Portal:Toolforge/Admin/APIs

Toolforge Admin

• Toolforge user docs
• Toolforge admin docs
• System overview
• Reference: all WMCS-owned services

Admin tasks and tools

• List of admin tasks
• Toolforge roots and Toolforge admins
• ToolsDB
• OpenStack Browser
• Infrastructure tools

Failover

• Toolschecker
• Redis
• Prometheus

Kubernetes

• Certificates
• Deploying
• Docker-registry
• Jobs framework
• Labels
• Networking and ingress
• Pod tracing

Kubernetes services

• Jobs framework
• Build service
• Envvars service
• Harbor

Packaging

• .deb packages

Runbooks and emergency guides

• Portal:Toolforge/Admin/Runbooks
• Incident response process

Other

• Exim and Email operations

[]

Toolforge is slowly moving towards an API-oriented model where client tools (such as those installed on bastions) contact custom Toolforge APIs to make changes instead of making them directly.

API gateway

To help decrease setup complexity for new APIs in this model, we've set up an API gateway to run in the Kubernetes cluster. The current implementation is based on Nginx with some Helm-generated configuration running in the Kubernetes cluster, which is then exposed via the HAProxy server pair.

Access

The base endpoint is https://api.svc.[project].eqiad1.wikimedia.cloud:30003. Services are routed with subpaths, for example /jobs for the Jobs API.

For authentication we currently use client certificates issued by the Kubernetes cluster internal CA via maintain-kubeusers. This might change in the future as we evolve how the APIs are accessed and used.

Backends

The backends are configured via Helm values. The communication between the gateway and the API gateway must be encrypted via internal CA certificates issued by the api-gateway-backend-ca ClusterIssuer.

Backend services can access the authentication certificate data via the ssl-client-subject-dn header.

See also

• Help:Toolforge/API - user documentation