So my proposal would be to do this considering 8 existing hosts + 4 expansion hosts already racked.
Considerations

• Leave s1 alone
• Add x1, x4 and of course maintain x3
• Two sections per host (excluding s1) now that we have enough hosts

In T395881#11280914, @BTullis wrote:

I created T407485 to track the work required to add this section to an-redacteddb1001 and set up the initial replication.

I'm conscious that @Marostegui has said this, back in June.

In T395881#10878825, @Marostegui wrote:

This definitely needs a review from security before we can proceed.
This will also likely need specific triggers/views.

But first, we need to get an indication on:

• tables that can be replicated entirely as they are
• tables that cannot be replicated at all
• tables that need some redactions
• tables that require some specific views

When you say:

tables that cannot be replicated at all

...do you mean that certain table might be entirely filtered out of the MariaDB replication so that it never leaves the upstream x1 replica?

Thanks @Gehel for asking for clarification. I agree with Joseph and approve the change, please move forward. Thanks!

It's worth noting that because of the table catalog (T363581), now all tables that should be fully filtered or are fully public can be easily determined and already will be filtered when someone sets up the replication (We did catalog x1 tables too: T399302). That leaves only updating maintain-views for partially public tables.

I created T407485 to track the work required to add this section to an-redacteddb1001 and set up the initial replication.

This happened again today. START REPLICA; was enough to resume replication.

I have reviewed the table, it contains only a features list with how many users use it. It is safe to replicate.

I pinged Data-Engineering on slack to get validation.

yes.

AIUI we would need to:

Cookbook cookbooks.sre.wikireplicas.update-views started by ladsgroup completed:

• an-redacteddb1001.eqiad.wmnet (PASS)
  • Ran Puppet agent
  • Ran 'maintain-views --replace --auto-depool --all-databases --table logging'

Cookbook cookbooks.sre.wikireplicas.update-views run by ladsgroup: Started updating wiki replica views

Cookbook cookbooks.sre.wikireplicas.update-views started by ladsgroup executed with errors:

• an-redacteddb1001.eqiad.wmnet (PASS)
  • Ran Puppet agent
  • Ran 'maintain-views --replace --auto-depool --all-databases --table logging'

Cookbook cookbooks.sre.wikireplicas.update-views run by ladsgroup: Started updating wiki replica views

Change #1194294 merged by Ladsgroup:

[operations/puppet@production] maintain-views: Add abusefilterblockeddomainhit to allowed log types

https://gerrit.wikimedia.org/r/1194294

Tagging Data-Platform-SRE to get their input.

Change #1194294 had a related patch set uploaded (by Ladsgroup; author: Amir Sarabadani):

[operations/puppet@production] maintain-views: Add abusefilterblockeddomainhit to allowed log types

https://gerrit.wikimedia.org/r/1194294

We're waiting on Data-Engineering to validate.

Change #1191675 merged by Majavah:

[operations/puppet@production] P:wmcs: maintain-dbusers: Remove accounts names from Prometheus labels

https://gerrit.wikimedia.org/r/1191675

Change #1191675 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] P:wmcs: maintain-dbusers: Remove accounts names from Prometheus labels

https://gerrit.wikimedia.org/r/1191675