2021-02-24

[joe] started experimenting on top of dancy's work https://github.com/dancysoft/mw-k8s-dev/pull/1

Always

Pipelinelib improvements to support building multiversion MW images using single-version image sources.
Leaning toward packages the l10n files in the image
- Keeps design simple and more secure at runtime.
- Will result in larger images (2GB larger per MW version), so ~6GB for a 2-version image.
- Verified that _current_ production wikipedia config does not actually access the DB when running rebuildLocalisationCache.php.
  - Looking into a way to disable or override etcd access when needed (such as during offline l10n file build)
Working on private settings
- Tried using Files.Glob in chart, but we may not be able to use this to source in files on the deployment server
- Including these in the images may be an option if we can ensure they are applied in the same way as security patches and resulting images are only published to the restricted registry namespace

Removed the last blockers for upgrading k8s
- Working (well?) for the staging cluster. Almost ready
docker-registry now has a restricted/ namespace for security-patched images, will put the credentials on releases1001/etc. later today

- Can't see this task, can the visibility restrictions be reduced? -lego
Score extension is Shellbox-aware (https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Score/+/630017)