Page MenuHomePhabricator
Create Task
Maniphest T357750

Phase out cergen
Closed, ResolvedPublic
Actions

Description

cergen is currently only installed on puppetmaster1001 by means of the cergen Puppet class. Even building cergen for Buster proved to be challenging back then, as it needs python-networkx 1 and even back then needed python3-lib2to3 (https://phabricator.wikimedia.org/T235405)

There are curently 48 services defined in certificate.manifests.d which use the Puppet 5 CA (authority: puppet_ca), we should probably just fix forward and move them all to the PKI/cfssl (some might also no longer be in use and just need cleaning up):

Data Engineering:

Collaboration Services:

ServiceOps:

  • chartmuseum.certs.yaml T360636
  • docker_registry.certs.yaml T360636
  • _etcd-server-ssl._tcp.v3.certs.yaml T352245
  • etcd-v3.certs.yaml T352245
  • etcd-v3-eqiad.certs.yaml T352245
  • mediawiki.certs.yaml (will be obsoleted when all legacy deployments are moved to wikikube) T360636
  • mwmaint.certs.yaml (used by noc.w.o which is already on wikikube, should be just a cleanup) T360636
  • parsoid.certs.yaml (will be obsoleted when all legacy deployments are moved to wikikube) T359387
  • restbase.certs.yaml T360636
  • testreduce.certs.yaml T360636
  • maps/karthoterian T360778

Infrastructure Foundations:

  • config-master.certs.yaml
  • debmonitor.certs.yaml
  • puppet_ca.certs.yaml (will be phased out along with Puppet 5)

Observability:

frtech:

  • kafka_fundraising_client.certs.yaml T360779

Cloud Services:

Traffic:

Search:

Data Persistence:

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
Remove various stub certs for now removed cergen certslabs/privatemaster+0 -28
tlsproxy::envoy: Remove support for legacy sslcert provideroperations/puppetproduction+5 -47
sslcert::certificate: Remove use_cergenoperations/puppetproduction+2 -19
varnishkafka: Remove some obsolete references to cergenoperations/puppetproduction+4 -11
Remove cergenoperations/puppetproduction+0 -34
Remove build hooks once needed to be build cergenoperations/puppetproduction+0 -19
Remove documentation about the legacy way to configure TLS for Kafkaoperations/puppetproduction+1 -32
Remove stub certs for ms-felabs/privatemaster+0 -2
Remove obsolete rendering stub certslabs/privatemaster+0 -6
Remove obsolete stub cert for config-masterlabs/privatemaster+0 -1
Remove obsolete config-master cergen certoperations/puppetproduction+0 -26
Remove obsolete parsoid recordsoperations/dnsmaster+0 -4
Remove obsolete rendering certsoperations/puppetproduction+0 -84
labs-private: Remove parsoid stub secretslabs/privatemaster+0 -9
Remove old parsoid certsoperations/puppetproduction+0 -128
tlsproxy::localssl: Remove support for cergen certsoperations/puppetproduction+4 -37
Remove obsolete wikikube etcd certificatesoperations/puppetproduction+0 -50
Remove ms-fe certsoperations/puppetproduction+0 -52
Remove obsolete wikikube/staging etcd certificatesoperations/puppetproduction+0 -52
Inline profile::swift::proxy_tlsoperations/puppetproduction+7 -13
profile::swift::proxy_tls: Use Envoy unconditionally and drop Hiera flagoperations/puppetproduction+1 -19
Stop supporting sslcert in Profile::Pki::Provider typeoperations/puppetproduction+1 -1
Remove dummy cert for debmonitorlabs/privatemaster+0 -3
debmonitor: Remove obsolete discovery certificateoperations/puppetproduction+0 -24
hieradata: use cfssl for cloudweb in eqiadoperations/puppetproduction+8 -1
Add component/cergen for Bookwormoperations/puppetproduction+1 -0
Show related patches Customize query in gerrit

Related Objects
Search...

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
MoritzMuehlenhoff updated the task description. (Show Details)Apr 17 2024, 7:16 AM
Dzahn closed subtask T360413: Phase out cergen for Collaboration Services services as Resolved.Apr 18 2024, 9:47 PM
Dzahn updated the task description. (Show Details)
Dzahn updated the task description. (Show Details)Apr 18 2024, 11:11 PM
MoritzMuehlenhoff updated the task description. (Show Details)Apr 25 2024, 3:22 PM
BTullis updated the task description. (Show Details)Apr 26 2024, 5:00 PM
andrea.denisse updated the task description. (Show Details)Apr 29 2024, 3:12 PM
andrea.denisse updated the task description. (Show Details)Apr 29 2024, 6:30 PM
bking closed subtask T360439: Phase out cergen for Search Platform services as Resolved.May 1 2024, 1:23 PM
MoritzMuehlenhoff updated the task description. (Show Details)May 2 2024, 12:58 PM
elukey mentioned this in T356412: Consolidate TLS cert puppetry for ms and thanos swift frontends.May 2 2024, 4:12 PM
andrea.denisse updated the task description. (Show Details)May 2 2024, 5:47 PM
gerritbot added a comment.May 3 2024, 8:58 AM

Change #1026804 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Stop supporting sslcert in Profile::Pki::Provider type

https://gerrit.wikimedia.org/r/1026804

gerritbot added a comment.May 7 2024, 1:50 PM

Change #1026804 merged by Muehlenhoff:

[operations/puppet@production] Stop supporting sslcert in Profile::Pki::Provider type

https://gerrit.wikimedia.org/r/1026804

gerritbot added a comment.May 8 2024, 8:53 AM

Change #1029128 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] profile::swift::proxy_tls: Use Envoy unconditionally and drop Hiera flag

https://gerrit.wikimedia.org/r/1029128

gerritbot added a comment.May 8 2024, 9:50 AM

Change #1029140 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Inline profile::swift::proxy_tls

https://gerrit.wikimedia.org/r/1029140

andrea.denisse closed subtask T360414: Phase out cergen for Observability services as Resolved.May 9 2024, 2:17 PM
andrea.denisse updated the task description. (Show Details)May 9 2024, 4:15 PM
MoritzMuehlenhoff updated the task description. (Show Details)May 10 2024, 5:54 AM
Jgreen closed subtask T360779: Phase out cergen for Fundraising services as Resolved.May 13 2024, 5:49 PM
Jgreen reopened subtask T360779: Phase out cergen for Fundraising services as Open.May 13 2024, 5:59 PM
Jgreen closed subtask T360779: Phase out cergen for Fundraising services as Resolved.May 13 2024, 6:28 PM
gerritbot added a comment.May 14 2024, 10:33 AM

Change #1029128 merged by Muehlenhoff:

[operations/puppet@production] profile::swift::proxy_tls: Use Envoy unconditionally and drop Hiera flag

https://gerrit.wikimedia.org/r/1029128

gerritbot added a comment.May 14 2024, 11:22 AM

Change #1029140 merged by Muehlenhoff:

[operations/puppet@production] Inline profile::swift::proxy_tls

https://gerrit.wikimedia.org/r/1029140

elukey changed the status of subtask T356412: Consolidate TLS cert puppetry for ms and thanos swift frontends from Open to Stalled.May 15 2024, 2:42 PM
Pppery removed a project: Patch-For-Review.May 21 2024, 6:10 PM
gerritbot added a comment.May 24 2024, 6:55 AM

Change #1035631 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] tlsproxy::envoy: Remove support for legacy sslcert provider

https://gerrit.wikimedia.org/r/1035631

gerritbot added a project: Patch-For-Review.May 24 2024, 6:55 AM
MoritzMuehlenhoff added a parent task: T365798: Shutdown of Puppet 5 servers.May 24 2024, 10:39 AM
gerritbot added a comment.May 29 2024, 8:09 AM

Change #1036998 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove obsolete wikikube/staging etcd certificates

https://gerrit.wikimedia.org/r/1036998

gerritbot added a comment.May 29 2024, 8:28 AM

Change #1037002 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove obsolete wikikube etcd certificates

https://gerrit.wikimedia.org/r/1037002

elukey closed subtask T356412: Consolidate TLS cert puppetry for ms and thanos swift frontends as Resolved.May 29 2024, 1:32 PM
elukey updated the task description. (Show Details)
gerritbot added a comment.May 29 2024, 1:38 PM

Change #1037074 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove ms-fe certs

https://gerrit.wikimedia.org/r/1037074

gerritbot added a comment.Jun 3 2024, 7:39 AM

Change #1036998 merged by Muehlenhoff:

[operations/puppet@production] Remove obsolete wikikube/staging etcd certificates

https://gerrit.wikimedia.org/r/1036998

MoritzMuehlenhoff updated the task description. (Show Details)Jun 3 2024, 8:02 AM
gerritbot added a comment.Jun 3 2024, 1:42 PM

Change #1037074 merged by Muehlenhoff:

[operations/puppet@production] Remove ms-fe certs

https://gerrit.wikimedia.org/r/1037074

MoritzMuehlenhoff updated the task description. (Show Details)Jun 5 2024, 10:53 AM
gerritbot added a comment.Jun 13 2024, 7:30 AM

Change #1042898 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] tlsproxy::localssl: Remove support for cergen certs

https://gerrit.wikimedia.org/r/1042898

MoritzMuehlenhoff updated the task description. (Show Details)Jun 13 2024, 10:31 AM
MoritzMuehlenhoff mentioned this in T368023: Move the private Puppet repository to puppetserver1001.Jun 20 2024, 8:47 AM
gerritbot added a comment.Jun 20 2024, 11:38 AM

Change #1037002 merged by Muehlenhoff:

[operations/puppet@production] Remove obsolete wikikube etcd certificates

https://gerrit.wikimedia.org/r/1037002

gerritbot added a comment.Sep 4 2024, 3:56 PM

Change #1042898 merged by Ryan Kemper:

[operations/puppet@production] tlsproxy::localssl: Remove support for cergen certs

https://gerrit.wikimedia.org/r/1042898

gerritbot added a comment.Sep 13 2024, 12:35 PM

Change #1072737 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove old parsoid certs

https://gerrit.wikimedia.org/r/1072737

gerritbot added a comment.Sep 13 2024, 12:35 PM

Change #1072738 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[labs/private@master] labs-private: Remove parsoid stub secrets

https://gerrit.wikimedia.org/r/1072738

gerritbot added a comment.Sep 13 2024, 2:51 PM

Change #1072737 merged by Alexandros Kosiaris:

[operations/puppet@production] Remove old parsoid certs

https://gerrit.wikimedia.org/r/1072737

gerritbot added a comment.Sep 13 2024, 2:51 PM

Change #1072738 merged by Alexandros Kosiaris:

[labs/private@master] labs-private: Remove parsoid stub secrets

https://gerrit.wikimedia.org/r/1072738

Muehlenhoff mentioned this in rLPRI92ec426bd176: labs-private: Remove parsoid stub secrets.Sep 13 2024, 3:15 PM
MoritzMuehlenhoff updated the task description. (Show Details)Sep 18 2024, 11:00 AM
MoritzMuehlenhoff closed subtask T360506: Migrate purged away from cergen-issued certificate as Resolved.Sep 19 2024, 9:59 AM
gerritbot added a comment.Sep 24 2024, 9:48 AM

Change #1075152 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove obsolete rendering certs

https://gerrit.wikimedia.org/r/1075152

gerritbot added a comment.Sep 26 2024, 1:40 PM

Change #1075152 merged by Muehlenhoff:

[operations/puppet@production] Remove obsolete rendering certs

https://gerrit.wikimedia.org/r/1075152

gerritbot added a comment.Sep 26 2024, 1:41 PM

Change #1075922 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove obsolete config-master cergen cert

https://gerrit.wikimedia.org/r/1075922

gerritbot added a comment.Oct 15 2024, 10:35 AM

Change #1080254 had a related patch set uploaded (by Clément Goubert; author: Clément Goubert):

[operations/dns@master] Remove obsolete parsoid records

https://gerrit.wikimedia.org/r/1080254

gerritbot added a comment.Oct 15 2024, 10:40 AM

Change #1080254 merged by Clément Goubert:

[operations/dns@master] Remove obsolete parsoid records

https://gerrit.wikimedia.org/r/1080254

gerritbot added a comment.Oct 24 2024, 12:14 PM

Change #1075922 merged by Muehlenhoff:

[operations/puppet@production] Remove obsolete config-master cergen cert

https://gerrit.wikimedia.org/r/1075922

gerritbot added a comment.Oct 29 2024, 11:19 AM

Change #1084058 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[labs/private@master] Remove obsolete stub cert for config-master

https://gerrit.wikimedia.org/r/1084058

gerritbot added a comment.Oct 29 2024, 12:22 PM

Change #1084058 merged by Muehlenhoff:

[labs/private@master] Remove obsolete stub cert for config-master

https://gerrit.wikimedia.org/r/1084058

MoritzMuehlenhoff updated the task description. (Show Details)Oct 29 2024, 12:42 PM
MoritzMuehlenhoff updated the task description. (Show Details)
gerritbot added a comment.Oct 29 2024, 3:48 PM

Change #1084149 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[labs/private@master] Remove obsolete rendering stub certs

https://gerrit.wikimedia.org/r/1084149

gerritbot added a comment.Oct 29 2024, 3:48 PM

Change #1084150 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[labs/private@master] Remove stub certs for ms-fe

https://gerrit.wikimedia.org/r/1084150

gerritbot added a comment.Oct 29 2024, 3:58 PM

Change #1084149 merged by Muehlenhoff:

[labs/private@master] Remove obsolete rendering stub certs

https://gerrit.wikimedia.org/r/1084149

gerritbot added a comment.Oct 30 2024, 1:46 PM

Change #1084150 merged by Muehlenhoff:

[labs/private@master] Remove stub certs for ms-fe

https://gerrit.wikimedia.org/r/1084150

Stashbot added a comment.Apr 14 2025, 12:43 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-14T12:43:45Z] <moritzm> remove ganeti01.svc.eqsin.wmnet cert (replaced by cfssl cert) T357750

Stashbot added a comment.Apr 14 2025, 12:46 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-14T12:46:05Z] <moritzm> remove ganeti01.svc.ulsfo.wmnet cert (replaced by cfssl cert) T357750

Stashbot added a comment.Apr 14 2025, 12:49 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-14T12:49:37Z] <moritzm> remove ganeti01.svc.esams.wmnet cert (replaced by cfssl cert) T357750

Stashbot added a comment.Apr 14 2025, 12:53 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-14T12:53:06Z] <moritzm> remove ganeti01.svc.codfw.wmnet cert (replaced by cfssl cert) T357750

Stashbot added a comment.Apr 14 2025, 1:00 PM

Mentioned in SAL (#wikimedia-operations) [2025-04-14T13:00:58Z] <moritzm> remove ganeti01.svc.eqiad.wmnet cert (replaced by cfssl cert) T357750

hashar mentioned this in T335765: Migrate all CI jobs from buster to bullseye or later and drop buster testing support.Jul 11 2025, 1:20 PM
hashar added a parent task: T335765: Migrate all CI jobs from buster to bullseye or later and drop buster testing support.
LSobanski awarded a token.Nov 24 2025, 12:30 PM
JMeybohm closed subtask T360636: Phase out cergen for ServiceOps services as Resolved.Dec 16 2025, 1:01 PM
MoritzMuehlenhoff reopened subtask T360636: Phase out cergen for ServiceOps services as Open.Dec 16 2025, 1:23 PM
gerritbot added a comment.Jan 21 2026, 2:08 PM

Change #1229573 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove documentation about the legacy way to configure TLS for Kafka

https://gerrit.wikimedia.org/r/1229573

gerritbot added a comment.Jan 21 2026, 4:11 PM

Change #1229573 merged by Muehlenhoff:

[operations/puppet@production] Remove documentation about the legacy way to configure TLS for Kafka

https://gerrit.wikimedia.org/r/1229573

MoritzMuehlenhoff closed subtask T360636: Phase out cergen for ServiceOps services as Resolved.Jan 22 2026, 11:11 AM
MoritzMuehlenhoff updated the task description. (Show Details)Feb 13 2026, 9:54 AM
MoritzMuehlenhoff closed subtask T364622: Review/cleanup content of /srv/git/private/modules/secret/secrets/ssl in the private repo as Resolved.Feb 17 2026, 11:28 AM
gerritbot added a comment.Feb 17 2026, 11:32 AM

Change #1239912 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove cergen

https://gerrit.wikimedia.org/r/1239912

gerritbot added a comment.Feb 17 2026, 11:55 AM

Change #1239915 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove build hooks once needed to be build cergen

https://gerrit.wikimedia.org/r/1239915

gerritbot added a comment.Feb 17 2026, 12:04 PM

Change #1239915 merged by Muehlenhoff:

[operations/puppet@production] Remove build hooks once needed to be build cergen

https://gerrit.wikimedia.org/r/1239915

gerritbot added a comment.Feb 17 2026, 12:17 PM

Change #1239921 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] varnishkafka: Remove some obsolete references to cergen

https://gerrit.wikimedia.org/r/1239921

gerritbot added a comment.Feb 17 2026, 1:20 PM

Change #1239912 merged by Muehlenhoff:

[operations/puppet@production] Remove cergen

https://gerrit.wikimedia.org/r/1239912

gerritbot added a comment.Feb 17 2026, 2:07 PM

Change #1239921 merged by Muehlenhoff:

[operations/puppet@production] varnishkafka: Remove some obsolete references to cergen

https://gerrit.wikimedia.org/r/1239921

hashar mentioned this in T417887: Archive the cergen repository.Feb 19 2026, 1:13 PM
hashar added a subtask: T417887: Archive the cergen repository.
hashar removed a parent task: T335765: Migrate all CI jobs from buster to bullseye or later and drop buster testing support.
hashar closed subtask T417887: Archive the cergen repository as Resolved.Feb 19 2026, 1:29 PM
gerritbot added a comment.Feb 19 2026, 2:49 PM

Change #1240711 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] sslcert::certificate: Remove use_cergen

https://gerrit.wikimedia.org/r/1240711

gerritbot added a comment.Feb 19 2026, 3:22 PM

Change #1240711 merged by Muehlenhoff:

[operations/puppet@production] sslcert::certificate: Remove use_cergen

https://gerrit.wikimedia.org/r/1240711

gerritbot added a comment.Feb 19 2026, 3:31 PM

Change #1035631 merged by Muehlenhoff:

[operations/puppet@production] tlsproxy::envoy: Remove support for legacy sslcert provider

https://gerrit.wikimedia.org/r/1035631

Maintenance_bot removed a project: Patch-For-Review.Feb 19 2026, 4:32 PM
gerritbot added a comment.Feb 20 2026, 8:58 AM

Change #1240866 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[labs/private@master] Remove various stub certs for now removed cergen certs

https://gerrit.wikimedia.org/r/1240866

gerritbot added a project: Patch-For-Review.Feb 20 2026, 8:58 AM

Change #1240866 merged by Muehlenhoff:

[labs/private@master] Remove various stub certs for now removed cergen certs

https://gerrit.wikimedia.org/r/1240866

MoritzMuehlenhoff closed this task as Resolved.Feb 20 2026, 9:12 AM

cergen is fully undeployed from our infrastructure: All certificates have been migrated to the PKI (or in some cases were obsoleted like some certs only relevant for baremetal Mediawiki), all old certificates were cleaned up (with the exception of two old Puppet CA certs which might still be needed to decrypt old backups) and cergen were removed from Puppet.

Maintenance_bot removed a project: Patch-For-Review.Feb 20 2026, 9:31 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits