Am 3. Juli 2017 19:01:33 MESZ schrieb "Marcus Rückert" :

it might be enough to just do brctl addif/delif + patch the XML file.

Right. This is what I call the easy hosts. But some machines (like freeipa or the db-clusters) are a bit more complicated: as other machines depend on them. Especially, if the other machines should stay in the old network. Regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Am Tue, 4 Jul 2017 13:59:18 +0200 schrieb Ludwig Nussel :

Lars Vogdt wrote:

...

2) When will be the best time when we can start with the migration ?

Given that Leap 42.3 will be released July 26th the infrastructure needs to work in that week and the following four ones at least. So release relevant hosts shouldn't be touched before September please.

I'm sorry to bother, but what *are* "release relevant hosts"? Could you provide a list of services or DNS names for us? Regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Am Tue, 4 Jul 2017 14:26:01 +0200 schrieb Ludwig Nussel :

...

Could you provide a list of services or DNS names for us?

Well, anything that would give a bad impression to people trying to get 42.3. You know better how the infrastructure is connected and which hosts you intend to touch. Off the bat I'd say things like obs, wiki, landing page, software.o.o, doc, countdown, download, beans, shop etc but also bugzilla shouldn't break.

ok, that sounds to me like either we get everything done until July 26th - or we need to wait for the Christmas time (at least for me, as September and October are already full). => 3 weeks left to go (not that I want to put some pressure on anybody, this is just a fact) Regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Hi Lars, software.opensuse.org isn't available since 10 minutes. Do you work on the network? Best regards, Sarah Am 05.07.2017 um 08:15 schrieb Lars Vogdt:

Am 3. Juli 2017 18:54:17 MESZ schrieb Lars Vogdt :

...

But this network split comes with some migration downtime. For most of the machines, a simple "shutdown", "put into the other network", "boot" should be enough (so something around max. 5-10 Minutes per machine). But some machines - especially those that are providing their service to others in this network - are a bit trickier...

JFY: we (Theo, Darix, myself - those are the ones who volunteered) will start with the work during our maintenance window this Thursday. I added a note on status.opensuse.org already.

I'm currently unsure if we can update status.o.o during the time with all details, but I will sent a summary to this list on Thursday afternoon.

...

I started http://etherpad.opensuse.org/p/Server_migration to collect the affected machines together

This is our "working base" now. Please note that neither OBS, the wiki or anything else hosted in Provo should be affected by our work - so if you see some outages in this area, feel free to inform any of us directly, so we can investigate what happened.

With kind regards, Lars

-- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

Hi Per On Fri, 07 Jul 2017 14:04:45 +0200 Per Jessen wrote:

...

Please note: those machines are currently NOT reachable from the outside any more (the xinetd redirection of the ssh port is disabled by intention).

I guess this is why I cannot currently reach baloo?

Yes, sorry. Depending on the urgency, we have a couple of options: * using Theo as proxy and let him do your work ;-) * giving you access to a jump host * implementing the same setup as before I would say: let's wait how long the openVPN setup needs and make a decision after the weekend. --- JFYI (needs to be documented): * anna and elsa are our new (ha)proxy machines => my idea is to limit them to this task and do not run other services on them * daffy is our new login machine (for authentication of users against the Novell Auth Server) => no other services on this machine (which needs a 2nd one for HA) * gate.opensuse.org should become our "gate" into the privat network - and also the new gateway for private machines who need external access. That way we know that "private"/management traffic only goes via this machine - and the machines that handle "public"/official traffic are not involved in any way. @Per: that would for example mean that we might need to reconfigure baloo in the next days, too. ^^^ does that make sense to anyone? Regards, Lars -- To unsubscribe, e-mail: heroes+unsubscribe@opensuse.org To contact the owner, e-mail: heroes+owner@opensuse.org

On Thu, Jul 06, 2017 at 10:02:08PM +0200, Lars Vogdt wrote:

Hi

...

Before I leave after ~20h of "server migration", here a short summary of what has been achieved so far:

Please note: those machines are currently NOT reachable from the outside any more (the xinetd redirection of the ssh port is disabled by intention).

So the next important step is to finalize the setup of the openVPN server, so we can distribute the openVPN credentials/certificates.

After that, I would say that we are ready to go wherever we want (especially in regard of Salt... ;-)

Thanks a lot to everyone that helped with the migration and firefighting! There are always a lot of people involved, but this time I want to thank especially *darix* and *bugfinder* for their work and debugging skills. I'm sure that the current state would not have been reached without you guys!

Thanks a lot to Lars, Rudi and Marcus for their amazing and fast work! The OpenVPN setup is an action item for me, and I am currently working on it with very high priority. So please be patient, and feel free to contact me to do any changes in your machines at the meantime. -- Theo Chatzimichos System Administrator SUSE Operations and Services Team