Page MenuHomePhabricator

Create the failoid service as fallback for the DNS discovery
Closed, ResolvedPublic

Description

  • Create one Ganeti instance in eqiad and one in codfw
  • Ensure that they hosts are not listening on ports 80 and 443

Details

Related Gerrit Patches:
operations/puppet : productionFailoid: reject all TCP traffic
operations/puppet : productionFailoid: add service to reject connections
operations/puppet : productionAdd entries for failoid VMs
operations/dns : masterAdd entries for ganeti instances for failoid

Event Timeline

Volans created this task.Mar 21 2017, 1:52 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 21 2017, 1:52 PM
Volans renamed this task from Create the nulloid service as fallback for the DNS discovery to Create the failoid service as fallback for the DNS discovery.Mar 21 2017, 2:33 PM

Change 343877 had a related patch set uploaded (by Volans):
[operations/dns] Add entries for ganeti instances for failoid

https://gerrit.wikimedia.org/r/343877

Change 343877 merged by Volans:
[operations/dns] Add entries for ganeti instances for failoid

https://gerrit.wikimedia.org/r/343877

Change 343890 had a related patch set uploaded (by Volans):
[operations/puppet] Add entries for failoid VMs

https://gerrit.wikimedia.org/r/343890

Change 343917 had a related patch set uploaded (by Volans):
[operations/puppet] Failoid: add service to reject connections

https://gerrit.wikimedia.org/r/343917

Change 343890 merged by Volans:
[operations/puppet] Add entries for failoid VMs

https://gerrit.wikimedia.org/r/343890

Volans updated the task description. (Show Details)Mar 21 2017, 6:37 PM

Change 343917 merged by Volans:
[operations/puppet@production] Failoid: add service to reject connections

https://gerrit.wikimedia.org/r/343917

Volans closed this task as Resolved.Mar 23 2017, 2:04 PM
Volans updated the task description. (Show Details)

Service up and running on roentgenium and tureis with puppet role failoid, refusing connections to ports 80 and 443.

Change 344406 had a related patch set uploaded (by Volans):
[operations/puppet@production] Failoid: reject all TCP traffic

https://gerrit.wikimedia.org/r/344406

Change 344406 merged by Volans:
[operations/puppet@production] Failoid: reject all TCP traffic

https://gerrit.wikimedia.org/r/344406

Given that there are a lot of services on non-standard ports and the lvs_services configuration had multiple instances for each discovery entry with different ports (http/https) and the mapping will just be a hieradata structure convention, we agreed to instead reject all TCP traffic on failoid as a last rule for iptables.