|
|
| (94 intermediate revisions by 6 users not shown) |
| Line 1: |
Line 1: |
| {{Template:Op menubar}} {{Template:Doc_menubar}} {{TOC_right}} | | {{Template:Op menubar}} {{Template:Doc_menubar}} |
| | | [[Category:Deprecated]] |
| <br> {{Ops_procedures
| | {| style="border:1px solid black; background-color:lightgrey; color: black; padding:5px; font-size:140%; width: 90%; margin: auto;" |
| |Doc_title = Service type decommission procedure | | | style="padding-right: 15px; padding-left: 15px;" | |
| |Doc_link = https://wiki.egi.eu/wiki/PROC16 | | |[[File:Alert.png]] This page is '''Deprecated'''; the content has been moved to https://confluence.egi.eu/display/EGIPP/PROC16+Decommissioning+of+unsupported+software |
| |Version = 1.0
| |
| |Policy_acronym = OMB
| |
| |Policy_name = Operations Management Board
| |
| |Contact_group = operational-documentation@mailman.egi.eu
| |
| |Doc_status = Draft
| |
| |Approval_date = | |
| |Procedure_statement = A procedure for removal of service type from production infrastructure. | |
| }}
| |
| | |
| = Overview =
| |
| | |
| The Service type decommission procedure was created to define steps which have to be taken to remove service type from prodcution infrastructure. <br>
| |
| | |
| = Terminology =
| |
| | |
| '''Support deadline'''
| |
| *from this day service type is unsupported
| |
| *sites '''should not''' register retired services in production infrastructure
| |
| *NGIs and sites should start action to move their services to supported versions
| |
| | |
| '''Decommission deadline'''
| |
| *from this day '''no services for the retired service type can be present in production infrastructure'''
| |
| *in case of violation security team can remove the site from production infrastructure
| |
| *service type is removed from operations tools
| |
| | |
| = Steps =
| |
| | |
| Following steps are taken since '''support deadline''' is known for COO
| |
| | |
| # COO on OMB announce '''decommission deadline''' for service migration
| |
| # The broadcast is send to NGi managers and Site administrators
| |
| # NGI managers announce the information to the sites
| |
| # Documentation about service X should re-classified as obsoleted (I would not remove it from our wiki, but I would just reclassify it)
| |
| # Security probe is developed for the security nagios that extracts hostnames from GOCDB and BDII associated to type X and raises critical alarm in the security dashboard
| |
| #* ROD teams followup the service migration till the decommission deadline - site admins should provide migration or decommission plan
| |
| | |
| After '''Decommision deadline'''
| |
| # Probes for the service are removed from profiles:
| |
| #*ROC
| |
| #*ROC_OPERATORS
| |
| #*ROC_CRITICAL
| |
| #*the SAM probes at the earliest convenience are removed from the SAM release
| |
| # CSIRT team followup the migration and if needed suspend sites which didn't migrate
| |
| # If a service specific SU in GGUS exists, the SU should be removed from GGUS
| |
| # The service type should be disabled in GOCDB (i.e. service entries can no more declared to be of service type X), but existing instances associated to type X continue to exist
| |
| # Security probe can be removed (should we do that?)
| |
| | |
| == TODO ==
| |
| | |
| * involve quattor WG
| |
| | |
| unresponsive sites handling process
| |
| # NGI will be requested by EGI.eu operations to contact site administrators to provide upgrade plans in the site ticket, DEADLINE MON 12/11
| |
| # EGI.eu operations will send a VO broadcast warning VO managers about sites risking suspension
| |
| # In case of no reply from site administrators, the NGI operations management (NGI manager or deputy, security officer) will be requested to put the affected service end-point in downtime, DEADLINE MON 19/11
| |
| # In case of no action by NGI, EGI CSIRT will suspend the site (after MON 19/11)
| |
| | |
| I would suggest the following procedure for EGI-CSIRT Security Officer on Duty
| |
| (SOOD), handling sites that qualified for suspension:
| |
| # Open ticket in RT ask COO to suspend site X (CCing Site/NGI-Manager,
| |
| Site/NGI-Security-Contact)
| |
| # Site/NGI can give a comment here, if we see suddenly some activity from the
| |
| site we can offer that the site goes immediately in Downtime.
| |
| # within 24 hours COO gives the green/red light for Suspension in the ticket
| |
| # After having received an OK from COO, SOOD changes the sites "certification
| |
| status" to "Suspended"
| |
| | |
| This is in EGI-CSIRT Critical Vulnerability Operational Procedure:
| |
| https://documents.egi.eu/secure/RetrieveFile?docid=283&version=9&filename=EGI- | |
| CSIRT-Procedure-CriticalSecurity-V8.pdf
| |
| Skipping the extensive communication part which has for these sites already
| |
| proven to not work, thus we might want to jump directly to
| |
| ==
| |
| 4.5 Carry out Site suspension
| |
| | |
| Site suspension WILL be carried out by the EGI CSIRT co-ordinator or deputy.
| |
| Site suspension is carried out by changing the status of the site in the GOCDB
| |
| to ‘suspended’.
| |
| ==
| |
| | |
| = Revision history =
| |
| | |
| {| class="wikitable"
| |
| |-
| |
| ! Version
| |
| ! Authors
| |
| ! Date
| |
| ! Comments
| |
| |-
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |} | | |} |
|
| |
| [[Category:Operations_Procedures]]
| |
The wiki is deprecated and due to be decommissioned by the end of September 2022.