Page MenuHomePhabricator
Create Task
Maniphest T255879

Move cxserver to use TLS only
Closed, ResolvedPublic
Actions

Description

  • Add TLS support to the deployment chart
  • Enable TLS on k8s in production
  • Add Additional LVS endpoint configuration
  • Switch services to use the TLS LVS
  • Remove non-TLS LVS endpoint configuration
  • Remove the non-TLS k8s service

Details

SubjectRepoBranchLines +/-
cxserver: Remove HTTP service from kubernetesoperations/deployment-chartsmaster+7 -12
lvs: Remove cxserver non-TLS endpoint from LVS 3/3operations/puppetproduction+0 -36
lvs: Remove cxserver non-TLS endpoint from LVS 1/3operations/puppetproduction+1 -1
lvs: Remove cxserver non-TLS endpoint from LVS 2/3operations/puppetproduction+1 -1
lvs: Rename cxserver-https to cxserveroperations/puppetproduction+5 -5
cxserver: enable the service proxy everywhereoperations/deployment-chartsmaster+4 -9
cxserver: enable the service proxy in stagingoperations/deployment-chartsmaster+12 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

JMeybohm created this task.Jun 19 2020, 3:46 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 19 2020, 3:46 PM
JMeybohm added a subscriber: Joe.Jun 19 2020, 3:47 PM

@Joe I think cxserver is missing the last two steps as well, correct?

JMeybohm removed JMeybohm as the assignee of this task.Jun 19 2020, 3:50 PM
JMeybohm triaged this task as Medium priority.Jul 21 2020, 7:54 AM
jijiki moved this task from Incoming 🐫 to cross-team active on the serviceops board.Aug 17 2020, 11:45 PM
gerritbot added a comment.Sep 8 2020, 4:15 PM

Change 625935 had a related patch set uploaded (by Giuseppe Lavagetto; owner: Giuseppe Lavagetto):
[operations/deployment-charts@master] cxserver: enable the service proxy in staging

https://gerrit.wikimedia.org/r/625935

gerritbot added a project: Patch-For-Review.Sep 8 2020, 4:15 PM
gerritbot added a comment.Sep 9 2020, 9:04 AM

Change 626110 had a related patch set uploaded (by Giuseppe Lavagetto; owner: Giuseppe Lavagetto):
[operations/deployment-charts@master] cxserver: enable the service proxy everywhere

https://gerrit.wikimedia.org/r/626110

gerritbot added a comment.Sep 9 2020, 12:37 PM

Change 625935 merged by jenkins-bot:
[operations/deployment-charts@master] cxserver: enable the service proxy in staging

https://gerrit.wikimedia.org/r/625935

gerritbot added a comment.Sep 14 2020, 5:41 AM

Change 626110 merged by jenkins-bot:
[operations/deployment-charts@master] cxserver: enable the service proxy everywhere

https://gerrit.wikimedia.org/r/626110

Maintenance_bot removed a project: Patch-For-Review.Sep 14 2020, 6:10 AM
gerritbot added a comment.Sep 15 2020, 9:31 AM

Change 627431 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] lvs: Rename cxserver-https to cxserver

https://gerrit.wikimedia.org/r/627431

gerritbot added a project: Patch-For-Review.Sep 15 2020, 9:31 AM

Change 627432 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] lvs: Remove cxserver non-TLS endpoint from LVS 1/3

https://gerrit.wikimedia.org/r/627432

gerritbot added a comment.Sep 15 2020, 9:31 AM

Change 627433 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] lvs: Remove cxserver non-TLS endpoint from LVS 2/3

https://gerrit.wikimedia.org/r/627433

gerritbot added a comment.Sep 15 2020, 9:31 AM

Change 627434 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] lvs: Remove cxserver non-TLS endpoint from LVS 3/3

https://gerrit.wikimedia.org/r/627434

JMeybohm claimed this task.Sep 15 2020, 9:31 AM
gerritbot added a comment.Sep 15 2020, 1:36 PM

Change 627431 merged by JMeybohm:
[operations/puppet@production] lvs: Rename cxserver-https to cxserver

https://gerrit.wikimedia.org/r/627431

gerritbot added a comment.Sep 15 2020, 1:54 PM

Change 627433 abandoned by JMeybohm:
[operations/puppet@production] lvs: Remove cxserver non-TLS endpoint from LVS 2/3

Reason:

https://gerrit.wikimedia.org/r/627433

gerritbot added a comment.Sep 21 2020, 7:57 AM

Change 627432 merged by JMeybohm:
[operations/puppet@production] lvs: Remove cxserver non-TLS endpoint from LVS 1/3

https://gerrit.wikimedia.org/r/627432

gerritbot added a comment.Sep 22 2020, 7:34 AM

Change 627434 merged by JMeybohm:
[operations/puppet@production] lvs: Remove cxserver non-TLS endpoint from LVS 3/3

https://gerrit.wikimedia.org/r/627434

Stashbot added a comment.Sep 22 2020, 7:39 AM

Mentioned in SAL (#wikimedia-operations) [2020-09-22T07:39:19Z] <jayme> running puppet on lvs servers - T255879 T254581

Stashbot mentioned this in T254581: Move termbox to use TLS only.Sep 22 2020, 7:39 AM
Stashbot added a comment.Sep 22 2020, 7:42 AM

Mentioned in SAL (#wikimedia-operations) [2020-09-22T07:42:29Z] <jayme> restarting pybal on lvs1016.eqiad.wmnet,lvs2010.codfw.wmnet - T255879 T254581

Stashbot added a comment.Sep 22 2020, 7:46 AM

Mentioned in SAL (#wikimedia-operations) [2020-09-22T07:46:29Z] <jayme> restarting pybal on lvs1015.eqiad.wmnet,lvs2009.codfw.wmnet - T255879 T254581

Stashbot added a comment.Sep 22 2020, 7:49 AM

Mentioned in SAL (#wikimedia-operations) [2020-09-22T07:49:48Z] <jayme> running ipvsadm -D -t 10.2.2.18:8080; ipvsadm -D -t 10.2.2.46:3030 on lvs1016.eqiad.wmnet,lvs1015.eqiad.wmnet - T255879 T254581

Stashbot added a comment.Sep 22 2020, 7:51 AM

Mentioned in SAL (#wikimedia-operations) [2020-09-22T07:51:18Z] <jayme> running ipvsadm -D -t 10.2.1.18:8080; ipvsadm -D -t 10.2.1.46:3030 on lvs2010.codfw.wmnet,lvs2009.codfw.wmnet - T255879 T254581

JMeybohm updated the task description. (Show Details)Sep 22 2020, 7:53 AM
gerritbot added a comment.Aug 30 2021, 8:06 AM

Change 715453 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/deployment-charts@master] cxserver: Remove HTTP service from kubernetes

https://gerrit.wikimedia.org/r/715453

gerritbot added a comment.Sep 2 2021, 1:49 PM

Change 715453 merged by jenkins-bot:

[operations/deployment-charts@master] cxserver: Remove HTTP service from kubernetes

https://gerrit.wikimedia.org/r/715453

JMeybohm closed this task as Resolved.Sep 2 2021, 2:40 PM
JMeybohm updated the task description. (Show Details)
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits