Cloud

cloud@lists.wikimedia.org

3 participants
966 discussions

Axios attack on Toolforge or Gitlab
by Maciej Jaros 02 Apr '26

02 Apr '26

Probably something worth checking out on nodes on WMF clouds: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-version… Perhaps there is a way to check all automated deployments on TF and Gitlab? Not sure how many are there. Fortunately I don't use axios that much myself so I'm not affected. Also I use `npm ci` for automated builds for a few years (which should use pre-tested package versions). So also might be worth checking if you use `npm i` in scripts. And no, this is NOT an april fools. Google and Microsoft also wrote about this. The script has 3 separate paths for Linux, Mac and Windows. Regards, Nux

2 1

[Cloud-announce] Cloud network switch maintenance on Wed April 8th at 8 UTC
by Filippo Giunchedi via Cloud-announce 02 Apr '26

02 Apr '26

Hello all, Starting on Wed April 8th at 8 UTC we will be performing maintenance on the cloud network switches. Thank you again for your patience while we improve Cloud resilience. As usual, progress can be followed at https://phabricator.wikimedia.org/T417393. best, Filippo -- *Filippo Giunchedi* Staff Site Reliability Engineer Wikimedia Foundation <https://wikimediafoundation.org/> _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

1 0

[Cloud-announce] [toolforge] Buildpack environment version upgrade
by David Caro via Cloud-announce 31 Mar '26

31 Mar '26

Hi! We are going to start rolling out a new version of the buildpack environment for toolforge built images (see the task [1], and the process outline [2]). If you build your container images using the toolforge build service, please keep reading, there might be some actions needed on your part. What you as tool admin need to do: * [optional] For the next two weeks, test your builds using the `toolforge build start --use-latest-versions ...` flag. This will run with the next default version. If you have no errors, no new changes are needed. If you get errors, then you'll need to adapt to the newer versions or open a bug for us to fix it [3]. * [required if you got errors] In two weeks, 31-03-2026, if you want to still use the old deprecated versions of the buildpacks to continue debugging/fixing the builds with the newer versions, use the `toolforge build start --use-deprecated-versions ...` flag. If you were using Aptfile to install packages, you'll have to move to project.toml, see [4]. * [required if you were using the latest versions] That same day, the `--use-latest-versions` flag, will now point to a newer version of the buildpacks, this might break your builds, so you might want to either fix them, open a bug for follow up, and/or use the default version instead. * [required if used the deprecated flag] on 2026-04-27, the flag will be disabled, and you will be required to stop using it. Most of the time there will be no changes needed to your code, but if you were relying on features or old languages that are not supported in the newer buildpacks you might have to adjust your configuration or your code. For reference, the current default version has the buildpacks: heroku_go: 0.1.13 heroku_gradle: 4.0.2 heroku_java: 4.0.2 heroku_jvm: 4.0.2 heroku_maven: 4.0.2 heroku_nodejs: 2.6.2 heroku_nodejs-corepack: 2.6.2 heroku_nodejs-engine: 2.6.2 heroku_nodejs-npm-engine: 2.6.2 heroku_nodejs-npm-install: 2.6.2 heroku_nodejs-pnpm-engine: 2.6.2 heroku_nodejs-pnpm-install: 2.6.2 heroku_nodejs-yarn: 2.6.2 heroku_php: 0.1.2 heroku_procfile: 2.0.2 heroku_python: 0.8.0 heroku_ruby: 2.1.2 heroku_sbt: 4.0.2 heroku_scala: 4.0.2 The current latest version has the buildpacks: heroku_deb-packages: 0.1.3 heroku_dotnet: 0.5.0 heroku_go: 0.5.8 heroku_gradle: 6.2.0 heroku_java: 6.2.0 heroku_jvm: 6.2.0 heroku_maven: 6.2.0 heroku_nodejs: 3.6.0 heroku_nodejs-corepack: 3.6.0 heroku_nodejs-engine: 3.6.0 heroku_nodejs-npm-engine: 3.6.0 heroku_nodejs-npm-install: 3.6.0 heroku_nodejs-pnpm-engine: 3.6.0 heroku_nodejs-pnpm-install: 3.6.0 heroku_nodejs-yarn: 3.6.0 heroku_php: 0.2.4 heroku_procfile: 4.2.1 heroku_python: 0.26.1 heroku_ruby: 7.0.1 heroku_sbt: 6.2.0 heroku_scala: 6.2.0 And the new latest version being rolled out will have the buildpacks: heroku_deb-packages: 0.3.0 heroku_dotnet: 1.0.3 heroku_go: 2.2.1 heroku_gradle: 7.0.9 heroku_java: 7.0.9 heroku_jvm: 7.0.9 heroku_maven: 7.0.9 heroku_nodejs: 5.5.3 heroku_php: 1.4.0 heroku_procfile: 4.2.1 heroku_python: 6.0.1 heroku_ruby: 12.3.0 heroku_sbt: 7.0.9 heroku_scala: 7.0.9 Some improvements are: * Native dotnet support (no need to install external buildpack). * Newer language versions, like: ** dotnet 9.0.203 by default/10.0.103 latest versions ** golang 1.24 default/1.26 latest versions ** jdk versions 1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1 by default /1.8.0_482, 11.0.30, 17.0.18, 21.0.10, 25.0.2 latest versions ** php 8.3.7 by default/8.5.3 latest version ** python 3.13 by default with poetry support/3.14 latest version, with uv+poetry support ** ruby 3.3.7 by default/3.3.9 latest version * Native apt buildpack support, if you were using Aptfile, you'll have to change to project.toml [4] You can see upstream the details of each buildpack following the links in [5]. Cheers! [1] https://phabricator.wikimedia.org/T380127 [2] https://wikitech.wikimedia.org/w/index.php?title=Help:Toolforge/Building_co… [3] https://phabricator.wikimedia.org/project/profile/539/ [4] https://github.com/heroku/buildpacks-deb-packages?tab=readme-ov-file#projec… [5] https://github.com/heroku/buildpacks?tab=readme-ov-file#supported-languages -- David Caro SRE - Cloud Services Wikimedia Foundation <https://wikimediafoundation.org/> PGP Signature: 7180 83A2 AC8B 314F B4CE 1171 4071 C7E1 D262 69C3 "Imagine a world in which every single human being can freely share in the sum of all knowledge. That's our commitment." _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

1 3

[Cloud-announce] Cloud VPS network maintenance on March 31st / 7 UTC
by Filippo Giunchedi via Cloud-announce 30 Mar '26

30 Mar '26

Hello all, as part of improving the Openstack / RabbitMQ operability we will be doing maintenance to the Cloud VPS network starting March 31st at 7 UTC. The work is being tracked in this Phabricator task: https://phabricator.wikimedia.org/T421054 . Thank you for your patience and understanding! best, Filippo -- *Filippo Giunchedi* Staff Site Reliability Engineer Wikimedia Foundation <https://wikimediafoundation.org/> _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

1 0

[Cloud-announce] Proposed updates and changes to cloud-vps 'trove' database as a service
by Andrew Bogott via Cloud-announce 27 Mar '26

27 Mar '26

tl;dr: new trove database versions are coming! Existing trove db servers will continue to run as before. Please provide feedback about the specifics. -- Sometime in the next few weeks I'd like to make a few updates to the databases supported on cloud-vps. Unless you have your own private database, toolforge users can ignore this email. If you ever visit the 'databases' tab in Horizon please read on! Right now we support the following database engines: mariadb10.5.10 (21 instances) mysql5.7.29(4 instances) postgresql 12.7 (13 instances) I propose to deprecate all three of those engines, and replace them with: mariadb12.2.2 postgres18 Here's how that would look, from a user standpoint: 1) **Any existing database instances will continue to run and operatein Horizonas before.** 2) It will no longer be possible to create new database instances with the deprecated engines. 3) It will no longer be possible to restore backups of databases using the old engine without admin intervention -- if we do this, I will be on hand to do manual restores if necessary. This restriction is bound up with #2 above; either both rules stay or both rules go.[0] 4) There will be no automatic or in-place upgrade path provided from old version to new version. Any upgrades, if needed, will have to be performed 'by hand' with something like an outside-of-openstack dump and restore. This pains me but I've spent some time testing and the internal storage formats are too different for a smooth transition. 5) It will no longer be possible to create new mysql databases. Mysql is not very popular, and as far as I know only provides a functional subset of mariadb. I'm making a lot of assumptions about you, the users, in this proposal, so please speak up if (for example) you perform frequent backup restores, or have a use case that requires mysql. You can respond to this email, or follow up on the associated phab task[1]. If this email provokes only silence or agreement, then I will make these changes on or near April 20. [0] Currently only a total of 9 trove backups exist (and only 4 in the last year), so I suspect no one is really relying on this service on the regular. [1] https://phabricator.wikimedia.org/T420737 _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

3 2

Toolforge "sandbox" project for beginners?
by Travis Briggs 27 Mar '26

27 Mar '26

Hello all, The Bay Area Wikipedians User Group organizers (BAWUG: https://meta.wikimedia.org/wiki/Bay_Area_Wikipedians_User_Group), is in the early stages of planning a satellite "hackathon" to coincide with the main one in Milan in May. As part of the planning, I'm thinking about doing more of a "beginner's workshop" type format, where there is a lot of hands on training and we work as a group on one or two projects. This is in contrast to the normal hackathon format where you give suggestions then set a bunch of people loose to work individually and in teams on a variety of projects. To be clear, we're anticipating 10 or less attendees, with almost no experience in Wikimedia development (but still developers of at least moderate other experience) Anyways, I was wondering if there's any capacity for us to have a "sandbox" type toolforge project, where we can get our participants onboarded with developer accounts, and they can experiment with developing and launching some kind of "hello world" tool. I think it would be a great experience to set up the accounts, the keys, the SSH tunnels, etc, as well as learning how to query enwiki_p and access other resources. Though looking through the onboarding docs just now (it's been ages since I've done this process myself and it clearly has changed), it says "Toolforge membership" can take up to a week for approval? This might not be an issue because I was already planning to have a "pre-session" for our workshop a week before the in person event. Basically my request comes down to: Can I just go ahead and use the self service tool account creation workflow ( https://wikitech.wikimedia.org/wiki/Help:Toolforge/Tool_accounts#Creating) with the knowledge that I'm not developing a "real" tool, it's for educational purposes? Thanks, -Travis BAWUG Co-organizer

5 6

Toolforge job stuck at "Run not attempted yet. Pod in 'Pending' phase."
by Sebastian Berlin 23 Mar '26

23 Mar '26

A Toolforge job I'm running is stuck. I started it last Friday after having stopped once before for now apparent reason. When I checked today I got: > tools.commonsdb-registry@tools-bastion-15:~$ toolforge jobs show > make-declarations-wlm-2013 > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Job name: | make-declarations-wlm-2013 > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Command: | src/make_declaration.py -t mem:1.0Gi -t cpu:3.0 -t > version:0.1.11 --verbose batch:category-26152515 | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Job type: | one-off > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Image: | tool-commonsdb-registry/tool-commonsdb-registry:latest > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Port: | none > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | File log: | yes > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Output log: | > /data/project/commonsdb-registry/make-declarations-wlm-2013.out > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Error log: | > /data/project/commonsdb-registry/make-declarations-wlm-2013.err > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Emails: | all > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Resources: | mem: 1.0Gi, cpu: 3.0 > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Replicas: | > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Mounts: | all > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Retry: | no > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Timeout: | no > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Health check: | none > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Status: | Running for 3d23m > | > > +---------------+-----------------------------------------------------------------------------------------------------+ > | Hints: | Run not attempted yet. Pod in 'Pending' phase. > | > > +---------------+-----------------------------------------------------------------------------------------------------+ As far as I can tell that means it hasn't actually started. It's still waiting for something, but it's unclear what. I restarted it a couple of times today so far, but it never gets past that stage. When I've run similar jobs in the past they sometimes take a while to start. Eventually they have though, so I though maybe they were waiting for resources or something. Can anyone help me get this started or explain if I've misunderstood something? *Sebastian Berlin* Utvecklare/*Developer* Wikimedia Sverige (WMSE) E-post/*E-Mail*: sebastian.berlin(a)wikimedia.se Telefon/*Phone*: (+46) 0707 - 92 03 84

3 3

[Cloud-announce] openstack upgrades Monday, 2026-03-16
by Andrew Bogott via Cloud-announce 17 Mar '26

17 Mar '26

I will be upgrading the cloud-vps openstack install on Monday, beginning around 17:00 UTC. This will involve one or two brief network resets. There may also be intermittent interruptions to the Horizon UI, and possible issues with scheduling new VMs or creating other cloud-vps resources. Apart from the network resets, toolforge services and existing, running VMs will not be affected. -Andrew + the WMCS team _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

1 1

[Cloud-announce] Cloud network switch maintenance on Wed March 18th
by Filippo Giunchedi via Cloud-announce 12 Mar '26

12 Mar '26

Hello all, We will be continuing the work of controlled cloud network switch maintenance on Wednesday March 18th starting at 8 UTC. Expected impact is minimal and we will be monitoring. Thank you for your patience and understanding: controlled tests are an important step towards a more resilient cloud infrastructure. Progress can be followed at https://phabricator.wikimedia.org/T417393 best, Filippo -- *Filippo Giunchedi* Staff Site Reliability Engineer Wikimedia Foundation <https://wikimediafoundation.org/> _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

1 0

[Cloud-announce] Cloud network switch maintenance on Tues March 10th
by Filippo Giunchedi via Cloud-announce 05 Mar '26

05 Mar '26

Hello all, as part of the effort to improve Cloud availability we will be carrying out controlled network switch testing next week on Tuesday March 10th starting at 8 UTC. Expected impact is limited and we will be monitoring. More details can be found at https://phabricator.wikimedia.org/T417393 best, Filippo -- *Filippo Giunchedi* Staff Site Reliability Engineer Wikimedia Foundation <https://wikimediafoundation.org/> _______________________________________________ Cloud-announce mailing list -- cloud-announce(a)lists.wikimedia.org List information: https://lists.wikimedia.org/postorius/lists/cloud-announce.lists.wikimedia.…

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

Cloud