aborrero opened https://gitlab.wikimedia.org/repos/cloud/cloud-vps/nova_fullstack_test/-/merge_requests/5

aborrero merged https://gitlab.wikimedia.org/repos/cloud/cloud-vps/nova_fullstack_test/-/merge_requests/2

I think my opinion is that I'm happy if openstack internally has uuids for projects ids, which is what upstream does.
Then, everything outside openstack, including our tooling, we can keep using project names. LDAP, stashbot, SAL, DNS, etc they all qualify in this category of being "our tooling".

aborrero merged https://gitlab.wikimedia.org/repos/cloud/cloud-vps/nova_fullstack_test/-/merge_requests/3

From an non-wmf perspective, the most important aspect is documentation. It only takes 5 seconds to C&P the project id, but it might take several hours to find out that the configuration was changed.

Thanks for working on this @cmooney. I agree with the allocations.

In T379030#10318678, @Andrew wrote:

The proposed patch seems hazardous because if we start using names rather than IDs in ldap, that is actually a big change -- even though it feels like it's putting things back the way it was, it's actually changing ldap to store a new kind of thing that nothing that consumes ldap will be expecting.

First, some context: There isn't actually a change in ldap from one format to another; in all cases ldap is using the canonical ID of the project. It's just that IDs and names have recently diverged.

aborrero opened https://gitlab.wikimedia.org/repos/cloud/cloud-vps/nova_fullstack_test/-/merge_requests/3

This is still happening: T373348: Quota leak for Trove dbs?

This is still happening on the new project tofuinfratest. I did reset the database quotas last week, following the instructions at Portal:Cloud_VPS/Admin/Trove#Reserved_quota_does_not_go_down.

We could do as it is suggested in this ticket and somehow "automate" fetching information from several NATs to figure out the original connection and source of network traffic, but we don't seem to be interested in developing that tooling at the moment.

I don't think this has ever happened.

default security group provisioning is now done via tofu-infra.

No longer happening.

This is done already:
https://gerrit.wikimedia.org/r/c/cloud/wmcs-cookbooks/+/1050335

Production SREs are currently evaluating possible solutions in {T340052}.

reopening to raise awareness on the pending work on the subtasks

Change #1090854 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] openstack: wmfkeystonehooks: create LDAP groups with project name

https://gerrit.wikimedia.org/r/1090854

Thank you so much! This is resolved now with your clue, I've used our project prefix as the hostname.

I should have tried that—my other attempt was something like "www" which of course is also already a wmcloud.org subdomain.

In T379283#10300633, @taavi wrote:

I skimmed through T187929: Cloud IPv6 subnets but couldn't see these mentioned specifically. Did you plan something for these already or do we need to figure them out here?

The problem is the beta.wmcloud.org FQDN is already taken, and the proxy API, instead of reporting it, is crashing. I was able to create betasomething proxy in your project:

I was just able to create a proxy on a different project: