[tor-bugs] #33921 [Internal Services/Services Admin Team]: gitlab monitoring

[Tor Bug Tracker & Wiki]

#33921: gitlab monitoring
-------------------------------------------------+-------------------------
 Reporter:  anarcat                              |          Owner:  hiro
     Type:  task                                 |         Status:
                                                 |  assigned
 Priority:  Low                                  |      Milestone:
Component:  Internal Services/Services Admin     |        Version:
  Team                                           |
 Severity:  Normal                               |     Resolution:
 Keywords:  tpa-roadmap-may                      |  Actual Points:
Parent ID:  #29400                               |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by anarcat):

 {{{
 +        monitoring_whitelist      => [
 +          '195.201.139.202',
 +        ],
 }}}

 this should have a `# XXX MAGIC-IP-ADDRESS` comment over it, in the short
 term. but even better, it should not be hardcoded at all and somehow
 guessed correctly. weasel had some tricks to fetch the IP address of
 another node, but I forgot how he pulled it off.

 {{{
 @@ -38,6 +38,10 @@ class profile::prometheus::server::internal (
      { 'job_name' => 'postfix' },
      { 'job_name' => 'postgres' },
      { 'job_name' => 'mtail' },
 +    { 'job_name' => 'gitlab_exporter' },
 +    { 'job_name' => 'redis_exporter' },
 +    { 'job_name' => 'gitaly' },
 +    { 'job_name' => 'gitlab_workhorse' },
    ]
    class { 'profile::prometheus::server::common':
      vhost_name          => $vhost_name,
 }}}

 that, in itself, won't be sufficient for the server to talk to the
 exporters. you'd need to export (as in `@@rule` in Puppet) the right
 resource for that to work. see how
 `profile::prometheus::blackbox_exporter` (and, really, whatever is going
 on in `prometheus::blackbox_exporter`) for an example on how to do this.

 {{{
 @@ -57,5 +61,9 @@ class profile::prometheus::server::internal (
      'postgres': port => 9187;
      'bind': port => 9119;
      'mtail': port => 3903;
 +    'gitlab_exporter': port => 9168;
 +    'redis_exporter': port => 9121;
 +    'gitaly': port => 9236;
 +    'gitlab_workhorse': port => 9229;
    }
  }
 }}}

 inversely, this will not do anything either unless you create a rule like
 the one in `prometheus::blackbox_exporter`, e.g.

 {{{
   # realize the allow rules defined on the prometheus server(s)
   Ferm::Rule <<| tag == 'profile::prometheus::server-blackbox-exporter'
 |>>
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/33921#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online