| | Status | Subtype | Assigned | Task |
|---|
| | Resolved | | Raymond_Ndibe | T359641 [infra,k8s] Upgrade Toolforge Kubernetes to version 1.27 |
| | | | | Restricted Task |
| | Resolved | | Slst2020 | T327025 [infra,k8s] Upgrade Toolforge Kubernetes to version 1.26 |
| | Resolved | | • aborrero | T316107 [infra,k8s] Upgrade Toolforge Kubernetes to version 1.25 |
| | Resolved | | • aborrero | T307651 Upgrade Toolforge Kubernetes to version 1.24 |
| | Resolved | | taavi | T298005 Upgrade Toolforge Kubernetes to version 1.23 |
| | Resolved | | taavi | T286856 Upgrade Toolforge Kubernetes to latest 1.22 |
| | Resolved | | taavi | T280436 Migrate Toolforge admission webhooks to use the admissionregistration.k8s.io/v1 API |
| | Resolved | | taavi | T286857 Update maintain-kubeusers to certificates/v1 api |
| | Resolved | | • Bstorm | T289390 Certificate generation is broken in toolsbeta |
| | Resolved | | taavi | T292238 Figure out certificate generation for admission webhooks before we lose the certificates/v1beta1 |
| | Resolved | | taavi | T329453 Deploy cert-manager to Toolforge |
| | Resolved | | taavi | T292706 tools-webservice should use ingress v1 |
| | Resolved | | taavi | T292771 upgrade to ingress-nginx 1.0 |
| | Resolved | | • rook | T291589 Upgrade paws jupyterhub |
| | Resolved | | taavi | T295190 Upgrade all third-party Toolforge Kubernetes components to versions supporting Kubernetes 1.22 |
| | Resolved | | taavi | T306296 Ensure k8s-status tool will work on Kubernetes 1.22 |
| | Resolved | | • rook | T308172 Upgrade PAWS to Kubernetes 1.21 |
| | Resolved | | taavi | T282942 Upgrade Toolforge Kubernetes to latest 1.21 |
| | Resolved | | • rook | T280402 Upgrade Toolforge Kubernetes to latest 1.20 |
| | Resolved | | taavi | T280340 Upgrade Toolforge Kubernetes to latest 1.19 |
| | Resolved | | taavi | T280299 Upgrade Toolforge Kubernetes to latest 1.18 |
| | Resolved | | taavi | T280300 Validate that maintain-kubeusers works with k8s 1.18 |
| | Resolved | | taavi | T280301 Refresh certs that are not controlled by kubeadm |
| | Resolved | | taavi | T280302 Upgrade PAWS Kubernetes to the latest 1.18 release |
| | Resolved | | taavi | T264221 Upgrade the nginx ingress controller in Toolforge (and likely PAWS) |
| | Resolved | | • Bstorm | T282087 Support cinder or expanded ephemeral disk worker nodes on Toolforge Kubernetes |
| | Resolved | | taavi | T284353 Fix prometheus monitoring for Toolforge Ingress |
| | Resolved | | taavi | T280342 Upgrade Calico to 3.18 |
| | Resolved | | taavi | T280360 Update ingress-admission-controller to support Ingress from networking.k8s.io/v1 |
| | Resolved | | taavi | T279106 Establish replacement for PodPresets in Toolforge Kubernetes |
| | Resolved | | • Bstorm | T292672 Issue creating pods after migration away from PodPresets |
| | Declined | | None | T290531 Weird issue with the wmcs-k8s-node-upgrade.py script |
| | Resolved | | • rook | T291976 Upgrade toolsbeta to k8s 1.20 |
| | Resolved | | taavi | T292698 Upgrade calico to 3.21 |
| | Resolved | BUG REPORT | None | T308189 Toolforge jobs stopped getting scheduled around the same time as the Toolforge k8s cluster upgrade |
| | Duplicate | | None | T308203 Create an alert for K8s cronjobs |
| | Resolved | | taavi | T308204 toolforge-jobs should set startingDeadlineSeconds by default |
| | Resolved | | taavi | T308205 Re-enable CronJobControllerV2 |
| | Open | | None | T308381 [infra,k8s] Scrape Kubernetes controller-manager and apiserver metrics into Prometheus |
| | Resolved | | • rook | T308274 test PAWS in k8s 1.21.8 |
| | Resolved | | taavi | T329869 Remove tool RBAC rules for APIs removed in Kubernetes 1.22 |
| | Resolved | BUG REPORT | taavi | T331572 maintain-kubeusers container in CrashLoopBackoff preventing new tool creation after 'user-maintainer' ClusterRole changes |
| | Resolved | | taavi | T331619 toolforge: rbac: change existing roles to reference PSP in the policy group |
| | Resolved | | taavi | T334380 Toolforge k8s: kube-scheduler permissions errors |
| | Resolved | | taavi | T334382 Toolforge k8s: kube-controller-manager permission errors |
| | Resolved | | taavi | T329677 Upgrade Calico to 3.24 |
| | Resolved | | taavi | T284656 Toolforge k8s: Migrate workers to Containerd and Bookworm |
| | Resolved | | taavi | T349795 Upgrade cadvisor |
| | Resolved | | taavi | T350227 toolforge prometheus servers OOMing |
| | Resolved | | taavi | T357901 Request increased server-group-members quota for tools |
| | Resolved | | • aborrero | T358476 toolforge k8s: some static pods needs manual restart |
| | Resolved | | taavi | T314665 Toolforge: Replace all bastion with grid-less bookworm based bastion hosts |
| | Resolved | | taavi | T314664 [infra] Decommission the Grid Engine infrastructure |
| | Resolved | | komla | T313405 Migrate remaining tools off Gridengine |
| | Declined | | None | T316124 Make Grid Engine tooling emit deprecation warnings |
| | Resolved | | taavi | T329619 Toolforge: decide what to do with tools that have 'stretch' in their service manifests |
| | Resolved | | Andrew | T353351 Provide tools for disabling the grid for specific tools |
| | Resolved | | Andrew | T353642 Relocate disable-tool-archive-dbs.service |
| | Resolved | | taavi | T358333 Remove toolschecker grid engine checks |
| | Resolved | | taavi | T359934 [infra] Archive grid engine related infrastructure tools |
| | Resolved | | taavi | T359935 [infra] Archive grid engine related Gerrit repositories |
| | Stalled | | dcaro | T356377 [toolforge] simplify calling the different toolforge apis from within the containers |
| | Stalled | | None | T356262 [jobs-cli,builds-cli,toolforge-cli,webservice] Consolidate the Toolforge CLIs |
| | Open | | None | T356261 [toolforge-cli,jobs-cli,builds-cli,envvars-cli] Explore OpenAPI SDK tooling for client consolidation |
| | Open | | None | T398651 [toolforge-cli-gen] review the https://gitlab.wikimedia.org/repos/cloud/toolforge/toolforge-gen-cli client as potential consolidation |
| | Resolved | | Slst2020 | T354745 [jobs-api,buildservice-api,envvars-api] Investigate ways to present our multiple Openapi definitions to a future consolidated CLI client |
| | Resolved | | Slst2020 | T358100 [toolforge API] expose all backend APIs OpenAPI specs |
| | Resolved | | • aborrero | T356523 [jobs-api] introduce OpenAPI to jobs framework |
| | Resolved | | Slst2020 | T362299 [api-gateway] Add a python server to serve consolidated openapi docs |
| | Declined | | None | T369693 [toolforge, toolforge-cli] Experiment with PyInstaller to package CLI tools for buildpack images |
| | Resolved | BUG REPORT | dcaro | T369569 `webservice` requires effective user to be the tool user and listed in NSS passwd data |
| | Resolved | BUG REPORT | dcaro | T369573 `toolforge jobs` requires current user to be the tool user and listed in NSS passwd data |
| | Resolved | BUG REPORT | None | T360488 Missing Perl packages on dev.toolforge.org for anomiebot workflows |
| | Resolved | | dcaro | T371556 Please re-install "joe" |
| | Resolved | | taavi | T397459 Lock down tools-sgebastion-10 (login-buster.toolforge.org) to only members of tools with known dependencies on it |
| | Resolved | | • aborrero | T359619 toolforge: prepare deb packages for k8s 1.24 |
| | Resolved | | • aborrero | T359620 toolforge: upgrade k8s etcd nodes to debian bookworm |
| | Resolved | | • aborrero | T359638 [toolsbeta,infra] upgrade kubernetes to 1.24 |
| | Resolved | | • aborrero | T359639 toolforge: verify etcd version is compatible with k8s 1.24 |
| | Resolved | | • aborrero | T359798 refresh kube-state-metrics version for k8s 1.24 |
| | Resolved | | • aborrero | T359927 [cookbook] wmcs.toolforge.k8s.prepare_upgrade: be more flexible checking for deb package components |
| | Resolved | | • aborrero | T279110 [infra] Replace PodSecurityPolicy in Toolforge Kubernetes |
| | Resolved | | • aborrero | T362050 toolforge: review pod templates for PSP replacement |
| | Resolved | | • aborrero | T362966 lima-kilo: replicate sssd setup from Toolforge |
| | Resolved | | • aborrero | T362233 Decision Request - Toolforge policy agent |
| | Resolved | | • aborrero | T362872 Decision Request - Toolforge policy agent enforcement model |
| | Resolved | | • aborrero | T363347 toolforge lima-kilo: PodSecurityPolicy admission is disabled |
| | Open | | None | T362967 lima-kilo: container image caching |
| | Resolved | | • aborrero | T363482 toolforge lima-kilo: refresh maintain-kubeusers test data |
| | Resolved | | • aborrero | T364113 toolforge: identify and cache in our container registry all kyverno images |
| | Resolved | | • aborrero | T364297 [k8s,infra] track PSP migration plan |
| | Resolved | | • aborrero | T364312 [maintain-kubeusers,infra,k8s]: introduce some logic to backfill maintain-kubeuser resources (like per-tool kyverno policies) |
| | Resolved | | • aborrero | T366564 toolforge: new maintain-kubeusers takes long time to loop over all the accounts to reconcile them |
| | Resolved | | • aborrero | T366598 maintain-kubeusers: metrics, monitoring and alerting |
| | Resolved | | • aborrero | T367332 toolforge maintain-kubeusers backtrace |
| | Resolved | | Andrew | T367348 Incident: 2024-06-12 toolforge k8s control plane |
| | Duplicate | | dcaro | T367349 Fix HA proxy load-balancer health check monitor to not poll nodes where the API is not responding |
| | Resolved | | • aborrero | T367350 [k8s,infra] Verify that kyverno policies are evaluated only for namespaced resources |
| | Resolved | | • aborrero | T367386 [k8s,infra] kyverno has a track record of overloading the cluster, maybe on new ways |
| | Resolved | | • aborrero | T367388 [k8s,infra] consider scaling the k8s control plane |
| | Resolved | | • aborrero | T367389 [k8s,infra,alerting] improve HAproxy and k8s apiserver interaction |
| | Declined | | • aborrero | T367950 Decision Request - Toolforge pod security via custom admission webhook |
| | Declined | | • aborrero | T367952 toolforge: drop kyverno |
| | Declined | | • aborrero | T367985 toolforge: create a new custom admission webhook to handle pod security settings |
| | Resolved | | • aborrero | T368044 Toolforge: redeploy kyverno after the outage |
| | Resolved | | • aborrero | T368141 toolforge: kyverno: change policies to Enforce |
| | Resolved | | • aborrero | T368142 Toolforge: drop PodSecurityPolicy |
| | Open | | None | T368135 [k8s,kyverno]: explore change from per-namespace policy resource to a single ClusterPolicy resource |
| | Duplicate | | None | T368512 toolforge: maintain-kubeusers crashes if LDAP server terminates session |
| | Resolved | | • aborrero | T368515 toolforge: kyverno: enable monitoring |
| | Resolved | | Slst2020 | T329671 toolforge: upgrade all Kubernetes components to versions supporting Kubernetes 1.25 |
| | Resolved | | • aborrero | T349197 [infra] Remove TTLAfterFinished from config before upgrade to 1.25 |
| | Resolved | | • aborrero | T355881 [toolforge,infra] Fix deprecated Kubelet flags |
| | Resolved | | • aborrero | T369163 toolforge: prepare deb packages for k8s 1.25 |
| | Resolved | | • aborrero | T369164 toolforge: review k8s API usage by custom components for 1.25 upgrade |
| | Resolved | | Slst2020 | T369165 toolforge: upgrade lima-kilo for kubernetes 1.25 |
| | Resolved | | Slst2020 | T369166 toolforge: refresh kubernetes cookbooks for the 1.25 upgrade |
| | Resolved | | • aborrero | T369167 toolforge: upgrade toolsbeta to k8s 1.25 |
| | Resolved | | • aborrero | T369168 toolsbeta: upgrade control plane nodes to k8s 1.25 |
| | Resolved | | • aborrero | T369170 toolsbeta: upgrade data plane nodes to k8s 1.25 |
| | Resolved | | • aborrero | T369171 toolforge: upgrade worker nodes to k8s 1.25 |
| | Resolved | | • aborrero | T369172 toolforge: upgrade control plane nodes to k8s 1.25 |