Page MenuHomePhabricator

New Service Request 'iPoid'
Closed, ResolvedPublic

Description

iPoid Service

iPoid (Wikitech: iPoid, Gerrit: security-api mediawiki/services/ipoid) is a node-based service. It offers 2 basic functionalities:

Local storage for 3rd party data

iPoid calls a third-party provider to fetch a large (~700MB) gzipped json. In turn that data is processed and stored in its MariaDB database. This Gzipped data unzips to ~4GB while the row count in the order of millions.

Scheduled job:
As far as we know, the current 3rd party provider updates their data frequently with new known actors and expires stale data on others. It is not known how often the data changes in practice but the service we’re using updates daily so we should try to take advantage of that if we can. Additionally, we can try to do some research on how much actually changes.

Interaction with MediaWiki

iPoid's REST API is accessed via a MediaWiki extension SecurityApi. It will receive requests for this data from MediaWiki and provides access through its RESTful API.

Other Information

Timeline: Jan 2023 although whatever would go up then wouldn’t be production ready. Unknown production ready date.
Diagram:

image.png (483×1 px, 112 KB)

Technologies: node.js, mariaDB
Point person: @sbassett, @Reedy, @Mstyles, @STran

Notes:

  • Possible caching? Data expected to be refreshed daily.
  • @SCherukuwada asked if this had to use a relational database and I don't have a good answer. @sbassett originally specced the schemas and might have a better informed answer. Perhaps a DBA could weigh in?

Event Timeline

I'm aware this is a duplicate of T290917: New Service Request Security API Gateway but I made it anyway because:

  • afaik, the the scope of security-api has changed (for now). Whatever's being implemented is for IPInfo's specific use case.
  • At the time the original ticket was written, security-api was fairly conceptual and seems to have stalled because of that. Although it still needs work to be production ready, hopefully it's out of the conceptual stage enough that we can start talking about getting it deployed and finding out more concrete next steps
  • I didn't want to just edit the ticket but we've been discussing deploying security-api for a week or two now and consensus seems to be that it's better to get what we have in front of SREs eyes sooner rather than later

If I've put the horse before the cart, please feel free to merge/close as you see fit. I believe I've tagged the involved parties and apologies if I've missed you.

akosiaris subscribed.

Triaging for serviceops, removing SRE.

  • afaik, the the scope of security-api has changed (for now). Whatever's being implemented is for IPInfo's specific use case.

Yes and no, IMO. Yes, the IPInfo use-case is driving this a bit more now, than say, the community efforts from T265845, but I believe that both use-cases would leverage the service in a similar fashion, just with the community efforts using SecurityApi and IPInfo talking to the node service endpoints directly within Wikimedia production.

  • At the time the original ticket was written, security-api was fairly conceptual and seems to have stalled because of that. Although it still needs work to be production ready, hopefully it's out of the conceptual stage enough that we can start talking about getting it deployed and finding out more concrete next steps

I think it probably is, though we'll need to reevaluate that status and necessity of the remaining sub-tasks under the old task, T290917.

  • I didn't want to just edit the ticket but we've been discussing deploying security-api for a week or two now and consensus seems to be that it's better to get what we have in front of SREs eyes sooner rather than later

I agree.

@SCherukuwada asked if this had to use a relational database and I don't have a good answer. @sbassett originally specced the schemas and might have a better informed answer. Perhaps a DBA could weigh in?

We had considered a few different options but the guidance from SRE here: T301428#7730915 lead to T305114.

@Joe Suman said you were the person to talk to regarding next steps?

@Joe Suman said you were the person to talk to regarding next steps?

Hi @STran, first of all sorry if it took this long to get back to you!

I'm happy to assist with the next steps. I will schedule a meeting, but if you have documents besides phabricator I can read to get acquainted with how security-api works, can you point me to them?

@STran

Hi, should we move this forward? I think as @Joe says, we 'll need to sync up a bit to see how to best move forward with deployment on our platform.

Yes I'm so sorry! This slipped my mind. I wrote up some internal documentation for the team that might be useful in this case: https://docs.google.com/document/d/1CqnWfwhjiEoQMK1mCWjcikgjMhdAVfoDL3f_Q-f7elg/

I can follow up on slack to set a meeting up with @Joe if we think that's the best next step.

Yes I'm so sorry! This slipped my mind. I wrote up some internal documentation for the team that might be useful in this case: https://docs.google.com/document/d/1CqnWfwhjiEoQMK1mCWjcikgjMhdAVfoDL3f_Q-f7elg/

That's useful, thanks!

I can follow up on slack to set a meeting up with @Joe if we think that's the best next step.

👍

I can follow up on slack to set a meeting up with @Joe if we think that's the best next step.

Feel free to add myself and @Mstyles to that meeting, if you'd like.

jijiki renamed this task from New Service Request 'security-api' to New Service Request 'IPoid'.May 9 2023, 10:05 AM
jijiki triaged this task as High priority.
jijiki updated the task description. (Show Details)
jijiki renamed this task from New Service Request 'IPoid' to New Service Request 'iPoid'.May 10 2023, 12:47 PM
jijiki updated the task description. (Show Details)

Change 922808 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[labs/private@master] kubernetes.yaml: add iPoid user/tokens

https://gerrit.wikimedia.org/r/922808

Change 922845 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/puppet@production] ipoid: deployment_server stanzas

https://gerrit.wikimedia.org/r/922845

Change 922845 merged by Effie Mouzeli:

[operations/puppet@production] ipoid: deployment_server stanzas

https://gerrit.wikimedia.org/r/922845

Change 922808 abandoned by Effie Mouzeli:

[labs/private@master] kubernetes.yaml: add iPoid user/tokens

Reason:

rebase hell

https://gerrit.wikimedia.org/r/922808

Change 928473 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/dns@master] ipoid: add records

https://gerrit.wikimedia.org/r/928473

Change 928473 merged by Effie Mouzeli:

[operations/dns@master] ipoid: add records

https://gerrit.wikimedia.org/r/928473

Change 928487 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/puppet@production] service.yaml: add iPoid to the service catalogue

https://gerrit.wikimedia.org/r/928487

Quick Note: Currently iPoid's database, m5-master.eqiad.wmnet is anchored to eqiad for writes, while in can read from m5-master.codfw.wmnet, that means that, the service will be active/active from the user perspective, but its cronjob, which is the only path where there are writes in the database, will run always from eqiad.

In other words, we have to not forget to make sure that any cronjobs that perform writes, need to only (and always) run on eqiad.

Change 988453 had a related patch set uploaded (by Kamila Součková; author: Kamila Součková):

[operations/puppet@production] Add ipoid to the service mesh

https://gerrit.wikimedia.org/r/988453

Change 988482 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[operations/mediawiki-config@master] ProductionServices: Add entry for ipoid

https://gerrit.wikimedia.org/r/988482

Change 988453 merged by Effie Mouzeli:

[operations/puppet@production] Add ipoid to the service mesh

https://gerrit.wikimedia.org/r/988453

Change 928487 merged by Effie Mouzeli:

[operations/puppet@production] service.yaml: add iPoid to the service catalogue

https://gerrit.wikimedia.org/r/928487

Change 989829 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/puppet@production] services_proxy: Add ipoid to the service mesh (fix)

https://gerrit.wikimedia.org/r/989829

Change 989829 merged by Effie Mouzeli:

[operations/puppet@production] services_proxy: Add ipoid to the service mesh (fix)

https://gerrit.wikimedia.org/r/989829

Change 988482 merged by jenkins-bot:

[operations/mediawiki-config@master] ProductionServices: Add entry for ipoid

https://gerrit.wikimedia.org/r/988482

Mentioned in SAL (#wikimedia-operations) [2024-01-11T14:51:11Z] <reedy@deploy2002> Synchronized wmf-config/: T325147 (duration: 06m 43s)

Change 995005 had a related patch set uploaded (by Clément Goubert; author: Clément Goubert):

[operations/puppet@production] ipoid: Fix probe definition

https://gerrit.wikimedia.org/r/995005

Change 995005 merged by Clément Goubert:

[operations/puppet@production] ipoid: Fix probe definition

https://gerrit.wikimedia.org/r/995005