Given the specific nature of wikifunctions, the SRE team has evaluated that even opening the execution of functions to the general public constitutes a risk that is unacceptable if wikifunctions shares the php worker pool with the rest of production. Given the current (and future, AIUI) performance of the system expected to be in the order of seconds per function call, we certainly want to contain the possible blast radius of the problem.
To this end we need the following:
- set up a new deployment of mediawiki on k8s,
possibly under ingress - Set up the corresponding entry in service::catalog, including discovery dns
- Modify the traffic layer routing logic to separate out wikifunctions.
Probably it makes sense to do so in mw-on-k8s.lua. - Add service-mesh listeners for mw-wikifunctions
- Change wikifunctions mesh listener to use the separate deployment (mw-wikifunctions-ro) instead of mw-api-int for api calls
- Add networkpolicy rule allowing wikifunctions to connect to mw-wikifunctions