Enable connection from labweb1001/labweb1002 to s6
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Marostegui
	May 7 2021, 4:53 AM

Description

labswiki will be moved to s6 during the DC switchover in June.
RIght now there is no connectivity from labweb1001/1002 to s6 hosts, so this needs to be changed.

The second step once the connectivity is allowed would be to deploy mysql grants, but that can be tracked after T282074 is done

Current connection to m5 master works:

root@labweb1001:~# telnet db1128.eqiad.wmnet 3306
Trying 10.64.0.98...
Connected to db1128.eqiad.wmnet.
Escape character is '^]'.
]
5.5.5-10.4.18-MariaDB-log��B#&5vtf~�is&a81-/CDiemysql_native_passwordConnection closed by foreign host.

Connection to either s6 master and one of s6 slaves does not work:

root@labweb1001:~# telnet db1131.eqiad.wmnet 3306
Trying 10.64.32.6...
^C
root@labweb1001:~# telnet db1165.eqiad.wmnet 3306
Trying 10.64.16.187...

Details

	Subject	Repo	Branch	Lines +/-
	profile:mariadb:core: Hack in access from labwebs to s6	operations/puppet	production	+28 -0

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Duplicate	None	T237771 Make Wikitech a normal wiki
Duplicate	None	T237772 Move Wikitech's database off of M5 and onto a normal production wiki DB server
Declined	None	T171570 Rename database 'labswiki' to 'wikitechwiki'
Resolved	Milimetric	T217792 Add wikitech (labswiki) to the sqoop list
		Restricted Task
Resolved	Legoktm	T281515 June 2021 Datacenter switchover
Resolved	Marostegui	T285139 DB maintenance work to do while eqiad is passive (June 2021)
Open	None	T189531 All Wikimedia developer services should use single sign-on
In Progress	None	T161859 Make Wikitech an SUL wiki
Duplicate	None	T237773 Move Wikitech onto the production MW cluster
Resolved	Marostegui	T167973 Move database for wikitech (labswiki) to a main cluster section
Resolved	Andrew	T282209 Enable connection from labweb1001/labweb1002 to s6
Declined	Andrew	T282573 Move labweb/cloudweb hosts to private IPs

Event Timeline

Marostegui created this task.May 7 2021, 4:53 AM

Restricted Application edited projects, added cloud-services-team (Kanban); removed cloud-services-team. · View Herald TranscriptMay 7 2021, 4:53 AM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Marostegui mentioned this in T282074: Audit labswiki grants.May 7 2021, 5:00 AM

Probably the correct solution to this is to move the wikitech servers onto private IPs; I'm creating a subtask to investigate that.

Andrew mentioned this in T282573: Move labweb/cloudweb hosts to private IPs.May 11 2021, 2:47 PM

Change 689092 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] profile:mariadb:core: Hack in access from labwebs to s6

https://gerrit.wikimedia.org/r/689092

gerritbot added a project: Patch-For-Review.May 11 2021, 3:01 PM

RhinosF1 subscribed.May 11 2021, 3:04 PM

further discussion suggests that moving to private IPs might not be the right solution/necessary (in part because we hope to deprecate the labweb servers entirely sometime soon.) I've proposed a temporary patch that resembles the current approach used on m5 -- it's pretty straightforward but if you hate it let me know and I can pursue the private-ip approach instead.

In order to have a clearer list of GRANTS, I would prefer private-ip approach (I guess they'd be 10.64.%?). But I don't have any strong opinions really against either approach. We'd need to work on T282573 anyways, to either add the new IPs (if they are public) and remove the old ones.

aborrero triaged this task as High priority.May 11 2021, 4:08 PM

aborrero moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.

aborrero assigned this task to Andrew.May 11 2021, 4:29 PM

The more I look at moving to private IPs the more complicated it looks... let's stick with the ferm hack for now; when we move wikitech off of labweb* entirely that will make the move to private IPs easier anyway. I'll catch up with comments on the pending ferm patch.

Just to reconfirm... the attached patch (https://gerrit.wikimedia.org/r/c/operations/puppet/+/689092) will resolve this task.

Change 689092 merged by Andrew Bogott:

[operations/puppet@production] profile:mariadb:core: Hack in access from labwebs to s6

https://gerrit.wikimedia.org/r/689092

andrew@labweb1001:~$ telnet db1131.eqiad.wmnet 3306
Trying 10.64.32.6...
Connected to db1131.eqiad.wmnet.
Escape character is '^]'.
]

Maintenance_bot removed a project: Patch-For-Review.Jun 8 2021, 2:11 PM

Andrew closed subtask T282573: Move labweb/cloudweb hosts to private IPs as Declined.Jul 13 2021, 2:43 PM

• nskaggs mentioned this in Unknown Object (Task).Mar 31 2022, 8:03 PM

Enable connection from labweb1001/labweb1002 to s6Closed, ResolvedPublicActions

Description

Details

Related ObjectsSearch...

Event Timeline

Enable connection from labweb1001/labweb1002 to s6
Closed, ResolvedPublic
Actions

Related Objects
Search...