Page MenuHomePhabricator

Make testreduce web UI publicly accessible on the internet
Closed, ResolvedPublic

Description

At one point, scandium used to have http://parsoid-rt-tests.wikimedia.org/ pointed at the parsoid-rt webservice web UI. But, once scandium became a mediawiki appserver, and since parsoid's rt test services aren't as heavily security hardened or tested or updated compared to production code, we decided to disable that public web access as part of this patch.

Now, as we move the parsoid-rt and parsoid-rt-client node services away from scandium onto testreduce1001, we can revisit this decision. testreduce1001 is not (need not be) a mediawiki app server and doesn't need to run PHP code at all. Right now parsoid-rt on testreduce1001 continues to connect to a database hosted on a production database server. However, as noted in T257906#6390890 parsoid-rt on testreduce1001 can simply connect to a local database on testreduce1001 and be completely isolated from any production services (but it still needs enough access to be able to issue Parsoid REST API requests to scandium).

So, here are some tasks:

  • Enable mysql/maraiadb on testreduce1001
  • Create a new database
  • Initialize this with a fresh set of test titles
  • Revert some version of https://gerrit.wikimedia.org/r/c/operations/puppet/+/534271 to enable the webserver on testreduce1001 and to point parsoid-rt-tests.wikimedia.org to parsoid-rt webserver UI
  • create certificate for testreduce.discovery.wmnet in private repo, copy to public repo, create fake cert in labs/private
  • add testreduce.discovery.wmnet in DNS and point to testreduce1001
  • add envoy on backend for TLS termination and let it speak to 8001 on nginx as upstream
  • add parsoid-rt-tests to the envoy TLS cert for testreduce.discovery.wmnet

This is not high priority and if any of this work is cumbersome or involves a lot of work, feel free to decline. And, this can also be done after the parent task is resolved as well. So free to edit / update the task as appropriate.

Event Timeline

I will be afk for about 2 weeks. If this needs earlier attention (I assume not, based on low prio etc) please contact the subteam.

Dzahn triaged this task as Medium priority.Nov 3 2020, 2:14 AM
Dzahn moved this task from Incoming 🐫 to Next up 🥌 on the serviceops board.

Change 654318 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] parsoid: include a generic mariadb server in testreduce role

https://gerrit.wikimedia.org/r/654318

Change 654318 merged by Dzahn:
[operations/puppet@production] parsoid: include a generic mariadb server in testreduce role

https://gerrit.wikimedia.org/r/654318

Change 654322 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] parsoid::testing: fix duplicate declaration of mariadb-client for buster

https://gerrit.wikimedia.org/r/654322

Change 654322 merged by Dzahn:
[operations/puppet@production] parsoid::testing: fix duplicate declaration of mariadb-client for buster

https://gerrit.wikimedia.org/r/654322

A generic mariadb server has now been installed by puppet on testreduce1001. (no change on scandium which at first conflicted with this).

The config is in /etc/my.cnf

The data_dir is /srv/sqldata.

No database has been created yet though.

Change 653998 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/dns@master] Revert "remove parsoid-vd/parsoid-rt.wikimedia.org"

https://gerrit.wikimedia.org/r/653998

Next we need to re-create the DNS entries (parsoid-rt-tests, parsoid-vd-tests) before we can point them to the new backend in the caching layer.

nginx config exists on testreduce1001 as it is puppetized.

Couple observations:

  1. We don't need parsoid-vd-tests on testreduce1001 anymore since there are no immediate plans to run visual diff tests there. If we need do that on production vms in the future, that will probably be its own vm.
  2. If we are going to have the test db be local on testreduce1001, then all parsoid-test-roots should have all privileges to those db. You can pick the same db-name and user-name from /etc/testreduce/parsoid-rt.settings.js for that new local db.

Change 654351 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] ATS: re-add config for parsoid-rt-tests.wikimedia.org

https://gerrit.wikimedia.org/r/654351

@ssastry ACK, only "rt" no "vd" needed. Adjusted the patches accordingly.

Regarding the database:

  • I created a new database "testreduce" on the local MariaDB server
  • I then granted "all privileges" to a user also called "testreduce" and with the password from parsoid-rt.settings.js.

So database name, user name and password are all exactly like before, just that it is now running on localhost instead of on m5-master.

[testreduce1001:~] $ mysql -h localhost -u testreduce testreduce -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 56

Now you can use that user to import the data you need.

Change 654565 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] parsoid::testing: switch db_host from m5-master to localhost

https://gerrit.wikimedia.org/r/654565

Change 654565 merged by Dzahn:
[operations/puppet@production] parsoid::testing: switch db_host from m5-master to localhost

https://gerrit.wikimedia.org/r/654565

Change 653998 merged by Dzahn:
[operations/dns@master] Revert "remove parsoid-rt-tests.wikimedia.org"

https://gerrit.wikimedia.org/r/653998

Change 658679 had a related patch set uploaded (by Subramanya Sastry; owner: Subramanya Sastry):
[operations/puppet@production] Parsoid Testing: Switch rt/vd server db hosts to localhost

https://gerrit.wikimedia.org/r/658679

Change 658679 merged by Dzahn:
[operations/puppet@production] Parsoid Testing: Switch rt/vd server db hosts to localhost

https://gerrit.wikimedia.org/r/658679

Change 658695 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] add certificate for testreduce.discovery.wmnet

https://gerrit.wikimedia.org/r/658695

Change 658696 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[labs/private@master] add fake cert for testreduce.discovery.wmnet

https://gerrit.wikimedia.org/r/658696

Change 658695 merged by Dzahn:
[operations/puppet@production] add certificate for testreduce.discovery.wmnet

https://gerrit.wikimedia.org/r/658695

Change 658696 merged by Dzahn:
[labs/private@master] add fake cert for testreduce.discovery.wmnet

https://gerrit.wikimedia.org/r/658696

Change 654351 merged by Dzahn:
[operations/puppet@production] ATS: re-add config for parsoid-rt-tests.wikimedia.org

https://gerrit.wikimedia.org/r/654351

Change 658701 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/dns@master] add testreduce.discovery.wmnet, point to testreduce1001

https://gerrit.wikimedia.org/r/658701

Change 658701 merged by Dzahn:
[operations/dns@master] add testreduce.discovery.wmnet, point to testreduce1001

https://gerrit.wikimedia.org/r/658701

Change 658706 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] parsoid/testreduce: add envoy on testreduce1001 for TLS termination

https://gerrit.wikimedia.org/r/658706

Change 658706 merged by Dzahn:
[operations/puppet@production] parsoid/testreduce: add envoy on testreduce1001 for TLS termination

https://gerrit.wikimedia.org/r/658706

Change 658708 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] trafficserver/parsoid: switch TLS termination to 443, upstream port 8001

https://gerrit.wikimedia.org/r/658708

Change 658708 merged by Dzahn:
[operations/puppet@production] trafficserver/parsoid: switch TLS termination to 443, upstream port 8001

https://gerrit.wikimedia.org/r/658708

Change 659051 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] parsoid::testreduce: let envoy listen on IPv6 as well

https://gerrit.wikimedia.org/r/659051

Change 659051 merged by Dzahn:
[operations/puppet@production] parsoid::testreduce: let envoy listen on IPv6 as well

https://gerrit.wikimedia.org/r/659051

Mentioned in SAL (#wikimedia-operations) [2021-01-27T18:50:14Z] <mutante> testreduce1001 - making nginx listen on IPv6 and restarting it T266509

Change 659058 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] parsoid/testing: let nginx also listen on IPv6

https://gerrit.wikimedia.org/r/659058

Change 659058 merged by Dzahn:
[operations/puppet@production] parsoid/testing: let nginx also listen on IPv6

https://gerrit.wikimedia.org/r/659058

Change 666694 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] Revert "parsoid::testreduce: let envoy listen on IPv6 as well"

https://gerrit.wikimedia.org/r/666694

Change 666694 merged by Dzahn:
[operations/puppet@production] Revert "parsoid::testreduce: let envoy listen on IPv6 as well"

https://gerrit.wikimedia.org/r/666694

Mentioned in SAL (#wikimedia-operations) [2021-03-12T21:52:08Z] <mutante> puppetmaster1001 sudo puppet cert clean testreduce.discovery.wmnet (T266509)

Change 671275 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] ssl: add regenerated TLS cert for testreduce with new SAN

https://gerrit.wikimedia.org/r/671275

Change 671275 merged by Dzahn:
[operations/puppet@production] ssl: add regenerated TLS cert for testreduce with new SAN

https://gerrit.wikimedia.org/r/671275

@ssastry Done! https://parsoid-rt-tests.wikimedia.org/ has been reactivated.

It needed the parsoid-rt-tests.wikimedia.org name on the envoy certificate to allow for TLS termination on the backend. Fixed that and now it's back.