Use a separate deployment for the internal API for GitLab SSHd (previously gitlab-shell)
GitLab shell uses the internal API for authorizing requests. Currently this is endpoint is set to use the Git HTTPs deployment but once we have a dedicated API deployment we can either use that, or create a separate deployment only for internal API requests.
Pros
- Separate service with its own SLO that will help us reason a bit better about user impact, isolating Git HTTPs and Git SSH
- We can probably tighten up our SLOs once this is isolated
- In addition to SLO, we have more isolation for metrics. For example, if a new deployment increases the RPS of the api significantly, we would be able to see that quite clearly where has now we can't really outside of logs.
Cons
- We will need to run new pods that are dedicated for this, so that will incur some overhead and extra cost
- We will increase the amount of metrics, since the overall number of pods will likely increase
- New services aren't zero cost for infra, so there will be probably a few engineering days of work to get this done.
Current configuration
# Url to gitlab instance. Used for api calls. Should end with a slash.
gitlab_url: "http://gitlab-webservice-git.gitlab.svc:8181/"
Proposed configuration
(gitlab-webservice-shell is just one option for what to call this thing)
# Url to gitlab instance. Used for api calls. Should end with a slash.
gitlab_url: "http://gitlab-webservice-shell.gitlab.svc:8181/"
Edited by John Jarvis