Monitoring of a Deckhouse Code instance consists of the limits set in the web interface and of the built-in Prometheus of each installation type.
Resource management
The limits and the performance settings of the instance are set by an administrator in the web interface:
-
Configure repository and artifact limits:
- Go to “Admin” → “Settings” → “Account and Limits”.
-
Optimize system performance:
- Go to “Admin” → “Settings” → “Network”.
Built-in monitoring
Each installation type ships its own metrics endpoint or alerting; the tab names the type.
- Linux package
- Omnibus Docker
- Helm Chart
- Deckhouse Kubernetes Platform module
Prometheus and the exporters (node, postgres, redis and others) are installed together with the package and listen on the 127.0.0.1 address only, so no port is open to the outside. Check their state:
sudo gitlab-ctl status | grep -E "prometheus|exporter"
# The readiness of the built-in Prometheus.
curl -s http://127.0.0.1:9090/-/readyTo let an external monitoring system collect the metrics, set the listen address of Prometheus in the /etc/gitlab/gitlab.rb file:
prometheus['listen_address'] = '0.0.0.0:9090'Apply the setting:
sudo gitlab-ctl reconfigureRestrict access to port 9090 on the firewall to the addresses of the monitoring system.
- firewalld (RED OS)
- ufw (Ubuntu)
sudo firewall-cmd --permanent --new-zone=monitoring
sudo firewall-cmd --permanent --zone=monitoring --add-source=<MONITORING_IP>/32
sudo firewall-cmd --permanent --zone=monitoring --add-port=9090/tcp
# The zone takes all traffic from this address, so the base services are opened as well.
sudo firewall-cmd --permanent --zone=monitoring --add-service={ssh,http,https}
sudo firewall-cmd --reloadsudo ufw allow from <MONITORING_IP> to any port 9090 proto tcpThe container runs the same Prometheus and the same exporters except node_exporter, which the image turns off. The image exposes ports 80, 443 and 22 only, so the Prometheus port has to be published when the container is created: add -p 9090:9090 to the docker run command, as the list of published ports of a running container cannot be changed.
Set prometheus['listen_address'] in the /etc/gitlab/gitlab.rb file in the configuration volume; the value, its meaning and the access restriction on the port are described on the “Linux package” tab. The setting is applied at the next start of the container: the gitlab-ctl reconfigure command runs at every start.
The Helm Chart creates a ServiceMonitor object (the Prometheus Operator custom resource) for each component that exposes Prometheus metrics, when metrics.serviceMonitor.enabled is true. metrics.serviceMonitor.labels sets the labels a Prometheus instance matches to discover them.
metrics:
serviceMonitor:
enabled: true
labels:
release: <PROMETHEUS_RELEASE_LABEL>A Prometheus instance configured to watch ServiceMonitor objects with these labels, in the code namespace or across the cluster depending on its own configuration, discovers and scrapes them without further setup on the release side.