We currently have some cloud egress NAT exceptions for wikimedia APT repositories:
These servers are in production public VLAN with public IPv4
I cannot find a reason why we need that. Moreover, sodium is currently migrating, see T286898: Setup new mirror server (mirror1001.wikimedia.org) so this could be the perfect time to revisit this.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T272395 Cloud: reduce NAT exceptions from cloud to production | |||
| Resolved | aborrero | T298042 evaluate & drop cloud NAT exceptions for APT repositories |
Change 748771 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):
[operations/puppet@production] cloudgw: drop APT repositories NAT exception
Change 748774 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):
[operations/homer/public@master] cloud: drop APT repositories NAT exception
Change 748771 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] cloudgw: drop APT repositories NAT exception
Change 748774 merged by jenkins-bot:
[operations/homer/public@master] cloud: drop APT repositories NAT exception
Mentioned in SAL (#wikimedia-cloud) [2021-12-21T10:39:00Z] <arturo> dropped egress NAT exceptions for WMF apt repos, T298042
Merged the patches, and apparently works:
aborrero@tools-sgegrid-master:~$ sudo apt update | grep wikimedia.org Hit:4 http://mirrors.wikimedia.org/debian buster-backports InRelease Hit:10 http://apt.wikimedia.org/wikimedia buster-wikimedia InRelease
Hopefully we don't need to revert this in the next few days.
Thank @jhathaway and @ayounsi.