Page MenuHomePhabricator
Create Task
Maniphest T272395

Cloud: reduce NAT exceptions from cloud to production
Open, MediumPublic
Actions

Description

Meta task to track the work to reduce NAT exceptions for connections cloud production --> wiki production.

Similar to T272585: Cloud: reduce NAT exceptions from production to cloud but notice the reverse direction.

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT272395 Cloud: reduce NAT exceptions from cloud to production
 DeclinedNoneT209011 Change routing to ensure that traffic originating from Cloud VPS is seen as non-private IPs by Wikimedia wikis
 Resolved• aborreroT272400 Update IP addresses of Cloud VPS instances to mark internal traffic on refinery code
 DeclinedNoneT273724 figure out what/how to handle bots/tools with restricted IP Oauth/password stored in the mediawiki databases
 DeclinedNoneT273725 make sure mediawiki limits on bad logins account for cloud public IPv4 ranges
 DeclinedNoneT273730 potential NAT overflow
 DeclinedNoneT273731 make sure Anti Harassment Tools are aware of cloud public IPv4 ranges
 DeclinedNoneT273737 Get traffic team green light for Cloud NAT to wikis change
 DeclinedNoneT273738 Get platform engineering team green light for Cloud NAT to wikis change
 ResolvedKrinkleT273739 Get performance team green light for Cloud NAT to wikis change
 DeclinedNoneT273740 Get Service Operations team green light for Cloud NAT to wikis change
 Resolved• aborreroT249022 Track and list the services that Cloud Services that connect to internal network endpoints
Restricted Task
 ResolveddcaroT272486 cloudcontrol1003/Check for VMs leaked by the nova-fullstack test is CRITICAL
 Resolved• aborreroT267779 CloudVPS: detail list of dmz_cidr optional NAT addresses to avoid reaching everything in production with internal private VM addresses
 Resolved• aborreroT272397 cloud: drop NAT exception for dumps NFS
 Resolved• aborreroT280225 Cloud: drop NAT exception for IRCD
 Resolved• aborreroT293897 wiki replicas: drop NAT exceptions
 ResolvedAndrewT291405 [NFS] Reduce or eliminate bare-metal NFS servers
 Resolved• aborreroT291257 Cloud: NFS: PoC: manila with generic driver using DHSS=true
 ResolvedAndrewT291406 POC: puppet-provision a cinder-backed NFS server in eqiad1
 DuplicateNoneT291409 [NFS] Update maintain_dbusers so it can run on a VM
 ResolvedAndrewT292546 cloud NFS: figure out backups for cinder volumes
 Resolved• aborreroT293752 cloud ceph: refactor rbd client puppet profiles
 DuplicateNoneT294429 cinder-backups: figure out automation
 Resolved• aborreroT295584 eqiad: 2 VMs for cloudbackup-dev
 Resolved• aborreroT296413 cinder: get victoria point release in the bpo repo
 Resolved• aborreroT299708 network access to eqiad ceph cluster from cloudbackup2002
 ResolvedAndrewT339830 cinder-backup getting OOM-killed for large volumes
 ResolvedAndrewT344065 Replace cinder-backup process with backy2
 ResolvedAndrewT358855 Use cloudbackup100[12]-dev for cinder backup test/dev
 ResolvedAndrewT366071 'backy2 cleanup' not getting called properly on cloudbackup hosts
 ResolvedAndrewT293800 [NFS] Automate creation of the NFS VM and the cinder volume to attach to it
 ResolvedAndrewT293801 [NFS] Test the share migration process to an NFS VM
 ResolveddcaroT293804 [NFS] Add monitoring and alerting to the new NFS system
 ResolvedAndrewT293805 [NFS] Create script to automate the cinder volume backups on cloudbackup2001
 ResolvedAndrewT295592 deploy cinder-backups for eqiad1
 ResolvedAndrewT306200 CRITICAL: Status of the systemd unit backup_cinder_volumes
 Resolved• nskaggsT312847 SystemdUnitDownForLong cloudcontrol1005:9100 Unit backup_cinder_volumes.service on node cloudcontrol1005 has been down for long.
 OpenNoneT301279 NFS-on-ceph: monitoring
 ResolvedAndrewT301280 Move project-specific NFS mounts onto project-local NFS servers
 ResolvedAndrewT301294 Does account-creation-assistance really need NFS?
 ResolvedAndrewT301295 Does the cloud-vps UTRS project need NFS?
 InvalidAndrewT301297 Does the cloud-vps Video project need NFS?
 ResolvedAndrewT301298 Does the cloud-vps WikiPathways project need NFS?
 DeclinedAndrewT301299 Does the cloud-vps wmde-templates-alpha project need NFS?
 ResolvedAndrewT301300 Does the 'math' project need NFS?
 DeclinedAndrewT301301 Does the cloud-vps 'huggle' project need NFS?
 ResolvedAndrewT300694 Move cloud-vps Maps nfs share to vm-hosted NFS
 DeclinedAndrewT301620 Does the 'dumps' project need NFS?
 ResolvedAndrewT301646 Does the 'wikilink' project really need NFS?
 Resolvedjsn.shermanT302401 migrate wikilink backups from nfs to cinder
 ResolvedAndrewT301715 Stop using NFS for the project-proxy cloud-vps project
 ResolveddcaroT303663 Split maintain-dbusers.py into two parts, one to run on cloudcontrol nodes and one to run on an NFS server VM
 ResolveddcaroT304040 REST api service to manage toolforge replica.my.cnf
 ResolvedNoneT214541 python3-ldap3 mixed versions and future traps
 ResolvedtaaviT329377 [bug] Server does not start
 Resolved• MarosteguiT330697 labsdbaccounts database grant for cloudcontrol1005
 ResolvedNoneT330916 Ensure that labstore1004.eqiad.wmnet accept http requests from cloudcontrol1005.wikimedia.org
 Resolved• MarosteguiT331014 Add GRANT access to cloudcontrol1005 for labsadmin to wikireplicas
 Resolved• rookT331056 PAWS cluster for nfs cutover
 ResolvedBUG REPORTdcaroT332762 New tool not allowed to connect to toolsdb
 InvalidBUG REPORTdcaroT332789 [maintain-dbusers] when filtering by a tool we use inconsistent filters
 ResolvedBUG REPORTdcaroT332798 [maintain-dbusers] When creating accounts, the script bails out processing other accounts if one of them fails in an unexpected way
 ResolveddcaroT332955 [maintain-dbusers] Generate prometheus metrics
 ResolveddcaroT332954 [maintain-dbusers] allow filtering by account type when running maintain
 ResolvedNoneT325012 Is paws-nfs-1 still used
 ResolvedAndrewT333477 Migrate tools nfs from labstore1004 server to a ceph-backed VM
 ResolvedAndrewT322219 Refactor tool deletion code for nfs-on-cinder
 Resolved• aborreroT298042 evaluate & drop cloud NAT exceptions for APT repositories
 OpenNoneT396986 Replace remaining IPv4 NAT exemptions by IPv6 adoption
 OpenNoneT380060 Support IPv6 in Toolforge Kubernetes
 OpenNoneT397149 Make ldap-ro service available over IPv6

Event Timeline

• aborrero created this task.Jan 19 2021, 4:05 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 19 2021, 4:05 PM
• aborrero triaged this task as Medium priority.Jan 19 2021, 4:05 PM
• aborrero moved this task from Inbox to Epics on the cloud-services-team (Kanban) board.
• aborrero added a subtask: T209011: Change routing to ensure that traffic originating from Cloud VPS is seen as non-private IPs by Wikimedia wikis.
• aborrero added a subtask: T249022: Track and list the services that Cloud Services that connect to internal network endpoints.
• aborrero closed subtask T249022: Track and list the services that Cloud Services that connect to internal network endpoints as Resolved.Jan 19 2021, 4:08 PM
• aborrero added a subtask: Restricted Task.
• aborrero added a subtask: T267779: CloudVPS: detail list of dmz_cidr optional NAT addresses to avoid reaching everything in production with internal private VM addresses.Jan 19 2021, 4:13 PM
ayounsi closed subtask Restricted Task as Resolved.Jan 20 2021, 10:56 AM
• aborrero mentioned this in T272585: Cloud: reduce NAT exceptions from production to cloud.Jan 21 2021, 12:00 PM
• aborrero updated the task description. (Show Details)
• aborrero mentioned this in T272587: cloud: current nova-fullstack mechanism requires cloudcontrol nodes to access individual VMs.Jan 21 2021, 12:10 PM
• aborrero closed subtask T272397: cloud: drop NAT exception for dumps NFS as Resolved.Feb 23 2021, 4:59 PM
• aborrero closed subtask T280225: Cloud: drop NAT exception for IRCD as Resolved.Apr 15 2021, 11:17 AM
• aborrero closed subtask T293897: wiki replicas: drop NAT exceptions as Resolved.Oct 21 2021, 10:21 AM
• aborrero added a subtask: T291405: [NFS] Reduce or eliminate bare-metal NFS servers.Oct 21 2021, 10:25 AM
JJMC89 reopened subtask T298042: evaluate & drop cloud NAT exceptions for APT repositories as Open.Dec 21 2021, 12:07 AM
• aborrero closed subtask T298042: evaluate & drop cloud NAT exceptions for APT repositories as Resolved.Dec 21 2021, 10:42 AM
• nskaggs mentioned this in T314847: Separate WMCS control and management plane traffic.Aug 23 2022, 2:58 PM
• aborrero changed the status of subtask T209011: Change routing to ensure that traffic originating from Cloud VPS is seen as non-private IPs by Wikimedia wikis from Open to Stalled.Nov 10 2022, 12:32 PM
fnegri edited projects, added cloud-services-team; removed cloud-services-team (Kanban).Jan 18 2023, 6:45 PM
fnegri moved this task from Kanban to Epics on the cloud-services-team board.
Andrew closed subtask T291405: [NFS] Reduce or eliminate bare-metal NFS servers as Resolved.May 23 2023, 1:45 PM
• nskaggs mentioned this in T273738: Get platform engineering team green light for Cloud NAT to wikis change.Oct 26 2023, 6:13 PM
taavi added a project: Cloud-VPS.Sep 28 2024, 1:35 PM
taavi moved this task from Unsorted to Network on the Cloud-VPS board.Nov 1 2024, 7:01 PM
taavi closed subtask T209011: Change routing to ensure that traffic originating from Cloud VPS is seen as non-private IPs by Wikimedia wikis as Declined.Apr 24 2025, 12:37 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits