Page MenuHomePhabricator
Create Task
Maniphest T424674

Migrate Data Persistence Envoy TLS proxy services to the 2026 discovery intermediate
Closed, ResolvedPublic
Actions

Description

All of these role use profile::tlsproxy::envoy and need to be migrated to the new discovery2026 PKI intermediate. The procedure is:

  1. Change the intermedia in Puppet, example can be found here: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1278491
  2. Merge the change, after a Puppet run the new certs should be present in /etc/envoy/ssl and the discovery2026 cert be referenced in /etc/envoy/envoy.yaml and Envoy should have been restarted. You can also explicitly doublecheck with "openssl s_client ip:port | grep openssl x509 -text -noout"
  3. If the service still works fine, proceed with the next
  • modules/profile/manifests/swift/proxy.pp
  • modules/role/manifests/restbase/production.pp
  • modules/role/manifests/thanos/frontend.pp
  • modules/role/manifests/cephadm/rgw.pp

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
role::swift::proxy: use discovery2026 intermediate for envoyMVernonoperations/puppetproduction+2 -1
role::thanos::frontend: use discovery2026 intermediate for envoyMVernonoperations/puppetproduction+1 -0
role::cephadm::rgw: use discovery2026 intermediate for envoyMVernonoperations/puppetproduction+1 -0
restbase: migrate envoy TLS proxy services to new intermediateEevansoperations/puppetproduction+1 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

MoritzMuehlenhoff created this task.Apr 28 2026, 3:38 PM
MatthewVernon added projects: SRE-swift-storage, Ceph.Apr 28 2026, 3:43 PM
MatthewVernon updated the task description. (Show Details)Apr 28 2026, 4:22 PM
Eevans added a project: User-Eevans.Apr 28 2026, 7:11 PM
Eevans moved this task from Backlog to In-Progress on the User-Eevans board.
gerritbot added a comment.Apr 28 2026, 7:34 PM

Change #1278554 had a related patch set uploaded (by Eevans; author: Eevans):

[operations/puppet@production] restbase: migrate envoy TLS proxy services to new intermediate

https://gerrit.wikimedia.org/r/1278554

gerritbot added a project: Patch-For-Review.Apr 28 2026, 7:34 PM
gerritbot added a comment.Apr 29 2026, 7:56 AM

Change #1278554 merged by Elukey:

[operations/puppet@production] restbase: migrate envoy TLS proxy services to new intermediate

https://gerrit.wikimedia.org/r/1278554

gerritbot added a comment.Apr 29 2026, 8:01 AM

Change #1279230 had a related patch set uploaded (by MVernon; author: MVernon):

[operations/puppet@production] role::cephadm::rgw: use discovery2026 intermediate for envoy

https://gerrit.wikimedia.org/r/1279230

Stashbot added a comment.Apr 29 2026, 8:16 AM

Mentioned in SAL (#wikimedia-operations) [2026-04-29T08:16:50Z] <Emperor> disable puppet in apus/codfw for TLS key rollover T424674

Stashbot added a comment.Apr 29 2026, 8:18 AM

Mentioned in SAL (#wikimedia-operations) [2026-04-29T08:18:26Z] <Emperor> re-enable puppet in apus/codfw for TLS key rollover T424674 (no change, incident took over)

MoritzMuehlenhoff updated the task description. (Show Details)Apr 29 2026, 9:04 AM
Stashbot added a comment.Apr 29 2026, 10:12 AM

Mentioned in SAL (#wikimedia-operations) [2026-04-29T10:12:03Z] <Emperor> disable puppet in apus/codfw rgws for TLS key rollover T424674

gerritbot added a comment.Apr 29 2026, 10:12 AM

Change #1279230 merged by MVernon:

[operations/puppet@production] role::cephadm::rgw: use discovery2026 intermediate for envoy

https://gerrit.wikimedia.org/r/1279230

Stashbot added a comment.Apr 29 2026, 10:15 AM

Mentioned in SAL (#wikimedia-operations) [2026-04-29T10:15:33Z] <Emperor> disable puppet in apus/eqiad rgws for TLS key rollover T424674

Maintenance_bot removed a project: Patch-For-Review.Apr 29 2026, 10:31 AM
MatthewVernon updated the task description. (Show Details)Apr 29 2026, 10:33 AM
gerritbot added a comment.Apr 29 2026, 10:37 AM

Change #1279265 had a related patch set uploaded (by MVernon; author: MVernon):

[operations/puppet@production] role::thanos::frontend: use discovery2026 intermediate for envoy

https://gerrit.wikimedia.org/r/1279265

gerritbot added a project: Patch-For-Review.Apr 29 2026, 10:37 AM
gerritbot added a comment.Apr 29 2026, 11:08 AM

Change #1279272 had a related patch set uploaded (by MVernon; author: MVernon):

[operations/puppet@production] role::swift::proxy: use discovery2026 intermediate for envoy

https://gerrit.wikimedia.org/r/1279272

Stashbot added a comment.Apr 29 2026, 11:54 AM

Mentioned in SAL (#wikimedia-operations) [2026-04-29T11:54:34Z] <Emperor> TLS key rollover for thanos-fe T424674

gerritbot added a comment.Apr 29 2026, 11:54 AM

Change #1279265 merged by MVernon:

[operations/puppet@production] role::thanos::frontend: use discovery2026 intermediate for envoy

https://gerrit.wikimedia.org/r/1279265

Stashbot added a comment.Apr 29 2026, 12:21 PM

Mentioned in SAL (#wikimedia-operations) [2026-04-29T12:21:38Z] <Emperor> TLS key rollover for ms-fe T424674

gerritbot added a comment.Apr 29 2026, 12:22 PM

Change #1279272 merged by MVernon:

[operations/puppet@production] role::swift::proxy: use discovery2026 intermediate for envoy

https://gerrit.wikimedia.org/r/1279272

Maintenance_bot removed a project: Patch-For-Review.Apr 29 2026, 12:31 PM
Eevans removed a project: User-Eevans.Apr 29 2026, 1:15 PM
MatthewVernon closed this task as Resolved.Apr 29 2026, 1:38 PM
MatthewVernon claimed this task.
MatthewVernon updated the task description. (Show Details)
MatthewVernon subscribed.

Rune in the description probably should be more like openssl s_client -connect hostname:443 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | grep CN but anyhow, these are all done.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits