IP Whitelisting on GitLab.com
Whitelist IP for specific project - on prem instance
Gitlab.com (saas) CI runners public or private IP addresses (range) - Stack Overflow
Restrict access to repository by IP address/range
From https://docs.gitlab.com/ee/user/gitlab_com/#ip-range
For outgoing connections from CI/CD runners we are not providing static IP addresses. All our runners are deployed into Google Cloud Platform (GCP) - any IP based firewall can be configured by looking up all IP address ranges or CIDR blocks for GCP.
Based on the documentation in GitLab docs here https://docs.gitlab.com/ee/user/gitlab_com/#ip-range
For outgoing connections from CI/CD runners, we are not providing static IP addresses. All GitLab.com shared runners are deployed into Google Cloud Platform (GCP) in us-east1. Any IP-based firewall can be configured by looking up IP address ranges or CIDR blocks for GCP
As you can see from the previous answer here, the document itself had changed and the runners now have been running within the IP address inside the scope of us-east1. So the suggestion here is also noted from the document in the google cloud documents is to create your own script to extract the collection of ipv4Prefix from scope us-east1 within this JSON file provided by the docs.
Important: In the past, Google Cloud instructed users to inspect the _cloud-netblocks.googleusercontent.com DNS TXT record (and the records it referenced). Please update your scripts or software libraries so that they read from the cloud.json file instead. The JSON file includes additional information, such as the region to which a regional external IP address is attached.
from the time I wrote this answer, the IP ranges in the scope of us-east1 are
34.23.0.0/16
34.24.0.0/15
34.26.0.0/16
34.73.0.0/16
34.74.0.0/15
34.98.128.0/21
34.118.250.0/23
34.138.0.0/15
34.148.0.0/16
35.185.0.0/17
35.190.128.0/18
35.196.0.0/16
35.207.0.0/18
35.211.0.0/16
35.220.0.0/20
35.227.0.0/17
35.229.16.0/20
35.229.32.0/19
35.229.64.0/18
35.231.0.0/16
35.237.0.0/16
35.242.0.0/20
35.243.128.0/17
104.196.0.0/18
104.196.65.0/24
104.196.66.0/23
104.196.68.0/22
104.196.96.0/19
104.196.128.0/18
104.196.192.0/19
162.216.148.0/22
Can setting by nginx.
https://docs.gitlab.com/omnibus/settings/nginx.html
you can create folder and file in: "/etc/nginx/conf.d/*.conf"
then update gitlab.rb:
nginx['custom_nginx_config'] = "include /etc/nginx/conf.d/*.conf;"
Another way is to set an allowlist by your cloud service like AWS.
I have an on-premise GitLab in a private network and I would like to have use Localized integration.
Their documentation says that I have to whitelist a range of IP addresses, localize also have to use a domain name, so I'll need to put a public record which is not what I want to have a public domain record for my private GitLab.
What is the best solution for that so that my GitLab stay secure and stay on my private network.
Should I put a network load balancer, use security groups, or a private link, private endpoint, ACL, WAF, maybe use API gateway ?
I'm not looking for IPsec tunnel just to whitelist public IP addresses from Lokalize app integration (Ir the documentation : https://docs.lokalise.com/en/articles/1789855-gitlab ) in to my private network on-premise GitLab, but I'm still not shur the best way to do it.
I would do something like a security groups with the IP, with a public alias Route 53 record that point to my Load Balancer. Or an endpoint join to my load balancer.
I don't want to give too much critical information for security reasons, but if someone have a concrete question about how to do it let me know, in those conditions I ready to give more context. Best regards.