Configure gitaly · Gitaly · Administration · Help (2024)

The Gitaly service itself is configured by using a TOML configuration file.

To change Gitaly settings:

For Omnibus GitLab

1. Edit /etc/gitlab/gitlab.rb and add or change theGitaly settings.
2. Save the file and reconfigure GitLab.

For installations from source

1. Edit /home/git/gitaly/config.toml and add or change the Gitaly settings.
2. Save the file and restart GitLab.

The following configuration options are also available:

• Enabling TLS support.
• Configuring the number of gitaly-ruby workers.
• Limiting RPC concurrency.

Run Gitaly on its own server

By default, Gitaly is run on the same server as Gitaly clients and isconfigured as above. Single-server installations are best served bythis default configuration used by:

• Omnibus GitLab.
• The GitLab source installation guide.

However, Gitaly can be deployed to its own server, which can benefit GitLab installations that spanmultiple machines.

NOTE:When configured to run on their own servers, Gitaly serversmust be upgraded before Gitalyclients in your cluster.

The process for setting up Gitaly on its own server is:

1. Install Gitaly.
2. Configure authentication.
3. Configure Gitaly servers.
4. Configure Gitaly clients.
5. Disable Gitaly where not required (optional).

When running Gitaly on its own server, note the following regarding GitLab versions:

• From GitLab 11.4, Gitaly was able to serve all Git requests without requiring a shared NFS mountfor Git repository data, except for theElasticsearch indexer.
• From GitLab 11.8, the Elasticsearch indexer also uses Gitaly for data access. NFS can still beleveraged for redundancy on block-level Git data, but should be mounted only on the Gitalyservers.
• From GitLab 11.8 to 12.2, it is possible to use Elasticsearch in a Gitaly setup that doesn't useNFS. To use Elasticsearch in these versions, therepository indexermust be enabled in your GitLab configuration.
• In GitLab 12.3 and later, the new indexer isthe default and no configuration is required.

Network architecture

The following list depicts the network architecture of Gitaly:

• GitLab Rails shards repositories into repository storages.
• /config/gitlab.yml contains a map from storage names to (Gitaly address, Gitaly token) pairs.
• The storage name -> (Gitaly address, Gitaly token) map in /config/gitlab.yml is the singlesource of truth for the Gitaly network topology.
• A (Gitaly address, Gitaly token) corresponds to a Gitaly server.
• A Gitaly server hosts one or more storages.
• A Gitaly client can use one or more Gitaly servers.
• Gitaly addresses must be specified in such a way that they resolve correctly for all Gitalyclients.
• Gitaly clients are:
  • Puma or Unicorn.
  • Sidekiq.
  • GitLab Workhorse.
  • GitLab Shell.
  • Elasticsearch indexer.
  • Gitaly itself.
• A Gitaly server must be able to make RPC calls to itself by using its own(Gitaly address, Gitaly token) pair as specified in /config/gitlab.yml.
• Authentication is done through a static token which is shared among the Gitaly and GitLab Railsnodes.

The following digraph illustrates communication between Gitaly servers and GitLab Rails showingthe default ports for HTTP and HTTPs communication.

WARNING:Gitaly servers must not be exposed to the public internet as Gitaly's network traffic is unencryptedby default. The use of firewall is highly recommended to restrict access to the Gitaly server.Another option is to use TLS.

In the following sections, we describe how to configure two Gitaly servers with secret tokenabc123secret:

• gitaly1.internal.
• gitaly2.internal.

We assume your GitLab installation has three repository storages:

• default.
• storage1.
• storage2.

You can use as few as one server with one repository storage if desired.

NOTE:The token referred to throughout the Gitaly documentation is just an arbitrary password selected bythe administrator. It is unrelated to tokens created for the GitLab API or other similar web APItokens.

Install Gitaly

Install Gitaly on each Gitaly server using either Omnibus GitLab or install it from source:

• For Omnibus GitLab, download and install the Omnibus GitLabpackage you want but do not provide the EXTERNAL_URL= value.
• To install from source, follow the steps atInstall Gitaly.

Configure authentication

Gitaly and GitLab use two shared secrets for authentication:

• One to authenticate gRPC requests to Gitaly.
• A second for authentication callbacks from GitLab Shell to the GitLab internal API.

For Omnibus GitLab

To configure the Gitaly token:

1. On the Gitaly clients, edit /etc/gitlab/gitlab.rb:

   gitlab_rails['gitaly_token'] = 'abc123secret'

2. Save the file and reconfigure GitLab.

3. On the Gitaly server, edit /etc/gitlab/gitlab.rb:

   gitaly['auth_token'] = 'abc123secret'

4. Reconfigure GitLab.

There are two ways to configure the GitLab Shell token.

Method 1:

1. Copy /etc/gitlab/gitlab-secrets.json from the Gitaly client to same path on the Gitaly servers(and any other Gitaly clients).
2. Reconfigure GitLab on Gitaly servers.

Method 2:

1. On the Gitaly clients, edit /etc/gitlab/gitlab.rb:

   gitlab_shell['secret_token'] = 'shellsecret'

2. Save the file and reconfigure GitLab.

3. On the Gitaly servers, edit /etc/gitlab/gitlab.rb:

   gitlab_shell['secret_token'] = 'shellsecret'

4. Reconfigure GitLab.

For installations from source

1. Copy /home/git/gitlab/.gitlab_shell_secret from the Gitaly client to the same path on theGitaly servers (and any other Gitaly clients).

2. On the Gitaly clients, edit /home/git/gitlab/config/gitlab.yml:

   gitlab: gitaly: token: 'abc123secret'

3. Save the file and restart GitLab.

4. On the Gitaly servers, edit /home/git/gitaly/config.toml:

   [auth]token = 'abc123secret'

5. Save the file and restart GitLab.

Configure Gitaly servers

On the Gitaly servers, you must configure storage paths and enable the network listener.The Gitaly server must be able to read, write, and set permissions on the configured path.

If you want to reduce the risk of downtime when you enable authentication, you can temporarilydisable enforcement. For more information, see the documentation on configuringGitaly authentication.

For Omnibus GitLab

1. Edit /etc/gitlab/gitlab.rb:

   # Avoid running unnecessary services on the Gitaly serverpostgresql['enable'] = falseredis['enable'] = falsenginx['enable'] = falsepuma['enable'] = falsesidekiq['enable'] = falsegitlab_workhorse['enable'] = falsegrafana['enable'] = falsegitlab_exporter['enable'] = false# If you run a separate monitoring node you can disable these servicesalertmanager['enable'] = falseprometheus['enable'] = false# If you don't run a separate monitoring node you can# enable Prometheus access & disable these extra services.# This makes Prometheus listen on all interfaces. You must use firewalls to restrict access to this address/port.# prometheus['listen_address'] = '0.0.0.0:9090'# prometheus['monitor_kubernetes'] = false# If you don't want to run monitoring services uncomment the following (not recommended)# node_exporter['enable'] = false# Prevent database connections during 'gitlab-ctl reconfigure'gitlab_rails['rake_cache_clear'] = falsegitlab_rails['auto_migrate'] = false# Configure the gitlab-shell API callback URL. Without this, `git push` will# fail. This can be your 'front door' GitLab URL or an internal load# balancer.# Don't forget to copy `/etc/gitlab/gitlab-secrets.json` from Gitaly client to Gitaly server.gitlab_rails['internal_api_url'] = 'https://gitlab.example.com'# Authentication token to ensure only authorized servers can communicate with# Gitaly servergitaly['auth_token'] = 'AUTH_TOKEN'# Make Gitaly accept connections on all network interfaces. You must use# firewalls to restrict access to this address/port.# Comment out following line if you only want to support TLS connectionsgitaly['listen_addr'] = "0.0.0.0:8075"

2. Append the following to /etc/gitlab/gitlab.rb for each respective Gitaly server:

   On gitaly1.internal:

   git_data_dirs({ 'default' => { 'path' => '/var/opt/gitlab/git-data' }, 'storage1' => { 'path' => '/mnt/gitlab/git-data' },})

   On gitaly2.internal:

   git_data_dirs({ 'storage2' => { 'path' => '/srv/gitlab/git-data' },})

3. Save the file and reconfigure GitLab.

4. Run sudo /opt/gitlab/embedded/bin/gitaly-hooks check /var/opt/gitlab/gitaly/config.tomlto confirm that Gitaly can perform callbacks to the GitLab internal API.

For installations from source

1. Edit /home/git/gitaly/config.toml:

   listen_addr = '0.0.0.0:8075'internal_socket_dir = '/var/opt/gitlab/gitaly'[logging]format = 'json'level = 'info'dir = '/var/log/gitaly'

2. Append the following to /home/git/gitaly/config.toml for each respective Gitaly server:

   On gitaly1.internal:

   [[storage]]name = 'default'path = '/var/opt/gitlab/git-data/repositories'[[storage]]name = 'storage1'path = '/mnt/gitlab/git-data/repositories'

   On gitaly2.internal:

   [[storage]]name = 'storage2'path = '/srv/gitlab/git-data/repositories'

3. Edit /home/git/gitlab-shell/config.yml:

   gitlab_url: https://gitlab.example.com

4. Save the files and restart GitLab.

5. Run sudo -u git /home/git/gitaly/gitaly-hooks check /home/git/gitaly/config.tomlto confirm that Gitaly can perform callbacks to the GitLab internal API.

Configure Gitaly clients

As the final step, you must update Gitaly clients to switch from using local Gitaly service to usethe Gitaly servers you just configured.

This can be risky because anything that prevents your Gitaly clients from reaching the Gitalyservers causes all Gitaly requests to fail. For example, any sort of network, firewall, or nameresolution problems.

Additionally, you must disable Ruggedif previously enabled manually.

Gitaly makes the following assumptions:

• Your gitaly1.internal Gitaly server can be reached at gitaly1.internal:8075 from your Gitalyclients, and that Gitaly server can read, write, and set permissions on /var/opt/gitlab/git-data and/mnt/gitlab/git-data.
• Your gitaly2.internal Gitaly server can be reached at gitaly2.internal:8075 from your Gitalyclients, and that Gitaly server can read, write, and set permissions on /srv/gitlab/git-data.
• Your gitaly1.internal and gitaly2.internal Gitaly servers can reach each other.

You can't define Gitaly servers with some as a local Gitaly server(without gitaly_address) and some as remoteserver (with gitaly_address) unless you usemixed configuration.

For Omnibus GitLab

1. Edit /etc/gitlab/gitlab.rb:

   git_data_dirs({ 'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' }, 'storage1' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' }, 'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },})

2. Save the file and reconfigure GitLab.

3. Run sudo gitlab-rake gitlab:gitaly:check on the Gitaly client (for example, theRails application) to confirm it can connect to Gitaly servers.

4. Tail the logs to see the requests:

   sudo gitlab-ctl tail gitaly

For installations from source

1. Edit /home/git/gitlab/config/gitlab.yml:

   gitlab: repositories: storages: default: gitaly_address: tcp://gitaly1.internal:8075 path: /some/local/path storage1: gitaly_address: tcp://gitaly1.internal:8075 path: /some/local/path storage2: gitaly_address: tcp://gitaly2.internal:8075 path: /some/local/path

   NOTE:/some/local/path should be set to a local folder that exists, however no data is stored inthis folder. This requirement is scheduled to be removed whenthis issue is resolved.

2. Save the file and restart GitLab.

3. Run sudo -u git -H bundle exec rake gitlab:gitaly:check RAILS_ENV=production to confirm theGitaly client can connect to Gitaly servers.

4. Tail the logs to see the requests:

   tail -f /home/git/gitlab/log/gitaly.log

When you tail the Gitaly logs on your Gitaly server, you should see requests coming in. One sure wayto trigger a Gitaly request is to clone a repository from GitLab over HTTP or HTTPS.

WARNING:If you have server hooks configured, either per repository or globally, youmust move these to the Gitaly servers. If you have multiple Gitaly servers, copy your server hooksto all Gitaly servers.

Mixed configuration

GitLab can reside on the same server as one of many Gitaly servers, but doesn't supportconfiguration that mixes local and remote configuration. The following setup is incorrect, because:

• All addresses must be reachable from the other Gitaly servers.
• storage1 is assigned a Unix socket for gitaly_address which isinvalid for some of the Gitaly servers.

git_data_dirs({ 'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' }, 'storage1' => { 'path' => '/mnt/gitlab/git-data' }, 'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },})

To combine local and remote Gitaly servers, use an external address for the local Gitaly server. Forexample:

git_data_dirs({ 'default' => { 'gitaly_address' => 'tcp://gitaly1.internal:8075' }, # Address of the GitLab server that has Gitaly running on it 'storage1' => { 'gitaly_address' => 'tcp://gitlab.internal:8075', 'path' => '/mnt/gitlab/git-data' }, 'storage2' => { 'gitaly_address' => 'tcp://gitaly2.internal:8075' },})# Make Gitaly accept connections on all network interfacesgitaly['listen_addr'] = "0.0.0.0:8075"# Or for TLSgitaly['tls_listen_addr'] = "0.0.0.0:9999"gitaly['certificate_path'] = "/etc/gitlab/ssl/cert.pem"gitaly['key_path'] = "/etc/gitlab/ssl/key.pem"

path can be included only for storage shards on the local Gitaly server.If it's excluded, default Git storage directory is used for that storage shard.

Disable Gitaly where not required (optional)

If you run Gitaly as a remote service, considerdisabling the local Gitaly service that runs on your GitLab server by default, and run itonly where required.

Disabling Gitaly on the GitLab instance makes sense only when you run GitLab in a custom cluster configuration, whereGitaly runs on a separate machine from the GitLab instance. Disabling Gitaly on all machines in the cluster is nota valid configuration (some machines much act as Gitaly servers).

To disable Gitaly on a GitLab server:

For Omnibus GitLab

1. Edit /etc/gitlab/gitlab.rb:

   gitaly['enable'] = false

2. Save the file and reconfigure GitLab.

For installations from source

1. Edit /etc/default/gitlab:

   gitaly_enabled=false

2. Save the file and restart GitLab.

Enable TLS support

• Introduced in GitLab 11.8.
• Introduced in GitLab 13.6, outgoing TLS connections to GitLab provide client certificates if configured.

Gitaly supports TLS encryption. To communicate with a Gitaly instance that listens for secureconnections, use the tls:// URL scheme in the gitaly_address of the correspondingstorage entry in the GitLab configuration.

Gitaly provides the same server certificates as client certificates in TLSconnections to GitLab. This can be used as part of a mutual TLS authentication strategywhen combined with reverse proxies (for example, NGINX) that validate client certificateto grant access to GitLab.

You must supply your own certificates as this isn't provided automatically. The certificatecorresponding to each Gitaly server must be installed on that Gitaly server.

Additionally, the certificate (or its certificate authority) must be installed on all:

• Gitaly servers.
• Gitaly clients that communicate with it.

Note the following:

• The certificate must specify the address you use to access the Gitaly server. You must add the hostname or IP address as a Subject Alternative Name to the certificate.
• You can configure Gitaly servers with both an unencrypted listening address listen_addr and anencrypted listening address tls_listen_addr at the same time. This allows you to graduallytransition from unencrypted to encrypted traffic if necessary.

To configure Gitaly with TLS:

For Omnibus GitLab

1. Create certificates for Gitaly servers.

2. On the Gitaly clients, copy the certificates (or their certificate authority) into/etc/gitlab/trusted-certs:

   sudo cp cert.pem /etc/gitlab/trusted-certs/

3. On the Gitaly clients, edit git_data_dirs in /etc/gitlab/gitlab.rb as follows:

   git_data_dirs({ 'default' => { 'gitaly_address' => 'tls://gitaly1.internal:9999' }, 'storage1' => { 'gitaly_address' => 'tls://gitaly1.internal:9999' }, 'storage2' => { 'gitaly_address' => 'tls://gitaly2.internal:9999' },})

4. Save the file and reconfigure GitLab.

5. On the Gitaly servers, create the /etc/gitlab/ssl directory and copy your key and certificatethere:

   sudo mkdir -p /etc/gitlab/sslsudo chmod 755 /etc/gitlab/sslsudo cp key.pem cert.pem /etc/gitlab/ssl/sudo chmod 644 key.pem cert.pem

6. Copy all Gitaly server certificates (or their certificate authority) to/etc/gitlab/trusted-certs on all Gitaly servers and clientsso that Gitaly servers and clients trust the certificate when calling into themselvesor other Gitaly servers:

   sudo cp cert1.pem cert2.pem /etc/gitlab/trusted-certs/

7. Edit /etc/gitlab/gitlab.rb and add:

   gitaly['tls_listen_addr'] = "0.0.0.0:9999"gitaly['certificate_path'] = "/etc/gitlab/ssl/cert.pem"gitaly['key_path'] = "/etc/gitlab/ssl/key.pem"

8. Save the file and reconfigure GitLab.

9. Verify Gitaly traffic is being served over TLS byobserving the types of Gitaly connections.

10. (Optional) Improve security by:

    1. Disabling non-TLS connections by commenting out or deleting gitaly['listen_addr'] in/etc/gitlab/gitlab.rb.
    2. Saving the file.
    3. Reconfiguring GitLab.

For installations from source

1. Create certificates for Gitaly servers.

2. On the Gitaly clients, copy the certificates into the system trusted certificates:

   sudo cp cert.pem /usr/local/share/ca-certificates/gitaly.crtsudo update-ca-certificates

3. On the Gitaly clients, edit storages in /home/git/gitlab/config/gitlab.yml as follows:

   gitlab: repositories: storages: default: gitaly_address: tls://gitaly1.internal:9999 path: /some/local/path storage1: gitaly_address: tls://gitaly1.internal:9999 path: /some/local/path storage2: gitaly_address: tls://gitaly2.internal:9999 path: /some/local/path

   NOTE:/some/local/path should be set to a local folder that exists, however no data is storedin this folder. This requirement is scheduled to be removed whenGitaly issue #1282 is resolved.

4. Save the file and restart GitLab.

5. On the Gitaly servers, create or edit /etc/default/gitlab and add:

   export SSL_CERT_DIR=/etc/gitlab/ssl

6. On the Gitaly servers, create the /etc/gitlab/ssl directory and copy your key and certificate there:

   sudo mkdir -p /etc/gitlab/sslsudo chmod 755 /etc/gitlab/sslsudo cp key.pem cert.pem /etc/gitlab/ssl/sudo chmod 644 key.pem cert.pem

7. Copy all Gitaly server certificates (or their certificate authority) to the system trustedcertificates folder so Gitaly server trusts the certificate when calling into itself or other Gitalyservers.

   sudo cp cert.pem /usr/local/share/ca-certificates/gitaly.crtsudo update-ca-certificates

8. Edit /home/git/gitaly/config.toml and add:

   tls_listen_addr = '0.0.0.0:9999'[tls]certificate_path = '/etc/gitlab/ssl/cert.pem'key_path = '/etc/gitlab/ssl/key.pem'

9. Save the file and restart GitLab.

10. Verify Gitaly traffic is being served over TLS byobserving the types of Gitaly connections.

11. (Optional) Improve security by:

    1. Disabling non-TLS connections by commenting out or deleting listen_addr in/home/git/gitaly/config.toml.
    2. Saving the file.
    3. Restarting GitLab.

Observe type of Gitaly connections

Prometheus can be used observe what type of connections Gitalyis serving a production environment. Use the following Prometheus query:

sum(rate(gitaly_connections_total[5m])) by (type)

gitaly-ruby

Gitaly was developed to replace the Ruby application code in GitLab.

To save time and avoid the risk of rewriting existing application logic, we chose to copy someapplication code from GitLab into Gitaly.

To be able to run that code, gitaly-ruby was created, which is a "sidecar" process for the mainGitaly Go process. Some examples of things that are implemented in gitaly-ruby are:

• RPCs that deal with wikis.
• RPCs that create commits on behalf of a user, such as merge commits.

We recommend:

• At least 300 MB memory per worker.
• No more than one worker per core.

NOTE:gitaly-ruby is planned to be eventually removed. To track progress, see theRemove the Gitaly-Ruby sidecar epic.

Configure number of gitaly-ruby workers

gitaly-ruby has much less capacity than Gitaly implemented in Go. If your Gitaly server has to handle lots ofrequests, the default setting of having just one active gitaly-ruby sidecar might not be enough.

If you see ResourceExhausted errors from Gitaly, it's very likely that you have not enoughgitaly-ruby capacity.

You can increase the number of gitaly-ruby processes on your Gitaly server with the followingsettings:

For Omnibus GitLab

1. Edit /etc/gitlab/gitlab.rb:

   # Default is 2 workers. The minimum is 2; 1 worker is always reserved as# a passive stand-by.gitaly['ruby_num_workers'] = 4

2. Save the file, and then reconfigure GitLab.

For installations from source

1. Edit /home/git/gitaly/config.toml:

   [gitaly-ruby]num_workers = 4

2. Save the file and restart GitLab.

Limit RPC concurrency

Clone traffic can put a large strain on your Gitaly service. The bulk of the work gets done in theeither of the following RPCs:

• SSHUploadPack (for Git SSH).
• PostUploadPack (for Git HTTP).

To prevent such workloads from overwhelming your Gitaly server, you can set concurrency limits inGitaly's configuration file. For example:

# in /etc/gitlab/gitlab.rbgitaly['concurrency'] = [ { 'rpc' => "/gitaly.SmartHTTPService/PostUploadPack", 'max_per_repo' => 20 }, { 'rpc' => "/gitaly.SSHService/SSHUploadPack", 'max_per_repo' => 20 }]

This limits the number of in-flight RPC calls for the given RPCs. The limit is applied perrepository. In the example above:

• Each repository served by the Gitaly server can have at most 20 simultaneous PostUploadPack RPCcalls in flight, and the same for SSHUploadPack.
• If another request comes in for a repository that has used up its 20 slots, that request getsqueued.

You can observe the behavior of this queue using the Gitaly logs and Prometheus:

• In the Gitaly logs, look for the string (or structured log field) acquire_ms. Messages that havethis field are reporting about the concurrency limiter.

• In Prometheus, look for the following metrics:

  • gitaly_rate_limiting_in_progress.
  • gitaly_rate_limiting_queued.
  • gitaly_rate_limiting_seconds.

NOTE:Although the name of the Prometheus metric contains rate_limiting, it's a concurrency limiter, nota rate limiter. If a Gitaly client makes 1,000 requests in a row very quickly, concurrency doesn'texceed 1, and the concurrency limiter has no effect.

Background Repository Optimization

Empty directories and unneeded configuration settings may accumulate in a repository andslow down Git operations. Gitaly can schedule a daily background task with a maximum durationto clean up these items and improve performance.

WARNING:This is an experimental feature and may place significant load on the host while running.Make sure to schedule this during off-peak hours and keep the duration short (for example, 30-60 minutes).

For Omnibus GitLab

Edit /etc/gitlab/gitlab.rb and add:

gitaly['daily_maintenance_start_hour'] = 4gitaly['daily_maintenance_start_minute'] = 30gitaly['daily_maintenance_duration'] = '30m'gitaly['daily_maintenance_storages'] = ["default"]

For installations from source

Edit /home/git/gitaly/config.toml and add:

[daily_maintenance]start_hour = 4start_minute = 30duration = '30m'storages = ["default"]

Rotate Gitaly authentication token

Rotating credentials in a production environment often requires downtime, causes outages, or both.

However, you can rotate Gitaly credentials without a service interruption. Rotating a Gitalyauthentication token involves:

• Verifying authentication monitoring.
• Enabling "auth transitioning" mode.
• Updating Gitaly authentication tokens.
• Ensuring there are no authentication failures.
• Disabling "auth transitioning" mode.
• Verifying authentication is enforced.

This procedure also works if you are running GitLab on a single server. In that case, "Gitalyserver" and "Gitaly client" refers to the same machine.

Verify authentication monitoring

Before rotating a Gitaly authentication token, verify that you can monitor the authenticationbehavior of your GitLab installation using Prometheus. Use the following Prometheus query:

sum(rate(gitaly_authentications_total[5m])) by (enforced, status)

In a system where authentication is configured correctly and where you have live traffic, yousee something like this:

{enforced="true",status="ok"} 4424.985419441742

There may also be other numbers with rate 0. We care only about the non-zero numbers.

The only non-zero number should have enforced="true",status="ok". If you have other non-zeronumbers, something is wrong in your configuration.

The status="ok" number reflects your current request rate. In the example above, Gitaly ishandling about 4000 requests per second.

Now that you have established that you can monitor the Gitaly authentication behavior of your GitLabinstallation, you can begin the rest of the procedure.

Enable "auth transitioning" mode

Temporarily disable Gitaly authentication on the Gitaly servers by putting them into "authtransitioning" mode as follows:

# in /etc/gitlab/gitlab.rbgitaly['auth_transitioning'] = true

After you have made this change, your Prometheus queryshould return something like:

{enforced="false",status="would be ok"} 4424.985419441742

Because enforced="false", it is safe to start rolling out the new token.

Update Gitaly authentication token

To update to a new Gitaly authentication token, on each Gitaly client and Gitaly server:

1. Update the configuration:

   # in /etc/gitlab/gitlab.rbgitaly['auth_token'] = '<new secret token>'

2. Restart Gitaly:

   gitlab-ctl restart gitaly

If you run your Prometheus query while this change isbeing rolled out, you see non-zero values for the enforced="false",status="denied" counter.

Ensure there are no authentication failures

After the new token is set, and all services involved have been restarted, you willtemporarily see a mix of:

• status="would be ok".
• status="denied".

After the new token is picked up by all Gitaly clients and Gitaly servers, theonly non-zero rate should be enforced="false",status="would be ok".

Disable "auth transitioning" mode

To re-enable Gitaly authentication, disable "auth transitioning" mode. Update the configuration onyour Gitaly servers as follows:

# in /etc/gitlab/gitlab.rbgitaly['auth_transitioning'] = false

WARNING:Without completing this step, you have no Gitaly authentication.

Verify authentication is enforced

Refresh your Prometheus query. You should now see a similarresult as you did at the start. For example:

{enforced="true",status="ok"} 4424.985419441742

Note that enforced="true" means that authentication is being enforced.