The Analytics VLAN needs to be able to talk to the schema registry http service. Can we add a rule in the network ACLs to allow this?
Description
Description
Details
Details
| Project | Branch | Lines +/- | Subject | |
|---|---|---|---|---|
| operations/puppet | production | +2 -4 | refine mediawiki-events - remove use of http proxy after T221690 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T185233 Modern Event Platform | |||
| Resolved | Ottomata | T201063 Modern Event Platform: Schema Repostories | |||
| Resolved | Ottomata | T206789 Modern Event Platform: Schema Registry: Implementation | |||
| Resolved | Ottomata | T219552 Schema Registry HTTP Service | |||
| Resolved | ayounsi | T221690 Allow analytics VLAN to reach schema.svc.$site.wmnet |
Event Timeline
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2019-04-25T16:58:58Z] <XioNoX> add analytics firewall filter term schema to cr1/2-eqiad - T221690
Comment Actions
I assumed you needed HTTPS and not HTTP based on T219552, but please reopen if it's wrong.
Comment Actions
HTTP is enough for now, thanks. If/when this gets exposed publicly we'll put it through the usual frontend nginx tls stuff there. Thank you!
Comment Actions
Hm, @ayounsi:
[@stat1004:/home/otto] $ curl -Iv http://schema.svc.eqiad.wmnet:8190/repositories/ * Trying 10.2.2.43... [@stat1004:/home/otto] $ curl -Iv http://schema1001.eqiad.wmnet:8190/repositories/ * Trying 10.64.0.18...
But
[@stat1004:/home/otto] $ export http_proxy=http://webproxy.eqiad.wmnet:8080; [@stat1004:/home/otto]↥ $ curl -I http://schema.svc.eqiad.wmnet:8190/repositories/ HTTP/1.1 200 OK [@stat1004:/home/otto]↥ $ curl -I http://schema1001.eqiad.wmnet:8190/repositories/ HTTP/1.1 200 OK
Comment Actions
Ah I think that might have been my fault. T219552 doesn't specify a port; that task description was made before service was implemented. Port 8190 plz! :)
Comment Actions
Change 506543 had a related patch set uploaded (by Ottomata; owner: Ottomata):
[operations/puppet@production] refine mediawiki-events - remove use of http proxy after T221690
Comment Actions
Change 506543 merged by Ottomata:
[operations/puppet@production] refine mediawiki-events - remove use of http proxy after T221690
Comment Actions
To keep archives happy:
term schema {
from {
destination-address {
/* schema.svc.codfw */
10.2.1.43/32;
/* schema.svc.eqiad */
10.2.2.43/32;
}
protocol tcp;
destination-port 8190;
}
then accept;
}
elukey@stat1004:~$ curl -I http://schema.svc.eqiad.wmnet:8190/repositories/
HTTP/1.1 200 OK