and changed. Theses improvements may invalidate assumptions, resulting in performance degradation, instability, and even data loss.
Gitaly has optimizations, such as the
[`info/refs` advertisement cache](https://gitlab.com/gitlab-org/gitaly/blob/master/doc/design_diskcache.md),
that rely on Gitaly controlling and monitoring access to repositories via the
official gRPC interface. Likewise, Praefect has optimizations, such as fault
tolerance and distributed reads, that depend on the gRPC interface and
database to determine repository state.
For these reasons, **accessing repositories directly is done at your own risk
and is not supported**.
## Direct access to Git in GitLab
Direct access to Git uses code in GitLab known as the "Rugged patches".
2020-01-01 13:55:28 +05:30
### History
2020-07-28 23:09:34 +05:30
Before Gitaly existed, what are now Gitaly clients used to access Git repositories directly, either:
- On a local disk in the case of a single-machine Omnibus GitLab installation
- Using NFS in the case of a horizontally-scaled GitLab installation.
2020-01-01 13:55:28 +05:30
2020-07-28 23:09:34 +05:30
Besides running plain `git` commands, GitLab used to use a Ruby library called
2020-01-01 13:55:28 +05:30
[Rugged](https://github.com/libgit2/rugged). Rugged is a wrapper around
2020-07-28 23:09:34 +05:30
[libgit2](https://libgit2.org/), a stand-alone implementation of Git in the form of a C library.
Over time it became clear that Rugged, particularly in combination with
[Unicorn](https://yhbt.net/unicorn/), is extremely efficient. Because `libgit2` is a library and
not an external process, there was very little overhead between:
- GitLab application code that tried to look up data in Git repositories.
- The Git implementation itself.
Because the combination of Rugged and Unicorn was so efficient, GitLab's application code ended up with lots of
duplicate Git object lookups. For example, looking up the `master` commit a dozen times in one
request. We could write inefficient code without poor performance.
When we migrated these Git lookups to Gitaly calls, we suddenly had a much higher fixed cost per Git
lookup. Even when Gitaly is able to re-use an already-running `git` process (for example, to look up
a commit), you still have:
- The cost of a network roundtrip to Gitaly.
- Within Gitaly, a write/read roundtrip on the Unix pipes that connect Gitaly to the `git` process.
Using GitLab.com to measure, we reduced the number of Gitaly calls per request until the loss of
Rugged's efficiency was no longer felt. It also helped that we run Gitaly itself directly on the Git
file severs, rather than via NFS mounts. This gave us a speed boost that counteracted the negative
effect of not using Rugged anymore.
Unfortunately, other deployments of GitLab could not remove NFS like we did on GitLab.com, and they
got the worst of both worlds:
- The slowness of NFS.
- The increased inherent overhead of Gitaly.
The code removed from GitLab during the Gitaly migration project affected these deployments. As a
performance workaround for these NFS-based deployments, we re-introduced some of the old Rugged
code. This re-introduced code is informally referred to as the "Rugged patches".
### How it works
The Ruby methods that perform direct Git access are behind
[feature flags](../../development/gitaly.md#legacy-rugged-code), disabled by default. It wasn't
convenient to set feature flags to get the best performance, so we added an automatic mechanism that
enables direct Git access.
When GitLab calls a function that has a "Rugged patch", it performs two checks:
- Is the feature flag for this patch set in the database? If so, the feature flag setting controls
GitLab's use of "Rugged patch" code.
- If the feature flag is not set, GitLab tries accessing the filesystem underneath the
2020-11-24 15:15:51 +05:30
Gitaly server directly. If it can, it will use the "Rugged patch":
- If using Unicorn.
- If using Puma and [thread count](../../install/requirements.md#puma-threads) is set
to `1`.
2020-07-28 23:09:34 +05:30
2020-11-24 15:15:51 +05:30
The result of these checks is cached.
2020-07-28 23:09:34 +05:30
To see if GitLab can access the repository filesystem directly, we use the following heuristic:
- Gitaly ensures that the filesystem has a metadata file in its root with a UUID in it.
- Gitaly reports this UUID to GitLab via the `ServerInfo` RPC.
- GitLab Rails tries to read the metadata file directly. If it exists, and if the UUID's match,
assume we have direct access.
Direct Git access is enable by default in Omnibus GitLab because it fills in the correct repository
paths in the GitLab configuration file `config/gitlab.yml`. This satisfies the UUID check.
### Transition to Gitaly Cluster
For the sake of removing complexity, we must remove direct Git access in GitLab. However, we can't
remove it as long some GitLab installations require Git repositories on NFS.
There are two facets to our efforts to remove direct Git access in GitLab:
- Reduce the number of inefficient Gitaly queries made by GitLab.
- Persuade administrators of fault-tolerant or horizontally-scaled GitLab instances to migrate off
NFS.
The second facet presents the only real solution. For this, we developed
[Gitaly Cluster](praefect.md).
2020-01-01 13:55:28 +05:30
2019-10-12 21:52:04 +05:30
## Troubleshooting Gitaly
2021-01-03 14:25:43 +05:30
Check [Gitaly timeouts](../../user/admin_area/settings/gitaly_timeouts.md) when troubleshooting
Gitaly.
2020-06-23 00:09:42 +05:30
### Checking versions when using standalone Gitaly servers
2020-01-01 13:55:28 +05:30
2020-06-23 00:09:42 +05:30
When using standalone Gitaly servers, you must make sure they are the same version
2020-01-01 13:55:28 +05:30
as GitLab to ensure full compatibility. Check **Admin Area > Gitaly Servers** on
your GitLab instance and confirm all Gitaly Servers are `Up to date`.
![Gitaly standalone software versions diagram](img/gitlab_gitaly_version_mismatch_v12_4.png)
2019-12-04 20:38:33 +05:30
### `gitaly-debug`
The `gitaly-debug` command provides "production debugging" tools for Gitaly and Git
performance. It is intended to help production engineers and support
engineers investigate Gitaly performance problems.
If you're using GitLab 11.6 or newer, this tool should be installed on
your GitLab / Gitaly server already at `/opt/gitlab/embedded/bin/gitaly-debug`.
If you're investigating an older GitLab version you can compile this
tool offline and copy the executable to your server:
2020-03-13 15:44:24 +05:30
```shell
2019-12-04 20:38:33 +05:30
git clone https://gitlab.com/gitlab-org/gitaly.git
cd cmd/gitaly-debug
GOOS=linux GOARCH=amd64 go build -o gitaly-debug
```
To see the help page of `gitaly-debug` for a list of supported sub-commands, run:
2020-03-13 15:44:24 +05:30
```shell
2019-12-04 20:38:33 +05:30
gitaly-debug -h
```
2019-10-12 21:52:04 +05:30
### Commits, pushes, and clones return a 401
2020-03-13 15:44:24 +05:30
```plaintext
2019-10-12 21:52:04 +05:30
remote: GitLab: 401 Unauthorized
```
2020-06-23 00:09:42 +05:30
You will need to sync your `gitlab-secrets.json` file with your Gitaly clients (GitLab
app nodes).
2019-10-12 21:52:04 +05:30
2020-03-13 15:44:24 +05:30
### Client side gRPC logs
2019-10-12 21:52:04 +05:30
Gitaly uses the [gRPC](https://grpc.io/) RPC framework. The Ruby gRPC
client has its own log file which may contain useful information when
you are seeing Gitaly errors. You can control the log level of the
gRPC client with the `GRPC_LOG_LEVEL` environment variable. The
default level is `WARN`.
2020-04-08 14:13:33 +05:30
You can run a gRPC trace with:
2020-03-13 15:44:24 +05:30
```shell
2020-04-08 14:13:33 +05:30
sudo GRPC_TRACE=all GRPC_VERBOSITY=DEBUG gitlab-rake gitlab:gitaly:check
2020-03-13 15:44:24 +05:30
```
2020-11-24 15:15:51 +05:30
### Correlating Git processes with RPCs
Sometimes you need to find out which Gitaly RPC created a particular Git process.
One method for doing this is via `DEBUG` logging. However, this needs to be enabled
ahead of time and the logs produced are quite verbose.
A lightweight method for doing this correlation is by inspecting the environment
of the Git process (using its `PID`) and looking at the `CORRELATION_ID` variable:
```shell
PID=<Git process ID>
sudo cat /proc/$PID/environ | tr '\0' '\n' | grep ^CORRELATION_ID=
```
Please note that this method is not reliable for `git cat-file` processes because Gitaly
internally pools and re-uses those across RPCs.
2019-10-12 21:52:04 +05:30
### Observing `gitaly-ruby` traffic
[`gitaly-ruby`](#gitaly-ruby) is an internal implementation detail of Gitaly,
so, there's not that much visibility into what goes on inside
`gitaly-ruby` processes.
If you have Prometheus set up to scrape your Gitaly process, you can see
request rates and error codes for individual RPCs in `gitaly-ruby` by
querying `grpc_client_handled_total`. Strictly speaking, this metric does
not differentiate between `gitaly-ruby` and other RPCs, but in practice
(as of GitLab 11.9), all gRPC calls made by Gitaly itself are internal
calls from the main Gitaly process to one of its `gitaly-ruby` sidecars.
Assuming your `grpc_client_handled_total` counter only observes Gitaly,
the following query shows you RPCs are (most likely) internally
implemented as calls to `gitaly-ruby`:
2020-03-13 15:44:24 +05:30
```prometheus
2019-10-12 21:52:04 +05:30
sum(rate(grpc_client_handled_total[5m])) by (grpc_method) > 0
```
### Repository changes fail with a `401 Unauthorized` error
If you're running Gitaly on its own server and notice that users can
successfully clone and fetch repositories (via both SSH and HTTPS), but can't
push to them or make changes to the repository in the web UI without getting a
`401 Unauthorized` message, then it's possible Gitaly is failing to authenticate
2020-06-23 00:09:42 +05:30
with the Gitaly client due to having the [wrong secrets file](#configure-gitaly-servers).
2019-10-12 21:52:04 +05:30
Confirm the following are all true:
2020-06-23 00:09:42 +05:30
- When any user performs a `git push` to any repository on this Gitaly server, it
2019-10-12 21:52:04 +05:30
fails with the following error (note the `401 Unauthorized`):
2020-03-13 15:44:24 +05:30
```shell
2019-10-12 21:52:04 +05:30
remote: GitLab: 401 Unauthorized
To <REMOTE_URL>
! [remote rejected] branch-name -> branch-name (pre-receive hook declined)
error: failed to push some refs to '<REMOTE_URL>'
```
- When any user adds or modifies a file from the repository using the GitLab
2020-03-13 15:44:24 +05:30
UI, it immediately fails with a red `401 Unauthorized` banner.
2019-10-12 21:52:04 +05:30
- Creating a new project and [initializing it with a README](../../gitlab-basics/create-project.md#blank-projects)
successfully creates the project but doesn't create the README.
2020-06-23 00:09:42 +05:30
- When [tailing the logs](https://docs.gitlab.com/omnibus/settings/logs.html#tail-logs-in-a-console-on-the-server)
on a Gitaly client and reproducing the error, you get `401` errors
2019-10-12 21:52:04 +05:30
when reaching the `/api/v4/internal/allowed` endpoint:
2020-03-13 15:44:24 +05:30
```shell
2019-10-12 21:52:04 +05:30
# api_json.log
{
"time": "2019-07-18T00:30:14.967Z",
"severity": "INFO",
"duration": 0.57,
"db": 0,
"view": 0.57,
"status": 401,
"method": "POST",
"path": "\/api\/v4\/internal\/allowed",
"params": [
{
"key": "action",
"value": "git-receive-pack"
},
{
"key": "changes",
"value": "REDACTED"
},
{
"key": "gl_repository",
"value": "REDACTED"
},
{
"key": "project",
"value": "\/path\/to\/project.git"
},
{
"key": "protocol",
"value": "web"
},
{
"key": "env",
"value": "{\"GIT_ALTERNATE_OBJECT_DIRECTORIES\":[],\"GIT_ALTERNATE_OBJECT_DIRECTORIES_RELATIVE\":[],\"GIT_OBJECT_DIRECTORY\":null,\"GIT_OBJECT_DIRECTORY_RELATIVE\":null}"
},
{
"key": "user_id",
"value": "2"
},
{
"key": "secret_token",
"value": "[FILTERED]"
}
],
"host": "gitlab.example.com",
"ip": "REDACTED",
"ua": "Ruby",
"route": "\/api\/:version\/internal\/allowed",
"queue_duration": 4.24,
"gitaly_calls": 0,
"gitaly_duration": 0,
"correlation_id": "XPUZqTukaP3"
}
# nginx_access.log
[IP] - - [18/Jul/2019:00:30:14 +0000] "POST /api/v4/internal/allowed HTTP/1.1" 401 30 "" "Ruby"
```
2020-06-23 00:09:42 +05:30
To fix this problem, confirm that your [`gitlab-secrets.json` file](#configure-gitaly-servers)
on the Gitaly server matches the one on Gitaly client. If it doesn't match,
update the secrets file on the Gitaly server to match the Gitaly client, then
[reconfigure](../restart_gitlab.md#omnibus-gitlab-reconfigure).
2019-12-04 20:38:33 +05:30
### Command line tools cannot connect to Gitaly
2020-06-23 00:09:42 +05:30
If you are having trouble connecting to a Gitaly server with command line (CLI) tools,
and certain actions result in a `14: Connect Failed` error message,
it means that gRPC cannot reach your Gitaly server.
2019-12-04 20:38:33 +05:30
Verify that you can reach Gitaly via TCP:
2020-03-13 15:44:24 +05:30
```shell
2019-12-04 20:38:33 +05:30
sudo gitlab-rake gitlab:tcp_check[GITALY_SERVER_IP,GITALY_LISTEN_PORT]
```
2020-06-23 00:09:42 +05:30
If the TCP connection fails, check your network settings and your firewall rules.
If the TCP connection succeeds, your networking and firewall rules are correct.
2019-12-04 20:38:33 +05:30
2020-06-23 00:09:42 +05:30
If you use proxy servers in your command line environment, such as Bash, these
can interfere with your gRPC traffic.
2019-12-04 20:38:33 +05:30
2020-06-23 00:09:42 +05:30
If you use Bash or a compatible command line environment, run the following commands
to determine whether you have proxy servers configured:
2019-12-04 20:38:33 +05:30
2020-03-13 15:44:24 +05:30
```shell
2019-12-04 20:38:33 +05:30
echo $http_proxy
echo $https_proxy
```
2020-06-23 00:09:42 +05:30
If either of these variables have a value, your Gitaly CLI connections may be
getting routed through a proxy which cannot connect to Gitaly.
2019-12-04 20:38:33 +05:30
To remove the proxy setting, run the following commands (depending on which variables had values):
2020-03-13 15:44:24 +05:30
```shell
2019-12-04 20:38:33 +05:30
unset http_proxy
unset https_proxy
```
2019-12-21 20:55:43 +05:30
2020-06-23 00:09:42 +05:30
### Permission denied errors appearing in Gitaly logs when accessing repositories from a standalone Gitaly server
2020-04-22 19:07:51 +05:30
If this error occurs even though file permissions are correct, it's likely that
2020-06-23 00:09:42 +05:30
the Gitaly server is experiencing
2020-04-22 19:07:51 +05:30
[clock drift](https://en.wikipedia.org/wiki/Clock_drift).
2020-06-23 00:09:42 +05:30
Please ensure that the Gitaly clients and servers are synchronized and use an NTP time
2020-04-22 19:07:51 +05:30
server to keep them synchronized if possible.
2019-12-21 20:55:43 +05:30
### Praefect
2020-06-23 00:09:42 +05:30
Praefect is a router and transaction manager for Gitaly, and a required
component for running a Gitaly Cluster. For more information see [Gitaly Cluster](praefect.md).