bking closed this task as "Resolved".
bking moved this task from Incoming to Needs review on the Discovery-Search
(Current work) board.
bking claimed this task.
bking added a comment.
Upon further review, it looks like beta cluster changed how it handles TLS
certificates. Nginx TLS config on
`deployment-elastic09.deployment-prep.eqiad1.wikimedia.cloud`:
ssl_certificate
/etc/cfssl/ssl/discovery__deployment-elastic09_deployment-prep_eqiad1_wikimedia_cloud/discovery__deployment-elastic09_deployment-prep_eqiad1_wikimedia_cloud.chained.pem;
ssl_certificate_key
/etc/cfssl/ssl/discovery__deployment-elastic09_deployment-prep_eqiad1_wikimedia_cloud/discovery__deployment-elastic09_deployment-prep_eqiad1_wikimedia_cloud-key.pem;
Contrast with production elastic host:
ssl_certificate /etc/ssl/localcerts/search.discovery.wmnet.chained.crt;
ssl_certificate_key /etc/ssl/private/search.discovery.wmnet.key;
It looks like whenever this changed on the beta hosts, nginx was not
reloaded. I reloaded nginx on all 3 instances and it appears that nginx is
serving a validate certificate now.
before reload:
bking@deployment-mwmaint02:~$ curl
https://deployment-elastic10.deployment-prep.eqiad1.wikimedia.cloud:9643
curl: (60) SSL certificate problem: certificate has expired
after reload:
bking@deployment-mwmaint02:~$ curl
https://deployment-elastic10.deployment-prep.eqiad1.wikimedia.cloud:9643
{
"name" : "deployment-elastic10-beta-search-psi",
"cluster_name" : "beta-search-psi",
"cluster_uuid" : "3qgHSCOrSZeGVeurqL6fGA",
"version" : {
"number" : "7.10.2",
"build_flavor" : "oss",
"build_type" : "deb",
"build_hash" : "747e1cc71def077253878a59143c1f785afa92b9",
"build_date" : "2021-01-13T00:42:12.435326Z",
"build_snapshot" : false,
"lucene_version" : "8.7.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
Thus, I believe the issue is resolved. Please feel free to reopen this ticket
if you do not agree.
TASK DETAIL
https://phabricator.wikimedia.org/T333952
WORKBOARD
https://phabricator.wikimedia.org/project/board/1227/
EMAIL PREFERENCES
https://phabricator.wikimedia.org/settings/panel/emailpreferences/
To: bking
Cc: MSantos, dcausse, bking, Jgiannelos, Michael, LucasWerkmeister, Aklapper,
Stang, Ericliu1912, Xqt, pywikibot-bugs-list, gonzalez.actor, PotsdamLamb,
MPhamWMF, Jyoo1011, Wilmanbeno, JohnsonLee01, SHEKH, Dijkstra, CBogen, Khutuck,
Zkhalido, CptViraj, Viztor, DannyS712, Wenyi, Bsandipan, EBjune, Tbscho, MayS,
Framawiki, Mdupont, JJMC89, Dvorapa, Altostratus, TheresNoTime, binbot,
Avicennasis, mys_721tx, jayvdb, Masti, Alchimista, Jay8g, Krenair, jeremyb
_______________________________________________
pywikibot-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
