Page MenuHomePhabricator
Create Task
Maniphest T276956

Make a plan for Trove v. rabbit
Closed, ResolvedPublic
Actions

Description

Trove uses rabbitmq to communicate between the API and the database hosts (which are VMs).

Currently rabbit is locked down so that only cloudcontrol/cloudservices/cloudnet nodes can talk to it. Opening it up to access for guests raises some concerns:

  • Does this break our nascent policies about network isolation?
  • How can we mitigate the risk of a non-trove guest launching a DOS against Rabbit?
  • Does creating a new rabbit cluster just for trove help with any of these issues?

Related Objects
Search...

Event Timeline

Andrew created this task.Mar 9 2021, 4:43 PM
Andrew moved this task from Inbox to Needs discussion on the cloud-services-team (Kanban) board.
• Bstorm awarded a token.Mar 9 2021, 4:51 PM
Andrew moved this task from Needs discussion to Soon! on the cloud-services-team (Kanban) board.Mar 17 2021, 3:25 PM
Andrew added a comment.Mar 30 2021, 8:29 PM

We discussed this during a team meeting and decided that the risk of exposing our primary rabbitmq cluster to VMs doesn't really scare anyone.

https://gerrit.wikimedia.org/r/c/operations/puppet/+/675899

Andrew closed this task as Resolved.May 10 2021, 8:51 PM
Andrew claimed this task.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits