This repository has been archived by the owner on Jan 18, 2022. It is now read-only.
CORE-1340 Change locator port 444 -> 443 #1220
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
As part of protecting the platform from DDoS attacks, we will be moving locator (xavier) behind a Google Global Load Balancer. These GLBs only support serving TLS traffic on port 443. Locator already supports serving gRPC traffic on port 443, so we can make this patch immediately, and it will be a seamless transition when the DNS for locator starts pointing to the GLB (which exposes port 443) instead of our current load balancer (which exposes port 443 and 444). ``` $ imp-kubectl h-eu1 a get services | grep xavier infra xavier-lb 10.218.254.177 35.187.123.237 443:31656/TCP,444:30616/TCP,80:30101/TCP 2y webtools xavier 10.218.254.124 <none> 8080/TCP,8081/TCP,80/TCP,443/TCP,444/TCP 1y webtools xavier-lb-temp 10.218.254.101 35.195.46.155 443:30518/TCP,444:31296/TCP,80:30144/TCP 2y webtools xavier-pod None <none> 8080/TCP,8081/TCP,444/TCP,443/TCP,80/TCP 63d ``` ``` $ imp-kubectl h-us1 a get services | grep xavier infra xavier-lb 10.217.254.219 104.198.212.81 443:30582/TCP,444:30740/TCP,80:30337/TCP 2y webtools xavier 10.217.254.152 <none> 8080/TCP,8081/TCP,80/TCP,443/TCP,444/TCP 1y webtools xavier-lb-temp 10.217.254.106 104.154.59.178 443:32388/TCP,444:31196/TCP,80:30687/TCP 2y webtools xavier-pod None <none> 8080/TCP,8081/TCP,444/TCP,443/TCP,80/TCP 63d ```
|
Corresponding JIRA ticket: https://improbableio.atlassian.net/browse/CORE-1340 |
improbable-prow-robot
added
jira/CORE
improbable-prow-robot
added
the
size/XS
Co-Authored-By: Jamie Brynes <[email protected]>
zeroZshadow
approved these changes
Nov 19, 2019
|
Thanks for the reviews - I don't have write access so can't hit the merge button, please can someone land this for me? |
Sure thing 😄 |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
As part of protecting the platform from DDoS attacks, we will be moving locator (xavier) behind a Google Global Load Balancer. These GLBs only support serving TLS traffic on port 443. Locator already supports serving gRPC traffic on port 443, so we can make this patch immediately, and it will be a seamless transition when the DNS for locator starts pointing to the GLB (which exposes port 443) instead of our current load balancer (which exposes port 443 and 444).
Tests
I have manually confirmed that Xavier is serving on 443 and 444 just like all other base servers. I have also confirmed that no additional steps are required to serve gRPC TLS on HTTP TLS ports for our base servers.
I have also run the QA pipeline on this branch and successfully connected to the resulting deployment: https://buildkite.com/improbable/gdk-for-unity-release-qa/builds/75
Documentation
Internal release note in the changelog.
Primary reviewers
If your change will take a long time to review, you can name at most two primary reviewers who are ultimately responsible for reviewing this request. @ mention them.