1494066 - please update releng signing server flows

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[[e-mail] (:bhearsum)]

We are repurposing the mac-depsigning* machines as production signing servers, so we need to change some of the flows.

The hostnames (but not IPs) are changing as follows:
mac-depsigning1.srv.releng.mdc1.mozilla.com -> mac-v2-signing1.srv.releng.mdc1.mozilla.com
mac-depsigning2.srv.releng.mdc1.mozilla.com -> mac-v2-signing2.srv.releng.mdc1.mozilla.com
mac-depsigning3.srv.releng.mdc1.mozilla.com -> mac-v2-signing3.srv.releng.mdc1.mozilla.com
mac-depsigning4.srv.releng.mdc2.mozilla.com -> mac-v2-signing4.srv.releng.mdc2.mozilla.com
mac-depsigning5.srv.releng.mdc2.mozilla.com -> mac-v2-signing5.srv.releng.mdc2.mozilla.com
mac-depsigning6.srv.releng.mdc2.mozilla.com -> mac-v2-signing6.srv.releng.mdc2.mozilla.com

And these machines should now be treated the same as the other mac-v2-signing* machines as far as network flows go. Based on https://bugzilla.mozilla.org/show_bug.cgi?id=1381152, it looks like this might mean adding them to releng_signing?

Comment 1

[Aki Sasaki (not active)]

Van, have you seen this? We'd like to bring these online tomorrow (Thurs) if possible.

Comment 2

[[e-mail] (:bhearsum)]

Hm, I just realized that production signing workers can already access these servers, eg:
$ nc -vz mac-v2-signing4.srv.releng.mdc2.mozilla.com 9120
Connection to mac-v2-signing4.srv.releng.mdc2.mozilla.com 9120 port [tcp/*] succeeded!


...which I guess is because of policy 8 from https://bugzilla.mozilla.org/show_bug.cgi?id=1381152#c2

So maybe there's nothing to do here other than perhaps update same hostnames in configs?

Comment 3

[Van Le [:van]]

:aki, can you test and let me know which have failed? if the IPs didn't change, it should work. i don't have an account to these boxes to test.

Comment 4

[Aki Sasaki (not active)]

Looks like this is Just Working. Thanks Van!

Comment 5

[[e-mail] (:bhearsum)]

Do we need to rename anything anywhere to avoid future confusion when asking for ACLs for mac-v2-signing{1..6}? Eg: are they still listed as mac-depsigning{1..6} anywhere?