Change Details

Our Elastic Puppet roles are either the last or one of the last using nginx as a TLS proxy. As illustrated in T360439 , this is slowly building up technical debt as these roles might be the only thing using a particular Puppet resource or code path. Creating this ticket to: - Discuss proposed changes with stakeholders - Assess our current nginx config and see what can be migrated to envoy (besides TLS, there could be headers inserted, rewrites etc) - Migrate our TLS termination to envoy. - If possible, completely remove nginx in favor of envoy.

Our Elastic Puppet roles are the only set of roles besides maps that still use nginx to terminate TLS, as illustrated by [[ https://gerrit.wikimedia.org/r/c/operations/puppet/+/1037029 | this CR ]] . As seen in T360439 and other tasks, this is slowly building up technical debt as almost no one uses the same Puppet code for TLS termination. Moving to envoy as TLS terminator will align us with the rest of WMF. Creating this ticket to: - Discuss proposed changes with stakeholders - Assess our current nginx config and see what can be migrated to envoy (besides TLS, there could be headers inserted, rewrites etc) - Migrate our TLS termination to envoy. - If possible, completely remove nginx in favor of envoy.

Our Elastic Puppet roles are either the last or one of the last using nginx as a TLS proxythe only set of roles besides maps that still use nginx to terminate TLS, as illustrated by [[ https://gerrit.wikimedia.org/r/c/operations/puppet/+/1037029 | this CR ]] . As illustrated in T360439 ,seen in T360439 and other tasks, this is slowly building up technical debt as almost no one uses the same Puppet code for TLS termination. this is slowly buildMoving up technical debtto envoy as these roles might be the only thing using a particular PuppetTLS terminator will align us with the resource or code patht of WMF. Creating this ticket to: - Discuss proposed changes with stakeholders - Assess our current nginx config and see what can be migrated to envoy (besides TLS, there could be headers inserted, rewrites etc) - Migrate our TLS termination to envoy. - If possible, completely remove nginx in favor of envoy.