Page MenuHomePhabricator

CloudVPS: our ideal future model
Open, NormalPublic

Description

We had some discussions recently about what an ideal security/networking/architecture model for CloudVPS would look like.
However, we lack a shared understanding and view of our goals and ideal situation with CloudVPS.

Instead of IRC chats and other informal conversations, we would really like to have a written document with a summary of what we agree, the requirements for the ideal model and some plans on how to get there.
The document is: https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/Neutron_ideal_model (edits welcome).

Let's this task be the main tracking point for all this subject.

Related Objects

StatusAssignedTask
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone
OpenNone
Openaborrero
Openaborrero
OpenNone
Resolvedherron
Resolvedbd808
Resolvedherron
OpenKrenair
OpenNone
OpenNone
OpenNone
ResolvedNone
OpenNone
OpenNone
OpenBstorm
ResolvedCmjohnson
ResolvedCmjohnson
Resolvedaborrero
StalledNone
DeclinedNone
OpenCmjohnson
ResolvedHalfak
ResolvedHalfak
ResolvedBstorm
OpenBstorm
OpenNone
DeclinedNone
OpenNone
Resolvedaborrero
Resolvedayounsi
Openayounsi

Event Timeline

aborrero created this task.Nov 14 2018, 9:54 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 14 2018, 9:54 AM
Krenair added a comment.EditedNov 14 2018, 10:06 AM

The document is: https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/Neutron_ideal_model (edits welcome).

I put in some basic ones: https://wikitech.wikimedia.org/w/index.php?title=Portal:Cloud_VPS/Admin/Neutron_ideal_model&diff=1808555&oldid=1808492

From the page:

full IPv6 support in Cloud VPS, meaning that every single VM has his own IPv6 allocated (TODO: or even a range per project?)

I'd suggest that each project should get it's own IPv6 range and ideally it's own IPv4 range. Recently I've seen a couple of interesting cross-project traffic flows that flew under the radar due to generic 10/8 rules. The eqiad1-r migration showed some of them but it's not the solution to the problem as there's still a flat network which any project will have instances scattered across. I haven't edited this in but I think we should? I don't know how much space we're willing to give each project.

Edit: After some semi-related discussion with Arturo I've split this out into it's own entry on the page

ayounsi added a subtask: Restricted Task.Dec 6 2018, 9:15 PM
Paladox added a subscriber: Paladox.Dec 6 2018, 9:20 PM

Can someone point me to the current network layout? Vlans, ip space in use, what's used to route/filter traffic, etc.? Knowing the current situation is usually a good first step when designing a to be situation. Does Wikimedia have an overall architecture or architecture principles? That would be good input too.

Can someone point me to the current network layout? Vlans, ip space in use, what's used to route/filter traffic, etc.? Knowing the current situation is usually a good first step when designing a to be situation. Does Wikimedia have an overall architecture or architecture principles? That would be good input too.

Regarding the Neutron side, you can check this https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/Neutron

GTirloni removed a subscriber: GTirloni.Mar 21 2019, 9:10 PM