Page MenuHomePhabricator
Create Task
Maniphest T317177

[tracking] Don't keep on the public vlans hosts that don't require it
Open, LowestPublic
Actions

Description

Tracking/umbrella task for all tasks potentially helping with removing hosts directly exposed to the Internet (on the public vlans, on public IPs). The ones that can be moved are often there for legacy reasons.

See https://wikitech.wikimedia.org/wiki/Wikimedia_network_guidelines#Public_IPs for details.

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT317177 [tracking] Don't keep on the public vlans hosts that don't require it
 Resolved• aborreroT307357 Move cloud vps ns-recursor IPs to host/row-independent addressing
 ResolvedcmooneyT336587 cloudservices[2004/2005]-dev & cloudweb2002-dev: connect them to cloudsw so they can have cloud-private vlan
 Resolved• aborreroT338433 openstack: figure out how to change /etc/resolv.conf in all VMs
 Resolved• aborreroT338778 cloudservices2004-dev: reimage into new network setup
 InvalidNoneT339869 codfw1dev: LDAP database content seems to have lost years of content
 Resolved• aborreroT338779 cloudservices2005-dev: reimage into new network setup
 Resolved• aborreroT340047 LDAP problems following cloudservices2005-dev reimage
 OpenNoneT340127 systemctl restart keystone doesn't actually restart keystone sometimes
 Resolved• aborreroT340488 codfw1dev: OpenStack services can only sort of talk to memacached on cloudcontrols
 Invalid• aborreroT338938 codfw1dev: finish auth DNS server transition
 Resolved• aborreroT339905 codfw1dev: LDAP setup needs a refresh so TLS works
 ResolvedfgiunchediT341966 prometheus in codfw can't reach cloudservices' pdns to fetch metrics
 Resolved• aborreroT342621 eqiad1: cloudlb: transition DNS clients (VMs) to the new BGP-based recursor VIP
 Invalid• aborreroT346092 cloudcontrols can't reach ns-recursor.openstack.eqiad1.wikimediacloud.org
 Resolved• aborreroT346426 Some VPS instances still using ns-recursor0
 ResolvedcmooneyT347858 Manage WMCS codfw public service VIP DNS from Netbox
 DeclinedAndrewT282573 Move labweb/cloudweb hosts to private IPs
 OpenNoneT310265 Reduce usage of public IPv4 addresses on GitLab hosts
 OpenFCeratto-WMFT317179 Move orchestrator (dborch) to private ipaddrs + CDN
 OpenNoneT317178 Move apt to private IPs + CDN
 DeclinedNoneT317182 Move archiva to private IPs + CDN
 OpenNoneT317183 Move ldap-replicas to private IPs
 OpenNoneT339909 LDAP: review domain and TLS setup
 OpenMoritzMuehlenhoffT317184 Move r/w LDAP servers to private IPs
 OpenNoneT417028 Reclaim public IPs from individual dumps distribution (clouddumps) hosts
 DeclinedtaaviT306550 Move dumps.wikimedia.org HTTP service behind CDN edge
 ResolvedxcollazoT415193 Get dump mirrors to use new dumps-rsync service name
 ResolvedtaaviT422040 Migrate clouddumps https/rsync interfaces behind LVS
 ResolvedtaaviT422042 Dumps access log analytics should support multiple active hosts

Event Timeline

ayounsi created this task.Sep 7 2022, 8:49 AM
ayounsi triaged this task as Lowest priority.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 7 2022, 8:49 AM
ayounsi added subtasks: T306550: Move dumps.wikimedia.org HTTP service behind CDN edge, T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing, T282573: Move labweb/cloudweb hosts to private IPs, T310265: Reduce usage of public IPv4 addresses on GitLab hosts.Sep 7 2022, 8:58 AM
ayounsi updated the task description. (Show Details)Sep 7 2022, 9:01 AM
Peachey88 added projects: netops, SRE, Tracking-Neverending.Sep 7 2022, 9:14 AM
Restricted Application added a project: Infrastructure-Foundations. · View Herald TranscriptSep 7 2022, 9:14 AM
ayounsi mentioned this in T317178: Move apt to private IPs + CDN.Sep 7 2022, 9:30 AM
ayounsi mentioned this in T317179: Move orchestrator (dborch) to private ipaddrs + CDN.Sep 7 2022, 9:35 AM
ayounsi added subtasks: T317179: Move orchestrator (dborch) to private ipaddrs + CDN, T317178: Move apt to private IPs + CDN.
jbond subscribed.Sep 7 2022, 9:41 AM
ayounsi mentioned this in T317182: Move archiva to private IPs + CDN.Sep 7 2022, 10:34 AM
ayounsi added a subtask: T317182: Move archiva to private IPs + CDN.
ayounsi mentioned this in T317183: Move ldap-replicas to private IPs.Sep 7 2022, 11:14 AM
ayounsi added a subtask: T317183: Move ldap-replicas to private IPs.
ayounsi added a subtask: T317184: Move r/w LDAP servers to private IPs.Sep 7 2022, 11:26 AM
Aklapper edited projects, added Epic; removed Tracking-Neverending.Sep 7 2022, 2:50 PM

Assuming this task is not literally neverending (if it was, it should be a project tag instead)

ayounsi added a comment.Sep 7 2022, 3:20 PM

It is not never-ending as it's about converting existing hosts. Either they will or won't. New services are out of scope.

ayounsi moved this task from Backlog to Watching on the netops board.Oct 5 2022, 1:23 PM
• aborrero changed the status of subtask T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing from Open to Stalled.Jun 12 2023, 3:18 PM
• aborrero changed the status of subtask T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing from Stalled to Open.Jun 13 2023, 4:32 PM
• aborrero closed subtask T307357: Move cloud vps ns-recursor IPs to host/row-independent addressing as Resolved.Sep 20 2023, 10:25 AM
Gehel closed subtask T317182: Move archiva to private IPs + CDN as Declined.Mar 20 2024, 9:06 AM
taavi edited subtasks, added: T417028: Reclaim public IPs from individual dumps distribution (clouddumps) hosts; removed: T306550: Move dumps.wikimedia.org HTTP service behind CDN edge.Feb 10 2026, 3:41 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits