Page MenuHomePhabricator

Allow-Listing for Enterprise IPs
Closed, ResolvedPublic


Hi there -

As Wikimedia Enterprise heads into full release (with the public launch last week), we are re-evaluating some of our technical dependence on WMF infrastructure and thinking through how we might need to strengthen those ties. Last year (see this ticket), we set up an allow-list for a Wikimedia Enterprise elastic IP in order to baseline our infrastructure with content when needed and avoid 429s on our systems. Reassessing, we think it'd be helpful to add another one to introduce more routes to recovery for us in the case of an incident.

Tagging @BBlack and @Pchelolo here to triage with us, but essentially we would like to add another IP into the same place as the above ticket.

Some of our reasoning behind the ask:

  • AWS does not allow transferring IP addresses between regions. So we are bound to the region where we have our whitelisted IP and in case of outage have no other options than wait till it is resolved by AWS. If we had whitelisted IP in another region we could use our infrastructure as code to spin up our application in another region and don’t wait till AWS resolves the issue.
  • Also as a backup option in case of human error or technical problems on AWS side that might result in losing our whitelisted IP.
  • As we are developing new architecture we want that architecture to be a completely separate thing for separation of concerns, security, fault tolerance etc. Meaning we need another IP to be whitelisted so we don’t have to physically connect those infrastructures.

Also - does ActionAPI have an equivalent rate limit that we should be aware of - we talked with Brandon about alerting his team when we are expecting traffic events, however might be good to get ahead of thresholds over there and ensure we're working our system around them.


Event Timeline

Adding to the Foundational Tech Requests board for Steering Committee intake. This will help us prioritize/resource this work effectively.

2021-12-08 Tech Steering Committee

  • seems like a small amount of effort
  • need by December 17th

Change 745560 had a related patch set uploaded (by Hnowlan; author: Hnowlan):

[operations/puppet@production] varnish: add second wikimedia enterprise elastic IP

Change 745560 merged by Hnowlan:

[operations/puppet@production] varnish: add second wikimedia enterprise elastic IP

This has been merged and will come into effect over the next 25 minutes or so.