Change Details

Orchestrator supports auth via forwarded headers (https://github.com/openark/orchestrator/blob/master/docs/security.md). Ideally we can put it behind idp/cas. Also use SSL Plan: [x] Decomission dborch1001 [] Recreate dborch1001 with a public ip (https://wikitech.wikimedia.org/wiki/Ganeti#Create_the_VM) [] Add CNAME from orchestrator.wikimedia.org to dborch1001 [] Run apache with mod_cas on dborch1001, forward auth'd traffic to orchestrator on loopback [] Configure orchestrator to respect the auth headers from mod_cas [] Update all orchestrator grants with the new public IP

Orchestrator supports auth via forwarded headers (https://github.com/openark/orchestrator/blob/master/docs/security.md). Ideally we can put it behind idp/cas. Also use SSL Plan: [x] Decomission dborch1001 [x] Recreate dborch1001 with a public ip (https://wikitech.wikimedia.org/wiki/Ganeti#Create_the_VM) [] Add CNAME from orchestrator.wikimedia.org to dborch1001 [] Run apache with mod_cas on dborch1001, forward auth'd traffic to orchestrator on loopback [] Configure orchestrator to respect the auth headers from mod_cas [] Update all orchestrator grants with the new public IP

Orchestrator supports auth via forwarded headers (https://github.com/openark/orchestrator/blob/master/docs/security.md). Ideally we can put it behind idp/cas. Also use SSL Plan: [x] Decomission dborch1001 [x] Recreate dborch1001 with a public ip (https://wikitech.wikimedia.org/wiki/Ganeti#Create_the_VM) [] Add CNAME from orchestrator.wikimedia.org to dborch1001 [] Run apache with mod_cas on dborch1001, forward auth'd traffic to orchestrator on loopback [] Configure orchestrator to respect the auth headers from mod_cas [] Update all orchestrator grants with the new public IP