Page MenuHomePhabricator

Can't connect to database replicas via PAWS
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

  • Open PAWS
  • Attempt to connect to one of the database replicas:
import pymysql
pymysql.connect(
    host="enwikisource.analytics.db.svc.wikimedia.cloud",
    read_default_file=".my.cnf",
    database="enwikisource_p"
)

What happens?:

OperationalError: (2003, "Can't connect to MySQL server on 'enwikisource.analytics.db.svc.wikimedia.cloud' (timed out)")

What should have happened instead?:

The connection should have succeeded

Based on timing alone, this is likely related to T325812

Event Timeline

This seems to be the new networkpolicy blocking private ip addresses.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: singleuser
spec:
  egress:
(...)
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12 # this impact replicas
        - 192.168.0.0/16
        - 169.254.169.254/32

If I'm understanding that network policy shouldn't 172.16.1.129 be permitted under 172.16.0.0/12?

If I'm understanding that network policy shouldn't 172.16.1.129 be permitted under 172.16.0.0/12?

Glad I'm not the only one to read that as the sane interpretation. But no, egress is the list of allowed destinations, cidr: 0.0.0.0/0 is allowed, except for the private spaces listed. I'm making a PR.

Oh wait, looks like that isn't allowing all the ports...

I added

- ports:
  - port: 3306
    protocol: TCP

And it seems to be working, though it wouldn't survive a helm upgrade