https://github.com/wikimedia/operations-puppet

sort by:
Revision Author Date Message Commit Date
bdd7db6 tools: Make home page check critical Check's green now Bug: T116925 Change-Id: Ief2d7b34242dea115bac65859b12af8d7fa30ca5 27 October 2015, 21:40:08 UTC
eca534c tools: Make main page check in icinga Can be made paging after testing to make sure it works Also move the NFS check to a more appropriate place Bug: T116925 Change-Id: I35c5bfe8941a509a2c92283e82208868e19e0e87 27 October 2015, 21:22:53 UTC
a700b8b ssh: Allow customizing authorized_keys_command Bug: T113979 Change-Id: Iee5197ef33abde4c6c0002c0129f0931bc9ab1f5 26 October 2015, 23:59:06 UTC
70c937b ssh: Allow direct login as servicegroups Can be turned on with ssh config if necessary. Isn't actually turned on anywhere atm, since it requires ssh 6.9 to be able to specify parameters Bug: T113979 Change-Id: Iec3b944cfd0cf095cbc22554b5a8ba99d1262510 26 October 2015, 23:47:04 UTC
7a80749 adding in globalsign to procurement approved vendors adding globalsigns email domain to allowed direct emails into procurement tasks Change-Id: I4f41b21ffc3a240d77655412a17028e8c17f0ba9 26 October 2015, 17:35:10 UTC
a288aa1 admin: let kartotherian and tilerator admins read logs Add journalctl -u <unit> for log access for these services. Just copying how we do it for other admin groups, and because there is the request for missing log access. Bug:T115067 Change-Id: I5d47c4d8dd3ea2d91d071e2a6b416e9bdd66b7f1 26 October 2015, 17:30:51 UTC
bea4ef3 Restrict access to deployment redis to internal plus silver Change-Id: Ibd32e61b721169cfbfa8acbcbd1f30ed9637410f 26 October 2015, 17:27:39 UTC
ed59e65 Move the ferm rules for elasticsearch internode traffic into role::logstash::elasticsearch logstash100[1-3] run all the injectors, while logstash100[4-6] only run the elasticsearch nodes. Bug: T104964 Change-Id: I0b76f76482aaf3bf25d236b3352b93d66e31b1e6 26 October 2015, 17:14:10 UTC
4c3be70 releases: move base::firewall into the role Change-Id: I7a276232a337519546c537a3fd7aec6cb4e9af94 26 October 2015, 17:05:19 UTC
987c66c Disable all diamond varnishreqstats collectors Bug: T83580 Change-Id: Ic445e10ad77cb091510edd1f1aa7e4e6c28abd58 26 October 2015, 15:21:57 UTC
5ea06e3 dataset: move system user creation to module The "datasets" user/group creation/maintainance has been wildly inconsistent to say the least: - It was created by role::dataset::systemusers which is clearly not a role. - The class was applied by site.pp, although User['datasets'] was actually required upon by role::dataset::pagecountsraw which was in turn included by role::dataset::primary. - The class dataset::dirs, included by dataset::html, included by class dataset (over at the dataset module, *not* the role), is actually hardcoded to use the user "datasets" so it actually requires role::dataset::systemusers to have been applied before, although there is no formal dependency (so it's broken puppet code) - All the cronjobs have a $user parameter which defaulted to "datasets", except one, which defaulted to undef. All of the callsites passed the parameter to set it to "datasets", although in all but one cases it was superfluous. Create a dataset::user and move the user/group creation there as it is (despite being broken in other ways, see the FIXME); require it from the main dataset class and remove the non-role role class. Change-Id: Iba922bc3f3f97c72a839fc5a1ef932ec783b5e17 26 October 2015, 14:56:47 UTC
1650073 Revert "remove cp1059 from ipsec hostlists - T114870" This reverts commit 537fd38b4dd8a64cc64a1dfee1722c1f195bf8b3. Change-Id: If82c125a39642f5f051f7df50e8f1b64efb8bb91 26 October 2015, 14:49:03 UTC
15150d4 Remove class role::dataset::publicdirs, noop It justs creates an empty directory and is applied only on fluorine where it isn't used by anything. Remove it. Change-Id: Ia8b6d0c1f214bd2439467316e077dea9dba355aa 26 October 2015, 14:37:58 UTC
675b945 Assign salt grains for openldap Change-Id: I4488441a689d864731414bacf1bfcaee0a080248 26 October 2015, 13:41:29 UTC
0d20824 Assign salt grains for graphite Change-Id: I6295349842f2ee91b24994ff28233752a76cb97c 26 October 2015, 13:37:42 UTC
86f3c4f toollabs: install libsort-fields-perl precise: libsort-fields-perl (0.90) trusty: libsort-fields-perl (0.90) jessie: libsort-fields-perl (0.90) Bug: T116579 Change-Id: I07e857be87ec10326d25520b4ab8aeaa34deb07f 26 October 2015, 12:59:44 UTC
c61994a Assign salt grains for librenms Change-Id: I61a1e4bcf34f1d0f1a8aaac9aae4a9bcc53e40ec 26 October 2015, 12:22:13 UTC
fb700b9 Assign salt grains for application servers Change-Id: I5cb39b57c8cb299356512851f31dc028285831e0 26 October 2015, 12:11:30 UTC
a833382 Assign salt grains for jobrunners Change-Id: Ib4fd0c1e28747018ff8b97cf390299171f16a587 26 October 2015, 12:10:44 UTC
7bcf7c6 puppetmaster: Move the role into the role module Move the puppetmaster role into the role module Change-Id: I3571dab849cc8874367ec57dedbb3a1fb34aef92 26 October 2015, 12:06:39 UTC
3d1d698 Assign salt grains for mw api servers Change-Id: I0afd68b60583521f8eb56c85c9b97e21a0767626 26 October 2015, 11:48:30 UTC
52ce76a Assign salt grains for image scalers Change-Id: I67b9468adfecb20a656105f30f1450a20cc3477f 26 October 2015, 09:41:57 UTC
918b92b Move base::firewall into the archiva role Change-Id: I87c7c9304690ba426e74d6084f8995e6be5b7602 26 October 2015, 09:13:42 UTC
89fada3 Move the base::firewall include into the impala role Change-Id: I829a22910f3d15530e4d3a91c4bea6d3290d741e 26 October 2015, 09:09:33 UTC
661b9c6 dumps: update listing of files for rsync to lastest rsync args rsync 3.01 and on human formats sizes of files and requires a special option not to do so. e don't want the commas so use the option. Change-Id: I36cfd2ebf367c632059ee0ef655f2d3e74c54b06 26 October 2015, 09:08:09 UTC
228f05c Assign salt grains for pool counters Change-Id: Ide6986a17bc38b4fed1c047597a55a341e489e7e 26 October 2015, 09:06:47 UTC
6bff836 Assign salt grains for db analytics/sanitarium Change-Id: I6b0227eba4639cb37a3e28ab1e3d8b1cc8689c32 26 October 2015, 09:04:32 UTC
d987446 Assign salt grains for ci Change-Id: I669441b5a382ac784cd27de29c2db5595881293a 26 October 2015, 08:58:24 UTC
6c7b151 Assign salt grains for hue Change-Id: I1cc22ca9acda42f17f1c01b90fb3836bcbaeb84b 26 October 2015, 08:53:46 UTC
27ca827 Assign salt grains for spark Change-Id: Id7b378e6a57ebf057f5f391644f226f11f1f7ba9 26 October 2015, 08:30:20 UTC
327f25f dumps: one more conf file not updated for new path of dblists Change-Id: I77af988c3810b7c8855e6bb605275968f2a403b0 26 October 2015, 08:28:11 UTC
d99e1cb Assign salt grains for terbium Change-Id: Ib592b6313f0c723737f984bda270a402bd0a210f 26 October 2015, 08:20:39 UTC
4cbaaef Assign salt grains for wdqs Change-Id: I9286df149c8e9c6164fa056c53314dc073d5b135 26 October 2015, 08:19:34 UTC
5afc50e Assign salt grains for labvirt/nova compute Change-Id: Ic2e3dd7895cd48c1d81d303bb711a86f4a28706f 26 October 2015, 08:17:32 UTC
24f6a8c Assign salt grains for gerrit Change-Id: I2e61af9cf69648e71c86117bdfd1bfc10c222c46 26 October 2015, 08:06:47 UTC
81caeef Assign salt grains for kafkatee Change-Id: I65bdcaf766cdb7309bb6cdc20d2a1315a74193df 26 October 2015, 08:00:11 UTC
777ea16 Addin dhcp and netboot cfg for ms-be1019-1021 Change-Id: Ibed5a4627d560267e6f2d6697a91fbab86c94d26 25 October 2015, 18:33:29 UTC
88a5f86 gdash: add notice pointing users to grafana.wikimedia.org * Add an alert message to the top of pages on gdash.wikimedia.org pointing users to the newer grafana.wikimedia.org. * Include ::apache::mod::expires -- needed for the site but ommitted from Iac5d238ca. Bug: T104365 Change-Id: I1b4a96e7401c126d4434dfe83ee7f28911a35675 25 October 2015, 17:29:35 UTC
dbd2803 Replace dynamic gdash.wikimedia.org with static mirror We migrated from gdash to grafana (https://grafana.wikimedia.org), but gdash continues to receive some traffic, so keep it around as a static mirror. I will manually remove remnants of the old class from graphite1001. Bug: T104365 Change-Id: Iac5d238ca9a06b8029e9f4187fbb3a63a6acbdfa 25 October 2015, 08:57:48 UTC
39c086b Fix w-beta.wmflabs.org redirect Bug: T116444 Change-Id: I73e68fae54f492cd59230d4dc0036ff155fc88bf 24 October 2015, 17:10:20 UTC
13c489b UrlShortener on beta: fix RewriteRule '/' matches both the 'Redirect /' directive and 'RewriteRule ^/(.*)' directive, because '*' is '0 or more'. Changing it to '+' (one or more) resolves the ambiguity and makes Apache not freak out. Change-Id: Icb1163878412fcaeb969c9166c160df051104783 24 October 2015, 07:34:48 UTC
346d522 Switch UrlShortener to w-beta.wmflabs.org Change-Id: I0a71bc622415105ca95fba9b59de7b21727ca9fd 24 October 2015, 06:53:24 UTC
b9e11d9 Add apache rewrite rule for UrlShortener on beta cluster Bug: T116444 Change-Id: I1d9e50b4df41aca4876ede0b3ee2d1cf8626d8b4 24 October 2015, 06:35:50 UTC
4702e09 Configure nova's nutcracker not to eject hosts I believe the reason we frequently get alerts for nutcracker on silver is that there is only one backend memcached server configured and auto_eject_hosts is set to true, which means that if memcached is slow to respond for whatever reason nutcracker is left without any backends. Change-Id: Ie7bf52c729cb9c59b29da7fba2d0fed0258ddb48 24 October 2015, 06:26:36 UTC
20d0edd Update flamegraph.pl to brendangregg/Flamegraph@182b24f Changes: * 182b24fb63: Ctrl-F to search * b26eda56a8: show matched percent * 4c821b895f: improve code, reduce SVG size * 71e5a78e83: Fix search to work if the nameattr href is being used * 2ee18074bc: search * 044f09b9d5: add --help option, URLs, and update major history * f18bcca92d: Fix quoting in mouseover * 996ef3c9d3: flamegraph.pl: fixed the delta percentage's sign when --negate is specified. Change-Id: Ieceaa846de557ab29c534398bd92120b7211a3d2 23 October 2015, 23:08:43 UTC
9be9570 updating procurement project direct domain emails we allow direct emails to procurement tasks from select domains, just updating our list for current vendors and tasks Change-Id: Iee402d6fc09ce56b482645e2c47e665b8691eebd 23 October 2015, 20:54:35 UTC
295b4d8 labs: Add statistics NFS mount to analytics project Change-Id: I8c83821a2c46ed69827d4d6e76cd2ec8337d31c0 23 October 2015, 20:31:20 UTC
88ed50d Update the ubuntu cloud-archive apt key Change-Id: I5f7f0dc353a3448dd4a9050cf8f0ce6951c67d5e 23 October 2015, 02:21:54 UTC
09ab6dc Don't create an explicit nova partition on labvirt1010. This is handled by partman for these boxes. Change-Id: Ie7f419749acd1bf216f1c80dc63cb29e552b2c7a 23 October 2015, 02:21:54 UTC
f9fd81e es: Remove maint scripts and add scap::scripts The former sets up cronjobs for maintainence scripts that we shouldn't have been using. Just need mwscript Change-Id: I938c2382518b545b7adb87fd4cfa22b965b5653f 23 October 2015, 19:17:37 UTC
d0bd9a3 Make labvirt1010 a compute node. Change-Id: I1dfee9805e50d938a63ec08093a55a18465f537a 23 October 2015, 18:46:47 UTC
36c85a4 scap: Allow nobelium to run scap Change-Id: Ib185430a5e42b17d5a20049084dc2455f39527a0 23 October 2015, 18:38:24 UTC
f9702bb mw: Make initial scap run as mwdeploy user scap no longer accepts being run as root Change-Id: Ie3e82ea92c57ec312c9f9e899fd2e94720f64c0a 23 October 2015, 18:30:44 UTC
3934d28 elasticsearch: Setup partial MW install on nobelium To help copy indices from prod cluster to here. This is CPU bound on the scripts side, so terbium is maxed out copying to codfw. This can max out nobelium copying to labsearch cluster Change-Id: I4c4b3464373356336716be50e73f053645ee00c9 23 October 2015, 18:07:22 UTC
b6eb002 Adding new installed servers to the mariadb::core role As we have not decided yet its shard, setting temporely to shard 1. Removing previous placeholder definition. Bug: T84428 Change-Id: I065613c5b5221e0b115c811a0d381c975985584a 23 October 2015, 16:35:12 UTC
4c29aae aqs: Fix the LVS monitoring restbase does not yet support the /_info endpoint for health monitoring. Change the LVS check endpoint to / Change-Id: I6cea7f383bfcd455e74d77f6f567fa17d2e2e0ea 23 October 2015, 15:58:17 UTC
a547442 Assign salt grains for Icinga Change-Id: I15f30e97096bdb0c5082d2a05b682becf518168d 23 October 2015, 13:51:08 UTC
da0d513 Assign salt grains for maps Change-Id: Ib2ae51dbac89454c467582f23cfc4d4e8cfbd9c8 23 October 2015, 13:48:07 UTC
82c91c0 Preparing db2055-db2070 for jessie installation Switching them to install jessie instead of trusty. Bug: T84428 Change-Id: Iaff1903cc0756fbe36b24851788b549a3b7a6080 23 October 2015, 13:46:32 UTC
89ec4a1 Assign salt grains for xenon Change-Id: I1c1e81f4eb41a3fb5b1c745225ec86671e57cc72 23 October 2015, 13:41:12 UTC
aab840f RESTBase: Set the correct base path for the global domain Due to Varnish rewrites, requests received by RESTBase have the base path in the form https://{domain}/api/rest_v1/ . All of the domains have had that set except the global domain, thus making the swagger UI (the docs) send requests to the wrong location. This patch fixes the issue. Change-Id: Ic7363bdd54f9a187e999eae0efbd69e06c043d84 23 October 2015, 13:39:32 UTC
8b005e9 Assign salt grains for installserver Change-Id: I8a460c3c7ec0e291d58ada8f310f56f885f73277 23 October 2015, 13:31:49 UTC
0e8e216 Assign salt grains for bugzilla Change-Id: I87631a76fc10cdd5a82f5ae3671902f77978449b 23 October 2015, 13:21:31 UTC
8ccef38 Assign salt grains for nova controller Change-Id: Ib6bf95c308adaf1b32d1770755a6450bfd19ed47 23 October 2015, 13:20:11 UTC
e4c2692 Assign salt grains for labmon Change-Id: Id1b3995570d5084bc09c9c45157f4088491daec2 23 October 2015, 13:10:30 UTC
0a76ef9 Fix getJobQueue cronspam "2&1" results into invoking "1", which in turn results into the cronspam of "/bin/sh: 1: 1: not found", every single minute. Presumably 2>&1 was meant, but replace it with 2>/dev/null for extra clarity/POSIX compatibility. Fixup for I78116df9ab8cfd27420b69f896a62da9f03b1fca. Change-Id: I620112ec29b18caa8661ef444eec89dcfdc363fb 23 October 2015, 11:56:26 UTC
0c4b7f7 cassandra: enable metric blacklist for restbase with mobileapps storage in I885a3e7a2ea a whole lot of new CFs are being created, this in turn results in many new graphite metrics created. Enable metric blacklisting to avoid cassandra metrics overwhelming graphite storage. Bug: T113733 Change-Id: I87ffd6dc0d4a60db25d6fd36d53ecc22dd515838 23 October 2015, 11:36:24 UTC
34c5dab cassandra: add restbase-test2002 instances Change-Id: I777aef78c4ddc911d7af68d5cf8c74866d7e679c 23 October 2015, 10:23:56 UTC
b9095e5 Assign salt grains for parsoid Change-Id: Ic80a643d13bfadf5db1b9ad995acf4d580123a72 23 October 2015, 10:01:46 UTC
71e18ee Assign salt grains for snapshot hosts Change-Id: I9e7b035a4775f38a12aefc5860a938d879a64e9f 23 October 2015, 10:00:15 UTC
9976c2a Assign salt grains for pmacct and puppetmaster backends Change-Id: I758b3d87498fd8e783ad54f0e935631da85dfda6 23 October 2015, 09:55:30 UTC
30618da Assign salt grains for archiva Change-Id: I8dbc18dffab5cf98e9c78e6c0b171cb21be06372 23 October 2015, 09:53:35 UTC
22ca78e Assign salt grains for rcstream Change-Id: Idaf6249308cba376b828f29894f0bb516dc26843 23 October 2015, 09:52:58 UTC
6f23ae3 diamond: enable ntpd collector across the fleet Having metrics about the state of clocks around the fleet could prove useful when debugging issues. Enable ntpd collector throught the fleet Change-Id: I8fbf8684369859356b3b3427433c0595b704dd1e 23 October 2015, 09:52:18 UTC
02ffa77 Assign salt grains for swift backends Change-Id: Ie37fe7196628d7a74bad06f37e50a1d022bbb407 23 October 2015, 09:49:48 UTC
02e6b9c Assign salt grains for swift frontends Change-Id: I9b4543a1eb5bebc350bc1dba262b39cf2fc38c38 23 October 2015, 09:44:27 UTC
26284d2 cassandra: add restbase-test2002-[ab] to seeds Change-Id: I6e255db9af85c01f66bad117a7acf69d4413b792 23 October 2015, 09:41:23 UTC
a26ff7d Assign salt grains for the LVS servers Change-Id: I74d8b4d590cac3be817d34f51df8fa4eafc4d455 23 October 2015, 08:26:05 UTC
d4340b3 Assign salt grains for osm Change-Id: I0f6a8b6eca99f383904fe166d9a2263f7246ba8f 23 October 2015, 08:19:42 UTC
97dda52 Assign salt grains for mariadb::labs Change-Id: Ibd4f26b0febd342241f1cd5a0c2183b7017ee817 23 October 2015, 08:19:01 UTC
827ca72 RESTBase: Set up MobileApps storage This patch sets up RESTBase storage for the Mobile Content Service. For each request that comes to RESTBase, first the revision ID is pulled from storage and then RESTBase checks if content for that revision and the given mobile route has already been rendered and is in storage. If so, that version is returned, otherwise a request to the back-end service is placed. Bug: T102130 Change-Id: I885a3e7a2ea380bee4d60463902ec1874ce47eb1 23 October 2015, 08:15:55 UTC
c7ef5a4 RESTBase: Set up the AQS public API This patch exposes the Analytics Query Service public API endpoints for the global domain. Bug: T114830 Change-Id: I17ae36660ebb374e7062cd1e4ad4634ffddf66a7 23 October 2015, 07:42:25 UTC
b50c14e Initial puppet config for labvirt1010 and 1011 Change-Id: I5952533ec870c8415a8f3e5259f377047b9f6050 22 October 2015, 20:44:14 UTC
1455d24 Add a cron job for reporting the job queue size to Graphite Add mediawiki::maintenance::jobqueue_stats, which provisions a cron job that will run every minute and report the size of the job queue to Graphite. Change-Id: I78116df9ab8cfd27420b69f896a62da9f03b1fca 22 October 2015, 22:03:49 UTC
e1a8aa7 admin: create agomez and add to stats groups Create a new user for Anne Gomez and add her to bastiononly, statistics-users and statistics-privatedata-users groups. UID: 4891 (atgomez wikitech user) Bug:T115666 Change-Id: Ib3f7efb49c4498c8b55c8bf93e3d1b778894613a 22 October 2015, 20:41:49 UTC
c166570 Added labvirt1010 and 1011 to linux-host-entries.ttyS1-115200 Change-Id: Ie7e600f9ad84363398c4c049e0b4e625a90c74f5 22 October 2015, 19:03:56 UTC
d4137f3 Publish bzip2 compressed Wikidata json dumps Also make sure we publish the gzip dumps at once, while I'm on it (write them completely to the temp dir and then just move them to the public directory, instead of assembling them in the public directory). Bug: T115222 Change-Id: If5648f87d0a04d3fa2bb4d22a70ba59210eb87d4 22 October 2015, 19:02:15 UTC
25f03ef mailman: run qdata cron later into 8am bounces Data being gathered is below limits but alerts are being fired after the run. Change-Id: Id6bd75c02e5c3d1c54dcfc6c40d918e93ab42096 22 October 2015, 19:00:39 UTC
0dad72a Partman attempt for the new labvirt hardware Change-Id: Id95688edf5c302d16dad0a73d4138560f0534a16 22 October 2015, 18:38:26 UTC
cfc47a8 Revert "dumps: move ssl cert and config to role" This reverts commit 2c9bd314ee4838153c97446fad11191c25042748. Change-Id: I42c79f6c802d220c74e85f8c33b54d7bccce014e 22 October 2015, 18:00:33 UTC
2c9bd31 dumps: move ssl cert and config to role Both the ssl cert install and the config settings should be in the role, in one place along with the ssl cert monitoring from Iac6b7533e8766. Change-Id: I806cfc76825732398fa4964e33ed7b5d988e2766 22 October 2015, 17:51:40 UTC
85eda43 Restrict access to redis on abacist I've run tcpdump for the redis port on stat1001 and the only external access originated from neon (covered by the /etc/ferm/conf.d/10_monitoring-all rule) Change-Id: I54a8e2dcb08766d7450a8da75282231942442c08 22 October 2015, 17:41:56 UTC
95f34dd gsb: Fix typo in icinga command_line definition $ARG$1 should have been $ARG1$ Change-Id: I2d40093c6c8faa05f6cdb19f613c1e4c4b36562e 22 October 2015, 17:28:12 UTC
779e2dd Remove auth.login-message - not supported by upstream anymore Bug: T116142 Change-Id: Icc1db6719c76815d890169242925c3cce558254e 22 October 2015, 17:22:34 UTC
8132583 Add req.host rule for m.wikidata.org It isn't covered by the <lang>.m.<project> pattern. Bug: T114995 Change-Id: I51efada00199a3c1f48a56c3688b6860f15d9eaf 22 October 2015, 16:34:09 UTC
fb14a67 icinga: Provide a check_gsb command and replace old commands A client for the API to check Google's safebrowsing lookup API. It needs a client_id and an API key and a URL as arguments. Populate it on the icinga server and create a check command to use with it. Use that command to replace the current gsb checks Bug: T116099 Change-Id: Iad79713b9b952929b8286674a2c574566cfe310c 22 October 2015, 15:47:52 UTC
1fbfeb0 Exclude CentralNoticeBannerHistory from mysql The CentralNoticeBannerHistory schema can't be inserted into mysql because one of its properties is an array. If it's not blacklisted it can bring the consumer down with a SQLAlchemy error that would be hard to fix otherwise. So the easiest thing to do is blacklist it since in this shape its events would never make it into the database anyway. Bug: T116241 Change-Id: I6d1904f82e4774254672a1c2b2b33d72e76a5906 22 October 2015, 15:43:03 UTC
ccbc917 Don't enable ferm on logstash1004 yet Needs additional changes Change-Id: Iac4d8ecccceff2c9524b3ce66ef9c9c9a2ef3cb4 22 October 2015, 15:27:39 UTC
8c860f0 Enable ferm on logstash1004 Change-Id: I752f7f2871010945193553b67cab72aa754ff6f8 22 October 2015, 15:14:41 UTC
99e5d2a subra/suhail: Use the role keyword We need this for Hiera-based assignment of Salt grains for debdeploy Change-Id: I4328862ab2d621f44ac02b52cc61c891a8d8ab38 22 October 2015, 14:26:38 UTC
back to top