The decision of whether or not an origin server response has to be considered cacheable is normally based upon the Cache-Control response header. However, both ATS and Varnish allow to override it and avoid caching certain responses regardless of what the origin says. The mechanism provided by ATS to do so is based on a configuration file called cache.config, while Varnish uses a VCL action called pass for this purpose.

In our environment, the ATS config file cache.config is generated using the profile::trafficserver::backend::caching_rules hiera setting, which looks like this:

profile::trafficserver::backend::caching_rules:
    - primary_destination: dest_host
      value: cxserver.discovery.wmnet
      action: never-cache
    - primary_destination: dest_host
      value: debmonitor.discovery.wmnet
      action: never-cache

The data structure gets rendered pretty much one-to-one as:

# /etc/trafficserver/cache.config
dest_host=cxserver.discovery.wmnet action=never-cache
dest_host=debmonitor.discovery.wmnet action=never-cache

In the case of Varnish, the hiera settings are cache::req_handling and cache::alternate_domains, which among other things allow to skip the cache by specifying the caching: 'pass' attribute:

cache::req_handling:
  cxserver.wikimedia.org:
    caching: 'pass'
cache::alternate_domains:
  15.wikipedia.org:
    caching: 'normal'
  analytics.wikimedia.org:
    caching: 'normal'
  annual.wikimedia.org:
    caching: 'normal'
  blubberoid.wikimedia.org:
    caching: 'pass'
[...]
  config-master.wikimedia.org:
    caching: 'pass'

As Varnish does not provide an equivalent to Traffic Server's cache.config, we do the plumbing and dynamically generate a list of if/else VCL statements in the wm_recv_pass VCL subroutine, matching the incoming Host request headers to return pass statements as appropriate:

sub wm_recv_pass {

    if (req.http.host == "blubberoid.wikimedia.org") {
        return (pass);
    } elsif (req.http.host == "config-master.wikimedia.org") {
        return (pass);

Having two different mechanisms to specify one policy is not optimal, as engineers currently have to specify both an entry in cache::req_handling/alternate_domains based upon the Host header for the cache frontend layer, and another in profile::trafficserver::backend::caching_rules based on the origin server hostname for the cache backend. Given that at the ATS layer we know the Host -> Origin mapping:

profile::trafficserver::backend::mapping_rules:
    - type: map
      target: http://cxserver.wikimedia.org
      replacement: https://cxserver.discovery.wmnet:4002

it should be possible to get rid of profile::trafficserver::backend::caching_rules altogether and generate cache.config programmatically by iterating on cache::req_handling/ cache::alternate_domains, extracting the matching origin hostnames from profile::trafficserver::backend::mapping_rules.