Portal:Cloud VPS/Admin/notes/Service predictions for cross realm situation

This page contains information and some predictions on how cloud-related services will go when we migrate them for compliance with the Cross-Realm_traffic_guidelines.

What	Current model	Predicted future model	Comments
Cloud rec DNS	cloudservices servers in cloud-support production VLAN, with public IPv4. Cloud egress NAT exception.	case 4
Cloud auth DNS	cloudservices servers in cloud-support production VLAN, with public IPv4. Cloud egress NAT exception.	case 4
Toolforge project NFS	labstore servers in cloud-support production VLAN, with private IPv4. Cloud egress NAT exception.	case 4
Toolforge home NFS	labstore servers in cloud-support production VLAN, with private IPv4. Cloud egress NAT exception.	case 4
Misc project NFS	labstore servers in cloud-support production VLAN, with private IPv4. Cloud egress NAT exception.	case 4
Dumps NFS	Done case 2 compliant	---	Recently done, see https://phabricator.wikimedia.org/T272397
Metrics services	cloudmetrics servers in cloud-support production VLAN, with private IPv4. Cloud egress NAT exception.	case 1
Wiki replicas	case 2 compliant	case 4	Might move to case 4 in next iteration
openstack APIs	cloudcontrol servers in production public VLAN, with public IPv4. Cloud egress NAT exception.	case 4
cloudelastic cluster (elasticsearch)	Done case 2 compliant		cloudelastic servers in production public VLAN, with public IPv4. No cloud egress NAT exception. RO access from cloud using local firewalling in cloudelastic servers. More info: Help:CirrusSearch_elasticsearch_replicas.
cloud hypervisors (cloudvirt servers)	Done case 4 compliant	---
cloud network (cloudnet & cloudgw servers)	Done case 4 compliant	---
ceph storage farm	TODO	TODO
horizon	labweb servers in production public VLAN with public IPv4.	case 3
LDAP	LDAP servers in production public VLAN with public IPv4. Cloud egress NAT exception.	case 2
NFS backups	cloudbackup servers in production private VLAN with private IPv4.	TODO	TODO
Gerrit	gerrit.wikimedia.org & gerrit-replica.wikimedia.org servers in production public VLAN with public IPv4. Cloud egress NAT exception.	case 2
APT repositories	apt1001.wikimedia.org & apt1002.wikimedia.org & sodium.wikimedia.org, servers in production public VLAN with public IPv4. Cloud egress NAT exception.	case 2	Potential low-hanging fruit.
kraz (IRCD)	Done case 2 compliant		See https://phabricator.wikimedia.org/T280225
Maps NFS	cloudstore1008/cloudstore1009, servers in production public VLAN with public IPv4. Cloud egress NAT exception.	case 2
Scratch NFS	cloudstore1008/cloudstore1009, servers in production public VLAN with public IPv4. Cloud egress NAT exception.	case 2
main Wikis & API	servers in production public VLAN with pulic IPv4. Cloud egress NAT exception.	case 2	Dropping the NAT exception is challenging, many moving parts. See News/CloudVPS NAT wikis and https://phabricator.wikimedia.org/T209011
nova-fullstack	Done case 3 compliant	---	See https://phabricator.wikimedia.org/T272587
What	Current model	Predicted future model	Comments

See also

Phabricator ticket T207536: Move various support services for Cloud VPS currently in prod into their own instances