Page MenuHomePhabricator

Move zotero to use TLS only
Open, MediumPublic

Description

  • Add TLS support to the deployment chart
  • Enable TLS on k8s in production
  • Add Additional LVS endpoint configuration
  • Switch services to use the TLS LVS
  • Remove non-TLS LVS endpoint configuration
  • Remove the non-TLS k8s service

Event Timeline

JMeybohm created this task.Jun 19 2020, 3:35 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 19 2020, 3:35 PM
JMeybohm triaged this task as Medium priority.Jul 21 2020, 7:53 AM
jijiki moved this task from Incoming 🐫 to Unsorted on the serviceops board.Aug 17 2020, 11:45 PM
JMeybohm claimed this task.Sep 23 2020, 9:40 AM

Change 629334 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] service: add TLS endpoint for zotero 1/3

https://gerrit.wikimedia.org/r/629334

Change 629335 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] service: add TLS endpoint for zotero 2/3

https://gerrit.wikimedia.org/r/629335

Change 629336 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] service: add TLS endpoint for zotero 3/3

https://gerrit.wikimedia.org/r/629336

Change 629337 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] services_proxy: switch zotero to the TLS endpoint

https://gerrit.wikimedia.org/r/629337

Change 629338 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] lvs: Remove zotero non-TLS endpoint 1/2

https://gerrit.wikimedia.org/r/629338

Change 629339 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] lvs: Remove zotero non-TLS endpoint 2/2

https://gerrit.wikimedia.org/r/629339

Change 629334 merged by JMeybohm:
[operations/puppet@production] service: add TLS endpoint for zotero 1/3

https://gerrit.wikimedia.org/r/629334

Mentioned in SAL (#wikimedia-operations) [2020-09-24T14:09:32Z] <jayme> running puppet on lvs servers - T255869

Mentioned in SAL (#wikimedia-operations) [2020-09-24T14:16:54Z] <jayme> restart pybal on lvs1016.eqiad.wmnet,lvs2010.codfw.wmnet - T255869

Mentioned in SAL (#wikimedia-operations) [2020-09-24T14:18:27Z] <jayme> restart pybal on lvs1015.eqiad.wmnet,lvs2009.codfw.wmnet - T255869

Change 629335 merged by JMeybohm:
[operations/puppet@production] service: add TLS endpoint for zotero 2/3

https://gerrit.wikimedia.org/r/629335

Change 629336 merged by JMeybohm:
[operations/puppet@production] service: add TLS endpoint for zotero 3/3

https://gerrit.wikimedia.org/r/629336

Change 629337 merged by JMeybohm:
[operations/puppet@production] services_proxy: switch zotero to the TLS endpoint

https://gerrit.wikimedia.org/r/629337

Mentioned in SAL (#wikimedia-operations) [2020-09-24T15:10:18Z] <jayme> switched zotero service-proxy listener to use TLS - T255869

Change 630769 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/deployment-charts@master] citoid: Add zotero TLS port to egress

https://gerrit.wikimedia.org/r/630769

Change 630771 had a related patch set uploaded (by Alexandros Kosiaris; owner: Alexandros Kosiaris):
[operations/deployment-charts@master] citoid: Allow zotero access to HTTPS port

https://gerrit.wikimedia.org/r/630771

Change 630771 abandoned by Alexandros Kosiaris:
[operations/deployment-charts@master] citoid: Allow zotero access to HTTPS port

Reason:
Also being done in https://gerrit.wikimedia.org/r/c/operations/deployment-charts/ /630769, abandoning in favor of that.

https://gerrit.wikimedia.org/r/630771

Change 630769 merged by jenkins-bot:
[operations/deployment-charts@master] citoid: Add zotero TLS port to egress

https://gerrit.wikimedia.org/r/630769

Change 630788 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] services_proxy: switch zotero to the TLS endpoint

https://gerrit.wikimedia.org/r/630788

Change 630788 merged by JMeybohm:
[operations/puppet@production] services_proxy: switch zotero to the TLS endpoint

https://gerrit.wikimedia.org/r/630788

Change 631147 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] services_proxy: Add nodejs keepalive timeout (4.5s) to citoid and zotero

https://gerrit.wikimedia.org/r/631147

Change 631147 merged by JMeybohm:
[operations/puppet@production] services_proxy: Add nodejs keepalive timeout (4.5s) to citoid and zotero

https://gerrit.wikimedia.org/r/631147

JMeybohm updated the task description. (Show Details)Sep 30 2020, 1:11 PM

Change 629338 merged by JMeybohm:
[operations/puppet@production] lvs: Remove zotero non-TLS endpoint 1/2

https://gerrit.wikimedia.org/r/629338

Change 629339 merged by JMeybohm:
[operations/puppet@production] lvs: Remove zotero non-TLS endpoint 2/2

https://gerrit.wikimedia.org/r/629339

Mentioned in SAL (#wikimedia-operations) [2020-10-02T09:14:41Z] <jayme> restarting pybal on lvs1016.eqiad.wmnet,lvs2010.codfw.wmnet - T255875 T255869

Mentioned in SAL (#wikimedia-operations) [2020-10-02T09:17:49Z] <jayme> restarting pybal on lvs1015.eqiad.wmnet,lvs2009.codfw.wmnet - T255875 T255869

Mentioned in SAL (#wikimedia-operations) [2020-10-02T09:18:14Z] <jayme> running ipvsadm -D -t 10.2.2.20:10042; ipvsadm -D -t 10.2.2.16:1969 on lvs1016.eqiad.wmnet,lvs1015.eqiad.wmnet - T255875 T255869

Mentioned in SAL (#wikimedia-operations) [2020-10-02T09:19:01Z] <jayme> running ipvsadm -D -t 10.2.1.20:10042; ipvsadm -D -t 10.2.1.16:1969 on lvs2010.codfw.wmnet,lvs2009.codfw.wmnet - T255875 T255869

JMeybohm updated the task description. (Show Details)Oct 2 2020, 9:22 AM