We currently configure our data engineering apps specifying the YARN domain to be yarn.wikimedia.org, which is a publicly accessible domain.

When deploying airflow in Kubernetes, we might need to define an external_services entry to allow egress to the domain.

The issue is: yarn.wikimedia.org is a CNAME record that points to dyna.wikimedia.org, the domain serving our ATS reverse proxy. So by allowing egress traffic to yarn.wikimedia.org, we virtually enable egress traffic to all domains proxied by ATS. It might be more prudent to configure Apache with an additional, internal, vhost, such as yarn.discovery.wnnet.