Yuvipanda has uploaded a new change for review.
https://gerrit.wikimedia.org/r/304581
Change subject: labs: Don't open everything to prometheus hosts
......................................................................
labs: Don't open everything to prometheus hosts
Since monitoring hosts open up *everything*, and that's
reasonably dangerous. Works ok for shinken-01 since we have
security groups limiting that. Instead allow a more specific
constant that just allows ssh, so that can be used for multiple
purposes
Change-Id: I6370d0335c7e15a557c47782ab46cbffa9db9936
---
M modules/network/manifests/constants.pp
1 file changed, 4 insertions(+), 4 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/81/304581/1
diff --git a/modules/network/manifests/constants.pp
b/modules/network/manifests/constants.pp
index 4a1404c..c24ae3c 100644
--- a/modules/network/manifests/constants.pp
+++ b/modules/network/manifests/constants.pp
@@ -84,15 +84,15 @@
],
},
'labs' => {
- 'bastion_hosts' => [
+ 'bastion_hosts' => concat([
'10.68.17.232', # bastion-01.eqiad.wmflabs
'10.68.18.65', # bastion-02.eqiad.wmflabs
'10.68.18.66', # bastion-restricted-01.eqiad.wmflabs
'10.68.18.68', # bastion-restricted-02.eqiad.wmflabs
- ],
- 'monitoring_hosts' => concat([
+ ], hiera('network::allow_ssh_from_ips', [])), # Allow labs
projects to setup their own ssh origination points
+ 'monitoring_hosts' => [
'10.68.16.210', # shinken-01.eqiad.wmflabs
- ], hiera('prometheus_host_ips', [])), # Support per-project
prometheus hosts!
+ ],
'deployment_hosts' => [
'10.68.17.240', #
deployment-tin.deployment-prep.eqiad.wmflabs
'10.68.17.215', # mira.deployment-prep.eqiad.wmflabs
--
To view, visit https://gerrit.wikimedia.org/r/304581
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I6370d0335c7e15a557c47782ab46cbffa9db9936
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Yuvipanda <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
