[08:00:02] <wikibugs>	 06Traffic, 10requestctl: Re-think how external_cloud_vendors works - https://phabricator.wikimedia.org/T438658 (10Joe) 03NEW
[08:00:18] <wikibugs>	 06Traffic, 10requestctl: Re-think how external_cloud_vendors works - https://phabricator.wikimedia.org/T438658#12343350 (10Joe) p:05Triage→03High
[08:23:30] <wikibugs>	 10netops, 06Infrastructure-Foundations: Upgrade gNMIc to 0.49.0 - https://phabricator.wikimedia.org/T438291#12343438 (10ayounsi) 05Open→03Resolved a:03ayounsi All done.
[09:17:13] <elukey>	 hey folks!
[09:17:30] <elukey>	 If anybody has time I have https://gerrit.wikimedia.org/r/c/operations/puppet/+/1338937 (and next patches) to add LVS to pki.discovery
[09:18:17] <elukey>	 Sukhbir already provided some suggestions etc.. lemme know if the patches make sense 
[10:05:51] <vgutierrez>	 elukey: I'm puzzled there... are we checking port 80 but prod traffic runs elsewhere?
[10:06:17] <vgutierrez>	 that's gonna put port 80 on the LVS VIP
[10:07:37] <elukey>	 vgutierrez: okok then we can probably wait, I am following what we already have but it is a bit convoluted. Port 80 is there since we require mTLS for pki.d.wmnet on 443
[10:07:48] <elukey>	 I didn't want to drag you in but https://phabricator.wikimedia.org/T436809#12328343 is the summary
[10:08:01] <elukey>	 my idea is to drop the mTLS requirement, that should simplify a lot things
[10:08:13] <elukey>	 so I'll hold for a moment 
[10:10:15] <vgutierrez>	 my concern is that https://gerrit.wikimedia.org/r/c/operations/puppet/+/1338937 puts port 80 behind the LVS, not ports 443 and/or 8443.. so only the metrics endpoint would be reachable via the VIP
[10:10:31] <vgutierrez>	 if that's the intended result ok, but that's unclear to me
[10:11:13] <elukey>	 nono ok that is wrong
[10:11:56] <vgutierrez>	 if mTLS is enforced for every request on ports 443/8443 the next best thing is a L4 check
[10:12:11] <vgutierrez>	 so at least pybal will know that the port is open
[10:12:17] <elukey>	 it is not enforced on 8443, only on 443
[10:12:38] <vgutierrez>	 so you could use a https probe for 8443 and tcp for 443
[10:13:14] <elukey>	 for 8443 there is a catch - we allow only k8s pod ip ranges to use it 
[10:15:05] <elukey>	 anyway, it seems better to wait for the final shape of the service to settle to avoid problems
[10:15:20] <elukey>	 I thought to proceed with port 443 anyway but it may complicates more things
[10:15:50] <vgutierrez>	 sorry :(
[10:16:01] <elukey>	 nono please thanks for the review :)
[10:18:22] <wikibugs>	 06Traffic, 10Liberica, 10Prod-Kubernetes, 06ServiceOps, and 2 others: Migrate Wikikube k8s apiserver and services to IPIP - https://phabricator.wikimedia.org/T420436#12344369 (10Jelto)