The Kibana frontend for Logstash stores dashboards in an Elasticsearch index. Saving a dashboard results in an HTTP PUT request being sent from the user's browser to logstash.wikimedia.org. This vhost is behind the misc Varnish cluster. It turns out that the base Varnish configuration (modules/varnish/templates/vcl/wikimedia.vcl.erb) returns a 403 response for any request that is not "^(GET|HEAD|POST|PURGE)$". The current Puppet module does not allow this to be overridden by a specific Varnish cluster configuration (eg. templates/varnish/misc.inc.vcl.erb).
Version: wmf-deployment
Severity: major