Ori.livneh has submitted this change and it was merged.
Change subject: kibana: Allow /status from all
......................................................................
kibana: Allow /status from all
The prior CIDR allow stanzas were potentially confusing in that they
really did not restrict access to internal clients since requests
proxied by the frontend Varnish caches appear to be internal to the
Apache layer.
Change-Id: I14a2a72eb898be92b2439f1a169de77734740ca7
---
M templates/kibana/apache.conf.erb
1 file changed, 4 insertions(+), 3 deletions(-)
Approvals:
Ori.livneh: Verified; Looks good to me, approved
diff --git a/templates/kibana/apache.conf.erb b/templates/kibana/apache.conf.erb
index eef2c2b..e843747 100644
--- a/templates/kibana/apache.conf.erb
+++ b/templates/kibana/apache.conf.erb
@@ -87,9 +87,10 @@
# Disallow caching of status checks
Header set Cache-Control "private, must-revalidate, max-age=0"
Header set Expires "Thu, 01 Jan 1970 00:00:00 GMT"
- # Allow internal hosts to access this URI without authenticating
- Allow from 10.0.0.0/8
- Allow from 2620:0:860::/46
+ # Allow access this URI without authenticating
+ # Due to varnish frontend, all reqests are seen by Apache as being internal
+ # so using IP ranges is not any more restrictive than "all".
+ Allow from all
Satisfy Any
</Location>
--
To view, visit https://gerrit.wikimedia.org/r/108722
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I14a2a72eb898be92b2439f1a169de77734740ca7
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: BryanDavis <[email protected]>
Gerrit-Reviewer: Ori.livneh <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
