Schema needs to be created on the RESTBase Cassandra cluster to accommodate Echo timestamp storage (via Kask).
Additionally, a dedicated application user should be created, with corresponding access rights to the allocated table.
Finally (if it is not already the case), Ferm rules should be added to permit access to the Cassandra cluster from k8s.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| restbase: Cassandra client access from k8s | operations/puppet | production | +8 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T234286 Multi-DC Echo Notification Storage | |||
| Resolved | None | T234289 Migrate Wikimedia Echo notification timestamps from MainStash to Kask | |||
| Resolved | None | T234402 Wikimedia infrastructure is configured for multi-DC echo notification storage | |||
| Resolved | None | T234374 Provision Cassandra access for Echo timestamp storage |
Additionally, a dedicated application user should be created, with corresponding access rights to the allocated table.
This seems like the Right Way™, but the Puppet code we use for templating a CQL flat file assumes a 1:1 relationship between a Cassandra cluster and an application. Either we come up with another way and refactor, or use the restb user and corresponding password here.
Additionally, a dedicated application user should be created, with corresponding access rights to the allocated table.
This part of the requirements is a little problematic. The Puppet module ([[ https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/production/modules/cassandra/ | operations/puppet/modules/cassandra ]]) assumes a 1:1 relationship between a Cassandra cluster and an application hosted on it. This issue sets a precedent for multi-tenant Cassandra access.
Fixing this shouldn't be complicated per say, but will be somewhat invasive, and effects all wmf cassandra clusters. I recommend that we forego this requirement for now, configuring echostore to use RESTBase's credentials, and accept that this user has GRANTs that cover every table. This should be considered temporary; We can setup the tasks to follow through with a permanent solution.
The following has been created on the RESTBase cluster:
CREATE KEYSPACE echostore WITH replication = { 'class': 'NetworkTopologyStrategy', 'eqiad': 3, 'codfw': 3 }; CREATE TABLE echostore.values (key text PRIMARY KEY, value blob);
Change 541911 had a related patch set uploaded (by Eevans; owner: Eevans):
[operations/puppet@production] restbase: Cassandra client access from k8s
Change 541911 merged by Alexandros Kosiaris:
[operations/puppet@production] restbase: Cassandra client access from k8s
T235299: Cassandra cluster management support for multi-tenancy has been created for follow-up, this issue is otherwise complete.