Page MenuHomePhabricator

Remove hardcoded hostnames from the DPE Kubernetes applications configuration
Open, MediumPublic

Assigned To
None
Authored By
brouberol
Jun 12 2024, 9:53 AM
Referenced Files
F55260271: image.png
Jun 12 2024, 9:55 AM
F55260157: Screenshot 2024-06-12 at 11.49.12.png
Jun 12 2024, 9:53 AM
F55260158: Screenshot 2024-06-12 at 11.49.02.png
Jun 12 2024, 9:53 AM
F55260159: Screenshot 2024-06-12 at 11.49.25.png
Jun 12 2024, 9:53 AM

Description

We have multiple applications that connect to external services, such as presto, MySQL/MariaDB, PostgresSQL, Druid, Kafka, Zookeeper, etc, via hostnames.

Examples in Superset

Screenshot 2024-06-12 at 11.49.25.png (994×718 px, 73 KB)

Screenshot 2024-06-12 at 11.49.02.png (992×830 px, 84 KB)

Screenshot 2024-06-12 at 11.49.12.png (1,002×758 px, 67 KB)

Datahub-next uses the following configuration

global:
  kafka:
    bootstrap:
      server: "kafka-test1006.eqiad.wmnet:9092"
    zookeeper:
      server: "zookeeper-test1002.eqiad.wmnet:2181"
    schemaregistry:
      type: "INTERNAL"
  sql:
    datasource:
      host: "an-test-coord1001.eqiad.wmnet:3306"
      hostForMysqlClient: "an-test-coord1001.eqiad.wmnet"
      port: "3306"
      url: "jdbc:mysql://an-test-coord1001.eqiad.wmnet:3306/datahub?verifyServerCertificate=true&useSSL=true&useUnicode=yes&characterEncoding=UTF-8&enabledTLSProtocols=TLSv1.2"
      driver: "com.mysql.cj.jdbc.Driver"

Ideally, we could try to rely on CNAMEs or even on internal DNS records exposed by our external-services setup (see T331894).

The ultimate goal would be to decorrelate machine names from application deployments, so we don't have to kickstart redeploys when a host changes.

Event Timeline

image.png (3,582×2,002 px, 187 KB)

It seems that using the analytics-presto.eqiad.wmnet would work well in Superset.

General thought: if we plan to make it possible to connect to a service using one of the <service>.external-services, <service>.external-services.svc or <service>.external-services.svc.cluster.local service names from within Kube, with x509 hostname verification enabled, then we'd need to make it easy to add these names as certificate SANs.

Gehel triaged this task as Medium priority.Jun 18 2024, 8:47 AM
Gehel moved this task from Incoming to Scratch on the Data-Platform-SRE board.