Hi @JAllemandou. Please associate at least one project with this task to allow others to find this task when searching in the corresponding project(s). Thanks!

Change 302283 had a related patch set uploaded (by Dzahn):
statistics: set cluster for stat1004

https://gerrit.wikimedia.org/r/302283

Change 302283 merged by Dzahn:
statistics: set cluster for stat1004

https://gerrit.wikimedia.org/r/302283

investigated a bit. could confirm outgoing packets from stat1004 towards carbon (the aggregator for eqiad).. could NOT confirm incoming packets on carbon (unlike from stat1003 and others)

looks like firewalling is different and related traffic is not allowed.

stat1003 for example has:

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

stat1004 does not have this rule.

how come ? we should assume both use base::firewall and are fully puppetized

i don't understand how analytics roles are setup. "role::analytics_cluster::client" includes a bunch of other things and the word "firewall" or "base::firewall" does not show up in any of this:

/puppet/modules/role/manifests/analytics_cluster$ ls
client.pp druid hive java.pp oozie refinery rsyncd.pp
database hadoop hue.pp monitoring README.md refinery.pp users.pp