Skip to content

Webservice: Enabling IPv6 breaks unauthenticated rate limiting

Summary

When we tried to rollout dual stack/IPv6 by default to staging and rate limiting started to kick in for several unauthenticated endpoints.

After some investigation it seems we don't observe the correct request IP anymore:

It looks like the remote.ip for all unauthenticated web requests that were being sent to the / path got converted to 127.0.0.1 after the chart bump. Before the bump, the remote.ip was the actual user's IP address, while after the chart bump, all the log entries have remote.ip = ::ffff:127.0.0.1

This could be similar to what we fixed in gitlab-org/gitlab-foss!24199 (merged).

Steps to reproduce

TBD

Configuration used

gitlab:
  webservice:
    puma:
      bindIp6: true
    metrics:
      listenAddr: '*'
    monitoring:
      exporter:
        listenAddr: '*'

Current behavior

All requests to the IP address are observed as requests from localhost, which results in the unexpected activation of rate limiting.

Expected behavior

Enabling IPv6 does not break rate limiting.