Description
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • AlexMonk-WMF | T104521 Support reverse dns for public labs IPs | |||
| Resolved | Andrew | T124184 Switch to using Horizon/Designate for labs public dns | |||
| Resolved | Andrew | T129272 Migrate DNS entries from ldap to designate | |||
| Resolved | Andrew | T130032 Enforce true multi-tenancy for labs public DNS | |||
| Resolved | Andrew | T131052 replace labs-ns0/1 with labs-ns2/3 | |||
| Duplicate | None | T124183 Create web-proxy editing panel in Horizon | |||
| Resolved | • AlexMonk-WMF | T129245 Horizon dashboard for managing http proxies for labs instances |
Event Timeline
Here's what I propose, to be added to labs dnsrecursor in a manner similar to labsaliaser (actually, maybe part of labsaliaser?). All projects should have existing $project.wmflabs.org DNS zones.
For every $instance in every $project with a floating IP $IP:
- $IP IN PTR instance-$instance.$project.wmflabs.org
- instance-$instance.$project.wmflabs.org IN A $IP
We'll also need to insert entries at the bottom of templates/155.80.208.in-addr.arpa to delegate these records to labs DNS servers so they can be updated automatically.
Change 299503 had a related patch set uploaded (by Alex Monk):
dnsrecursor labsaliaser: Set up instance-$instance.$project.wmflabs.org domains for every instance with a public IP
Change 299513 had a related patch set uploaded (by Alex Monk):
Delegate 208.80.155.128/25 (labs instances) PTR records to labs-ns* so they can be managed automatically
Change 299503 abandoned by Alex Monk:
dnsrecursor labsaliaser: Set up instance-$instance.$project.wmflabs.org domains for every instance with a public IP
Reason:
Unfortunately won't actually work because this needs to be on the authoritative server, not the recursor... Which doesn't seem to support lua hooks. So I'll have to write a script to manage the data in Designate I guess.
So I have a WIP script coming along to do this, but there's a blocker: Designate stores the in-addr.arpa zone under the 'noauth-project' account... Which isn't accessible through Keystone-authenticated requests that the python API uses (designate-sink usually deals with this zone). @Andrew, I think you hit the REST API directly instead when you "curl things directly into designate"?
The above is no longer the problem, now there's some designate internal errors happening when I try to create domains under a new 128-25.155.80.208.in-addr.arpa. domain... see labtestservices2001:/var/log/designate/designate-pool-manager.log
Change 300331 had a related patch set uploaded (by Alex Monk):
[WIP/POC/POS] Puppetise script to manage labs floating IP PTR records
Change 300331 merged by Andrew Bogott:
Puppetise script to manage labs floating IP PTR records
Change 299513 merged by Andrew Bogott:
Delegate 208.80.155.128/25 (labs instances) PTR records to labs-ns* so they can be managed automatically
- labs-morebots (tools.more@instance-tools-exec-1216.tools.wmflabs.org) has joined
^ that used to show an IP :)
This script sets up instance-$instance.$project.wmflabs.org records where possible, primarily for the benefit of cases where you have an instance with a public IP, but no domain pointing at it. It also helps to identify what instance is running what domain though.
I say "where possible" because it relies upon the project having control of the $project.wmflabs.org domain. In some projects (53 of 220 total labs projects = approximately 24% of labs projects actually), this is not the case - these projects will see 'instance-' records in PTRs but they will not resolve.
The following would currently exist but are in projects without full control of $project.wmflabs.org and therefore are missing:
instance-cvn-app4.cvn.wmflabs.org.
instance-cvn-app5.cvn.wmflabs.org.
instance-wm-bot.bots.wmflabs.org.
instance-google-api-proxy-02.google-api-proxy.wmflabs.org.
instance-huggle.huggle.wmflabs.org.
instance-wikisource-dev.wikisource-dev.wmflabs.org.
instance-utrs-primary.utrs.wmflabs.org.
instance-wikistream-web.wikistream.wmflabs.org.
instance-yandex-proxy01.yandex-proxy.wmflabs.org.
And the following other projects are without full control of $project.wmflabs.org and therefore won't be able to get such records either, though do not currently have any AFAIK:
redirects
mediawiki-verp
phlogiston
structured-wikiquote
cyberbot
discourse
analytics
pagemigration
petscan
wikispy
piwik
ores-staging
servermon
planet
git
authmanager
commtech
integration
fastcci
wikistats
reading-web-staging
graphite
commonsarchive
mwv-apt
cvresearch
wpx
shinken
quarry
striker
nginx
phragile
xtools
social-tools
wikidata-topicmaps
pubsubhubbub
embed-sandbox
reportcard
safesandbox
dumps
wikidata-metrics
extdist
openocr
orgcharts
paws
ores
These are blocked on T131367: Proxy corner case: proxy name foo.wmflabs.org == domain name foo.wmflabs.org