Cloudflare: Migrate ops.gitlab.net (Phase 2)

  1. Once traffic is ensured to flow though Cloudflare, we initiate decommission of Route53.
    • We will not do this on ops, because we will roll back the change at least once.
  2. Now we have reached the target infrastructure described in the diagrams in the readiness review.
  3. Lock down, to re gain a defined path for rate limiting.
    • While not having one of these in place we are reachable via our origin IPs and rate-limiting will be disabled there. This is the case on ops anyways.
    • Cut off the old GCP LBs after we monitored, that traffic shifted to Cloudflare completely.
    • IP whitelist Cloudflare and reject everything else.
      • This might not be an option, due to the GCP LB facing the internet
    • Enable Authenticated Origin Pulls.

~"workflow::Blocked" because of phase 1

Edited by Hendrik Meyer (xLabber)