@Ciell reported the issue this weekend. All of my investigations lead to this error.

I confirmed that the issue persists when calling ores-legacy. E.g.

$.ajax({url: "https://ores-legacy.wikimedia.org/v3/scores/"}).done(function(response){console.log(response)})

I confirm this bug on enwiki in the user script https://en.wikipedia.org/wiki/User:Evad37/rater, which has 1200 installs. The CORS error is:

Access to XMLHttpRequest at 'https://ores.wikimedia.org/v3/scores/enwiki?models=articlequality&revids=1164786582' from origin 'https://en.wikipedia.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

See also: https://en.wikipedia.org/wiki/User_talk:Evad37/rater.js#Missing_ORES_predication

The red in the screenshot below is probably a side effect of this:

I confirm the Rater user-script can no longer use ORES in for enwiki.

Change 960763 had a related patch set uploaded (by Ilias Sarantopoulos; author: Ilias Sarantopoulos):

[machinelearning/liftwing/inference-services@main] ores-legacy: fix CORS headers

https://gerrit.wikimedia.org/r/960763

Change 960763 merged by jenkins-bot:

[machinelearning/liftwing/inference-services@main] ores-legacy: fix CORS headers and avoid redirects

https://gerrit.wikimedia.org/r/960763

Change 960998 had a related patch set uploaded (by Ilias Sarantopoulos; author: Ilias Sarantopoulos):

[operations/deployment-charts@master] ml-services: allows CORS in ores-legacy

https://gerrit.wikimedia.org/r/960998

Change 960998 merged by jenkins-bot:

[operations/deployment-charts@master] ml-services: allows CORS in ores-legacy

https://gerrit.wikimedia.org/r/960998

Change 961044 had a related patch set uploaded (by Ilias Sarantopoulos; author: Ilias Sarantopoulos):

[machinelearning/liftwing/inference-services@main] ores-legacy: fix allowed cross origins

https://gerrit.wikimedia.org/r/961044

Change 961044 merged by jenkins-bot:

[machinelearning/liftwing/inference-services@main] ores-legacy: fix allowed cross origins

https://gerrit.wikimedia.org/r/961044

Change 961106 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] role::cache::text: set pass for ores.wikimedia.org

https://gerrit.wikimedia.org/r/961106

Change 961106 merged by Elukey:

[operations/puppet@production] role::cache::text: set pass for ores.wikimedia.org

https://gerrit.wikimedia.org/r/961106

I applied the following config to both ml-serve-eqiad and codfw:

# kubectl edit vs -n ores-legacy
[..] 
 - corsPolicy:
      allowCredentials: false
      allowHeaders:
      - Api-User-Agent
      allowMethods:
      - POST
      - GET
      allowOrigins:
      - exact: '*'

This option is not allowed in the deployment-charts' ingress config, we'll need to add it to make it permanent, but the above should fix ores-legacy for the time being. We should also revert the code added to ores-legacy to support CORS, since we'll handle it directly via istio/envoy configs.

Petscan also depends on this. Or to be more exact it assumes calback parameter is available to avoid CORS issues.

Petscan is dead because of this (white page).

This fails with a syntax error (returns JSON, should return a function):

	$.getJSON ( 'https://ores.wikimedia.org/v3/scores/?callback=?' , function ( d ) {
		console.log ( d );
	} , 'json' ) ;

I am no longer able to reproduce this. Thank you for the quick patches. Can probably mark this as resolved, but will let the machine learning team make the decision on that in case they want to track it on their kanban board.

Note that Petscan is still broken over in T347367: ORES possibly blocking PetScan from loading? / T347317: petscan expects javascript function callback from ORES due to a different issue.

I can confirm the scripts on Dutch Wikipedia are working again.
As far as I can see, same for en-wp.

The issue has indeed been fixed. We will resolve this task as soon we apply the permanent fix descibed by @elukey above.

Change 961730 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/deployment-charts@master] Upgrade mesh and ingress modules for python-webapp

https://gerrit.wikimedia.org/r/961730

Change 961731 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/deployment-charts@master] ml-services: enable base CORS headers policy for ores-legacy

https://gerrit.wikimedia.org/r/961731

Change 961730 merged by Elukey:

[operations/deployment-charts@master] Upgrade mesh and ingress modules for python-webapp

https://gerrit.wikimedia.org/r/961730

Change 961731 merged by Elukey:

[operations/deployment-charts@master] ml-services: enable base CORS headers policy for ores-legacy

https://gerrit.wikimedia.org/r/961731