Change Details

In T227860 we added HTTPS support to Analytics UIs using nginx. This has revealed some missing support in puppet for Buster, and overall it seems that nobody will maintain TLS settings for nginx in the long term (since Traffic moved to ATS). The other services are using envoy, so we should investigate if using it is feasible.

In T227860 we added HTTPS support to Analytics UIs using nginx. This has revealed some missing support in puppet for Buster, and overall it seems that nobody will maintain TLS settings for nginx in the long term (since Traffic moved to ATS). The other services are using envoy, so we should investigate if using it is feasible. More context: - https://wikitech.wikimedia.org/wiki/Envoy - https://wikitech.wikimedia.org/wiki/LVS We want the services listed in T227860 to go through Envoy instead of directly to Nginx on the service hosts. Envoy will do TLS termination, and then proxy the request to the backend service over http instead of https. We can then remove our custom Nginx based TLS termination from the backend service boxes.

In T227860 we added HTTPS support to Analytics UIs using nginx. This has revealed some missing support in puppet for Buster, and overall it seems that nobody will maintain TLS settings for nginx in the long term (since Traffic moved to ATS). The other services are using envoy, so we should investigate if using it is feasible. More context: - https://wikitech.wikimedia.org/wiki/Envoy - https://wikitech.wikimedia.org/wiki/LVS We want the services listed in T227860 to go through Envoy instead of directly to Nginx on the service hosts. Envoy will do TLS termination, and then proxy the request to the backend service over http instead of https. We can then remove our custom Nginx based TLS termination from the backend service boxes.