Will this be moot after the move to k8s, or is this blocking the move to k8s?

In T371592#10081520, @Andrew wrote:

Will this be moot after the move to k8s, or is this blocking the move to k8s?

This is blocking the move to k8s since the SREs have decided not to support PHP's ldap library in k8s.

Right, but after the sul migration the ldap extension will be dead code, right? Or does it need to be explicitly removed?

In T371592#10082373, @Andrew wrote:

Right, but after the sul migration the ldap extension will be dead code, right? Or does it need to be explicitly removed?

This removal from the MediaWiki LocalSettings.php chain used by wikitech is part of the SUL migration. In reality I expect this task is just a required step in the config changes that implement its T371588: wikitech self-auth: Allow wikitech to use its own internal authentication parent. Once MediaWiki-extensions-LdapAuthentication is removed from the config MediaWiki will default to local auth as the default provider in MediaWiki-Core-AuthManager.

Yep, that makes sense. I was confused because it popped up in our inbox as though it was an isolated task

In T371592#10081906, @bd808 wrote:

In T371592#10081520, @Andrew wrote:

Will this be moot after the move to k8s, or is this blocking the move to k8s?

This is blocking the move to k8s since the SREs have decided not to support PHP's ldap library in k8s.

I am not sure how this misunderstanding came to be, but I want to point out that it's not the PHP LDAP library that we don't want to support. That was never the case. What we don't want is to regress from the, now improved, situation where no wiki has access to the LDAP servers (there are firewall rules now, ones that did not exist in the legacy infra) to a situation where any wiki can access them due to a single wiki needing to access them (or that we end up creating special rules for wikitech, treating differently to other wiki's we operate in wikikube)

The above is far from the only reason that we have an entire KR this quarter to move wikitech to wikikube, but let me stress again it is not about PHP's LDAP library.

In T371592#10091775, @akosiaris wrote:

In T371592#10081906, @bd808 wrote:

This is blocking the move to k8s since the SREs have decided not to support PHP's ldap library in k8s.

I am not sure how this misunderstanding came to be

4+ years of resistance by SRE to moving Wikitech off of the labscloudweb servers with vague concerns about LDAP being the most repeated concrete explanation are what informed my sense making. The information that today the concern is LDAP connectivity in general rather than the PHP extension in particular seems to be a distinction without difference from my point of view.

Change #1059339 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/mediawiki-config@master] (DNM WIP) wikitech: de-wikitech mediawiki-config

https://gerrit.wikimedia.org/r/1059339

Change #1059339 merged by jenkins-bot:

[operations/mediawiki-config@master] wikitech: de-wikitech mediawiki-config

https://gerrit.wikimedia.org/r/1059339

Mentioned in SAL (#wikimedia-operations) [2024-10-01T10:41:56Z] <jiji@deploy2002> Started scap sync-world: Backport for [[gerrit:1059339|wikitech: de-wikitech mediawiki-config (T371537 T371592 T371374 T371359)]]

Mentioned in SAL (#wikimedia-operations) [2024-10-01T10:44:23Z] <jiji@deploy2002> jiji: Backport for [[gerrit:1059339|wikitech: de-wikitech mediawiki-config (T371537 T371592 T371374 T371359)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-10-01T10:52:52Z] <jiji@deploy2002> Started scap sync-world: Backport for [[gerrit:1059339|wikitech: de-wikitech mediawiki-config (T371537 T371592 T371374 T371359)]]

Mentioned in SAL (#wikimedia-operations) [2024-10-01T10:55:17Z] <jiji@deploy2002> jiji: Backport for [[gerrit:1059339|wikitech: de-wikitech mediawiki-config (T371537 T371592 T371374 T371359)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-10-01T11:01:16Z] <jiji@deploy2002> Finished scap sync-world: Backport for [[gerrit:1059339|wikitech: de-wikitech mediawiki-config (T371537 T371592 T371374 T371359)]] (duration: 08m 23s)

Change #1076995 had a related patch set uploaded (by Ladsgroup; author: Amir Sarabadani):

[operations/mediawiki-config@master] Drop wikitech.php

https://gerrit.wikimedia.org/r/1076995

Change #1076995 merged by jenkins-bot:

[operations/mediawiki-config@master] Drop wikitech.php

https://gerrit.wikimedia.org/r/1076995

Mentioned in SAL (#wikimedia-operations) [2024-10-01T11:42:14Z] <ladsgroup@deploy2002> Started scap sync-world: Backport for [[gerrit:1076995|Drop wikitech.php (T371592 T371374)]]

Mentioned in SAL (#wikimedia-operations) [2024-10-01T11:44:24Z] <ladsgroup@deploy2002> ladsgroup: Backport for [[gerrit:1076995|Drop wikitech.php (T371592 T371374)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-10-01T11:49:47Z] <ladsgroup@deploy2002> Finished scap sync-world: Backport for [[gerrit:1076995|Drop wikitech.php (T371592 T371374)]] (duration: 07m 32s)

Change #1077345 had a related patch set uploaded (by Zabe; author: Zabe):

[operations/puppet@production] Drop WikitechPrivateSettings.php

https://gerrit.wikimedia.org/r/1077345

This probably needs a ticket to undeploy the extension altogether from our production. See T253216#9441964

Probably need to archive the extension too, which T354997: Archive the Listings extension could be used as example.

T376097: Archive the LdapAuthentication extension was already created.

Change #1078105 had a related patch set uploaded (by Jforrester; author: Jforrester):

[operations/mediawiki-config@master] wikitech: Stop loading the i18n for LdapAuthentication, no longer used

https://gerrit.wikimedia.org/r/1078105

jforrester opened https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/120

make-release: Stop branching LdapAuthentication for production

In T371592#10191571, @jijiki wrote:

LDAP extension has been removed.

Only partially.

Remaining steps:

• Remove from the i18n list
• Remove the extension from the release branch list

Change #1083305 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Stop building LdapAuthentication i10n

https://gerrit.wikimedia.org/r/1083305

Change #1083305 abandoned by Majavah:

[operations/mediawiki-config@master] Stop building LdapAuthentication i10n

https://gerrit.wikimedia.org/r/1083305

Change #1077345 abandoned by Zabe:

[operations/puppet@production] Drop WikitechPrivateSettings.php

Reason:

Removed in https://gerrit.wikimedia.org/r/c/operations/puppet/+/1081968

https://gerrit.wikimedia.org/r/1077345

reedy merged https://gitlab.wikimedia.org/repos/releng/release/-/merge_requests/120

make-release: Stop branching LdapAuthentication for production

Change #1078105 merged by jenkins-bot:

[operations/mediawiki-config@master] wikitech: Stop loading the i18n for LdapAuthentication, no longer used

https://gerrit.wikimedia.org/r/1078105

Change #1161871 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/mediawiki-config@master] wikitech: remove logging configuration for hooks

https://gerrit.wikimedia.org/r/1161871

Change #1161871 merged by jenkins-bot:

[operations/mediawiki-config@master] wikitech: remove logging configuration for hooks

https://gerrit.wikimedia.org/r/1161871

Mentioned in SAL (#wikimedia-operations) [2025-06-24T11:00:52Z] <ladsgroup@deploy1003> Started scap sync-world: Backport for [[gerrit:1161871|wikitech: remove logging configuration for hooks (T371592 T371374)]], [[gerrit:1163312|Specify caller for query builder in GlobalJsonLinks]]

Mentioned in SAL (#wikimedia-operations) [2025-06-24T11:03:04Z] <ladsgroup@deploy1003> ladsgroup, hashar: Backport for [[gerrit:1161871|wikitech: remove logging configuration for hooks (T371592 T371374)]], [[gerrit:1163312|Specify caller for query builder in GlobalJsonLinks]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-06-24T11:10:54Z] <ladsgroup@deploy1003> Finished scap sync-world: Backport for [[gerrit:1161871|wikitech: remove logging configuration for hooks (T371592 T371374)]], [[gerrit:1163312|Specify caller for query builder in GlobalJsonLinks]] (duration: 10m 01s)