swiftrepl is now running puppetized and running in eqiad as a timer once a week per site.
Left to do is shipping swiftrepl.conf from puppet, which requires being able to access all sites credentials, which in turn requires a refactor in swift's puppetization to have credentials from all sites in the same place. Unless we can look up other sites' hiera, in which case less refactorization will be needed.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | MatthewVernon | T306098 Cloud VPS "swift" project Stretch deprecation | |||
| Resolved | MatthewVernon | T317616 Revisit CDN<-->Swift communication | |||
| Resolved | MatthewVernon | T279637 Upgrade Swift ms cluster to Bullseye and revisit mkfs.xfs options | |||
| Resolved | MatthewVernon | T299125 Swiftrepl doesn't work on bullseye (and swiftrepl.conf is deployed by hand) | |||
| Resolved | fgiunchedi | T162792 Reduce Swift technical debt | |||
| Resolved | MatthewVernon | T162123 Refactor swift credentials to be global rather than per-site |
Afaict we are not going to have to rely on swiftrepl anymore soon. Is that right? In that case, would this ticket be declined?
That's correct, let's leave it open until T204245: Run MediaWiki media originals active/active is fixed
Change 536586 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] WIP swift: add swiftrepl
Change 539535 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] swift: open per-port object server ports
Change 539535 merged by Filippo Giunchedi:
[operations/puppet@production] swift: open per-port object server ports
Punched in the wrong task, this change was meant for T222366: Test swift object server deployment with one disk per tcp port
Change 537613 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] site: turn on swiftrepl on swift frontends
Change 536586 merged by Filippo Giunchedi:
[operations/puppet@production] swift: add swiftrepl
Change 537613 merged by Filippo Giunchedi:
[operations/puppet@production] site: turn on swiftrepl on swift frontends
Change 544845 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] swift: use resurce for swiftrepl tidy
Change 544845 merged by Filippo Giunchedi:
[operations/puppet@production] swift: use resurce for swiftrepl tidy
Change 544863 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] swiftrepl: ensure system user and service runs as 'swiftrepl'
Change 544863 merged by Filippo Giunchedi:
[operations/puppet@production] swiftrepl: ensure system user and service runs as 'swiftrepl'
Change 544911 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] swift: use systemd::unit for swiftrepl-mw
Change 544912 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] swift: use systemd::timer::job for swiftrepl
Change 544911 abandoned by Filippo Giunchedi:
swift: use systemd::unit for swiftrepl-mw
Reason:
Not needed
Change 544912 merged by Filippo Giunchedi:
[operations/puppet@production] swift: use systemd::timer::job for swiftrepl
swiftrepl is now running puppetized on both codfw and eqiad and running as a timer once a week per site.
Left to do is shipping swiftrepl.conf from puppet, which requires being able to access all sites credentials, which in turn requires a refactor in swift's puppetization.
Mentioned in SAL (#wikimedia-operations) [2021-06-30T09:35:19Z] <godog> start swiftrepl-mw on ms-fe2005 post-switchover (credentials were missing) - T162123
Change 868718 had a related patch set uploaded (by MVernon; author: MVernon):
[labs/private@master] hiera: move swift accounts_keys into common
Change 868721 had a related patch set uploaded (by MVernon; author: MVernon):
[operations/puppet@production] swift: move accounts_keys to common hiera
I've put out two CRs; an equivalent change will also need doing to private-puppet. They'll all need co-ordinating.
Change 870555 had a related patch set uploaded (by MVernon; author: MVernon):
[operations/puppet@production] swift: add swift::rclone
Change 868718 merged by MVernon:
[labs/private@master] hiera: move swift credentials into common
Change 868721 merged by MVernon:
[operations/puppet@production] swift: move accounts_keys to common hiera global_account_keys
Change 879283 had a related patch set uploaded (by MVernon; author: MVernon):
[labs/private@master] hiera: remove swift accounts_keys
Change 879283 merged by MVernon:
[labs/private@master] hiera: remove swift accounts_keys
Done - old site-specific profile::swift::accounts_keys removed in favour of new common hiera entry profile::swift::global_account_keys