Volans has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/379209 )
Change subject: WMCS: fine tuning Cumin configuration for proxies
......................................................................
WMCS: fine tuning Cumin configuration for proxies
* The proxies need to be able to proxy to themselves because the
hostname is a private name and the only public one is the proxy
service. Merge the two lists in this case.
* Change ssh LogLevel from QUIET to ERROR to be able to see fatals.
* Add options to ignore the host key also in the proxy command for now.
We should investigate a way to enforce it but this requires a
mechanism that is able to automatically update that value in the cumin
master whenever it changes.
Bug: T175712
Change-Id: I97f339ce4c4e8dac5320c5be8865af7e10cec500
---
M modules/profile/files/openstack/main/cumin/ssh_config
M modules/profile/manifests/openstack/main/cumin/target.pp
2 files changed, 13 insertions(+), 4 deletions(-)
Approvals:
jenkins-bot: Verified
Volans: Looks good to me, approved
diff --git a/modules/profile/files/openstack/main/cumin/ssh_config
b/modules/profile/files/openstack/main/cumin/ssh_config
index 0ee3a89..27267b2 100644
--- a/modules/profile/files/openstack/main/cumin/ssh_config
+++ b/modules/profile/files/openstack/main/cumin/ssh_config
@@ -1,5 +1,5 @@
# WMCS Bastions
-Host bastion-restricted.wmflabs.org bastion-restricted-??.bastion.eqiad.wmflabs
+Host bastion-restricted.wmflabs.org
ProxyCommand none
# WMCS Instances
@@ -9,5 +9,5 @@
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
GlobalKnownHostsFile /dev/null
- LogLevel QUIET
- ProxyCommand ssh -a -W %h:%p bastion-restricted.wmflabs.org
+ LogLevel ERROR
+ ProxyCommand ssh -o StrictHostKeyChecking=no -o
UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null -o
LogLevel=ERROR -a -W %h:%p bastion-restricted.wmflabs.org
diff --git a/modules/profile/manifests/openstack/main/cumin/target.pp
b/modules/profile/manifests/openstack/main/cumin/target.pp
index fd23ab6..ec642ff 100644
--- a/modules/profile/manifests/openstack/main/cumin/target.pp
+++ b/modules/profile/manifests/openstack/main/cumin/target.pp
@@ -3,7 +3,16 @@
) {
require ::network::constants
- $ssh_authorized_sources =
join($::network::constants::special_hosts[$::realm][$cumin_auth_group], ',')
+ if $cumin_auth_group == 'cumin_masters' {
+ $ssh_authorized_sources_list =
$::network::constants::special_hosts[$::realm][$cumin_auth_group]
+ } else {
+ # Authorize both the default cumin masters and the custom config,
required for proxies.
+ $ssh_authorized_sources_list = concat(
+ $::network::constants::special_hosts[$::realm]['cumin_masters'],
+ $::network::constants::special_hosts[$::realm][$cumin_auth_group])
+ }
+
+ $ssh_authorized_sources = join($ssh_authorized_sources_list, ',')
$cumin_master_pub_key = secret('keyholder/cumin_openstack_master.pub')
ssh::userkey { 'root-cumin':
--
To view, visit https://gerrit.wikimedia.org/r/379209
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I97f339ce4c4e8dac5320c5be8865af7e10cec500
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Volans <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: BryanDavis <[email protected]>
Gerrit-Reviewer: Chasemp <[email protected]>
Gerrit-Reviewer: Madhuvishy <[email protected]>
Gerrit-Reviewer: Muehlenhoff <[email protected]>
Gerrit-Reviewer: Volans <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
