Add faq, intro, deploy, secure and reverse proxy for TiDB Dashboard by TomShawn · Pull Request #2737 · pingcap/docs

TomShawn · 2020-06-08T13:14:37Z

What is changed, added or deleted? (Required)

Add TiDB Dashboard 常见问题（reviewer： @CaitinChen
TiDB Dashboard 介绍（reviewer：@CaitinChen
部署 TiDB Dashboard（reviewer： @ran-huang
通过反向代理使用 TiDB Dashboard（reviewer：@yikeke
提高 TiDB Dashboard 安全性（reviewer： @ran-huang

Which TiDB version(s) do your changes apply to? (Required)

If you select two or more versions from above, to trigger the bot to cherry-pick this PR to your desired release version branch(es), you must add corresponding labels such as needs-cherry-pick-4.0, needs-cherry-pick-3.1, needs-cherry-pick-3.0, and needs-cherry-pick-2.1.

What is the related PR or file link(s)?

This PR is translated from: Add more Dashboard docs docs-cn#3440
Other reference link(s):

Co-authored-by: Ran <huangran@pingcap.com>

Co-authored-by: Caitin <34535727+CaitinChen@users.noreply.github.com>

TomShawn · 2020-06-09T11:27:18Z

@CaitinChen @breeswish Thanks very much for your comments! PTAL again.

Co-authored-by: Caitin <34535727+CaitinChen@users.noreply.github.com> Co-authored-by: Ran <huangran@pingcap.com>

CaitinChen

LGTM

yikeke

dashboard/dashboard-ops-reverse-proxy.md LGTM

yikeke · 2020-06-10T03:25:41Z

/merge

sre-bot · 2020-06-10T03:28:01Z

/run-all-tests

Signed-off-by: sre-bot <sre-bot@pingcap.com>

sre-bot · 2020-06-10T03:43:01Z

cherry pick to release-4.0 in PR #2764

…2737) (#2764) Signed-off-by: sre-bot <sre-bot@pingcap.com>

breezewish · 2020-06-10T05:06:45Z

+
+- See [TiDB Dashboard Multi-PD Instance Deployment](/dashboard/dashboard-ops-deploy.md#) to learn the working principle of TiDB Dashboard with multiple PD instances.
+- See [Use TiDB Dashboard through a Reverse Proxy](/dashboard/dashboard-ops-reverse-proxy.md) to learn how to correctly configure a reverse proxy.
+- See [Improve TiDB Dashboard Security](/dashboard/dashboard-ops-security.md) to learn how to correctly configure the firewall.


Secure TiDB Dashboard

I'll create another PR to address the comments.

breezewish · 2020-06-10T05:07:30Z

+
+For security reasons, TiDB Dashboard on PD only monitors the IP addresses specified during deployment (that is, it only listens on one NIC), not on `0.0.0.0`. Therefore, when multiple NICs are installed on the host, you cannot access TiDB Dashboard using another NIC.
+
+If you have deployed TiDB using the `tiup cluster` or `tiup playground` command, currently this problem cannot be solved. It is recommended that you use a reverse proxy to safely expose TiDB Dashboard to another NIC. For details, see [Use TiDB Dashboard through Reverse Proxy](/dashboard/dashboard-ops-reverse-proxy.md).


Use TiDB Dashboard behind a Reverse Proxy

breezewish · 2020-06-10T05:07:40Z

+    >
+    > TiDB, TiKV, and other components need to communicate with the PD component through the PD client port, so do not block access to the internal network between components. Otherwise, the cluster will become unavailable.
+
+ See [Use TiDB Dashboard through Reverse Proxy](/dashboard/dashboard-ops-reverse-proxy.md) to learn how to configure the reverse proxy to safely provide the TiDB Dashboard service on another port to the external network.


Use TiDB Dashboard behind a Reverse Proxy

breezewish · 2020-06-10T05:07:47Z

+
+As mentioned in [Use a firewall to block untrusted access](#use-a-firewall-to-block-untrusted access), the services provided under the PD client port include not only TiDB Dashboard (located at <http://IP:2379/dashboard/>), but also other privileged interfaces in PD (such as <http://IP:2379/pd/api/v1/members>). Therefore, when using a reverse proxy to provide TiDB Dashboard to the external network, ensure that the services **ONLY** with the `/dashboard` prefix are provided (**NOT** all services under the port) to avoid that the external network can access the privileged interface in PD through the reverse proxy.
+
+It is recommended that you see [Use TiDB Dashboard through Reverse Proxy](/dashboard/dashboard-ops-reverse-proxy.md) to learn a safe and recommended reverse proxy configuration.


Use TiDB Dashboard behind a Reverse Proxy

breezewish · 2020-06-10T05:08:01Z

+
+- To learn how to access and log into the TiDB Dashboard UI, see [Access TiDB Dashboard](/dashboard/dashboard-access.md).
+
+- To learn how to enhance the security of TiDB Dashboard, such as configuring a firewall, see [Improve TiDB Dashboard Security](/dashboard/dashboard-ops-security.md).


Secure TiDB Dashboard

breezewish · 2020-06-10T05:08:08Z

+
+   > **Warning:**
+   >
+   > You must keep the `/dashboard/` path in the `proxy_pass` directive to ensure that only the services under this path are reverse proxied. Otherwise, security risks will be introduced. See [Improve TiDB Dashboard Security](/dashboard/dashboard-ops-security.md).


Secure TiDB Dashboard

breezewish · 2020-06-10T05:08:15Z

+
+> **Warning:**
+>
+> Keep the `/dashboard/` path in the `proxy_pass` directive to ensure that only the services under this path are reverse proxied. Otherwise, security risks will be introduced. See [Improve TiDB Dashboard Security](/dashboard/dashboard-ops-security.md).


Secure TiDB Dashboard

Co-authored-by: pingcap-github-bot <sre-bot@pingcap.com>

Add faq. intro, deploy, secure and reverse proxy for TiDB Dashboard

9c1d1be

TomShawn added translation/from-docs-cn This PR is translated from a PR in pingcap/docs-cn. status/WIP This PR is still working in progress. needs-cherry-pick-4.0 labels Jun 8, 2020

TomShawn requested review from breezewish and yikeke June 8, 2020 13:14

Merge branch 'master' into dashboard-4

715a091

yikeke requested review from CaitinChen and ran-huang June 9, 2020 02:56

ran-huang reviewed Jun 9, 2020

View reviewed changes

TomShawn and others added 2 commits June 9, 2020 13:34

add Reverse Proxy document

9a91b8b

Apply suggestions from code review

c87e5b1

Co-authored-by: Ran <huangran@pingcap.com>

CaitinChen reviewed Jun 9, 2020

View reviewed changes

breezewish reviewed Jun 9, 2020

View reviewed changes

TomShawn and others added 4 commits June 9, 2020 15:02

update access dashboard

18d3505

address comments from breeswish

a9a6bc8

address comments from cc

b04b34e

Co-authored-by: Caitin <34535727+CaitinChen@users.noreply.github.com>

Apply suggestions from code review

fbc0eb9

Co-authored-by: Caitin <34535727+CaitinChen@users.noreply.github.com>

TomShawn mentioned this pull request Jun 9, 2020

dashboard: convert svg to png #2755

Merged

5 tasks

Merge branch 'master' into dashboard-4

ca229fa

sre-bot mentioned this pull request Jun 9, 2020

dashboard: convert svg to png (#2755) #2757

Merged

5 tasks

Merge branch 'master' into dashboard-4

32c386c

ran-huang reviewed Jun 9, 2020

View reviewed changes

Comment thread dashboard/dashboard-ops-deploy.md

Comment thread dashboard/dashboard-ops-deploy.md Outdated

Comment thread dashboard/dashboard-ops-deploy.md Outdated

Comment thread dashboard/dashboard-ops-security.md Outdated

TomShawn commented Jun 9, 2020

View reviewed changes

Comment thread dashboard/dashboard-ops-deploy.md Outdated

Apply suggestions from code review

8cd38e6

Co-authored-by: Caitin <34535727+CaitinChen@users.noreply.github.com> Co-authored-by: Ran <huangran@pingcap.com>

TomShawn commented Jun 9, 2020

View reviewed changes

Comment thread dashboard/dashboard-ops-security.md Outdated

Update dashboard/dashboard-ops-security.md

0f0cd79

CaitinChen approved these changes Jun 9, 2020

View reviewed changes

ran-huang approved these changes Jun 9, 2020

View reviewed changes

Update dashboard-ops-reverse-proxy.md

910f71d

yikeke approved these changes Jun 10, 2020

View reviewed changes

sre-bot added the status/can-merge Indicates a PR has been approved by a committer. label Jun 10, 2020

Merge branch 'master' into dashboard-4

ab5eac7

TomShawn removed the status/WIP This PR is still working in progress. label Jun 10, 2020

sre-bot merged commit 2f59300 into pingcap:master Jun 10, 2020

sre-bot pushed a commit to sre-bot/docs that referenced this pull request Jun 10, 2020

cherry pick pingcap#2737 to release-4.0

caf904b

Signed-off-by: sre-bot <sre-bot@pingcap.com>

sre-bot mentioned this pull request Jun 10, 2020

Add faq, intro, deploy, secure and reverse proxy for TiDB Dashboard (#2737) #2764

Merged

5 tasks

TomShawn deleted the dashboard-4 branch June 10, 2020 03:45

sre-bot added a commit that referenced this pull request Jun 10, 2020

Add faq, intro, deploy, secure and reverse proxy for TiDB Dashboard (#…

3e90fbc

…2737) (#2764) Signed-off-by: sre-bot <sre-bot@pingcap.com>

breezewish reviewed Jun 10, 2020

View reviewed changes

TomShawn mentioned this pull request Jun 10, 2020

Address Dashboard comments in #2737 #2767

Merged

5 tasks

sre-bot added a commit that referenced this pull request Jun 11, 2020

Address Dashboard comments in #2737 (#2767)

6c33ba1

Co-authored-by: pingcap-github-bot <sre-bot@pingcap.com>

sre-bot mentioned this pull request Jun 11, 2020

Address Dashboard comments in #2737 (#2767) #2781

Merged

5 tasks


		For security reasons, TiDB Dashboard on PD only monitors the IP addresses specified during deployment (that is, it only listens on one NIC), not on `0.0.0.0`. Therefore, when multiple NICs are installed on the host, you cannot access TiDB Dashboard using another NIC.

		If you have deployed TiDB using the `tiup cluster` or `tiup playground` command, currently this problem cannot be solved. It is recommended that you use a reverse proxy to safely expose TiDB Dashboard to another NIC. For details, see [Use TiDB Dashboard through Reverse Proxy](/dashboard/dashboard-ops-reverse-proxy.md).


		As mentioned in [Use a firewall to block untrusted access](#use-a-firewall-to-block-untrusted access), the services provided under the PD client port include not only TiDB Dashboard (located at <http://IP:2379/dashboard/>), but also other privileged interfaces in PD (such as <http://IP:2379/pd/api/v1/members>). Therefore, when using a reverse proxy to provide TiDB Dashboard to the external network, ensure that the services ONLY with the `/dashboard` prefix are provided (NOT all services under the port) to avoid that the external network can access the privileged interface in PD through the reverse proxy.

		It is recommended that you see [Use TiDB Dashboard through Reverse Proxy](/dashboard/dashboard-ops-reverse-proxy.md) to learn a safe and recommended reverse proxy configuration.


		- To learn how to access and log into the TiDB Dashboard UI, see [Access TiDB Dashboard](/dashboard/dashboard-access.md).

		- To learn how to enhance the security of TiDB Dashboard, such as configuring a firewall, see [Improve TiDB Dashboard Security](/dashboard/dashboard-ops-security.md).

Conversation

TomShawn commented Jun 8, 2020 • edited by yikeke Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is changed, added or deleted? (Required)

Which TiDB version(s) do your changes apply to? (Required)

What is the related PR or file link(s)?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TomShawn commented Jun 9, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CaitinChen left a comment

Choose a reason for hiding this comment

Uh oh!

yikeke left a comment

Choose a reason for hiding this comment

Uh oh!

yikeke commented Jun 10, 2020

Uh oh!

sre-bot commented Jun 10, 2020

Uh oh!

sre-bot commented Jun 10, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

TomShawn commented Jun 8, 2020 •

edited by yikeke

Loading