Page MenuHomePhabricator
Create Task
Maniphest T427799

toolforge VMs should use nftables
Open, Needs TriagePublic
Actions

Description

Toolforge infrastructure VMs with a host-level firewall should be moved from Ferm to nftables.

  • acme-chief
    • profile is compatible
    • toolsbeta
    • tools
  • puppetdb
    • profile is compatible
    • toolsbeta
    • tools
  • redis
    • profile is compatible
    • toolsbeta
    • tools
  • k8s etcd
    • profile is compatible
    • toolsbeta
    • tools
  • elastic
    • profile is compatible
    • tools
  • legacy-redirector
    • profile is compatible
    • tools

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
P:toolforge::redis_sentinel: Add nftables-based VRRP ruleMajavahoperations/puppetproduction+6 -1
nftables: add support for the VRRP protocolJHathawayoperations/puppetproduction+107 -10
P:wmcs::kubeadm::etcd: Migrate to firewall::serviceMajavahoperations/puppetproduction+6 -10
P:elasticsearch: Migrate inter-node traffic to firewall::serviceMajavahoperations/puppetproduction+2 -3
P:toolforge::redis_sentinel: Migrate to firewall::serviceMajavahoperations/puppetproduction+4 -14
P:toolforge:legacy_redirector: Migrate to firewall::serviceMajavahoperations/puppetproduction+11 -8
Customize query in gerrit

Related Objects

Event Timeline

taavi created this task.Jun 1 2026, 12:55 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 1 2026, 12:55 PM
taavi claimed this task.Jun 1 2026, 12:56 PM
taavi updated Other Assignee, removed: taavi.
taavi updated the task description. (Show Details)
taavi updated the task description. (Show Details)
gerritbot added a comment.Jun 1 2026, 12:58 PM

Change #1295905 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:wmcs::kubeadm::etcd: Migrate to firewall::service

https://gerrit.wikimedia.org/r/1295905

gerritbot added a project: Patch-For-Review.Jun 1 2026, 12:58 PM
taavi updated the task description. (Show Details)Jun 1 2026, 1:04 PM
gerritbot added a comment.Jun 1 2026, 1:08 PM

Change #1295913 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:toolforge:legacy_redirector: Migrate to firewall::service

https://gerrit.wikimedia.org/r/1295913

gerritbot added a comment.Jun 1 2026, 1:08 PM

Change #1295908 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:toolforge::redis_sentinel: Migrate to firewall::service

https://gerrit.wikimedia.org/r/1295908

gerritbot added a comment.Jun 1 2026, 1:10 PM

Change #1295915 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:elasticsearch: Migrate inter-node traffic to firewall::service

https://gerrit.wikimedia.org/r/1295915

gerritbot added a comment.Jun 1 2026, 2:54 PM

Change #1295913 merged by Majavah:

[operations/puppet@production] P:toolforge:legacy_redirector: Migrate to firewall::service

https://gerrit.wikimedia.org/r/1295913

taavi updated the task description. (Show Details)Jun 2 2026, 10:26 AM
Stashbot added a comment.Jun 2 2026, 10:33 AM

Mentioned in SAL (#wikimedia-cloud) [2026-06-02T10:33:54Z] <taavi> migrate acme-chief, puppetdb to nftables T427799

taavi updated the task description. (Show Details)Jun 2 2026, 10:49 AM
gerritbot added a comment.Jun 3 2026, 9:57 AM

Change #1295908 merged by Majavah:

[operations/puppet@production] P:toolforge::redis_sentinel: Migrate to firewall::service

https://gerrit.wikimedia.org/r/1295908

gerritbot added a comment.Jun 3 2026, 10:19 AM

Change #1297093 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:toolforge::redis_sentinel: Add nftables-based VRRP rule

https://gerrit.wikimedia.org/r/1297093

gerritbot added a comment.Jun 3 2026, 10:26 AM

Change #1295915 merged by Majavah:

[operations/puppet@production] P:elasticsearch: Migrate inter-node traffic to firewall::service

https://gerrit.wikimedia.org/r/1295915

taavi updated the task description. (Show Details)Jun 4 2026, 1:50 PM
gerritbot added a comment.Jun 9 2026, 12:17 PM

Change #1295905 merged by Majavah:

[operations/puppet@production] P:wmcs::kubeadm::etcd: Migrate to firewall::service

https://gerrit.wikimedia.org/r/1295905

taavi updated the task description. (Show Details)Jun 9 2026, 12:50 PM
gerritbot added a comment.Jul 7 2026, 6:12 PM

Change #1308177 had a related patch set uploaded (by JHathaway; author: JHathaway):

[operations/puppet@production] nftables: add support for the VRRP protocol

https://gerrit.wikimedia.org/r/1308177

cmooney subscribed.EditedJul 16 2026, 5:19 PM

Just a note, I'm not sure if this is still the case but at one point the cloudnet hosts were wrapping their VRRP keepalives in multicast UDP packets sent to port 8472. See T319539#8290922.

So that might also be a case that needs to be catered for. Ignore me if it's irrelevant, I seen some VRRP patches which reminded me.

gerritbot added a comment.Jul 21 2026, 6:32 PM

Change #1308177 merged by JHathaway:

[operations/puppet@production] nftables: add support for the VRRP protocol

https://gerrit.wikimedia.org/r/1308177

gerritbot added a comment.Jul 23 2026, 10:48 AM

Change #1297093 merged by Majavah:

[operations/puppet@production] P:toolforge::redis_sentinel: Add nftables-based VRRP rule

https://gerrit.wikimedia.org/r/1297093

Maintenance_bot removed a project: Patch-For-Review.Jul 23 2026, 11:31 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits