Page MenuHomePhabricator

Southparkfan (Ferran Tufan)
InfoSec/infrastructure/networking guru

Projects (19)

Today

  • No visible events.

Tomorrow

  • No visible events.

Saturday

  • No visible events.

User Details

User Since
Oct 12 2014, 7:12 AM (625 w, 4 d)
Availability
Available
IRC Nick
Southparkfan
LDAP User
Southparkfan
MediaWiki User
Southparkfan [ Global Accounts ]

The guy watching South Park all day. Used to be a student in Computer Science (specialised in InfoSec, open source infrastructures, computer networking, and ethical security & network research). Formerly employed in InfoSec as well.

Macro southparkfan-approves: Approved by Wikimedia

Recent Activity

Sat, Oct 3

Southparkfan closed T440085: Found non-revoked Puppet certificates for 3 deleted instances on deployment-puppetserver-1 as Resolved.

Thanks, @tchin! I have performed the required actions on deployment-puppetserver-1:

for host in deployment-eventstreams-2 deployment-eventgate-4 deployment-schema-3; do fqdn="${host}.deployment-prep.eqiad1.wikimedia.cloud"; puppet node deactivate "${fqdn}" && puppet node clean "${fqdn}"; done
Sat, Oct 3, 7:05 PM · Beta-Cluster-Infrastructure
Southparkfan updated subscribers of T440085: Found non-revoked Puppet certificates for 3 deleted instances on deployment-puppetserver-1.

Hi @tchin, I think this alert is related to your work on T429497. From the Prometheus metrics:

puppetmaster_stale_cert{cert_instance="deployment-eventstreams-2",cert_name="deployment-eventstreams-2.deployment-prep.eqiad1.wikimedia.cloud",cert_project="deployment-prep"} 1.0
puppetmaster_stale_cert{cert_instance="deployment-eventgate-4",cert_name="deployment-eventgate-4.deployment-prep.eqiad1.wikimedia.cloud",cert_project="deployment-prep"} 1.0
puppetmaster_stale_cert{cert_instance="deployment-schema-3",cert_name="deployment-schema-3.deployment-prep.eqiad1.wikimedia.cloud",cert_project="deployment-prep"} 1.0
Sat, Oct 3, 4:42 PM · Beta-Cluster-Infrastructure

Tue, Sep 29

Southparkfan closed T436480: Replace deployment-rdb01 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Tue, Sep 29, 9:58 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436480: Replace deployment-rdb01 (Bullseye deprecation) as Resolved.

Turns out removing the hack was easier than anticipated.

Tue, Sep 29, 9:58 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Wed, Sep 23

Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.

The PHP 8.3 hosts have been decommissioned. Remaining actions:

Wed, Sep 23, 10:19 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering

Tue, Sep 22

Southparkfan closed T436470: Replace deployment-cumin-3 (Bullseye deprecation) as Resolved.

✅

Tue, Sep 22, 9:23 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436470: Replace deployment-cumin-3 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Tue, Sep 22, 9:23 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T428052: Beta cluster haproxy does not support `warn-blocked-traffic-after` keyword, a subtask of T436468: Replace cache proxies: deployment-cache-(text|upload)08 (Bullseye deprecation), as Resolved.
Tue, Sep 22, 8:54 PM · Traffic, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T428052: Beta cluster haproxy does not support `warn-blocked-traffic-after` keyword as Resolved.

Thanks to Brett's work on T436468, this hack is no longer needed. I have removed the cherry-pick.

Tue, Sep 22, 8:54 PM · Traffic, SRE, Beta-Cluster-Infrastructure
Southparkfan changed the status of T436480: Replace deployment-rdb01 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Open to In Progress.
Tue, Sep 22, 8:42 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436480: Replace deployment-rdb01 (Bullseye deprecation) from Open to In Progress.
Tue, Sep 22, 8:42 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T438656: Beta cluster jobrunner opcache is not updated during automated deployments as Resolved.
Tue, Sep 22, 8:08 PM · Beta-Cluster-Infrastructure, Wikidata, Wikidata Integration in Wikimedia projects (Goals Board)
Southparkfan closed T438656: Beta cluster jobrunner opcache is not updated during automated deployments, a subtask of T438464: Test stopping sending LL notifications, as Resolved.
Tue, Sep 22, 8:08 PM · Wikidata Integration in Wikimedia projects (Sprint 14 🍅 Sept 21 - Oct. 2), Wikidata
Southparkfan added a comment to T438656: Beta cluster jobrunner opcache is not updated during automated deployments.

Hi @JMonton-WMF, @awight, deployment-jobrunner06 is a new PHP 8.5 jobrunner slated to replace the old PHP 8.3 host deployment-jobrunner05. Please see T435393#12320355 for the background.

Tue, Sep 22, 8:08 PM · Beta-Cluster-Infrastructure, Wikidata, Wikidata Integration in Wikimedia projects (Goals Board)
Southparkfan merged T438818: Beta: Old code in jobrunner06 into T438656: Beta cluster jobrunner opcache is not updated during automated deployments.
Tue, Sep 22, 7:57 PM · Beta-Cluster-Infrastructure, Wikidata, Wikidata Integration in Wikimedia projects (Goals Board)
Southparkfan merged task T438818: Beta: Old code in jobrunner06 into T438656: Beta cluster jobrunner opcache is not updated during automated deployments.
Tue, Sep 22, 7:57 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Beta-Cluster-Infrastructure

Wed, Sep 16

Southparkfan updated subscribers of T436480: Replace deployment-rdb01 (Bullseye deprecation).

Hi @Ladsgroup! I am currently working on getting the Beta Cluster off Bullseye. As the author https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/1326944 and given your work on T427999, I would like your advice to proceed with this ticket.

Wed, Sep 16, 9:40 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Tue, Sep 15

Southparkfan updated subscribers of T436472: Replace Acme-chief hosts: deployment-acme-chief0[56] (Bullseye deprecation).

Hi @BCornwall you have created deployment-acme-chief07 and deployment-acme-chief08, and the two Bullseye hosts mentioned in the title have been deleted. Great work! Feel free to claim and close this task if there is nothing left to do.

Tue, Sep 15, 7:32 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T436468: Replace cache proxies: deployment-cache-(text|upload)08 (Bullseye deprecation).

Hi @BCornwall, thank you for your help! I have added the servers to cache_hosts.

Tue, Sep 15, 7:27 PM · Traffic, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Mon, Sep 14

Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.
NOTE: TL;DR: Beta Cluster is running PHP 8.5 now. If you need to perform a rollback, see the instructions below. Unless objections are raised, the PHP 8.3 hosts are eligible for deletion after 2026-09-17 21:00 UTC.
Mon, Sep 14, 10:48 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering

Sat, Sep 12

Southparkfan closed T437788: No Puppet resources found on instance deployment-cumin04 on project deployment-prep as Invalid.

Works fine.

Sat, Sep 12, 7:49 PM · Beta-Cluster-Infrastructure
Southparkfan added a comment to T436470: Replace deployment-cumin-3 (Bullseye deprecation).

Manual steps, not in Puppet:

  • Copy /root/.ssh/cumin{,.pub} to new host
  • Arm the keyholder (keyholder arm) using the passphrase found at deployment-puppetserver-1:/srv/git/labs/private/files/ssh/tin/cumin_rsa.passphrase
  • Add the primary IPv4 and IPv6 addresses to profile::openstack::eqiad1::cumin::project_masters
Sat, Sep 12, 7:43 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T436470: Replace deployment-cumin-3 (Bullseye deprecation).

Puppet run fails:

# run-puppet-agent
Local puppet cert no longer verifies against the pinned puppetserver CA; re-anchoring SSL
Notice: Removed private key /var/lib/puppet/ssl/private_keys/deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud.pem
Notice: Removed certificate request /var/lib/puppet/ssl/certificate_requests/deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud.pem
Error: Could not run: Could not submit certificate request for 'deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud' to https://deployment-puppetserver-1.deployment-prep.eqiad1.wikimedia.cloud:8140/puppet-ca/v1 due to a conflict on the server
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud
Info: Certificate Request fingerprint (SHA256): 08:32:B8:C7:14:3D:F8:49:DE:9E:6B:88:3A:24:12:E3:50:A2:A4:97:CE:A6:E1:95:EB:60:2A:B4:22:69:1F:A6
Info: Downloaded certificate for deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud from https://deployment-puppetserver-1.deployment-prep.eqiad1.wikimedia.cloud:8140/puppet-ca/v1
Error: The certificate for 'CN=deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud' does not match its private key
Error: The certificate for 'CN=deployment-cumin04.deployment-prep.eqiad1.wikimedia.cloud' does not match its private key
Sat, Sep 12, 7:17 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436470: Replace deployment-cumin-3 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Open to In Progress.
Sat, Sep 12, 5:35 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436470: Replace deployment-cumin-3 (Bullseye deprecation) from Open to In Progress.
Sat, Sep 12, 5:35 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Thu, Sep 10

Southparkfan closed T436469: Replace deployment-mwlog02 (Bullseye deprecation) as Resolved.

https://gerrit.wikimedia.org/r/c/operations/puppet/+/1338305 has been cherry-picked to the Puppetserver and /srv/mw-log/archive has been transferred from deployment-mwlog02 to deployment-mwlog03.

Thu, Sep 10, 10:09 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436469: Replace deployment-mwlog02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Thu, Sep 10, 10:09 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Wed, Sep 9

Southparkfan added a comment to T436469: Replace deployment-mwlog02 (Bullseye deprecation).

deployment-mwlog03 has been set up with a Cinder volume.

Wed, Sep 9, 10:38 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436469: Replace deployment-mwlog02 (Bullseye deprecation) from Stalled to In Progress.

T437117 has been solved.

Wed, Sep 9, 10:16 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436469: Replace deployment-mwlog02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Stalled to In Progress.
Wed, Sep 9, 10:16 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T437489: No Puppet resources found on instance deployment-docker-mathoid02 on project deployment-prep as Resolved.

Apparently, I didn't delete the instance properly. Fixed.

Wed, Sep 9, 9:18 PM · Beta-Cluster-Infrastructure
Southparkfan added a comment to T437489: No Puppet resources found on instance deployment-docker-mathoid02 on project deployment-prep.

Not sure why this is still alerting. Instance has been decommissioned earlier today: T436465. Instructed the Puppetserver to clean up references to this instance.

Wed, Sep 9, 9:16 PM · Beta-Cluster-Infrastructure
Southparkfan closed T436465: Replace deployment-docker-mathoid02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Wed, Sep 9, 9:14 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436465: Replace deployment-docker-mathoid02 (Bullseye deprecation) as Resolved.
Wed, Sep 9, 9:14 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan claimed T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.
Wed, Sep 9, 4:10 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering

Sep 8 2026

Southparkfan added a comment to T436177: ☂ PHP 8.5 issues found during WMF rollout.

T437354 seems to be a new error, at least reproducible on the Beta Cluster. Although the task description doesn't mention errors occurring on the Beta Cluster, I would like to raise attention for this new error. Unknown if this is going to cause logspam in production.

Sep 8 2026, 8:14 PM · PHP 8.5 support, ServiceOps, ServiceOps-Upgrades-Hardware, MediaWiki-Engineering
Southparkfan removed a project from T437354: PHP Deprecated: Using null as an array offset is deprecated, use an empty string instead: Wikimedia-production-error.
Sep 8 2026, 8:11 PM · Content-Platform-Team (Work In Progress), MW-1.47-notes (1.47.0-wmf.21; 2026-09-22), Scribunto, Beta-Cluster-reproducible, PHP 8.5 support
Southparkfan created T437354: PHP Deprecated: Using null as an array offset is deprecated, use an empty string instead.
Sep 8 2026, 8:11 PM · Content-Platform-Team (Work In Progress), MW-1.47-notes (1.47.0-wmf.21; 2026-09-22), Scribunto, Beta-Cluster-reproducible, PHP 8.5 support

Sep 7 2026

Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.

deployment-mediawiki15 and deployment-mediawiki16 (both PHP 8.5) have been serving respectively API and non-API traffic for about 1.5 hours, between ~18:05 and ~19:31 UTC today. Until we are ready for a permanent switchover, I have switched the Beta Cluster back to the PHP8.3 hosts.

Sep 7 2026, 7:55 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering

Sep 4 2026

Southparkfan changed the status of T436469: Replace deployment-mwlog02 (Bullseye deprecation) from In Progress to Stalled.
Sep 4 2026, 10:57 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436469: Replace deployment-mwlog02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from In Progress to Stalled.
Sep 4 2026, 10:57 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan updated the task description for T437117: Quota increase request for project deployment-prep.
Sep 4 2026, 10:56 PM · Cloud-VPS (Quota-requests)
Southparkfan added a comment to T436469: Replace deployment-mwlog02 (Bullseye deprecation).

I couldn't finish the Tofu run, because we have too many server groups: │ Error: Error creating openstack_compute_servergroup_v2 deployment-mwlog: Expected HTTP response code [200] when accessing [POST https://openstack.eqiad1.wikimediacloud.org:28774/v2.1/os-server-groups], but got 403 instead: {"forbidden": {"code": 403, "message": "Quota exceeded, too many server groups."}}. Opened T437117 for a quota increase.

Sep 4 2026, 10:56 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T437117: Quota increase request for project deployment-prep.
Sep 4 2026, 10:56 PM · Cloud-VPS (Quota-requests)
Southparkfan added a comment to T436469: Replace deployment-mwlog02 (Bullseye deprecation).

Rough outline:

  • Turn up deployment-mwlog03 with Trixie (T417002) and a 20 GiB Cinder volume for /srv
  • Adjust udp2log_aggregator to send to deployment-mwlog03 [0].
  • Adjust profile::rsyslog::udp_tee::destinations to forward all logs to udp2log instances on deployment-mwlog0{2,3}
  • Change betacluster_udplog_host (Puppet: scap) and udp2log in wmf-config/LabsServices.php.
  • Manual logrotate isn't needed, because daily rotation has probably already run.
  • Sync /srv/mw-log/archive between hosts
  • Decommission deployment-mwlog02
Sep 4 2026, 10:12 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436469: Replace deployment-mwlog02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Open to In Progress.
Sep 4 2026, 6:08 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436469: Replace deployment-mwlog02 (Bullseye deprecation) from Open to In Progress.
Sep 4 2026, 6:08 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Sep 2 2026

Southparkfan updated the task description for T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie.
Sep 2 2026, 10:42 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436873: Project deployment-prep instance deployment-webperf21 is down as Invalid.
Sep 2 2026, 10:41 PM · Beta-Cluster-Infrastructure
Southparkfan added a comment to T436873: Project deployment-prep instance deployment-webperf21 is down.

Decommissioned in T436464.

Sep 2 2026, 10:41 PM · Beta-Cluster-Infrastructure
Southparkfan changed the status of T436465: Replace deployment-docker-mathoid02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Open to In Progress.
Sep 2 2026, 10:24 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436465: Replace deployment-docker-mathoid02 (Bullseye deprecation) from Open to In Progress.
Sep 2 2026, 10:24 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436464: Replace deployment-webperf2[12] (Bullseye deprecation) as Resolved.

Done!

Sep 2 2026, 10:23 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436464: Replace deployment-webperf2[12] (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Sep 2 2026, 10:22 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T429497: Upgrade (replace) beta|deployment-prep event platform VPS instances.

@Southparkfan thanks for the tasks! For ease of project tracking, we are going to use this one ticket for all of the individual host migrations.

Thanks for letting me know! Looking forward to the progress. :-)

Sep 2 2026, 9:06 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation)
Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.

I went ahead and created an ext4 filesystem on /dev/sdb and mounted it at /srv (moving over the old data).

root@deployment-mwmaint04:~# df -t ext4 -h
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G  5.1G   14G  28% /
/dev/sdb         20G   10G  8.6G  54% /srv

It will be great when this is completely automated.

Thank you for creating the filesystem!

Sep 2 2026, 9:00 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering

Sep 1 2026

Southparkfan added a comment to T436464: Replace deployment-webperf2[12] (Bullseye deprecation).

Seems to work fine with https://webperf.svc.deployment-prep.eqiad1.wikimedia.cloud. After running curl -H 'X-Wikimedia-Debug: excimer; profile' https://en.wikipedia.beta.wmcloud.org/wiki/Main_Page_XWDTEST8:

22:09:38.215153 ens3  Out IP deployment-mediawiki14.deployment-prep.eqiad1.wikimedia.cloud.35242 > deployment-webperf31.deployment-prep.eqiad1.wikimedia.cloud.https: Flags [S], seq 2010449796, win 42340, options [mss 1460,sackOK,TS val 2966769682 ecr 0,nop,wscale 9], length 0
22:09:38.216621 ens3  In  IP deployment-webperf31.deployment-prep.eqiad1.wikimedia.cloud.https > deployment-mediawiki14.deployment-prep.eqiad1.wikimedia.cloud.35242: Flags [S.], seq 706553928, ack 2010449797, win 43440, options [mss 1460,sackOK,TS val 4010399449 ecr 2966769682,nop,wscale 9], length 0
Sep 1 2026, 10:11 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T436464: Replace deployment-webperf2[12] (Bullseye deprecation).

Almost done! After applying the wmf-config/LabsServices.php changes on deployment-mediawiki14, I can see Redis traffic flowing to the Arc Lamp server:

21:57:08.587310 ens3  Out IP deployment-mediawiki14.deployment-prep.eqiad1.wikimedia.cloud.43648 > deployment-arclamp01.deployment-prep.eqiad1.wikimedia.cloud.redis: Flags [P.], seq 1:4188, ack 1, win 83, options [nop,nop,TS val 1933086863 ecr 1281742854], length 4187: RESP "PUBLISH" "excimer-wall" "/srv/mediawiki/w/index.php;/srv/mediawiki/php-master/index.php;MediaWiki\MediaWikiEntryPoint::run;MediaWiki\Actions\ActionEntryPoint::execute;MediaWiki\Actions\ActionEntryPoint::performRequest;MediaWiki\Actions\ActionEntryPoint
Sep 1 2026, 10:02 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T436464: Replace deployment-webperf2[12] (Bullseye deprecation).

Initial bootstrap of the Wikimedia Performance site fails:

Notice: /Stage[main]/Httpd/Httpd::Mod_conf[php8.2]/Exec[ensure_present_mod_php8.2]/returns: ERROR: Module mpm_event is enabled - cannot proceed due to conflicts. It needs to be disabled first!
Notice: /Stage[main]/Httpd/Httpd::Mod_conf[php8.2]/Exec[ensure_present_mod_php8.2]/returns: ERROR: Could not enable dependency mpm_prefork for php8.2, aborting
Notice: /Stage[main]/Httpd/Httpd::Mod_conf[php8.2]/Exec[ensure_present_mod_php8.2]/returns: Considering dependency mpm_prefork for php8.2:
Notice: /Stage[main]/Httpd/Httpd::Mod_conf[php8.2]/Exec[ensure_present_mod_php8.2]/returns: Considering conflict mpm_event for mpm_prefork:
Notice: /Stage[main]/Httpd/Httpd::Mod_conf[php8.2]/Exec[ensure_present_mod_php8.2]/returns: Considering conflict mpm_worker for mpm_prefork:
Error: '/usr/sbin/a2enmod php8.2' returned 1 instead of one of [0]
Error: /Stage[main]/Httpd/Httpd::Mod_conf[php8.2]/Exec[ensure_present_mod_php8.2]/returns: change from 'notrun' to ['0'] failed: '/usr/sbin/a2enmod php8.2' returned 1 instead of one of [0] (corrective)
Sep 1 2026, 9:36 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436716: Project deployment-prep instance deployment-webperf22 is down as Invalid.

Decommissioned in T436464

Sep 1 2026, 9:06 PM · Beta-Cluster-Infrastructure
Southparkfan added a comment to T436464: Replace deployment-webperf2[12] (Bullseye deprecation).

Given the fact Arc Lamp has been broken for ages anyways, I'm going to follow an adjusted procedure for migrating Arc Lamp (inspired by T319434):

  1. Finish rollout of deployment-arclamp01 (yes, new prefix [0]) including Scap run *and* including new arclamp service RR
  2. Copy /srv/xenon from the old to the new host
  3. Point arclamp_host to new host, ensure arclamp directory still reachable
  4. Decommission deployment-webperf22
  5. Point profile::webperf::arclamp::redis_host to the Redis instance on deployment-arclamp01- provisioned by profile::arclamp::redis
  6. Create patch to point xenon in wmf-config/LabsServices.php to the new arclamp service RR
  7. If it works; good. If it doesn't, wait until T430511 is resolved?
Sep 1 2026, 7:24 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T436464: Replace deployment-webperf2[12] (Bullseye deprecation).

On deployment-webperf22, Arc Lamp has been broken for a long, long time:

Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]: Traceback (most recent call last):
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:   File "/srv/deployment/performance/arc-lamp/arclamp-log.py", line 140, in <module>
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:     pubsub.subscribe(config.get('redis_channel', 'arclamp'))
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:   File "/usr/lib/python3/dist-packages/redis/client.py", line 3580, in subscribe
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:     ret_val = self.execute_command('SUBSCRIBE', *iterkeys(new_channels))
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:   File "/usr/lib/python3/dist-packages/redis/client.py", line 3466, in execute_command
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:     self.connection = self.connection_pool.get_connection(
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:   File "/usr/lib/python3/dist-packages/redis/connection.py", line 1192, in get_connection
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:     connection.connect()
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:   File "/usr/lib/python3/dist-packages/redis/connection.py", line 563, in connect
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]:     raise ConnectionError(self._error_message(e))
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249358]: redis.exceptions.ConnectionError: Error 110 connecting to deployment-mwlog02.deployment-prep.eqiad1.wikimedia.cloud:6379. Conne>
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249359]:     connection.connect()
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249359]:   File "/usr/lib/python3/dist-packages/redis/connection.py", line 563, in connect
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249359]:     raise ConnectionError(self._error_message(e))
Sep 01 18:21:52 deployment-webperf22 arclamp-log.py[2249359]: redis.exceptions.ConnectionError: Error 110 connecting to deployment-mwlog02.deployment-prep.eqiad1.wikimedia.cloud:6379. Conne>
Sep 01 18:21:52 deployment-webperf22 systemd[1]: excimer-wall-log.service: Main process exited, code=exited, status=1/FAILURE
Sep 01 18:21:52 deployment-webperf22 systemd[1]: excimer-wall-log.service: Failed with result 'exit-code'.
Sep 01 18:21:52 deployment-webperf22 systemd[1]: excimer-log.service: Main process exited, code=exited, status=1/FAILURE
Sep 01 18:21:52 deployment-webperf22 systemd[1]: excimer-log.service: Failed with result 'exit-code'.
Sep 1 2026, 6:48 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan updated subscribers of T436619: Found non-revoked Puppet certificates for 2 deleted instances on deployment-puppetserver-1.

Certificates have been revoked:

# /usr/local/sbin/clean-stale-puppet-certs --clean
Certificate for deployment-docker-cxserver02.deployment-prep.eqiad1.wikimedia.cloud has been revoked
Cleaned files related to deployment-docker-cxserver02.deployment-prep.eqiad1.wikimedia.cloud
Submitted 'deactivate node' for deployment-docker-cxserver02.deployment-prep.eqiad1.wikimedia.cloud with UUID e9f695f0-4e79-4a85-b361-ba79c9b2d6ab
Certificate for deployment-docker-citoid02.deployment-prep.eqiad1.wikimedia.cloud has been revoked
Cleaned files related to deployment-docker-citoid02.deployment-prep.eqiad1.wikimedia.cloud
Submitted 'deactivate node' for deployment-docker-citoid02.deployment-prep.eqiad1.wikimedia.cloud with UUID b8565e65-e1c6-428a-8a29-85001da52f8c
Sep 1 2026, 6:01 PM · Beta-Cluster-Infrastructure
Southparkfan added a comment to T436467: Replace deployment-docker-cxserver02 (Bullseye deprecation).

Note: this instance has been deleted, deployment-docker-cxserver03 exists. Status unknown.

Sep 1 2026, 5:58 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T436466: Replace deployment-docker-citoid02 (Bullseye deprecation).

Note: this instance has been deleted, deployment-docker-citoid03 exists. Status unknown.

Sep 1 2026, 5:57 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan claimed T436619: Found non-revoked Puppet certificates for 2 deleted instances on deployment-puppetserver-1.
Sep 1 2026, 5:09 PM · Beta-Cluster-Infrastructure

Aug 31 2026

Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.

@Krinkle Hi! You have migrated the Beta Cluster from PHP 8.1 to PHP 8.3, could you advise me on how to proceed here? We have a few hosts (T435393#12269425) running PHP 8.5 now and the Puppet changes aren't too hard.

Aug 31 2026, 9:55 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering
Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.

As mentioned @IRC: I have performed a smoke test for mediawiki16 by making it serve non-api traffic for about a minute, and at least Special:Version renders just fine. I have reverted the change to ATS config, so we're back to mediawiki14 now.

Aug 31 2026, 9:26 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering
Southparkfan closed T436462: Replace deployment-wikifeeds02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Aug 31 2026, 8:32 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T436462: Replace deployment-wikifeeds02 (Bullseye deprecation) as Resolved.
Aug 31 2026, 8:32 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436562: profile::pki::client does not create symlinks using hashes of CAs.
Aug 31 2026, 8:19 PM · Infrastructure-Foundations, CFSSL-PKI, Beta-Cluster-Infrastructure
Southparkfan added a comment to T435393: Beta Cluster: Switch to PHP 8.5, includes writing Puppet changes to support PHP 8.5 on baremetal.

There might be some more things that need fixing on the MediaWiki running nodes. curl -v -4 --connect-to ::$(hostname -f) -H 'X-Forwarded-Proto: https' 'http://meta.wikimedia.beta.wmcloud.org/wiki/Main_Page' returns "503 Service Unavailable" on both of them.

Aug 31 2026, 7:58 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure, MediaWiki-Engineering
Southparkfan added a comment to T436462: Replace deployment-wikifeeds02 (Bullseye deprecation).

The VM has been decommissioned, but this patch is currently cherry-picked.

Aug 31 2026, 6:44 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure

Aug 30 2026

Southparkfan changed the status of T436464: Replace deployment-webperf2[12] (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Open to In Progress.
Aug 30 2026, 10:31 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436464: Replace deployment-webperf2[12] (Bullseye deprecation) from Open to In Progress.
Aug 30 2026, 10:31 PM · Patch-For-Review, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436462: Replace deployment-wikifeeds02 (Bullseye deprecation) from Open to In Progress.

It wasn't too hard to get Wikifeeds up and running using hiera:

# curl http://localhost:8889/en.wikipedia.beta.wmcloud.org/v1/page/random/title
{"items":[{"title":"Test_page_images_again"}]}
Aug 30 2026, 9:29 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan changed the status of T436462: Replace deployment-wikifeeds02 (Bullseye deprecation), a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, from Open to In Progress.
Aug 30 2026, 9:29 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T433998: Planning for a plan to migrate Beta Cluster again, a subtask of T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie, as Resolved.
Aug 30 2026, 9:05 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T433998: Planning for a plan to migrate Beta Cluster again as Resolved.

For all services and hosts, subtasks have been created under T401839. Bryan and I have paved the way forward to get the Beta Cluster off Bullseye. I consider this "planning" task to be finished.

Aug 30 2026, 9:05 PM · User-bd808, Release-Engineering-Team (Doing 😎), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan closed T433998: Planning for a plan to migrate Beta Cluster again, a subtask of T434103: Requests to extend shutdown timeline for Bullseye deprecation, as Resolved.
Aug 30 2026, 9:05 PM · Cloud-VPS (Debian Bullseye Deprecation)
Southparkfan updated the task description for T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie.
Aug 30 2026, 9:03 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436481: Replace deployment-zookeeper-3 (Bullseye deprecation).
Aug 30 2026, 9:03 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436480: Replace deployment-rdb01 (Bullseye deprecation).
Aug 30 2026, 9:03 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan updated the task description for T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie.
Aug 30 2026, 8:58 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436479: Replace deployment-echostore02 (Bullseye deprecation).
Aug 30 2026, 8:58 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a comment to T433998: Planning for a plan to migrate Beta Cluster again.

Traffic will work on upgrading deployment-cache-(text|upload)08 if that's fine and we would like to coordinate about that. Is this task the right place to do that or is something else preferred?

Aug 30 2026, 8:55 PM · User-bd808, Release-Engineering-Team (Doing 😎), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a project to T436468: Replace cache proxies: deployment-cache-(text|upload)08 (Bullseye deprecation): Traffic.
Aug 30 2026, 8:53 PM · Traffic, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan updated the task description for T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie.
Aug 30 2026, 8:52 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan removed a subtask for T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie: T429497: Upgrade (replace) beta|deployment-prep event platform VPS instances.
Aug 30 2026, 8:48 PM · Epic, Release-Engineering-Team (Priority Backlog 📥), Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan edited parent tasks for T429497: Upgrade (replace) beta|deployment-prep event platform VPS instances, added: T436474: Replace deployment-eventgate-4 (Bullseye deprecation), T436475: Replace deployment-eventstreams-2 (Bullseye deprecation), T436463: Replace deployment-schema-3 (Bullseye deprecation); removed: T401839: Migrate deployment-prep away from Debian Bullseye to Bookworm/Trixie.
Aug 30 2026, 8:48 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation)
Southparkfan added a subtask for T436463: Replace deployment-schema-3 (Bullseye deprecation): T429497: Upgrade (replace) beta|deployment-prep event platform VPS instances.
Aug 30 2026, 8:48 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a subtask for T436475: Replace deployment-eventstreams-2 (Bullseye deprecation): T429497: Upgrade (replace) beta|deployment-prep event platform VPS instances.
Aug 30 2026, 8:48 PM · Data-Engineering, Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added a subtask for T436474: Replace deployment-eventgate-4 (Bullseye deprecation): T429497: Upgrade (replace) beta|deployment-prep event platform VPS instances.
Aug 30 2026, 8:48 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added projects to T436463: Replace deployment-schema-3 (Bullseye deprecation): Event-Platform, Data-Engineering.
Aug 30 2026, 8:47 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436477: Replace or decommission RESTBase hosts: deployment-restbase(05|-bullseye) (Bullseye deprecation).
Aug 30 2026, 8:46 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436476: Replace Swift hosts: deployment-ms-(be0[78]|fe04) (Bullseye deprecation).
Aug 30 2026, 8:46 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436475: Replace deployment-eventstreams-2 (Bullseye deprecation).
Aug 30 2026, 8:46 PM · Data-Engineering, Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan added projects to T436474: Replace deployment-eventgate-4 (Bullseye deprecation): Event-Platform, Data-Engineering.
Aug 30 2026, 8:46 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436474: Replace deployment-eventgate-4 (Bullseye deprecation).
Aug 30 2026, 8:45 PM · Data-Engineering (Q1 FS26/27 July 1st - September 30th), Event-Platform, Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure
Southparkfan created T436473: Replace deployment-etcd05 (Bullseye deprecation).
Aug 30 2026, 8:45 PM · Cloud-VPS (Debian Bullseye Deprecation), Beta-Cluster-Infrastructure