Project

General

Profile

Actions

Feature #17011

closed

Add keep-web wildcard DNS to salt

Added by Peter Amstutz over 2 years ago. Updated over 1 year ago.

Status:
Resolved
Priority:
Normal
Assigned To:
Category:
Deployment
Target version:
Start date:
11/25/2020
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
Story points:
1.0
Release relationship:
Auto

Description

Keep-web supports virtual hosts to securely serve inline content to the browser (otherwise, everything is forced to be download-only to maintain same-origin security). This is also necessary for our S3 API support, as the preferred way to refer to buckets is with the bucket name as the first part of the domain name.

For each cluster zzzzz that we control:

  1. Configure DNS for *.collections.zzzzz.arvadosapi.com to go to keep-web
  2. Get a wildcard DNS cert for *.collections.zzzzz.arvadosapi.com
  3. Set Services.WebDAV.ExternalURL to "https://*.collections.zzzzz.arvadosapi.com"

More information at https://doc.arvados.org/v2.1/api/keep-web-urls.html


Subtasks 1 (0 open1 closed)

Task #17030: ReviewResolvedJavier Bértoli11/25/2020

Actions

Related issues

Blocks Arvados - Feature #17009: [keep-web] S3 API should accept bucket name as first component of domain nameResolvedTom Clegg11/19/2020

Actions
Blocks Arvados - Story #17109: Support keep-web URLs with collection the domain nameResolvedLucas Di Pentima01/13/2021

Actions
Actions #1

Updated by Peter Amstutz over 2 years ago

  • Status changed from New to In Progress
Actions #2

Updated by Peter Amstutz over 2 years ago

  • Status changed from In Progress to New
  • Tracker changed from Bug to Feature
Actions #3

Updated by Peter Amstutz over 2 years ago

  • Description updated (diff)
Actions #4

Updated by Peter Amstutz over 2 years ago

  • Description updated (diff)
Actions #5

Updated by Peter Amstutz over 2 years ago

  • Description updated (diff)
Actions #6

Updated by Peter Amstutz over 2 years ago

  • Category set to Deployment
Actions #7

Updated by Peter Amstutz over 2 years ago

  • Assigned To set to Javier Bértoli
Actions #8

Updated by Peter Amstutz over 2 years ago

  • Description updated (diff)
Actions #9

Updated by Peter Amstutz over 2 years ago

  • Description updated (diff)
Actions #10

Updated by Peter Amstutz over 2 years ago

  • Target version changed from 2020-11-04 Sprint to 2020-11-18
Actions #11

Updated by Peter Amstutz about 2 years ago

  • Description updated (diff)
Actions #12

Updated by Peter Amstutz about 2 years ago

  • Blocks Feature #17009: [keep-web] S3 API should accept bucket name as first component of domain name added
Actions #13

Updated by Peter Amstutz about 2 years ago

  • Blocks Story #17109: Support keep-web URLs with collection the domain name added
Actions #14

Updated by Ward Vandewege about 2 years ago

  • Assigned To changed from Javier Bértoli to Ward Vandewege
Actions #15

Updated by Peter Amstutz about 2 years ago

  • Target version changed from 2020-11-18 to 2020-12-02 Sprint
Actions #16

Updated by Ward Vandewege about 2 years ago

  • Status changed from New to In Progress

I've gone through all the necessary steps on ce8i5 (see e.g. https://c28440adeb7421c5edc54d8fa31f16ed-114.collections.ce8i5.arvadosapi.com/_/cwl.output.json?disposition=inline), this configuration is now active there. Working on making the salt changes now.

Actions #17

Updated by Ward Vandewege about 2 years ago

Ready for review at commit:be3507374c33090fb6023fb2c289df0a314c54de on branch 17011-add-letsencrypt-wildcard-support.

The changes have already been applied for ce8i5. The only thing that is not automated is the creation of the IAM role + policy for the account that does the DNS validation.

Actions #18

Updated by Javier Bértoli about 2 years ago

  • Story points set to 8.0

@cure, it LGTM, I think it's ready to merge.

Actions #19

Updated by Ward Vandewege about 2 years ago

  • Story points changed from 8.0 to 1.0

merged thanks.

Actions #20

Updated by Ward Vandewege about 2 years ago

The terraform piece is now ready for review at commit:38c129609533e85b289c04301a34dfdcf20ac86f on branch 17011-terraform-changes (terraform repo). Applied for ce8i5 only in this commit.

Once this is merged, I'll go around all our clusters and
  • migrate their dns to route53 (if they haven't been yet)
  • switch them to wildcard dns/ssl for keep-web
Actions #21

Updated by Javier Bértoli about 2 years ago

@cure, it LGTM.

migrate their dns to route53 (if they haven't been yet)

This was partially done on #16240, it might need an update (to see if any value changed) and finish the migration from corehost.

Actions #22

Updated by Ward Vandewege about 2 years ago

Javier Bértoli wrote:

@cure, it LGTM.

migrate their dns to route53 (if they haven't been yet)

This was partially done on #16240, it might need an update (to see if any value changed) and finish the migration from corehost.

Thanks, merged. Indeed, I picked up from there for ce8i5. Will do the rest.

Actions #23

Updated by Ward Vandewege about 2 years ago

Converted to Route53:

  • ce8i5
  • 9tee4
  • su92l
  • tb05z
  • bd44f

Already on Route53:

  • jutro
  • lugli
  • pirca
  • tordo

Cleaned up so that terraform applies:

  • jutro
  • lugli
  • pirca
  • lugli

Created IAM role + policy:

  • ce8i5
  • 9tee4
  • su92l

Refactored IAM role + policy:

  • jutro
  • lugli
  • pirca
  • lugli

Enabled *.collections:

  • ce8i5
  • jutro
  • lugli
  • pirca
  • tordo
  • su92l
  • 9tee4
Actions #24

Updated by Peter Amstutz about 2 years ago

  • Target version changed from 2020-12-02 Sprint to 2020-12-16 Sprint
Actions #26

Updated by Ward Vandewege about 2 years ago

  • Status changed from In Progress to Resolved
Actions #27

Updated by Peter Amstutz over 1 year ago

  • Release set to 38
Actions

Also available in: Atom PDF