Currently ats-be is having issues connecting to netmon when trying to serve requests for smokeping.wikimedia.org:
Nov 22 04:19:44 cp1075 traffic_manager[16888]: [Nov 22 04:19:44.777] {0x2b12ac588700} ERROR: SSL connection failed for 'smokeping.wikimedia.org': error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • ema | T207048 ATS production-ready as a backend cache layer | |||
| Resolved | • ema | T210411 Applayer services without TLS | |||
| Resolved | Vgutierrez | T238900 add TLS support for smokeping.wikimedia.org |
Change 552398 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Add smokeping certificate
@Volans @crusnov @ayounsi we need some clarification regarding TLS material on netmon boxes, right now they get access to librenms and netbox acme-chief managed certificates. Is netbox still needed there?
We could add smokeping.wm.o as a SNI to the librenms one or handle it as an independent certificate (as proposed in https://gerrit.wikimedia.org/r/552398)
No, it's not as Netbox was migrated to dedicated VMs netbox[12]001. I've opened T238919 for a more general cleanup.
Change 552680 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] acme_chief: Revoke access from netmon boxes to netbox certificate
Change 552680 merged by Vgutierrez:
[operations/puppet@production] acme_chief: Revoke access from netmon boxes to netbox certificate
@Volans @ayounsi IMHO it doesn't make any sense to include smokeping.wm.o SNI on the librenms certificate, that would set a dependency between otherwise completely isolated services. So I'd say we continue with the 2 certs approach (https://gerrit.wikimedia.org/r/552398)
I was made aware that the two above comments are contradictory. I don't recall the why of my above comment or any limitation on the 2 certs approach. I agree they are separate services and should not depend on each other.
Change 552398 merged by Vgutierrez:
[operations/puppet@production] acme_chief: Add smokeping certificate
Change 564045 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/dns@master] Serve smokeping.wm.o directly from netmon1002
Change 564046 had a related patch set uploaded (by Vgutierrez; owner: Vgutierrez):
[operations/puppet@production] smokeping: Serve traffic directly and using TLS
Change 564046 merged by Vgutierrez:
[operations/puppet@production] smokeping: Serve traffic directly and using TLS
Change 564045 merged by Vgutierrez:
[operations/dns@master] Serve smokeping.wm.o directly from netmon1002