components interconnection

[celesteking]

I don't seem to understand how the components are interconnected and what is required to make them more secure.

I have decided to deploy mimir in so-called "read-write mode", but I'm doing it in custom fashion, not using your deployment scripts&configs but rather doing it myself manually via AWS terraform: I'm using -target x,y,z to select which microservices to run (NOT -target=backend). So I end up with 3 AWS services contained in a single cluster: read, write, backend, each running a selection of components according to the linked page.

Now come the questions:

• Despite the memberlist having join_members setting pointing only to write hosts, every other host is now listed on memberlist status page. I guess somehow hosts passed info to each other, unintentionally? Is this the expected outcome, should I really be letting every host participate? What's the quorum count in such case?
• I see ingester ring status page present on each host. How come? For sure ingester is enabled & running only on write type hosts and the page indeed lists only write hosts as members, but that really confuses me.
• The firewall. Shall I set it up? Should I somehow try isolating read, write, backend from each other? Isolate how much? Yes, there's a description of each component and the diagram in the docs, but won't that be hell lot of work? Right now, as I see it, a compromise of a single component on a host would lead to compromise of entire thing. I'd be willing to accept a compromise of a component leading to a host compromise (e.g., break in through distributor would lead to ingester being affected), but the entire mimir cluster?

Thanks.

[celesteking]

Another big issue is that someone came up with the "brilliant" idea of putting alertmanager and ruler into the backend service group, while query-frontend and querier were stuffed into the read service group. You try to configure Grafana with the read service-group URI and get a middle finger aka 404 because other services are hiding in a different group.

What was the idea behind this? Why not constrain whatever service endpoints are required by visualiser to a single host?