1179575 - Remove flows from Treeherder and OrangeFactor to the main ElasticSearch instance

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Ed Morley [:emorley]]

OrangeFactor has now switched to it's own ElasticSearch instance, as part of bug 1142538. As such, we no longer need flows to the instance used by everyone else.

The instance we no longer need access to is:
elasticsearch-zlb.webapp.scl3.mozilla.com

The instance we are now using (so must be left as is):
of-elasticsearch-zlb.webapp.scl3.mozilla.com

This is all for port 9200.

The affected hosts are:

brasstacks1.dmz.scl3.mozilla.com
treeherder-rabbitmq1.private.scl3.mozilla.com
treeherder-rabbitmq1.stage.private.scl3.mozilla.com
treeherder1.webapp.scl3.mozilla.com
treeherder2.webapp.scl3.mozilla.com
treeherder3.webapp.scl3.mozilla.com
treeherder1.stage.webapp.scl3.mozilla.com
treeherder2.stage.webapp.scl3.mozilla.com
treeherder3.stage.webapp.scl3.mozilla.com

No rush with this, just thought it would be good cleanup (I didn't realise some of my old OrangeFactor scripts were still using the old ES instance for a while; a timeout would have made this clearer :-))

Comment 1

[Dave Curado :dcurado]

OK, I believe I have cleaned this up (and not broken anything).

I stumbled across this policy in the process, does "brasstacks" still require this?

policy elasticsearch-zlb-dev-vlan81-phx1--elasticsearch {
   match {
       source-address brasstacks1;
       destination-address elasticsearch-zlb.dev.vlan81.phx1;
       application elasticsearch;
   }
   then {
        permit;
   }


Thanks,
Dave

Comment 2

[Ed Morley [:emorley]]

Ah that's the dev ES instance from the looks of it (flow was added in bug 869627). We're not using that either (bug 860256, bug 779644), so it can be removed.

Thanks! :-)

Comment 3

[Dave Curado :dcurado]

OK, I removed that policy as well.
Dave