Page MenuHomePhabricator
Create Task
Maniphest T405017

Rebuild VMs in PKI cloud-vps project
Closed, ResolvedPublic
Actions

Description

There are 6 Buster VMs remaining in the 'pki' project:

| 3e6c31d7-b4db-4a5f-a610-a74d0013f631 | pki-test01         | ACTIVE | VLAN/legacy=172.16.3.131 | debian-10.0-buster (deprecated 2021-07-30)   | g4.cores1.ram2.disk20 |
| 22e7671e-c144-4508-afe0-f0e24603fa69 | pki-pm             | ACTIVE | VLAN/legacy=172.16.2.254 | debian-10.0-buster (deprecated 2021-03-24)   | g4.cores1.ram2.disk20 |
| 7081de14-d7f5-44ca-b82e-6b99af667696 | pki-proxy          | ACTIVE | VLAN/legacy=172.16.4.48  | debian-10.0-buster (deprecated 2021-03-24)   | g4.cores1.ram2.disk20 |
| f56e0ae1-b26f-43d8-8e9e-2e7fb424ce0b | pki-intermediate   | ACTIVE | VLAN/legacy=172.16.5.134 | debian-10.0-buster (deprecated 2021-03-24)   | g4.cores1.ram2.disk20 |
| edfc4cbd-dd02-41f2-8732-c48ef55e9c67 | pki-root           | ACTIVE | VLAN/legacy=172.16.2.231 | debian-10.0-buster (deprecated 2021-03-24)   | g4.cores1.ram2.disk20 |
| 3788dd45-8e96-471f-a4f5-4c788c12601b | pki-db             | ACTIVE | VLAN/legacy=172.16.6.20  | debian-10.0-buster (deprecated 2021-03-24)   | g4.cores1.ram2.disk20 |

I would like to delete them as part of eliminating Debian Buster usage (and base images) from cloud-vps. May I? And/or should we get rid of that project entirely?

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
cloud: move pki-root's config to pki-root-1Elukeyoperations/puppetproduction+0 -0
cloud: move pki project to pki-db-1Elukeyoperations/puppetproduction+2 -2
Customize query in gerrit

Event Timeline

Andrew created this task.Sep 18 2025, 5:52 PM
Restricted Application added a project: cloud-services-team. · View Herald TranscriptSep 18 2025, 5:52 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
• elukey added a comment.Sep 19 2025, 6:32 AM

Hey Andrew! These are used by deployment-prep's TLS certificates, so we should probably upgrade them to say bookworm. We have to do the upgrade in prod as well, so this may be a good prep test. Do you have a specific deadline? (aside from the fact that Buster is EOLed etc..)

fgiunchedi removed fgiunchedi as the assignee of this task.Sep 19 2025, 6:50 AM
fgiunchedi subscribed.

I have not interacted with this project in a long time, can't judge the status/usefulness of the VMs

Andrew added a comment.Sep 19 2025, 3:07 PM
In T405017#11196353, @elukey wrote:

Hey Andrew! These are used by deployment-prep's TLS certificates, so we should probably upgrade them to say bookworm. We have to do the upgrade in prod as well, so this may be a good prep test. Do you have a specific deadline? (aside from the fact that Buster is EOLed etc..)

There's no deadline, and they aren't strictly running buster; I believe they've been upgraded in place. This is really just me being compulsive, wanting to remove the Buster base images which these are backed by.

Would it make sense to rebuild them in deployment-prep, if that's the only project that depends on them?

• elukey added a comment.Sep 22 2025, 8:47 AM
In T405017#11197702, @Andrew wrote:
In T405017#11196353, @elukey wrote:

Hey Andrew! These are used by deployment-prep's TLS certificates, so we should probably upgrade them to say bookworm. We have to do the upgrade in prod as well, so this may be a good prep test. Do you have a specific deadline? (aside from the fact that Buster is EOLed etc..)

There's no deadline, and they aren't strictly running buster; I believe they've been upgraded in place. This is really just me being compulsive, wanting to remove the Buster base images which these are backed by.

Would it make sense to rebuild them in deployment-prep, if that's the only project that depends on them?

Okok now I recall, I think I was the one upgrading in place. We should probably keep a separate project since all VPS projects may use it to get TLS certs, not only deployment-prep. We are going to upgrade to Bookworm/Trixie soon, so we'll recycle those images for sure.

taavi renamed this task from Buster VMs in cloud-vps PKI project to Rebuild VMs in PKI cloud-vps project.Sep 26 2025, 11:34 AM
taavi edited projects, added: Cloud-VPS (Debian Bullseye Deprecation), CFSSL-PKI; removed: cloud-services-team, Cloud-VPS (Debian Buster Deprecation).
Restricted Application added a project: Infrastructure-Foundations. · View Herald TranscriptSep 26 2025, 11:34 AM
taavi moved this task from Backlog to VPS projects on the Cloud-VPS (Debian Bullseye Deprecation) board.Sep 26 2025, 11:34 AM
taavi subscribed.

Repurposing this task for that, please close or adjust if you want to track that somewhere else!

• elukey triaged this task as Medium priority.Sep 29 2025, 2:51 PM
• elukey added a project: User-Elukey.
gerritbot added a comment.Tue, Jul 21, 10:35 AM

Change #1313106 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] cloud: move pki project to pki-db-1

https://gerrit.wikimedia.org/r/1313106

gerritbot added a project: Patch-For-Review.Tue, Jul 21, 10:35 AM
gerritbot added a comment.Tue, Jul 21, 10:46 AM

Change #1313106 merged by Elukey:

[operations/puppet@production] cloud: move pki project to pki-db-1

https://gerrit.wikimedia.org/r/1313106

gerritbot added a comment.Tue, Jul 21, 11:05 AM

Change #1313122 had a related patch set uploaded (by Elukey; author: Elukey):

[operations/puppet@production] cloud: move pki-root's config to pki-root-1

https://gerrit.wikimedia.org/r/1313122

gerritbot added a comment.Tue, Jul 21, 11:06 AM

Change #1313122 merged by Elukey:

[operations/puppet@production] cloud: move pki-root's config to pki-root-1

https://gerrit.wikimedia.org/r/1313122

Maintenance_bot removed a project: Patch-For-Review.Tue, Jul 21, 11:31 AM
• elukey added a comment.Tue, Jul 21, 11:46 AM

pki-db-1 and pki-root-1 replaced the last buster VMs. I already configured everything and made sure that the new pki-root vm contains the same files under /etc/cfss as the old VM. I am going to leave the old VMs around for a couple of weeks just to be sure, and then I'll delete them.

• elukey closed this task as Resolved.Wed, Jul 29, 11:26 AM
• elukey claimed this task.

Old VMs deleted!

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits