Currently, PAWS uses a peculiar ingress setup involving nodeport where the single control plane node is the single point of contact hardcoded into an nginx front proxy.
Ideally, we are starting off using all the same domain names and routes that are currently in the paws cluster. We don't want to introduce a new name until after the cluster is set up and issues are fixed where we find them. Then we can deal with the social and technical issues of using the paws.wmcloud.org domain with whatever redirects are required. This is because we have a complicated chunk of oauth, community expectations, diverse bits of documentation and paws-internal proxies and such to change once we have a concept of "working".
As we are deploying an upgraded cluster (and very likely an upgraded jupyterhub in that cluster--see https://github.com/crookedstorm/paws), the ingress probably needs to become a standard nginx ingress with https://cert-manager.io/docs/usage/ingress/ on top for TLS.
Then it will be a pretty off-the-shelf standard implementation of this kind of thing. That can still head through the haproxy like the ingress for Toolforge does, but likely at a standard SSL port instead of 30000 or whatever, I think. That way we can start the switchover by changing the existing proxy and then change DNS to remove the existing proxy entirely.
- Implement TLS in the ingress
- Actually get PAWS deployed in there before or after that first point (works in a minikube as I've got it set up, but that doesn't help us)
- This will require sorting out a way to store the images either with different tags in quay.io or on our setup that has no automation (figuring out the former sounds better, though it may be tied to Yuvi's personal accounts).
- May be worth experimenting with auto-failover similar to https://wikitech.wikimedia.org/wiki/User:Jhedden/notes/keepalived for the frontend. Then we can port that back to Toolforge if it works well!
- figure out paws-public
- finish up the helm templating (basically decided that only ingress objects need to be in the chart--and they are in our fork)
- write documentation about how this works https://wikitech.wikimedia.org/wiki/PAWS/Admin#Architecture