whitelist network or ip in gitlab.yml without token return 404
Summary
When added ip_whitelist in gitlab.yml we cannot query liveness readiness or health page from the network or ip address whitelisted
Steps to reproduce
Modify gitlab.yml: ip_whitelist: - "xxx.xxx.xxx.xxx/24"
From the computer which whitelited: curl --head http://gitserver/-/readiness HTTP/1.1 404 Not Found The page could not be found or you don't have permission to view it.
The only way to have query working without token is to add: Modify gitlab.yml: ip_whitelist: - "127.0.0.1" - "xxx.xxx.xxx.xxx/24" However when you add this everybody can access the monitoring page even if youare not in the withelisted network. curl --head http://xxxxxxx/-/readiness HTTP/1.1 200 OK
What is the current bug behavior?
We cannot limit and use the withelist parameter to only allow specific computer like supervision or reverse proxy to healthcheck without token. This happen after upgrade to 11.8.1
What is the expected correct behavior?
Only the Whitelisted network can query readiness/health/liveness for security reason. Before it's working well on 11.7.3.
Relevant logs and/or screenshots
production_json.log.1.gz:
{"method":"HEAD","path":"/-/readiness","format":"html","controller":"HealthController","action":"readiness","status":404,"duration":58.89,"view":56.28,"db":7.84,"time":"2019-03-05T16:19:44.635Z","params":[],"remote_ip":null,"user_id":null,"username":null,"ua":null,"correlation_id":"mV6r5Co4nY8"}
gitlab_access.log.1.gz
xxx.xxx.xxx.xxx - - [05/Mar/2019:16:19:44 +0100] "HEAD /-/readiness HTTP/1.1" 404 0 "" "-"
Output of checks
On premise architecture with omnibus configuration and external postgresql databases
Results of GitLab environment info
System information System: Current User: git Using RVM: no Ruby Version: 2.5.3p105 Gem Version: 2.7.6 Bundler Version:1.16.6 Rake Version: 12.3.2 Redis Version: 3.2.12 Git Version: 2.18.1 Sidekiq Version:5.2.5 Go Version: unknown
GitLab information Version: 11.8.1 Revision: 657d5085 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: postgresql URL: http://xxxxxxx HTTP Clone URL: http://xxxxxxx/some-group/some-project.git SSH Clone URL: git@xxxxxx:some-group/some-project.git Using LDAP: yes Using Omniauth: yes Omniauth Providers:
GitLab Shell Version: 8.4.4 Repository storage paths:
- default: /mnt/gitdata/repositories Hooks: /opt/gitlab/embedded/service/gitlab-shell/hooks Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... Server: ldapmain LDAP authentication... Success LDAP users with access to your GitLab server (only showing the first 100 results) xxxxxxx Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet) Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 3/1 ... yes 7/9 ... yes 7/10 ... yes 8/11 ... yes 8/12 ... yes 8/13 ... yes 8/14 ... yes 8/15 ... yes 8/16 ... yes 8/17 ... yes 8/18 ... yes 7/19 ... yes 7/20 ... yes 7/21 ... yes 9/22 ... yes 9/23 ... yes 9/24 ... yes 9/25 ... yes 9/26 ... yes 9/27 ... yes 10/28 ... yes 11/29 ... yes 12/30 ... yes 13/31 ... yes 13/32 ... yes 14/33 ... yes 14/34 ... yes 15/36 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.3.5 ? ... yes (2.5.3) Git version >= 2.18.0 ? ... yes (2.18.1) Git user has default SSH configuration? ... yes Active users: ... 5
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished