Protect Catalyst/PatchDemo from aggressive bots at the ingress layer
Open, Stalled, Needs TriagePublic3 Estimated Story Points
Actions

Assigned To

Authored By

	thcipriani
	Jan 27 2026, 6:26 PM

Description

Our k3s uses Traefik.

In the past, we've mitigated aggressive bots at the apache layer of our projects. We should try to limit them as they enter our k8s to avoid having to update deployments with new apache configs.

Possibilities:

A.C.

Migrate the configuration from our https://patchdemo.wmcloud.org/ apache to traefik
Make it easy it update with our pipelines so we can respond quickly to new bots causing problems

Details

Other Assignee: EBomani

Related Changes in GitLab:

Title	Reference	Author	Source Branch	Dest Branch
PoC: add Traefik configuration to cluster	repos/test-platform/catalyst/catalyst-tofu!27	jnuche	T415701-PoC	main
Draft: Update file traefik-config.yaml	repos/test-platform/catalyst/catalyst-tofu!24	ebomani	T415701	main
Draft: BotWrangler WIP	repos/test-platform/catalyst/patchdemo!246	ebomani	415701	main

Customize query in GitLab

Related Objects
Search...

Status	Assigned	Task
Stalled	jeena	T415701 Protect Catalyst/PatchDemo from aggressive bots at the ingress layer
Open	None	T400077 Upgrade K3s cluster to most recent stable version
Resolved	jnuche	T408379 OpenTofu: Clean up older local path provisioner addons
Open	None	T419580 Disaster recovery for k8s upgrade

Event Timeline

thcipriani created this task.Jan 27 2026, 6:26 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 27 2026, 6:26 PM

thcipriani updated the task description. (Show Details)Jan 27 2026, 6:27 PM

thcipriani assigned this task to jeena.Jan 29 2026, 5:29 PM

thcipriani updated the task description. (Show Details)

thcipriani set the point value for this task to 3.

thcipriani moved this task from Backlog to Ready on the Catalyst (Luka Ijo Pimeja Jan) board.

thcipriani updated Other Assignee, added: EBomani.Jan 29 2026, 5:54 PM

EBomani added a project: Test Platform (Tkaronto Marathon 22).Feb 2 2026, 4:55 PM

tacsipacsi updated https://gitlab.wikimedia.org/repos/test-platform/catalyst/patchdemo/-/merge_requests/246

Draft: BotWrangler WIP

Tacsipacsi subscribed.Feb 4 2026, 12:18 AM

ebomani opened https://gitlab.wikimedia.org/repos/test-platform/catalyst/catalyst-tofu/-/merge_requests/24

Draft: Update file traefik-config.yaml

Peter subscribed.Feb 6 2026, 8:39 AM

Unfortunately it seems the bot-wrangler-traefik-plugin plugin is not compatible with our current K3s production version v1.28.7+k3s1.

I tried deploying the latest version v0.10.1 and ran into the following error:

time="2026-02-09T16:24:03Z" level=error msg="Plugins are disabled because an error has occurred." error="github.com/holysoles/bot-wrangler-traefik-plugin: failed to import plugin code \"github.com/holysoles/bot-wrangler-traefik-plugin\": 1:21: import \"github.com/holysoles/bot-wrangler-traefik-plugin\" error: plugins-storage/sources/gop-2486277708/src/github.com/holysoles/bot-wrangler-traefik-plugin/wrangler.go:12:2: import \"github.com/holysoles/bot-wrangler-traefik-plugin/pkg/botmanager\" error: plugins-storage/sources/gop-2486277708/src/github.com/holysoles/bot-wrangler-traefik-plugin/pkg/botmanager/botmanager.go:14:2: import \"github.com/holysoles/bot-wrangler-traefik-plugin/pkg/config\" error: plugins-storage/sources/gop-2486277708/src/github.com/holysoles/bot-wrangler-traefik-plugin/pkg/config/config.go:8:2: import \"slices\" error: unable to find source related to: \"slices\""

slices was added in go 1.21. At the same time, traefik uses a go interpreter named yaegi under the hood. At the time K3s v1.28.7+k3s1 was released, yaegi didn't support go 1.21, see: https://github.com/traefik/yaegi/issues/1608#issuecomment-1937084471

I tried using the earliest bot-wrangler-traefik-plugin release in this MR, but that release (v0.1.0) is still too recent and runs into the same issue.

All of the above means we will have to either: