I'd like to remove the username/password protection from beta's logstash server (or make them trivially findable) so that users who experience failures in beta can try to debug the failure a bit themselves. Ideally we would even add a link from fatal pages served in beta directly to logstash.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| beta: Disable authentication for Kibana | operations/puppet | production | +1 -3 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | bd808 | T76784 Make logstash in beta public | |||
| Open | None | T77858 Make Privacy Policy/ToS on Beta Cluster explain the privacy implications of using Beta |
Event Timeline
Comment Actions
This change would need @greg's approval. I think we decided on IRC one day that there really aren't any secrets in beta's logs but having that "in writing" here would be good.
Comment Actions
Reasoning to do it:
- The ToS for wmflabs is written in a way that is less stringent than production wmf sites to allow "random" users to host tools that are accessed by users
- The data that is included is not related to production username/passwords (any person who reuses their password on wmflabs is doing themselves a diservice, either for Beta Cluster or for any other tool)
- It does log IP addresses, but these are probably fine given the labs ToS
Comment Actions
Please remember to add the disclaimer from the Labs Terms of Use in a very conspicuous location.
Comment Actions
Logstash and kibana in and of themselves don't collect any information at all, they just make the information collected in the beta cluster wikis visible for debugging.
Comment Actions
@greg What do you think, can we flip this switch? I have all the bits in puppet now (at least in proposed patches) to let me change the vhost easily to no longer require auth.
Comment Actions
Change 231179 had a related patch set uploaded (by BryanDavis):
beta: Disable authentication for Kibana