Skip to content

Commit b59e117

Browse files
authored
Merge pull request #722 from linear-b/exaplain-allow-list
Add detailed IP allowlisting explanation for all Git providers
2 parents fb80255 + 6b39d07 commit b59e117

File tree

3 files changed

+67
-9
lines changed

3 files changed

+67
-9
lines changed

docs/bitbucket-installation.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,26 @@ description: Install gitStream to your Bitbucket workspace.
1919
- 13.56.203.235
2020
- 54.151.81.98
2121

22+
??? Info "Understanding IP Allowlisting for gitStream"
23+
When setting up IP allowlists in Bitbucket, you're specifying which source IP addresses are permitted to interact with your repositories and APIs. This affects both gitStream and your CI/CD runners.
24+
25+
There are two primary cases where this matters for gitStream:
26+
27+
1. **Webhook Event Handling by gitStream**
28+
When Bitbucket triggers a webhook event (e.g., a pull request opened), gitStream may need to make follow-up API calls to Bitbucket. This can include fetching additional metadata, posting comments to the PR, or performing other actions. These calls are made from the LinearB/gitStream service, which uses a fixed set of IP addresses. These IPs must be added to your Bitbucket allowlist to ensure proper operation.
29+
30+
2. **Outbound Requests from Your CI Runner**
31+
When your pipeline runs gitStream, that runner might also make outbound calls to Bitbucket—for example, to clone a repository or retrieve commit history. These requests will originate from the runner's IP address.
32+
33+
If you encounter errors due to blocked IPs during your CI runs, it's likely that the runner is using an IP that is not part of the configured allowlist.
34+
35+
**Recommended Solution**
36+
To ensure reliability:
37+
- Add LinearB/gitStream service IPs to your Bitbucket allowlist (listed above).
38+
- Use self-hosted runners or runners with static IPs so you can manage and allowlist their addresses explicitly.
39+
40+
This combination ensures that both gitStream's internal operations and your CI runners' interactions with Bitbucket function without network restrictions.
41+
2242
Bitbucket Installation Overview
2343

2444
1. Designate a gitStream user account.

docs/github-installation.md

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,30 @@ description: Install gitStream to your GitHub organization.
66

77
!!! Info "Prerequisites"
88
Allowed network connection between the runners and the following IPs:
9-
9+
1010
- 13.56.203.235
1111
- 54.151.81.98
1212

13+
??? Info "Understanding IP Allowlisting for gitStream"
14+
When setting up IP allowlists in GitHub, you're specifying which source IP addresses are permitted to interact with your repositories and APIs. This affects both gitStream and your CI/CD runners.
15+
16+
There are two primary cases where this matters for gitStream:
17+
18+
1. **Webhook Event Handling by gitStream**
19+
When GitHub triggers a webhook event (e.g., a pull request opened), gitStream may need to make follow-up API calls to GitHub. This can include fetching additional metadata, posting comments to the PR, or performing other actions. These calls are made from the LinearB/gitStream service, which uses a fixed set of IP addresses. These IPs must be added to your GitHub allowlist to ensure proper operation.
20+
21+
2. **Outbound Requests from Your CI Runner**
22+
When your pipeline runs gitStream (e.g., via a GitHub Action), that runner might also make outbound calls to GitHub—for example, to clone a repository or retrieve commit history. These requests will originate from the runner's IP address.
23+
24+
If you encounter errors due to blocked IPs during your CI runs, it's likely that the runner is using an IP that is not part of the configured allowlist. This is a common issue with GitHub-hosted runners, as their IPs can be dynamic and change frequently.
25+
26+
**Recommended Solution**
27+
To ensure reliability:
28+
- Add LinearB/gitStream service IPs to your GitHub allowlist (listed above).
29+
- Use self-hosted runners or runners with static IPs so you can manage and allowlist their addresses explicitly.
30+
31+
This combination ensures that both gitStream's internal operations and your CI runners' interactions with GitHub function without network restrictions.
32+
1333
!!! Warning "Install gitStream"
1434

1535
Before you can complete the gitStream setup process, you need to install the gitStream app to your [GitHub organization](https://github.com/apps/gitstream-cm/installations/new){ .md-button }.

docs/gitlab-installation.md

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,36 @@ description: Install gitStream to your GitLab organization.
1313
- 13.56.203.235
1414
- 54.151.81.98
1515

16+
??? Info "Understanding IP Allowlisting for gitStream"
17+
When setting up IP allowlists in GitLab, you're specifying which source IP addresses are permitted to interact with your repositories and APIs. This affects both gitStream and your CI/CD runners.
18+
19+
There are two primary cases where this matters for gitStream:
20+
21+
1. **Webhook Event Handling by gitStream**
22+
When GitLab triggers a webhook event (e.g., a merge request opened), gitStream may need to make follow-up API calls to GitLab. This can include fetching additional metadata, posting comments to the MR, or performing other actions. These calls are made from the LinearB/gitStream service, which uses a fixed set of IP addresses. These IPs must be added to your GitLab allowlist to ensure proper operation.
23+
24+
2. **Outbound Requests from Your CI Runner**
25+
When your pipeline runs gitStream, that runner might also make outbound calls to GitLab—for example, to clone a repository or retrieve commit history. These requests will originate from the runner's IP address.
26+
27+
If you encounter errors due to blocked IPs during your CI runs, it's likely that the runner is using an IP that is not part of the configured allowlist.
28+
29+
**Recommended Solution**
30+
To ensure reliability:
31+
- Add LinearB/gitStream service IPs to your GitLab allowlist (listed above).
32+
- Use self-hosted runners or runners with static IPs so you can manage and allowlist their addresses explicitly.
33+
34+
This combination ensures that both gitStream's internal operations and your CI runners' interactions with GitLab function without network restrictions.
35+
1636
GitLab Installation Overview
1737

1838
1. Designate a gitStream user account.
1939
1. Create a `cm` repo and `.cm` configuration file.
2040
1. Create a GitLab pipeline.
21-
1. Connect gitStream in LinearB.
41+
1. Connect gitStream in LinearB.
2242

2343
## Designate a gitStream User Account
2444

25-
gitStream automation rules are executed on behalf of the user account configured when you install the gitStream service. This account must have the `maintainer` or `owner` role to the relevant repos.
45+
gitStream automation rules are executed on behalf of the user account configured when you install the gitStream service. This account must have the `maintainer` or `owner` role to the relevant repos.
2646

2747
We recommend creating a [dedicated service account](https://docs.gitlab.com/ee/user/profile/service_accounts.html){:target="_blank"} to control access to individual repos easily. You can also use your professional or personal GitLab account for this, which would result in all automations being executed under that account, which might also affect LinearB's metrics.
2848

@@ -50,7 +70,7 @@ Once your gitStream configuration file is set up, you need a GitLab CI configura
5070
=== "GitLab-Hosted runners"
5171

5272
**Gitlab-Hosted Runners**
53-
73+
5474
Use the following `.gitlab-ci.yml`
5575

5676
``` yaml+jinja
@@ -68,14 +88,14 @@ Once your gitStream configuration file is set up, you need a GitLab CI configura
6888
``` yaml+jinja
6989
--8<-- "docs/downloads/gitlab-shell-ci.yml"
7090
```
71-
91+
7292
=== "Self-Managed Runners - Kubernetes"
7393
**Self-Managed Runners**
7494

7595
First, [register the runner](https://docs.gitlab.com/runner/register/){:target="_blank"} with a tag, and use the named tag in the `.gitlab-ci.yml` file
7696

7797
**Kubernetes executors**
78-
98+
7999
1. Ensure your runner configuration (`config.toml` for example) has the followig:
80100
``` yaml
81101
[runners.kubernetes]
@@ -93,7 +113,7 @@ Once your gitStream configuration file is set up, you need a GitLab CI configura
93113
- ...
94114
- docker pull YOUR-REGISTRY-URL/gitstream/rules-engine:latest
95115
```
96-
The docker image can be pulled to your private repository from [DockerHub](https://hub.docker.com/r/gitstream/rules-engine){:target=_blank}.
116+
The docker image can be pulled to your private repository from [DockerHub](https://hub.docker.com/r/gitstream/rules-engine){:target=_blank}.
97117

98118
## Connect gitStream in LinearB
99119

@@ -117,5 +137,3 @@ The required permissions are:
117137
| Read/Write API | To get notified on MR changes and allow gitStream to approve MRs once all conditions are met |
118138
| Read repository | To read and check rules over the code changes on monitored repositories |
119139
| Read user profile | Used to identify users |
120-
121-

0 commit comments

Comments
 (0)