Export development_network_probe data to Puppet servers for CDN deployment
Open, MediumPublic
Actions

Assigned To

Authored By

	Vgutierrez
	Aug 21 2025, 12:36 PM

Project Tags

Referenced Files

	F71570205: Screenshot 2026-01-19 at 12.35.22.png
	Jan 19 2026, 11:35 AM

Subscribers

View All 14 Subscribers

Description

As part of WE5.4.3, we need to export a subset of data that currently lives in Hive (event.development_network_probe) into the production Puppet servers.
The goal is to run a query daily, export its results, and make them available to Puppet so they can be deployed to the CDN servers.

Proposed approach (from Data Engineering feedback on Slack):

Generate the file daily on HDFS with Airflow + Spark.
Use an "archiver" to manage file naming and ensure consistency.
Configure the Puppet server to fetch the file from HDFS (e.g., via hdfs_rsync) and then deploy it to the CDN hosts.

Open questions / next steps:

Is configuring the Puppet server with HDFS access acceptable?
Do we have any existing Airflow DAG that we can use as a template? Check https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags

Acceptance criteria:

Daily job exports query results to HDFS.
Puppet server fetches and stores the file in a way usable by Puppet manifests.
File is deployed to CDN servers via the normal Puppet workflows.

Details

Other Assignee: brouberol

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
role::cache::{text,upload}: enable webrequest tagging globally	operations/puppet	production	+2 -6
role::cache::{text,upload}: enable webrequest tagging in eqsin	operations/puppet	production	+2 -0
role::cache::haproxy: move webrequest ip reputation exp to all magru	operations/puppet	production	+4 -2
P:cache::haproxy: guard webrequest IP reputation data for beta	operations/puppet	production	+17 -15
haproxy: Enable use_webrequest_ipreputation flag for cp7002/cp7012	operations/puppet	production	+2 -0
profile::cache::haproxy: add webrequest-based ip reputation data	operations/puppet	production	+34 -0
dse-k8s-services: update the base Airflow image	operations/deployment-charts	master	+1 -1
Increase the size of the WAL volume for postgresql-airflow-sre	operations/deployment-charts	master	+3 -0
profile::puppetserver: rework and fix the analytics-sre config	operations/puppet	production	+10 -7
admin: set home dir for analytics-sre	operations/puppet	production	+1 -1
profile::puppetserver: simplify analytics-sre's authorized key	operations/puppet	production	+1 -1
dse-k8s-services: add pvc config for airflow-sre	operations/deployment-charts	master	+17 -0
airflow: ensure the ssh privatekey is b64 encoded in the Secret	operations/deployment-charts	master	+2 -2
airflow: allow the definition of rsync/ssh configuration	operations/deployment-charts	master	+114 -2
airflow-sre: enable ssh access from task pods to the puppetservers	operations/deployment-charts	master	+41 -8
dse-k8s-services: add service-secrets to airflow-sre's helmfile config	operations/deployment-charts	master	+9 -1
hadoop/yarn: allow analytics-sre to submit jobs to the production queue	operations/puppet	production	+3 -3
role::puppetserver: add the analytics-sre user key and configs	operations/puppet	production	+34 -0
Provision the OIDC config for airflow-sre	operations/puppet	production	+8 -0
trafficserver: setup caching and ATS rules to publicly expose airflow-sre.w.o	operations/puppet	production	+5 -0
dse-k8s-eqiad/airflow-sre: define deploy role and TLS SAN	operations/deployment-charts	master	+4 -0
dse-k8s-eqiad: define the airflow-sre service	operations/deployment-charts	master	+71 -0
dse-k8s-eqiad: define the postgresql-airflow-sre service	operations/deployment-charts	master	+60 -0
dse-k8s-eqiad: add the airflow-sre to the ceph/PG operator tenant ns	operations/deployment-charts	master	+10 -7
Fix formatting of airflow-sre domain declarations	operations/dns	master	+2 -2
Define the airflow-sre public and internal domains	operations/dns	master	+3 -0
deployment_server: Fix group name typo	operations/puppet	production	+1 -1
Define the airflow-sre kubeconfig files	operations/puppet	production	+18 -0
Add fake kerberos keytabs for the Puppetserver hosts	labs/private	master	+0 -0
role::puppetserver: remove kerberos config	operations/puppet	production	+0 -10
WIP: profile::puppetserver::volatile: add hdfs rsync job	operations/puppet	production	+16 -0
role::puppetserver: add the profile to fetch the krb keytabs	operations/puppet	production	+1 -0
role::puppetserver: deploy kerberos keytab for analytics-sre	operations/puppet	production	+9 -0
admin: add the analytics-sre uid and gid	operations/puppet	production	+13 -2

Related Changes in GitLab:

Title	Reference	Author	Source Branch	Dest Branch
sre: fix container/pod security context for rsync task	repos/data-engineering/airflow-dags!2153	elukey	elukey_T402512_fix_security_context	main
Create the first webrequest-based pipeline for SRE	repos/data-engineering/airflow-dags!2100	elukey	elukey_T402512	main
Add the netaddr dependency and regenerate poetry's lock	repos/data-engineering/airflow-dags!2082	elukey	netaddr_dep	main
Define the sre root DAG folder	repos/data-engineering/airflow-dags!1930	brouberol	T402512	main

Customize query in GitLab

Related Objects
Search...

Status	Assigned	Task
Resolved	Joe	T398161 FY 25/26 WE 5.4.3: CDN (text) filtering rationalization
Open	None	T341649 Provide an easy way for MediaWiki to fetch aggregate data from the data lake
Open	elukey	T402512 Export development_network_probe data to Puppet servers for CDN deployment

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

In T402512#11527862, @brouberol wrote:

I can take care of spinning up the airflow instance if required @BTullis.

That would be great. Thanks.

Sure thing. I'd need a couple of details. from you @elukey, namely the defaut team name DAGs would be labeled with, as well as a default alert email for failing DAGs.

Change #1227731 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/dns@master] Define the airflow-sre public and internal domains

https://gerrit.wikimedia.org/r/1227731

Change #1227732 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] Define the airflow-sre kubeconfig files

https://gerrit.wikimedia.org/r/1227732

Change #1227733 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] Setup the caching and ATS rules to publicly expose airflow-sre.wikimedia.org

https://gerrit.wikimedia.org/r/1227733

@brouberol I'd say team name "sre" and the root wikimedia email as starter, then later on we can tune it with a different one!

For logging into the instance we can use cn=ops,ou=groups,dc=wikimedia,dc=org

Change #1227732 merged by Brouberol:

[operations/puppet@production] Define the airflow-sre kubeconfig files

https://gerrit.wikimedia.org/r/1227732

Change #1227829 had a related patch set uploaded (by Clément Goubert; author: Clément Goubert):

[operations/puppet@production] deployment_server: Fix group name typo

https://gerrit.wikimedia.org/r/1227829

Change #1227829 merged by Clément Goubert:

[operations/puppet@production] deployment_server: Fix group name typo

https://gerrit.wikimedia.org/r/1227829

Next steps:

DP to create the Airflow SRE instance.
Me and DP to configure the rsync settings and credentials to be able to push data from the DSE Cluster to the puppetservers.
Me/Chris to test the Airflow workflow and publish the first bit of data to the puppetservers.

Change #1227731 merged by Brouberol:

[operations/dns@master] Define the airflow-sre public and internal domains

https://gerrit.wikimedia.org/r/1227731

Change #1228315 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/dns@master] Fix formatting of airflow-sre domain declarations

https://gerrit.wikimedia.org/r/1228315

Change #1228315 merged by Brouberol:

[operations/dns@master] Fix formatting of airflow-sre domain declarations

https://gerrit.wikimedia.org/r/1228315

Change #1228420 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] dse-k8s-eqiad: add the airflow-sre to the ceph/PG operator tenant ns

https://gerrit.wikimedia.org/r/1228420

Change #1228421 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] dse-k8s-eqiad: define the postgresql-airflow-sre service

https://gerrit.wikimedia.org/r/1228421

Change #1228422 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] dse-k8s-eqiad: define the airflow-sre service

https://gerrit.wikimedia.org/r/1228422

Change #1228420 merged by Brouberol:

[operations/deployment-charts@master] dse-k8s-eqiad: add the airflow-sre to the ceph/PG operator tenant ns

https://gerrit.wikimedia.org/r/1228420

Change #1228421 merged by jenkins-bot:

[operations/deployment-charts@master] dse-k8s-eqiad: define the postgresql-airflow-sre service

https://gerrit.wikimedia.org/r/1228421

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/1930

Define the sre root DAG folder

@MoritzMuehlenhoff re cn=ops,ou=groups,dc=wikimedia,dc=org understood! The LDAP/Airflow role mapping is by default:

role_mappings:
  airflow-{{ $.Values.config.airflow.instance_name }}-ops: [Op]
  nda: [User]
  wmf: [User]
  ops: [Admin]

where the Op role is a powerful role, but not as powerful as admin. In our case, as we're provisioning the instance for SREs, all users will be members of ops anyway, meanining that they will all get Admin powers. There'd be no need to create the airflow-sre-ops LDAP group.

brouberol updated Other Assignee, added: brouberol.Jan 19 2026, 9:51 AM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/1930

Define the sre root DAG folder

Change #1228422 merged by Brouberol:

[operations/deployment-charts@master] dse-k8s-eqiad: define the airflow-sre service

https://gerrit.wikimedia.org/r/1228422

Change #1228437 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] dse-k8s-eqiad/airflow-sre: define deploy role and TLS SAN

https://gerrit.wikimedia.org/r/1228437

Change #1228437 merged by Brouberol:

[operations/deployment-charts@master] dse-k8s-eqiad/airflow-sre: define deploy role and TLS SAN

https://gerrit.wikimedia.org/r/1228437

Change #1227733 merged by Brouberol:

[operations/puppet@production] trafficserver: setup caching and ATS rules to publicly expose airflow-sre.w.o

https://gerrit.wikimedia.org/r/1227733

Change #1228448 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] Provision the OIDC config for airflow-sre

https://gerrit.wikimedia.org/r/1228448

Change #1228448 merged by Brouberol:

[operations/puppet@production] Provision the OIDC config for airflow-sre

https://gerrit.wikimedia.org/r/1228448

Maintenance_bot removed a project: Patch-For-Review.Jan 19 2026, 11:31 AM

https://airflow-sre.wikimedia.org has been deployed!

Screenshot 2026-01-19 at 12.35.22.png (1,435×484 px, 78 KB)

Give it a good hour for the ATS changes to propagate everywhere.

In T402512#11529638, @elukey wrote:

Next steps:

DP to create the Airflow SRE instance.

That's done now.

Me and DP to configure the rsync settings and credentials to be able to push data from the DSE Cluster to the puppetservers.

We're ready to start configuring this now, @elukey

Could you tell me which posix user will be permitted to SSH into the puppetservers, please?
Will it be a new user, specifically for this purpose, or an existing account?

We will need the following resources to be configured.

In Puppet

An ssh::userkey resource on the puppetservers - (example here.) - This is an authorized_keys file containing the public part of an SSH keypair, along with some options to restrict the source addresses. We could force the command to be rsync --server <snip> as was shown in this commit, if you would like to lock down the options as much as possible.

The corresponding SSH private key goes into the private puppet repository

A firewall::service on the puppetservers that open up port TCP/22 on the puppetservers to the DSE_KUBEPODS network. (Example: here.)

A profile::ssh::server::match_config block on the puppetservers (example here) that further restricts the options that apply to an SSH session matching this user. (e.g. AllowTcpForwarding: 'no')

In deployment-charts

A secret that contains the SSH private key mentioned earlier

ConfigMaps that contain the following:
- A known_hosts file, containing the SSH host keys for the puppet servers
- An rsync_targets file, containing the puppet server host names, and the posix username to be used
- A config file containing other useful settings, such as the ciphers to use

You can look at these examples for the files themselves, plus the way that extra-config resources can be managed by the airflow chart.

There is no corresponding way of creating arbitrary secrets in the Airflow chart, in the way that the ConfigMap objects are managed. Perhaps we will want to add this, or perhaps we could add the secret using a raw YAML object in the helmfile.yaml for airflow-sre.

Have we decided whether to use cephfs or S3 for the intermediate data store? Either is fine by me.

Change #1229590 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] role::puppetserver: add the analytics-sre user key and configs

https://gerrit.wikimedia.org/r/1229590

gerritbot added a project: Patch-For-Review.Jan 21 2026, 3:42 PM

Thanks a lot for the detailed explanation Ben! I tried to work on the Puppet part in https://gerrit.wikimedia.org/r/1229590, and I'll do the deployment-charts hopefully tomorrow. From a quick glance I am a little concerned about the need for known_hosts, since it can easily get out of sync with reimages etc.. Have you duplicated them for the dumps use case, or did you use a different approach?

Change #1229590 merged by Elukey:

[operations/puppet@production] role::puppetserver: add the analytics-sre user key and configs

https://gerrit.wikimedia.org/r/1229590

Maintenance_bot removed a project: Patch-For-Review.Jan 22 2026, 4:31 PM

Replying to my own question - in helmfile.d/dse-k8s-services/mediawiki-dumps-legacy/values-dumps.yaml I see the following:

ssh_known_hosts:
  - clouddumps1001.wikimedia.org,208.80.154.142,2620:0:861:2:208:80:154:142 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMA/Al2V+CTWWEdMJmqzhSmtn5tche1OmBxh67/g8AP7wdtUSZ6urOUZBe8lcjiAif9heJb7jwWWSNe+VCKCq0g=
  - clouddumps1002.wikimedia.org,208.80.154.71,2620:0:861:3:208:80:154:71 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBExvftUq/vgRdl20f4hKYECNRYoZNI2C789OOxz92IQBrsDU8NqgMy1o9bdfVc2acZBC3VD/LNCtiLx1kWtetro=

This is probably fine for the moment but I am pretty sure it will cause some issues down the line when a host is reimaged/changed/etc.. and people forget to update these configs. I am wondering if there is a way in external-services or similar to pick the known hosts config from the deploy's trusted list and load it to a config map in k8s.

Change #1230970 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/deployment-charts@master] dse-k8s-services: add service-secrets to airflow-sre's helmfile config

https://gerrit.wikimedia.org/r/1230970

gerritbot added a project: Patch-For-Review.Jan 23 2026, 5:13 PM

I am wondering if there is a way in external-services or similar to pick the known hosts config from the deploy's trusted list and load it to a config map in k8s.

I'll admit that I don't know atm. Do you feel like this is a hard blocker? I'm happy to create a subticket for us to investigate, but still unblock you right now and proceed with keys you'd generate in puppet.

Once the keys are generated, I'll add some functionality to the airflow chart to support the definition of the known_hosts, rsync_targets and config file (config being .ssh/config) and mounting of these files in the task pods, when defined.

That being said, if that information is defined in a hiera value, we can export it to general-<env>.yaml via global_config.pp in puppet. If it's not in a hiera, we might still be able to fetch the known hosts with a PQL query?

Change #1235837 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] hadoop/yarn: allow analytics-sre to submit jobs to the production queue

https://gerrit.wikimedia.org/r/1235837

Change #1235837 merged by Brouberol:

[operations/puppet@production] hadoop/yarn: allow analytics-sre to submit jobs to the production queue

https://gerrit.wikimedia.org/r/1235837

Change #1230970 merged by Elukey:

[operations/deployment-charts@master] dse-k8s-services: add service-secrets to airflow-sre's helmfile config

https://gerrit.wikimedia.org/r/1230970

Maintenance_bot removed a project: Patch-For-Review.Feb 2 2026, 5:32 PM

Change #1236729 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] airflow-sre: enable ssh access from task pods to the puppetservers

https://gerrit.wikimedia.org/r/1236729

gerritbot added a project: Patch-For-Review.Feb 4 2026, 1:16 PM

Change #1236756 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] airflow: allow the definition of rsync/ssh configuration

https://gerrit.wikimedia.org/r/1236756

Change #1236756 merged by Brouberol:

[operations/deployment-charts@master] airflow: allow the definition of rsync/ssh configuration

https://gerrit.wikimedia.org/r/1236756

Change #1236729 merged by Brouberol:

[operations/deployment-charts@master] airflow-sre: enable ssh access from task pods to the puppetservers

https://gerrit.wikimedia.org/r/1236729

Maintenance_bot removed a project: Patch-For-Review.Feb 4 2026, 4:31 PM

Change #1237221 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] airflow: ensure the ssh privatekey is b64 encoded in the Secret

https://gerrit.wikimedia.org/r/1237221

gerritbot added a project: Patch-For-Review.Feb 5 2026, 1:43 PM

Change #1237221 merged by Brouberol:

[operations/deployment-charts@master] airflow: ensure the ssh privatekey is b64 encoded in the Secret

https://gerrit.wikimedia.org/r/1237221

Maintenance_bot removed a project: Patch-For-Review.Feb 5 2026, 2:31 PM

We have deployed the "infrastructure" that will support rsync-ing files from airflow-sre task pods to the pupperserver hosts:

brouberol@deploy2002:~$ kubectl get configmap | grep puppetservers
airflow-rsync-puppetservers              1      54s
airflow-ssh-puppetservers                2      54s
brouberol@deploy2002:~$ kubectl get networkpolicies | grep puppetservers
airflow-production-task-pod-egress-ssh-puppetservers   app=airflow,component=task-pod,release=production   64s

We can see that task pods now have egress to the port 22 of the puppetservers enabled:

runuser@airflow-task-shell-66d66dd999-2mxbr:/opt/airflow$ ./usr/bin/is_port_open puppetserver1001.eqiad.wmnet 22
puppetserver1001.eqiad.wmnet:22 is open

elukey claimed this task.Feb 9 2026, 9:48 AM

Change #1239029 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/deployment-charts@master] dse-k8s-services: add pvc config for airflow-sre

https://gerrit.wikimedia.org/r/1239029

gerritbot added a project: Patch-For-Review.Feb 12 2026, 11:15 AM

Change #1239029 merged by Elukey:

[operations/deployment-charts@master] dse-k8s-services: add pvc config for airflow-sre

https://gerrit.wikimedia.org/r/1239029

Maintenance_bot removed a project: Patch-For-Review.Feb 12 2026, 1:31 PM

To keep archives happy - I created a new pvc called airflow-sre-webrequest-to-cdn for airflow-sre, and created another one with the same name in airflow-dev (following T396495#11128447) for testing purposes.

The main idea is the following for the DAG:

Hive queries webrequest and saves to a file on HDFS ---> the file is copied in a persistent volume (from hdfs) ---> the file is copied from the pvc to puppetservers via rsync

Change #1240714 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] profile::puppetserver: simplify analytics-sre's authorized key

https://gerrit.wikimedia.org/r/1240714

gerritbot added a project: Patch-For-Review.Feb 19 2026, 2:52 PM

Change #1240714 merged by Elukey:

[operations/puppet@production] profile::puppetserver: simplify analytics-sre's authorized key

https://gerrit.wikimedia.org/r/1240714

Maintenance_bot removed a project: Patch-For-Review.Feb 19 2026, 4:32 PM

Change #1241004 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] admin: set home dir for analytics-sre

https://gerrit.wikimedia.org/r/1241004

gerritbot added a project: Patch-For-Review.Feb 20 2026, 3:23 PM

Change #1241004 merged by Elukey:

[operations/puppet@production] admin: set home dir for analytics-sre

https://gerrit.wikimedia.org/r/1241004

Maintenance_bot removed a project: Patch-For-Review.Feb 20 2026, 4:32 PM

Change #1241012 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] profile::puppetserver: rework and fix the analytics-sre config

https://gerrit.wikimedia.org/r/1241012

gerritbot added a project: Patch-For-Review.Feb 20 2026, 4:35 PM

Change #1241012 merged by Elukey:

[operations/puppet@production] profile::puppetserver: rework and fix the analytics-sre config

https://gerrit.wikimedia.org/r/1241012

I am finally able to query a week worth of IPs from webrequest and dump a txt file on the puppetserver1001's volatile dir (one IP for each line, something that haproxy can ingest).

The airflow dag is still running in the dev env, I'll polish it and send a patch to merge it in main.

Next steps:

Refine the query to Hive.
File the merge request for the main branch of the airflow dag repo.

elukey opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2082

Add the netaddr dependency and regenerate poetry's lock

elukey merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2082

Add the netaddr dependency and regenerate poetry's lock

Change #1253422 had a related patch set uploaded (by Btullis; author: Btullis):

[operations/deployment-charts@master] Increase the size of the WAL volume for postgresql-airflow-sre

https://gerrit.wikimedia.org/r/1253422

Change #1253422 merged by jenkins-bot:

[operations/deployment-charts@master] Increase the size of the WAL volume for postgresql-airflow-sre

https://gerrit.wikimedia.org/r/1253422

Change #1254887 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/deployment-charts@master] dse-k8s-services: update the base Airflow image

https://gerrit.wikimedia.org/r/1254887

elukey updated https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2100

Create the first webrequest-based pipeline for SRE

Change #1254887 merged by Elukey:

[operations/deployment-charts@master] dse-k8s-services: update the base Airflow image

https://gerrit.wikimedia.org/r/1254887

elukey merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2100

Create the first webrequest-based pipeline for SRE

elukey opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2153

sre: fix container/pod security context for rsync task

elukey merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2153

sre: fix container/pod security context for rsync task

Change #1283821 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] profile::cache::haproxy: add webrequest-based ip reputation data

https://gerrit.wikimedia.org/r/1283821

Change #1283821 merged by Elukey:

[operations/puppet@production] profile::cache::haproxy: add webrequest-based ip reputation data

https://gerrit.wikimedia.org/r/1283821

Change #1289808 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] haproxy: Enable use_webrequest_ipreputation flag for cp7002/cp7012

https://gerrit.wikimedia.org/r/1289808

Change #1289808 merged by Elukey:

[operations/puppet@production] haproxy: Enable use_webrequest_ipreputation flag for cp7002/cp7012

https://gerrit.wikimedia.org/r/1289808

Change #1290047 had a related patch set uploaded (by Ssingh; author: Ssingh):

[operations/puppet@production] P:cache::haproxy: guard webrequest IP reputation data for beta

https://gerrit.wikimedia.org/r/1290047

Change #1290047 merged by Ssingh:

[operations/puppet@production] P:cache::haproxy: guard webrequest IP reputation data for beta

https://gerrit.wikimedia.org/r/1290047

Change #1290767 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] role::cache::haproxy: move webrequest ip reputation exp to all magru

https://gerrit.wikimedia.org/r/1290767

Change #1290767 merged by Elukey:

[operations/puppet@production] role::cache::haproxy: move webrequest ip reputation exp to all magru

https://gerrit.wikimedia.org/r/1290767

Change #1297641 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] role::cache::{text,upload}: enable webrequest tagging in eqsin

https://gerrit.wikimedia.org/r/1297641

Change #1297641 merged by Elukey:

[operations/puppet@production] role::cache::{text,upload}: enable webrequest tagging in eqsin

https://gerrit.wikimedia.org/r/1297641

Change #1298318 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] role::cache::{text,upload}: enable webrequest tagging globally

https://gerrit.wikimedia.org/r/1298318

Change #1298318 merged by Elukey: