GPUS-IT-Infrastructure — Data-Team GCE Fleet¶

Classification: CONFIDENTIAL — Internal Use Only Document: infrastructure/gpus-it-infrastructure.md · v1.0 · 2026-06-26 · GPUS-IT

1. Overview¶

This page documents the gpus-it-infrastructure GCP project — a separate project from gpus-infra (which hosts the SOC/monitoring stack on OAK/MAPLE/CEDAR). It holds the data team's Compute Engine fleet on the shared gl5-shared network domain.

These instances are tracked in inventory.yaml under the compute_instances category. They are documented-but-not-polled: none of them is on the SSH-poll path the gpus-infra backends use, so the regenerate-servers-py.py generator renders them into DOCUMENTED_HOSTS (a non-SSH dictionary) and deliberately excludes them from the SERVERS dict. The status/SOC backends never attempt to SSH them.

Their telemetry intent is a collector at WDC — Windows hosts via the Wazuh agent reporting to the WDC Wazuh manager, Linux hosts via Prometheus node_exporter. Until those agents/exporters are wired, every asset carries monitoring.status: pending-path (rendered as a neutral "● monitoring pending" badge on the status and SOC portals). Terminated / unknown instances are not-monitored.

Monitoring pending — coverage gap

No security or metrics telemetry is flowing from these instances yet. They are listed as known, documented coverage gaps, not as monitored assets. Do not interpret a card here as a passing state.

2. Fleet inventory¶

Instance	Platform	Private IP	Public IP	Zone · Machine type	OS (EOL)	Role	Disposition	Monitoring
`duck`	windows	10.1.96.46	—	us-central1-a · n1-highmem-4	Windows Server 2016-DC (2027-01-12)	Analyst terminal server + Redshift/SQL	migrate (→WS2025, rebuild-cutover)	wazuh-agent → WDC · pending-path
`grebe`	windows	10.1.96.51	—	us-central1-a · n1-highmem-4	Windows Server 2016 (2027-01-12)	Terminal/app server + 500 GB data disk	migrate (→WS2025, rebuild-cutover)	wazuh-agent → WDC · pending-path
`falcon`	windows	10.1.96.12	35.223.86.92	us-central1-f · n2-custom-2-9984	Windows Server 2016 (2027-01-12)	Talend ETL node (prod)	migrate (→WS2025, rolling-cutover)	wazuh-agent → WDC · pending-path
`gull`	windows	10.1.96.42	104.154.21.30	us-central1-f · n2-standard-4	Windows Server 2016 (2027-01-12)	Talend ETL node (prod)	migrate (→WS2025, rolling-cutover)	wazuh-agent → WDC · pending-path
`kestrel`	windows	10.1.96.15	35.239.221.226	us-central1-f · n2-standard-4	Windows Server 2016 (2027-01-12)	Talend ETL node (prod)	migrate (→WS2025, rolling-cutover)	wazuh-agent → WDC · pending-path
`woodpecker`	windows	10.1.96.48	—	us-central1-a · e2-custom-16-32768	Windows Server 2022-DC	Unknown — role unconfirmed; instance terminated	investigate	none · not-monitored
`kingfisher`	linux	10.1.96.14	35.192.36.47	us-central1-f · n2-standard-16	CentOS 7 (EOL 2024-06-30); instance terminated	Tamr data-mastering (legacy)	decommission (gated: pending Tamr disposition)	none · not-monitored
`magpie`	linux	10.1.96.50	34.72.120.159	us-central1-f · e2-medium	RHEL 8 (2029-05-31)	SQL/Linux data service	keep	node-exporter → WDC · pending-path
`nfs-gw`	linux	10.128.0.11	—	us-central1-a · e2-micro	Debian 10 (EOL 2024-06-30)	Filestore/NFS gateway (dual-homed)	rebuild (supported OS)	node-exporter → WDC · pending-path

All roles are confirmed with the data team except woodpecker, whose purpose is unconfirmed (disposition: investigate).

3. Disposition summary¶

Theme	Instances	Plan
Windows Server 2016 → 2025 migration	`duck`, `grebe`	Rebuild-cutover (terminal/app servers)
Talend ETL prod → WS2025	`falcon`, `gull`, `kestrel`	Rolling-cutover (keep ETL pipeline online)
Investigate	`woodpecker`	Terminated WS2022 host; identify purpose before any action
Decommission (gated)	`kingfisher`	EOL CentOS 7; blocked on Tamr data-mastering disposition
Keep	`magpie`	Supported RHEL 8 SQL/Linux service
Rebuild (supported OS)	`nfs-gw`	EOL Debian 10 dual-homed NFS gateway → supported OS

Public-IP exposure¶

falcon (35.223.86.92), gull (104.154.21.30), kestrel (35.239.221.226), kingfisher (35.192.36.47 — terminated), and magpie (34.72.120.159) carry external IPs. Prioritize wiring the WDC collector path for the live, publicly-reachable hosts.

4. Orphaned-resource cleanup¶

Surfaced during the 2026-06-26 integration and recorded under inventory.yaml → cleanup_notes (not managed assets):

loonnew — orphaned persistent disk, not attached to any instance. Confirm unneeded, snapshot if in doubt, then delete to stop storage cost.
Dead GKE PVCs — PersistentVolumeClaims left by a since-deleted GKE cluster; backing PDs no longer mounted. Verify the cluster is gone, then release the bound PVs/PDs and delete to reclaim storage.

5. Source of truth & propagation¶

Edit inventory.yaml (compute_instances) only — never hand-edit servers.py or the portal sources. On push, Cloud Build:

Runs the coverage check (scripts/check-component-coverage.py), which enforces schema, portal presence, and an IAR entry for every gpus-it-infrastructure asset.
Bakes inventory.json into the status-site and soc-site images.
Rebuilds and deploys the portals and this docs page.

Promotion to monitored: when a Wazuh agent (Windows) or node_exporter (Linux) starts reporting to the WDC collector, change that instance's monitoring.status from pending-path to live. No other change is needed — the portal badge flips on the next build.