Use a separate deployment for the internal API for GitLab SSHd (previously gitlab-shell)

GitLab shell uses the internal API for authorizing requests. Currently this is endpoint is set to use the Git HTTPs deployment but once we have a dedicated API deployment we can either use that, or create a separate deployment only for internal API requests.

Pros

  • Separate service with its own SLO that will help us reason a bit better about user impact, isolating Git HTTPs and Git SSH
  • We can probably tighten up our SLOs once this is isolated
  • In addition to SLO, we have more isolation for metrics. For example, if a new deployment increases the RPS of the api significantly, we would be able to see that quite clearly where has now we can't really outside of logs.

Cons

  • We will need to run new pods that are dedicated for this, so that will incur some overhead and extra cost
  • We will increase the amount of metrics, since the overall number of pods will likely increase
  • New services aren't zero cost for infra, so there will be probably a few engineering days of work to get this done.

Current configuration

# Url to gitlab instance. Used for api calls. Should end with a slash.
gitlab_url: "http://gitlab-webservice-git.gitlab.svc:8181/"

Proposed configuration

(gitlab-webservice-shell is just one option for what to call this thing)

# Url to gitlab instance. Used for api calls. Should end with a slash.
gitlab_url: "http://gitlab-webservice-shell.gitlab.svc:8181/"
Edited by John Jarvis