Restrict access to analytics configurator endpoint to .com only
Problem to solve
It is currently possible for clients from outside of GitLab.com to call the configurator for both our private and shared cluster.
Proposed solution
Use Google Cloud Armor to restrict access to this new configurator endpoint to only accept requests from .com.
Implementation plan - 

- Update the GCA policies for production and .com as per our docs to restrict access to requests made only from .com.
Designs
- Show closed items
Blocks
Activity
-
Newest first Oldest first
-
Show all activity Show comments only Show history only
- Robert Hunt added to epic &9016 (closed)
added to epic &9016 (closed)
- Maintainer
@rob.hunt, Please add a group or category label to identify issue ownership.You can refer to the Features by Group handbook page for guidance.
If you are unsure about the correct group, please do not leave the issue without a group label, and refer to GitLab's shared responsibility functionality guidelines for more information on how to triage this kind of issue.
This message was generated automatically. You're welcome to improve it.
- Contributor
This issue was automatically tagged with the label ~"group::configure" by TanukiStan, a machine learning classification model, with a probability of 0.32.
If this label is incorrect, please tag this issue with the correct group label as well as automation:ml wrong to help TanukiStan learn from its mistakes.
If you are unsure about the correct group, please do not leave the issue without a group label. Please refer to GitLab's shared responsibility functionality guidelines for more information on how to triage this kind of issues.
Authors who do not have permission to update labels can use the
@gitlab-bot label ~"group::<correct group name>"
command, or leave the issue to be triaged by group leaders initially assigned by TanukiStan.This message was generated automatically. You're welcome to improve it.
- Ghost User changed the description
Compare with previous version changed the description
- A deleted user added automation:ml label
added automation:ml label
- Robert Hunt changed milestone to %Backlog
changed milestone to %Backlog
- Robert Hunt added infrastructure label
added infrastructure label
- Robert Hunt added Category:Product Analytics Visualization label
added Category:Product Analytics Visualization label
- Robert Hunt added featureenhancement label and removed featureaddition label
added featureenhancement label and removed featureaddition label
- Robert Hunt mentioned in issue #438033 (moved)
mentioned in issue #438033 (moved)
- Robert Hunt changed the description
Compare with previous version changed the description
- Robert Hunt changed the description
Compare with previous version changed the description
- Robert Hunt set weight to 1
set weight to 1
- Robert Hunt added workflowscheduling label and removed workflowsolution validation label
added workflowscheduling label and removed workflowsolution validation label
- Robert Hunt marked this issue as blocked by #438033 (moved)
marked this issue as blocked by #438033 (moved)
- Robert Hunt mentioned in issue #427860 (closed)
mentioned in issue #427860 (closed)
- Robert Hunt marked this issue as blocking #427860 (closed)
marked this issue as blocking #427860 (closed)
- Robert Hunt marked this issue as blocking gitlab-org/analytics-section/product-analytics/devkit#24 (closed)
marked this issue as blocking gitlab-org/analytics-section/product-analytics/devkit#24 (closed)
- Dennis Tang added workflowready for development label and removed workflowscheduling label
added workflowready for development label and removed workflowscheduling label
- 🤖 GitLab Bot 🤖 mentioned in issue gitlab-org/quality/triage-reports#16727 (closed)
mentioned in issue gitlab-org/quality/triage-reports#16727 (closed)
- 🤖 GitLab Bot 🤖 mentioned in issue gitlab-org/quality/triage-reports#16811 (closed)
mentioned in issue gitlab-org/quality/triage-reports#16811 (closed)
- 🤖 GitLab Bot 🤖 changed milestone to %16.11
changed milestone to %16.11
- 🤖 GitLab Bot 🤖 added missed:16.10 label
added missed:16.10 label
- 🤖 GitLab Bot 🤖 mentioned in issue gitlab-org/quality/triage-reports#16917 (closed)
mentioned in issue gitlab-org/quality/triage-reports#16917 (closed)
After discussing with @rob.hunt, we agreed that it makes more sense to restrict access to the entire configurator from outside GitLab.com rather than individual endpoints.
@bastirehm Do you have any objection to that?
Collapse replies - Developer
@mwoolf not at all, we actually have https://gitlab.com/gitlab-org/analytics-section/analytics-configurator/-/issues/28 to do just that, but I'm fine if you wanna take this on directly since we didn't manage to get to it yet.
@bastirehm Sure, happy to take it on.
1
- Max Woolf changed title from Restrict access to funnels configurator endpoint to .com only to Restrict access to analytics configurator endpoint to .com only
changed title from Restrict access to funnels configurator endpoint to .com only to Restrict access to analytics configurator endpoint to .com only
- Max Woolf changed the description
Compare with previous version changed the description
- Max Woolf added workflowin dev label and removed workflowready for development label
added workflowin dev label and removed workflowready for development label
- 🤖 GitLab Bot 🤖 mentioned in issue gitlab-org/quality/triage-reports#16996 (closed)
mentioned in issue gitlab-org/quality/triage-reports#16996 (closed)
- 🤖 GitLab Bot 🤖 mentioned in issue gitlab-org/quality/triage-reports#17189 (closed)
mentioned in issue gitlab-org/quality/triage-reports#17189 (closed)
- 🤖 GitLab Bot 🤖 mentioned in issue gitlab-org/quality/triage-reports#17269 (closed)
mentioned in issue gitlab-org/quality/triage-reports#17269 (closed)
- Max Woolf closed
closed
- Robert Hunt mentioned in epic &11962
mentioned in epic &11962
- Robert Hunt mentioned in issue gitlab-org/analytics-section/product-analytics/devkit#43 (closed)
mentioned in issue gitlab-org/analytics-section/product-analytics/devkit#43 (closed)