Page MenuHomePhabricator
Create Task
Maniphest T317177

[tracking] Don't keep on the public vlans hosts that don't require it
Open, LowestPublic
Actions

Description

Tracking/umbrella task for all tasks potentially helping with removing hosts directly exposed to the Internet (on the public vlans, on public IPs). The ones that can be moved are often there for legacy reasons.

See https://wikitech.wikimedia.org/wiki/Wikimedia_network_guidelines#Public_IPs for details.

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT317177 [tracking] Don't keep on the public vlans hosts that don't require it
 OpenNoneT306550 Move dumps.wikimedia.org HTTP service behind CDN edge
 ResolvedaborreroT307357 Move cloud vps ns-recursor IPs to host/row-independent addressing
 ResolvedcmooneyT336587 cloudservices[2004/2005]-dev & cloudweb2002-dev: connect them to cloudsw so they can have cloud-private vlan
 ResolvedaborreroT338433 openstack: figure out how to change /etc/resolv.conf in all VMs
 ResolvedaborreroT338778 cloudservices2004-dev: reimage into new network setup
 InvalidNoneT339869 codfw1dev: LDAP database content seems to have lost years of content
 ResolvedaborreroT338779 cloudservices2005-dev: reimage into new network setup
 ResolvedaborreroT340047 LDAP problems following cloudservices2005-dev reimage
 OpenNoneT340127 systemctl restart keystone doesn't actually restart keystone sometimes
 ResolvedaborreroT340488 codfw1dev: OpenStack services can only sort of talk to memacached on cloudcontrols
 InvalidaborreroT338938 codfw1dev: finish auth DNS server transition
 ResolvedaborreroT339905 codfw1dev: LDAP setup needs a refresh so TLS works
 ResolvedfgiunchediT341966 prometheus in codfw can't reach cloudservices' pdns to fetch metrics
 ResolvedaborreroT342621 eqiad1: cloudlb: transition DNS clients (VMs) to the new BGP-based recursor VIP
 InvalidaborreroT346092 cloudcontrols can't reach ns-recursor.openstack.eqiad1.wikimediacloud.org
 ResolvedaborreroT346426 Some VPS instances still using ns-recursor0
 ResolvedcmooneyT347858 Manage WMCS codfw public service VIP DNS from Netbox
 DeclinedAndrewT282573 Move labweb/cloudweb hosts to private IPs
 OpenNoneT310265 Reduce usage of public IPv4 addresses on GitLab hosts
 OpenNoneT317179 Move dborch to private IPs + CDN
 OpenNoneT317178 Move apt to private IPs + CDN
 DeclinedNoneT317182 Move archiva to private IPs + CDN
 OpenNoneT317183 Move ldap-replicas to private IPs
 OpenNoneT339909 LDAP: review domain and TLS setup
 OpenNoneT317184 Move r/w LDAP servers to private IPs

Event Timeline

ayounsi triaged this task as Lowest priority.Sep 7 2022, 8:49 AM
ayounsi created this task.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 7 2022, 8:49 AM
ayounsi added subtasks: T306550: Move dumps.wikimedia.org HTTP service behind CDN edge, T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing, T282573: Move labweb/cloudweb hosts to private IPs, T310265: Reduce usage of public IPv4 addresses on GitLab hosts.Sep 7 2022, 8:58 AM
ayounsi updated the task description. (Show Details)Sep 7 2022, 9:01 AM
Peachey88 added projects: netops, SRE, Tracking-Neverending.Sep 7 2022, 9:14 AM
Restricted Application added a project: Infrastructure-Foundations. · View Herald TranscriptSep 7 2022, 9:14 AM
ayounsi mentioned this in T317178: Move apt to private IPs + CDN.Sep 7 2022, 9:30 AM
ayounsi mentioned this in T317179: Move dborch to private IPs + CDN.Sep 7 2022, 9:35 AM
ayounsi added subtasks: T317179: Move dborch to private IPs + CDN, T317178: Move apt to private IPs + CDN.
jbond subscribed.Sep 7 2022, 9:41 AM
ayounsi mentioned this in T317182: Move archiva to private IPs + CDN.Sep 7 2022, 10:34 AM
ayounsi added a subtask: T317182: Move archiva to private IPs + CDN.
ayounsi mentioned this in T317183: Move ldap-replicas to private IPs.Sep 7 2022, 11:14 AM
ayounsi added a subtask: T317183: Move ldap-replicas to private IPs.
ayounsi added a subtask: T317184: Move r/w LDAP servers to private IPs.Sep 7 2022, 11:26 AM
Aklapper edited projects, added Epic; removed Tracking-Neverending.Sep 7 2022, 2:50 PM

Assuming this task is not literally neverending (if it was, it should be a project tag instead)

ayounsi added a comment.Sep 7 2022, 3:20 PM

It is not never-ending as it's about converting existing hosts. Either they will or won't. New services are out of scope.

ayounsi moved this task from Backlog to Watching on the netops board.Oct 5 2022, 1:23 PM
aborrero changed the status of subtask T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing from Open to Stalled.Jun 12 2023, 3:18 PM
aborrero changed the status of subtask T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing from Stalled to Open.Jun 13 2023, 4:32 PM
aborrero closed subtask T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing as Resolved.Sep 20 2023, 10:25 AM
Gehel closed subtask T317182: Move archiva to private IPs + CDN as Declined.Mar 20 2024, 9:06 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits