Page MenuHomePhabricator
Create Task
Maniphest T175712

Install cumin in the WMCS infrastructure
Closed, ResolvedPublic
Actions

Description

As part of the parent task effort to deprecate and remove Salt from out infrastructure, we need an alternative way for the WMCS admins to reach all the instances and Cumin can be used for that.

This task is to track the installation of Cumin into the WMCS infrastructure and ensure it works and that Cumin masters can reach and connect to all instances.

As of now all the tests will be performed with the direct backend using FQDN, while the development of the dedicated backend for OpenStack is done as part of T175711

Details

SubjectRepoBranchLines +/-
WMCS: fine tuning Cumin configuration for proxiesoperations/puppetproduction+13 -4
WMCS: fix Cumin configurationoperations/puppetproduction+29 -9
WMCS: install Cumin for WMCS adminsoperations/puppetproduction+109 -7
keyholder: add Cumin openstack master keylabs/privatemaster+4 -0
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedMoritzMuehlenhoffT164780 Sunset our use of Salt
 ResolvedVolansT175712 Install cumin in the WMCS infrastructure

Event Timeline

Volans created this task.Sep 12 2017, 4:43 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 12 2017, 4:43 PM
Volans moved this task from Backlog to In Progress on the SRE-tools board.Sep 12 2017, 4:44 PM
bd808 added a project: Cloud-VPS.Sep 12 2017, 5:14 PM
hashar subscribed.Sep 12 2017, 6:48 PM

As a side effect, Beta-Cluster-Infrastructure and Continuous-Integration-Infrastructure would need a way to have a per project cumin master. We don't have access to the WMCS salt master.

The instances are:

deployment-salt02.deployment-prep.eqiad.wmflabs
integration-saltmaster.integration.eqiad.wmflabs

gerritbot subscribed.Sep 13 2017, 3:44 PM

Change 377787 had a related patch set uploaded (by Volans; owner: Volans):
[operations/puppet@production] WMCS: install Cumin for WMCS admins

https://gerrit.wikimedia.org/r/377787

gerritbot added a project: Patch-For-Review.Sep 13 2017, 3:44 PM
gerritbot added a comment.Sep 13 2017, 4:19 PM

Change 377796 had a related patch set uploaded (by Volans; owner: Volans):
[labs/private@master] keyholder: add Cumin openstack master key

https://gerrit.wikimedia.org/r/377796

gerritbot added a comment.Sep 13 2017, 4:26 PM

Change 377796 merged by Volans:
[labs/private@master] keyholder: add Cumin openstack master key

https://gerrit.wikimedia.org/r/377796

Volans moved this task from In Progress to In Code Review on the SRE-tools board.Sep 13 2017, 4:31 PM
• chasemp subscribed.Sep 14 2017, 1:40 PM
In T175712#3601612, @hashar wrote:

As a side effect, Beta-Cluster-Infrastructure and Continuous-Integration-Infrastructure would need a way to have a per project cumin master. We don't have access to the WMCS salt master.

The instances are:

deployment-salt02.deployment-prep.eqiad.wmflabs
integration-saltmaster.integration.eqiad.wmflabs

what does integration (CI) use salt for?

gerritbot added a comment.Sep 19 2017, 9:18 PM

Change 377787 merged by Andrew Bogott:
[operations/puppet@production] WMCS: install Cumin for WMCS admins

https://gerrit.wikimedia.org/r/377787

Stashbot subscribed.Sep 19 2017, 9:51 PM

Mentioned in SAL (#wikimedia-operations) [2017-09-19T21:51:31Z] <volans> disabled puppet on labpuppetmaster1001, testing cumin T175712

gerritbot added a comment.Sep 20 2017, 9:25 AM

Change 379192 had a related patch set uploaded (by Volans; owner: Volans):
[operations/puppet@production] WMCS: fix Cumin configuration

https://gerrit.wikimedia.org/r/379192

hashar added a comment.Sep 20 2017, 9:29 AM
In T175712#3607926, @chasemp wrote:
In T175712#3601612, @hashar wrote:

As a side effect, Beta-Cluster-Infrastructure and Continuous-Integration-Infrastructure would need a way to have a per project cumin master. We don't have access to the WMCS salt master.

The instances are:

deployment-salt02.deployment-prep.eqiad.wmflabs
integration-saltmaster.integration.eqiad.wmflabs

what does integration (CI) use salt for?

For both beta and CI, we use it for mass commands execution. Be it checking state of instances, manually upgrading packages, mass clean up or deploying some scripts.

I guess that can be replaced by either:

  • cumin master (if there is a puppet class for standalone cumin master in labs)
  • cluster shell (apparently used by tools labs)
gerritbot added a comment.Sep 20 2017, 10:24 AM

Change 379192 merged by Volans:
[operations/puppet@production] WMCS: fix Cumin configuration

https://gerrit.wikimedia.org/r/379192

gerritbot added a comment.Sep 20 2017, 11:24 AM

Change 379209 had a related patch set uploaded (by Volans; owner: Volans):
[operations/puppet@production] WMCS: fine tuning Cumin configuration for proxies

https://gerrit.wikimedia.org/r/379209

gerritbot added a comment.Sep 20 2017, 11:32 AM

Change 379209 merged by Volans:
[operations/puppet@production] WMCS: fine tuning Cumin configuration for proxies

https://gerrit.wikimedia.org/r/379209

Volans added a comment.Sep 20 2017, 11:45 AM
In T175712#3601612, @hashar wrote:

As a side effect, Beta-Cluster-Infrastructure and Continuous-Integration-Infrastructure would need a way to have a per project cumin master. We don't have access to the WMCS salt master.

The instances are:

deployment-salt02.deployment-prep.eqiad.wmflabs
integration-saltmaster.integration.eqiad.wmflabs

@hashar I think this is unrelated with this task. My understanding is that those two WMCS projects have their own salt master internal to the project that they self-administer. Nothing forbid to keep it that way, and replacing the global WMCS salt master with cumin doesn't affect those in any way AFAIK.
I agree that it would be nice to have a simple way to install a cumin master inside a labs project, I can look into it once the goal-related work will be completed.
Feel free to open a dedicated task for it.

Volans closed this task as Resolved.Sep 20 2017, 11:48 AM
Volans removed a project: Patch-For-Review.

Cumin master is now installed on labpuppetmaster100[1-2].wikimedia.org and is able to connect via SSH to cloud instances, including the SSH proxy themselves. The targeting for the moment is done just using FQDNs with the direct backend, until T175711 is completed, in the next couple of days.

But as far as concern this specific task, the work is completed, so resolving it.

hashar added a comment.Sep 20 2017, 1:17 PM
In T175712#3620881, @Volans wrote:
In T175712#3601612, @hashar wrote:

As a side effect, Beta-Cluster-Infrastructure and Continuous-Integration-Infrastructure would need a way to have a per project cumin master. We don't have access to the WMCS salt master.

The instances are:

deployment-salt02.deployment-prep.eqiad.wmflabs
integration-saltmaster.integration.eqiad.wmflabs

@hashar I think this is unrelated with this task. My understanding is that those two WMCS projects have their own salt master internal to the project that they self-administer. Nothing forbid to keep it that way, and replacing the global WMCS salt master with cumin doesn't affect those in any way AFAIK.
I agree that it would be nice to have a simple way to install a cumin master inside a labs project, I can look into it once the goal-related work will be completed.
Feel free to open a dedicated task for it.

Thanks. I have filled T176314: Replace salt on integration and deployment-prep projects

Aklapper edited projects, added Cumin; removed SRE-tools.May 10 2023, 11:15 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL