Page MenuHomePhabricator

Test envoyproxy as a WMF's CDN TLS terminator with real traffic
Open, MediumPublic

Description

Envoy is one of the candidates to replace ats-tls as the TLS terminator used in the WMF caching infrastructure. To fully validate its performance and stability a real traffic test is needed.
To be able to perform this test several requirements need to be fulfilled:

  • Package envoyproxy 1.16.2 - T271407
  • Adapt the current envoy puppetization to be able to meet Traffic requirements -> currently blocked by T265880
  • Test envoyproxy in Traffic WCMS environment
  • Test envoyproxy in ulsfo
  • Test envoyproxy in eqsin
  • Test envoyproxy in esams

Details

ProjectBranchLines +/-Subject
operations/puppetproduction+32 -0
operations/puppetproduction+19 -0
operations/puppetproduction+10 -0
operations/puppetproduction+9 -0
operations/puppetproduction+35 -18
operations/puppetproduction+73 -0
operations/puppetproduction+25 -2
operations/puppetproduction+28 -2
operations/puppetproduction+26 -7
operations/puppetproduction+30 -0
operations/puppetproduction+5 -3
operations/puppetproduction+74 -26
operations/puppetproduction+111 -0
operations/puppetproduction+31 -0
operations/puppetproduction+39 -13
operations/puppetproduction+21 -0
operations/puppetproduction+81 -57
operations/puppetproduction+41 -1
operations/puppetproduction+8 -0
operations/puppetproduction+8 -4
Show related patches Customize query in gerrit

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Vgutierrez triaged this task as Medium priority.Jan 7 2021, 1:52 PM
Vgutierrez moved this task from Triage to TLS on the Traffic board.

Change 710496 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Add prefetched OCSP staple support

https://gerrit.wikimedia.org/r/710496

Change 710507 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Add dual stack cert support

https://gerrit.wikimedia.org/r/710507

Change 710577 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Support ciphersuite configuration

https://gerrit.wikimedia.org/r/710577

Change 710581 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Support ECDH curves configuration

https://gerrit.wikimedia.org/r/710581

Change 711386 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Add upstream PROXY protocol support

https://gerrit.wikimedia.org/r/711386

Change 711399 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Add STEK configuration support

https://gerrit.wikimedia.org/r/711399

Change 711407 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] cache: Provide an envoy STEK manager script

https://gerrit.wikimedia.org/r/711407

Change 712368 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Provide support for UDS upstreams

https://gerrit.wikimedia.org/r/712368

Change 713238 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Support alpn_protocols configuration

https://gerrit.wikimedia.org/r/713238

Change 713246 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Suport TLS min/max version config

https://gerrit.wikimedia.org/r/713246

Change 713271 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Allow setting a global lua script

https://gerrit.wikimedia.org/r/713271

Change 713272 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] cache: Use envoy lua API to provide TLS info

https://gerrit.wikimedia.org/r/713272

Change 713460 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Support PreserveCase HeaderKeyFormat

https://gerrit.wikimedia.org/r/713460

Change 713879 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Allow configuring the admin address

https://gerrit.wikimedia.org/r/713879

Change 713879 abandoned by Vgutierrez:

[operations/puppet@production] envoyproxy: Allow configuring the admin address

Reason:

not needed

https://gerrit.wikimedia.org/r/713879

Change 714039 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Allow configuring TLS handshake timeout

https://gerrit.wikimedia.org/r/714039

Change 710496 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Add prefetched OCSP staple support

https://gerrit.wikimedia.org/r/710496

Change 711386 abandoned by Vgutierrez:

[operations/puppet@production] envoyproxy: Add upstream PROXY protocol support

Reason:

upstream PROXY support isn't ready for our requirements yet

https://gerrit.wikimedia.org/r/711386

Change 714379 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Allow setting per_connection_buffer_limit_bytes

https://gerrit.wikimedia.org/r/714379

Change 714380 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Add downstream idle_timeout config option

https://gerrit.wikimedia.org/r/714380

Change 714381 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] envoyproxy: Allow setting http2 protocol options

https://gerrit.wikimedia.org/r/714381

Change 710507 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Add dual stack cert support

https://gerrit.wikimedia.org/r/710507

Change 710577 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Support ciphersuite configuration

https://gerrit.wikimedia.org/r/710577

Change 710581 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Support ECDH curves configuration

https://gerrit.wikimedia.org/r/710581

Change 711399 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Add STEK configuration support

https://gerrit.wikimedia.org/r/711399

Change 711407 merged by Vgutierrez:

[operations/puppet@production] cache: Provide an envoy STEK manager script

https://gerrit.wikimedia.org/r/711407

Change 715541 had a related patch set uploaded (by Vgutierrez; author: Vgutierrez):

[operations/puppet@production] varnish: Allow SSR=2 on XCPS

https://gerrit.wikimedia.org/r/715541

Change 715952 had a related patch set uploaded (by Ema; author: Ema):

[operations/puppet@production] varnish: add tests for unknown XCPS session reuse

https://gerrit.wikimedia.org/r/715952

Change 712368 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Provide support for UDS upstreams

https://gerrit.wikimedia.org/r/712368

Change 715541 merged by Vgutierrez:

[operations/puppet@production] varnish: Allow SSR=2 on XCPS

https://gerrit.wikimedia.org/r/715541

Change 715952 merged by Ema:

[operations/puppet@production] varnish: add tests for unknown XCPS session reuse

https://gerrit.wikimedia.org/r/715952

Change 713238 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Support alpn_protocols configuration

https://gerrit.wikimedia.org/r/713238

Change 713246 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Support TLS min/max version config

https://gerrit.wikimedia.org/r/713246

Change 713271 merged by Vgutierrez:

[operations/puppet@production] envoyproxy: Allow setting a global lua script

https://gerrit.wikimedia.org/r/713271

Change 713272 merged by Vgutierrez:

[operations/puppet@production] cache: Use envoy lua API to provide TLS info

https://gerrit.wikimedia.org/r/713272