We would like to have it in PROD before 59 reaches BETA (January 22nd). Do you guys know if I can release kinto-dist 5.1.0 with the new plugins version or if I should wait for a bugfix.

Configuration change is: kinto.attachment.resources.fingerprinting-defenses-staging_fonts.use_content_encoding = true I am going to file a PR to cloudops for that one.

I have a couple questions: 1. kinto v5.0.0 has an issue [1] that hasn't been fully fixed. Will deploying v5.1.0 cause the same high CPU load issue to kinto-setting, as it did to kintowe? 2. Does this deployment require a db migration (current storage_schema_version is 13)? [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1421999

> kinto v5.0.0 has an issue Yes it will eventually be fixed later, kinto-settings being used mostly in read only we won't have the CPU problem we see in kinto-webextension. > Does this deployment require a db migration (current storage_schema_version is 13)? Yes it will !

> > Does this deployment require a db migration (current storage_schema_version is 13)? > Yes it will ! OK! Can we run the db migration live while the service is taking requests, or do we need to shut down the old kinto-settings stack, do the migration, and then bring up the new stack?

Hmm, the `metadata` table on -prod looks like this, kinto=> select * from metadata ; name | value ------------------------+------------------------------- created_at | 2015-11-12 22:58:01.465424+00 storage_schema_version | 7 storage_schema_version | 8 storage_schema_version | 9 storage_schema_version | 10 created_at | 2016-04-29 08:05:47.021997+00 storage_schema_version | 10 (7 rows) Will it cause a problem for db migration (I have no idea how it became like that)?

> Can we run the db migration live while the service is taking requests, or do we need to shut down the old kinto-settings stack, do the migration, and then bring up the new stack? The latter is fine.

Now that Bug 1421999 is fixed, we can deploy 5.1.3 Add permission for Wayne: https://github.com/mozilla-services/cloudops-deployment/pull/1530 Fingerprinting defenses: https://github.com/mozilla-services/cloudops-deployment/pull/1173/files Migrate configuration: https://github.com/mozilla-services/cloudops-deployment/pull/1444/files Add preload configuration: https://github.com/mozilla-services/cloudops-deployment/pull/1520

kinto v5.1.3 is deployed to -stage with the following: * https://github.com/mozilla-services/cloudops-deployment/pull/1530 * https://github.com/mozilla-services/cloudops-deployment/pull/1444/files * https://github.com/mozilla-services/cloudops-deployment/pull/1520 However, * https://github.com/mozilla-services/cloudops-deployment/pull/1173/ is not deployed because it now has some conflicts, which I'm not sure how to resolve... Remy, could you take a look at the PR? Also you mentioned in comment #1 that there is a configuration change related to this, but I couldn't find the PR for it. Could you add that too? Another thing I need to figure out is how to load the permission file into database with kinto-wizard, because my email address is not an admin account in kinto database.

I don't know much, but I glanced at the pull request and saw the following accounts which are no longer Mozilla employees =( + - ldap:cfu@mozilla.com + - ldap:ettseng@mozilla.com + - ldap:tihuang@mozilla.com + - ldap:rbarnes@mozilla.com

Tom can you give me the list of people that will be able to edit and review the fingerprinting-defenses bucket?

(In reply to Rémy Hubscher (:natim) from comment #10) > Tom can you give me the list of people that will be able to edit and review > the fingerprinting-defenses bucket? For now, Let's make it myself and Luke Crouch.

Thank :wei I updated the PR with the new information.

Thank you Remy! I re-deployed v5.1.3 to -stage with merged https://github.com/mozilla-services/cloudops-deployment/pull/1173/. However, I ran into some chicken-egg problem when trying to run "kinto-wizard" to load the permission files into -stage. Because I don't have write permissions for most of the buckets my run failed. I'm trying to add myself to the permission file in this PR: https://github.com/mozilla-services/cloudops-deployment/pull/1543 Also what about the "kinto.attachment.resources.fingerprinting-defenses-staging_fonts.use_content_encoding = true" in comment #1. Do we still need it?

> what about the "kinto.attachment.resources.fingerprinting-defenses-staging_fonts.use_content_encoding = true" in comment #1. Do we still need it? Yes > I don't have write permissions for most of the buckets my run failed. You can also temporary grab administrator access by configuring the .ini file with the following settings: kinto.bucket_write_principals = ldap:wezhou@mozilla.com kinto.bucket_read_principals = ldap:wezhou@mozilla.com kinto.bucket_create_principals = ldap:wezhou@mozilla.com kinto.collection_write_principals = ldap:wezhou@mozilla.com kinto.collection_read_principals = ldap:wezhou@mozilla.com kinto.collection_create_principals = ldap:wezhou@mozilla.com kinto.record_write_principals = ldap:wezhou@mozilla.com kinto.record_read_principals = ldap:wezhou@mozilla.com kinto.record_create_principals = ldap:wezhou@mozilla.com kinto.group_write_principals = ldap:wezhou@mozilla.com kinto.group_read_principals = ldap:wezhou@mozilla.com kinto.group_create_principals = ldap:wezhou@mozilla.com

v5.1.4 was deployed to -stage. Latest permission file is loaded into -stage db as well. :natim, can you review https://github.com/mozilla-services/cloudops-deployment/pull/1553 We need to merge it and then do another push of v5.1.4 to -stage.

Yes r+, I also started looking at stage and it looks to be working with the new fixes thanks.

Thanks :natim! v5.1.4 has been deployed again to -stage with "kinto.attachment.resources.fingerprinting-defenses-staging_fonts.use_content_encoding = true"

Can you try to run magic automated your tests?

I *believe* things are set up so that when kinto-settings is deployed the tests I wrote should be triggered. If that didn't happen, I can run them manually.

For the v5.1.4 -stage deployment, the test wasn't triggered properly, unfortunately. It's because one of the libraries for the jenkins pipeline wasn't updated. I've asked :oremj to look into it. Chris, could you manually trigger the tests against kinto-settings v5.1.4 on -stage?

pytest -v --env=stage -m settings config-tests config-tests/test_dlc.py::test_fennec_dlc_exists PASSED config-tests/test_dlc.py::test_fonts_fingerprinting_defenses PASSED config-tests/test_dlc.py::test_fonts_fingerprinting_defenses_preview PASSED config-tests/test_kinto_signer.py::test_addons_signatures PASSED config-tests/test_kinto_signer.py::test_plugins_signatures PASSED config-tests/test_kinto_signer.py::test_gfx_signatures PASSED config-tests/test_kinto_signer.py::test_certificates_signatures PASSED config-tests/test_kinto_signer.py::test_certificate_pinning_signatures SKIPPED config-tests/test_server_details.py::test_version PASSED config-tests/test_server_details.py::test_heartbeat PASSED config-tests/test_server_details.py::test_server_info PASSED config-tests/test_server_details.py::test_contribute PASSED Looks OK from here