| gmodena | |
| Jun 15 2026, 10:02 AM |
| F93329252: Screenshot 2026-07-13 at 10.07.28.png | |
| Mon, Jul 13, 8:07 AM |
| F93322550: Screenshot 2026-07-13 at 09.34.23.png | |
| Mon, Jul 13, 7:37 AM |
While we run qlever and blazegraph in parallel we'll need two subdomains for the WDQS v2 endpoints:
query-next.wikidata.org
query-scholarly-next.wikidata.org
These domain will support the migration for FY27. We can commit (soft) to a date after which they will redirect to query.wikidata.org and query-scholarly.wikidata.org as the default WDQS v2 endpoints.
Related
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | gmodena | T431253 [DE2.4.2] WDQS v2 Scaling | |||
| Resolved | brouberol | T429150 WDQS v2 subdomain for public endpoints |
We don't. We'll be providing public routes only for WDQS endpoints.
The QLever team maintains a public query service for commons and structured data at https://qlever.dev/wikimedia-commons, and it can federate from wikidata T429807: Add QLever Wikimedia Commons endpoint to WDQS allowlist.
Change #1309183 had a related patch set uploaded (by Brouberol; author: Brouberol):
[operations/dns@master] Define public DNS records for WDQS/qlever
Change #1309183 merged by Brouberol:
[operations/dns@master] Define public/discovery DNS records for WDQS/qlever
Change #1309625 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: install external releases in eqiad
Change #1309625 merged by jenkins-bot:
[operations/deployment-charts@master] wdqs: install external releases in eqiad
Change #1309642 had a related patch set uploaded (by Brouberol; author: Brouberol):
[operations/deployment-charts@master] dse-k8s/wdqs: add the public DNS records to the namespace certificate SANs
Change #1309644 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: bump init image and set qlever memory per-release
Change #1309646 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: install external releases in codfw
Change #1309646 merged by jenkins-bot:
[operations/deployment-charts@master] wdqs: install external releases in codfw
Change #1309644 merged by jenkins-bot:
[operations/deployment-charts@master] wdqs: bump init image and set qlever memory per-release
Change #1309670 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: allow codfw backends egress to eqiad RGW
Change #1309642 merged by Brouberol:
[operations/deployment-charts@master] dse-k8s/wdqs: add the public DNS records to the namespace certificate SANs
Change #1309670 merged by jenkins-bot:
[operations/deployment-charts@master] wdqs: allow codfw backends egress to eqiad RGW
Some reminder about the way traffic to query-next.wikidata.org and query-scholarly-next.wikidata.org ingress to the wdqs pods, for posterity. Taking query-next.wikidata.org for example here, but the same logic apply to the other domain.
query-next.wikidata.org hits our CDN:
brouberol@cumin1003:~$ host query-next.wikidata.org query-next.wikidata.org is an alias for dyna.wikimedia.org. dyna.wikimedia.org has address 208.80.154.224 dyna.wikimedia.org has IPv6 address 2620:0:861:ed1a::1
On cache-text nodes, ATS will redirect the traffic to https://wdqs2-main-external.discovery.wmnet:30443. That domain points to the active/active dse-k8s ingress IP, resolved using anycast DNS to the geographically-closest one.
brouberol@deploy2003:~$ host wdqs2-main-external.discovery.wmnet wdqs2-main-external.discovery.wmnet is an alias for k8s-ingress-dse-aa.discovery.wmnet. k8s-ingress-dse-aa.discovery.wmnet has address 10.2.1.91 brouberol@cumin1003:~$ host wdqs2-main-external.discovery.wmnet wdqs2-main-external.discovery.wmnet is an alias for k8s-ingress-dse-aa.discovery.wmnet. k8s-ingress-dse-aa.discovery.wmnet has address 10.2.2.91
That will connect to the dse-k8s-{eqiad,codfw} ingressgateway pods. Traffic will then be redirected to the tls-terminator sidecar container of the wdqs-main-proxy pod:
brouberol@deploy2003:~$ k get destinationrule.networking.istio.io wdqs-main-external -oYAML apiVersion: networking.istio.io/v1 kind: DestinationRule metadata: annotations: meta.helm.sh/release-name: main-external meta.helm.sh/release-namespace: wdqs creationTimestamp: "2026-07-10T09:55:23Z" generation: 1 labels: app: wdqs app.kubernetes.io/managed-by: Helm chart: wdqs-0.0.5 heritage: Helm release: main-external name: wdqs-main-external namespace: wdqs resourceVersion: "1562913571" uid: c5af4e48-8a70-477a-a872-df96f5f8a1d9 spec: host: wdqs-main-external-tls-service.wdqs.svc.cluster.local # <--- trafficPolicy: tls: caCertificates: /etc/ssl/certs/wmf-ca-certificates.crt mode: SIMPLE subjectAltNames: - wdqs.discovery.wmnet - wdqs-main-external-tls-service.wdqs.svc.cluster.local - wdqs2-main-external.discovery.wmnet - wdqs2-main-external.svc.codfw.wmnet - wdqs2-main-external.svc.eqiad.wmnet - query-next.wikidata.org - wdqs2-main-external.discovery.wmnet - wdqs2-main-external.svc.codfw.wmnet - wdqs2-main-external.svc.eqiad.wmnet - query-next.wikidata.org
brouberol@deploy2003:~$ k get service wdqs-main-external-tls-service NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE wdqs-main-external-tls-service ClusterIP 10.67.41.87 <none> 443/TCP 3h59m brouberol@deploy2003:~$ k get endpoints wdqs-main-external-tls-service NAME ENDPOINTS AGE wdqs-main-external-tls-service 10.67.30.179:443 3h59m
That envoy pod is then configured to terminate the TLS session and proxy the HTTP traffic to the proxt container.
And just like that..
In codfw.
brouberol@deploy2003:~$ curl https://wdqs2-main-external.discovery.wmnet:30443 <html><body><h1>Resource not found</h1></body></html> brouberol@deploy2003:~$ curl https://wdqs2-scholarly-external.discovery.wmnet:30443 <html><body><h1>Resource not found</h1></body></html>
in eqiad
brouberol@cumin1003:~$ curl https://wdqs2-main-external.discovery.wmnet:30443 <html><body><h1>Resource not found</h1></body></html> brouberol@cumin1003:~$ curl https://wdqs2-scholarly-external.discovery.wmnet:30443 <html><body><h1>Resource not found</h1></body></html>
Now, we need to configure the ATS mapping, and the service should be fully public.
Change #1309679 had a related patch set uploaded (by Brouberol; author: Brouberol):
[operations/puppet@production] trafficserver: redirect query-next.w.o/sparql to qlever in dse-k8s
Change #1309680 had a related patch set uploaded (by Brouberol; author: Brouberol):
[operations/puppet@production] cache/text: enable caching for query-next.w.o
Change #1309679 merged by Brouberol:
[operations/puppet@production] trafficserver: redirect query-next.w.o/sparql to qlever in dse-k8s
I ran puppet on all drmrs and esams cache text hosts.
Confirmed that I'm seeing the following log entry in wdqs-main-external-proxy-79c8777ddf-g9b89 running in dse-k8s-eqiad/wdqs every time I hit https://query-next.wikidata.org/sparql.
{"timestamp":"2026-07-13T07:47:16.226961993Z","sequence":100,"loggerClassName":"org.jboss.logging.Logger","loggerName":"org.wikimedia.wdqs.resources.SparqlQueryResource","level":"INFO","message":"null","threadName":"executor-thread-1","threadId":19,"mdc":{},"ndc":"","hostName":"wdqs-main-external-proxy-79c8777ddf-g9b89","processName":"/usr/lib/jvm/java-25-openjdk-amd64/bin/java","processId":1}
Change #1309680 merged by Brouberol:
[operations/puppet@production] cache/text: enable caching for query-next.w.o
Change #1310012 had a related patch set uploaded (by Brouberol; author: Brouberol):
[operations/puppet@production] trafficserver: redirect query-scholarly next.w.o/sparql to wdqs-scholarly in dse-k8s
Change #1310013 had a related patch set uploaded (by Brouberol; author: Brouberol):
[operations/puppet@production] cache/text: enable caching for query-scholarly next.w.o
Change #1310012 merged by Brouberol:
[operations/puppet@production] trafficserver: redirect query-scholarly next.w.o/sparql to dse/wdqs-scholarly
Change #1310066 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: load qlever index from qlever-index/ S3 prefix
Change #1310078 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: bump init container resources.
Change #1310078 merged by Gmodena:
[operations/deployment-charts@master] wdqs: bump init container resources.
Both endpoints are now working!
brouberol@deploy2003:~$ curl -i "https://query-next.wikidata.org/sparql?query=select+%2A+where+%7B+%3Fs+%3Fp+%3Fo+%7D+limit+1"
HTTP/2 200
content-length: 330
content-type: */*;charset=UTF-8
date: Mon, 13 Jul 2026 13:20:35 GMT
server: main-external-tls
age: 2
accept-ranges: bytes
x-cache: cp2049 miss, cp2049 miss
x-cache-status: miss
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
x-client-ip: 2620:0:860:12c:10:192:57:6
set-cookie: WMF-Uniq=u_KS60IWJa5uoe0BZFAOYgOcAAAAAFvdBEg9-iY0xTATJst5QEAcT4XzAhRoYk7Y;Domain=.wikidata.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Tue, 13 Jul 2027 00:00:00 GMT
x-request-id: df6be46c-2e01-4bd6-b3a0-4122ef295c59
server-timing: cache;desc="miss", host;desc="cp2049";co_id;desc="2198138333"
{"head":{"vars":["s","p","o"]},"results":{"bindings":[{"s":{"type":"uri","value":"http://www.wikidata.org/entity/Q10000000"},"p":{"type":"uri","value":"http://wikiba.se/ontology#identifiers"},"o":{"datatype":"http://www.w3.org/2001/XMLSchema#int","type":"literal","value":"0"}}]},"meta":{"query-time-ms":24,"result-size-total":1}}brouberol@deploy2003:~$ curl -i "https://query-scholarly-next.wikidata.org/sparql?query=select+%2A+where+%7B+%3Fs+%3Fp+%3Fo+%7D+limit+1"
HTTP/2 200
content-length: 331
content-type: */*;charset=UTF-8
date: Mon, 13 Jul 2026 10:30:06 GMT
server: scholarly-external-tls
age: 10254
accept-ranges: bytes
x-cache: cp2049 miss, cp2049 hit/5
x-cache-status: hit-front
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
set-cookie: WMF-Last-Access=13-Jul-2026;Path=/;HttpOnly;secure;Expires=Fri, 14 Aug 2026 12:00:00 GMT
set-cookie: WMF-Last-Access-Global=13-Jul-2026;Path=/;Domain=.wikidata.org;HttpOnly;secure;Expires=Fri, 14 Aug 2026 12:00:00 GMT
x-client-ip: 2620:0:860:12c:10:192:57:6
set-cookie: GeoIP=US:::37.75:-97.82:v4; Path=/; secure; Domain=.wikidata.org
set-cookie: NetworkProbeLimit=0.001;Path=/;Secure;SameSite=None;Max-Age=3600
set-cookie: WMF-Uniq=D7sX5nTUJ9kYdxQm97c8GAOcAAAAAFvdgvCnECJfjyfb8J2rwoPJTBsWqeUyNsjt;Domain=.wikidata.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Tue, 13 Jul 2027 00:00:00 GMT
x-request-id: ea9d0595-20c1-49f3-bf07-28b4a4f4af66
server-timing: cache;desc="hit-front", host;desc="cp2049";co_id;desc="1298120414"
{"head":{"vars":["s","p","o"]},"results":{"bindings":[{"s":{"type":"uri","value":"http://www.wikidata.org/entity/Q140266119"},"p":{"type":"uri","value":"http://wikiba.se/ontology#identifiers"},"o":{"datatype":"http://www.w3.org/2001/XMLSchema#int","type":"literal","value":"0"}}]},"meta":{"query-time-ms":55,"result-size-total":1}}Change #1310066 merged by jenkins-bot:
[operations/deployment-charts@master] wdqs: load qlever index from qlever-index/ S3 prefix
Change #1310013 merged by Brouberol:
[operations/puppet@production] cache/text: enable caching for query-scholarly next.w.o
Change #1311429 had a related patch set uploaded (by Gmodena; author: Gmodena):
[operations/deployment-charts@master] wdqs: bump init container memory and startup probe timeout
Change #1311429 merged by jenkins-bot:
[operations/deployment-charts@master] wdqs: bump init container memory and startup probe timeout