In T379030#10344421, @Andrew wrote:

I am not coming up with reasons to keep mirroring the Keystone project membership data into LDAP at all if it is going to be obfuscated.

Up until this week, I would have said that keystone projects are in ldap for pam/sssd and sudo rule management. @bd808 can you tell me more about what kinds of things you use ldap for directly? I think I understand the stashbot case (which can potentially be altered to talk to keystone directly).

Changes should now use names rather than IDs. I did my best to retcon the existing ID-based examples so that they use names as well.

Change #1094033 merged by Andrew Bogott:

[operations/puppet@production] puppet-enc: wider use of project names instead of project IDs

https://gerrit.wikimedia.org/r/1094033

Change #1094033 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] puppet-enc: wider use of project names instead of project IDs

https://gerrit.wikimedia.org/r/1094033

Change #1094015 merged by Andrew Bogott:

[operations/puppet@production] puppet-enc: use project names rather than IDs in instance-puppet git

https://gerrit.wikimedia.org/r/1094015

Change #1094015 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] puppet-enc: use project names rather than IDs in instance-puppet git

https://gerrit.wikimedia.org/r/1094015

Change #1093997 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[labs/tools/stashbot@master] Get openstack project list from keystone

https://gerrit.wikimedia.org/r/1093997

We should also make sure that these records are no longer managed by the wmcs-wikireplica-dns script: T374953: tofu-infra: replace wmcs-wikireplica-dns.py with tofu

fnegri opened https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/135

@aborrero I will try to import the records to tofu-infra in the process!

Changing this specific subtask to "High" and assigning to myself as I want to do it as part of T352206: [toolsdb] Upgrade to MariaDB 10.6, which requires me to update the DNS records in this zone.

Thanks to @fnegri's patient explanation (and an actual meeting we held about this yesterday) I'm now convinced that the specific delete-by-surprise issue I was worried about is not actually an issue. So while there are still tofuinfra questions to be decided, I'm closing this task as invalid.

I am not coming up with reasons to keep mirroring the Keystone project membership data into LDAP at all if it is going to be obfuscated.

@MusikAnimal invited me to engage directly. I represent what you called above the "owners". As mentioned, I need to wait for replies from the IT department.

expanded https://wikitech.wikimedia.org/wiki/News/Cloud_VPS_VXLAN_IPv6_migration#Common_questions_and_problems

TODO next:

• activate IPv6 support within openstack (merge https://gitlab.wikimedia.org/repos/cloud/cloud-vps/tofu-infra/-/merge_requests/132)
• enable IPv6 on the edge network
• test everything
• generate docs T380054: Cloud VPS: prepare documentation on VXLAN/IPV6 migration
• update horizon settings T380081: horizon: enable the UI to select networks on VM creation panel

updates:

• cloud-flat-1-ipv4only (eqiad1) 172.16.8.0/21 https://netbox.wikimedia.org/ipam/prefixes/1076/
• cloud-flat-1-dualstack-ipv4 (eqiad1) 172.16.16.0/21 https://netbox.wikimedia.org/ipam/prefixes/1103/
• cloud-flat-codfw1dev-ipv4only 172.16.130.0/24 https://netbox.wikimedia.org/ipam/prefixes/1101/