Page MenuHomePhabricator
Create Task
Maniphest T211382

Requesting access to Proton for pmiazga, bearND, Mholloway, MSantos, Tgr
Closed, ResolvedPublic
Actions

Description

Please grant access to Proton production servers and access rights to deploy the service for

Username: pmiazga
Full name: Piotr Miazga

Username: bsitzmann
Full name: Bernd Sitzmann

Username: mholloway-shell
Full name: Michael Holloway
Prod SSH public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIneKTP+6PaLMgGkOqtGe89r1i6e8lAPSZuBgGSbJaFS [email protected]
L3: Signed

Username: mbsantos
Full name: Mateus B. Santos
Prod SSH public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHVfF4WbLZsEyojr+GciiTvGmOEt8jPa5ut+K47dz1X0 [email protected]
L3: Signed

Username: tgr
Full name: Gergo Tisza

Details

SubjectRepoBranchLines +/-
admins: add to proton-admins: pmiazga, bsitzmann, mholloway, mbsantos, tgroperations/puppetproduction+2 -2
admins: add new group for proton adminsoperations/puppetproduction+6 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

pmiazga created this task.Dec 6 2018, 9:41 PM
Restricted Application added a project: SRE. · View Herald TranscriptDec 6 2018, 9:41 PM
Restricted Application added a subscriber: Aklapper. · View Herald Transcript
pmiazga updated the task description. (Show Details)Dec 6 2018, 9:43 PM
pmiazga added subscribers: • bearND, • Mholloway, MSantos, Tgr.
pmiazga added a subscriber: • mobrovac.Dec 6 2018, 9:45 PM

@bearND @Mholloway @MSantos @Tgr could you edit the task and put your shell usernames here please?

@mobrovac could you approve the request? Also, are there any additional rights that those people require?

I added myself, as I don't have access to production servers, this would help me a lot when debugging/helping Readers Infrastructure in the early phase.

pmiazga mentioned this in T210652: Handoff Proton service to Reading Infrastructure.Dec 6 2018, 9:46 PM
pmiazga added a parent task: T210652: Handoff Proton service to Reading Infrastructure.Dec 6 2018, 10:04 PM
• Mholloway updated the task description. (Show Details)Dec 6 2018, 10:10 PM
• mobrovac added a project: Proton.Dec 7 2018, 10:07 AM

Once all the usernames are known in the task description, your respective managers need to explicitly approve each of the individual requests.

• Mholloway added a subscriber: • Jhernandez.Dec 7 2018, 2:37 PM

Ping @Jhernandez ^

Dzahn subscribed.Dec 7 2018, 2:45 PM

Are you requesting the admin group "sc-admins" ?

sc-admins:
  description: General service cluster admins - sc(a|b)
  gid: 779
  members: [eevans, mobrovac, ppchelko]
  privileges: ['ALL = NOPASSWD: /usr/bin/puppet agent *',
             'ALL = NOPASSWD: /usr/sbin/service changeprop *',
             'ALL = NOPASSWD: /usr/sbin/service citoid *',
             'ALL = NOPASSWD: /usr/sbin/service cpjobqueue *',
             'ALL = NOPASSWD: /usr/sbin/service cxserver *',
             'ALL = NOPASSWD: /usr/sbin/service graphoid *',
             'ALL = NOPASSWD: /usr/sbin/service mathoid *',
             'ALL = NOPASSWD: /usr/sbin/service mobileapps *',
             'ALL = NOPASSWD: /usr/sbin/service pdfrender *',
             'ALL = NOPASSWD: /usr/sbin/service proton *',
             'ALL = (proton) NOPASSWD: ALL',
             'ALL = NOPASSWD: /usr/sbin/service recommendation_api *',
             'ALL = (recommendation_api) NOPASSWD: ALL',
             'ALL = NOPASSWD: /usr/sbin/service zotero *',
             'ALL = NOPASSWD: /usr/bin/firejail --join=*']
Dzahn added a comment.Dec 7 2018, 2:50 PM

please see https://wikitech.wikimedia.org/wiki/Production_shell_access#New_users for the required steps for the process

we'll also need you to read sign L3 and add SSH keys please

jijiki subscribed.Dec 7 2018, 2:59 PM

Those requests will be discussed on the 17th Dec SRE meeting, provided we have all information :)

• mobrovac added a subscriber: akosiaris.Dec 7 2018, 3:38 PM
In T211382#4806010, @Dzahn wrote:

Are you requesting the admin group "sc-admins" ?

No. The scope of this ticket is for Proton only. AFAIK, we currently don't have an admin group for proton (ping @akosiaris), so we will have to create it.

pmiazga added a subscriber: phuedx.Dec 7 2018, 3:44 PM

@phuedx could you approve my request? @Jhernandez can you approve the request for @bearND @Mholloway @MSantos and @Tgr?

phuedx added a comment.Dec 7 2018, 3:49 PM

Approved.

• bearND updated the task description. (Show Details)Dec 7 2018, 3:56 PM
• bearND added a subscriber: Jdforrester-WMF.Dec 7 2018, 4:00 PM

Shouldn't @Jdforrester-WMF be added, too?

pmiazga added a comment.Dec 7 2018, 4:01 PM

@bearND - per https://phabricator.wikimedia.org/T210652#4787383 looks like no, James is working on multimedia.

• Mholloway updated the task description. (Show Details)Dec 7 2018, 6:32 PM
MSantos updated the task description. (Show Details)Dec 7 2018, 9:35 PM
MSantos mentioned this in T211455: Can't connect to production with mbsantos user.Dec 7 2018, 10:06 PM
gerritbot subscribed.Dec 8 2018, 12:06 AM

Change 478373 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] admins: add new group for proton admins

https://gerrit.wikimedia.org/r/478373

gerritbot added a project: Patch-For-Review.Dec 8 2018, 12:06 AM
Dzahn added a comment.Dec 8 2018, 12:09 AM
In T211382#4806114, @mobrovac wrote:

.. we currently don't have an admin group for proton (ping @akosiaris), so we will have to create it.

ACK, https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/478373/

• Jhernandez added a comment.Dec 10 2018, 6:07 PM

Approved on my side too.

gerritbot added a comment.Dec 10 2018, 8:27 PM

Change 478373 merged by Dzahn:
[operations/puppet@production] admins: add new group for proton admins

https://gerrit.wikimedia.org/r/478373

gerritbot added a comment.Dec 10 2018, 8:36 PM

Change 478776 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] admins: add to proton-admins: pmiazga, bsitzmann, mholloway, mbsantos, tgr

https://gerrit.wikimedia.org/r/478776

Dzahn claimed this task.Dec 10 2018, 11:07 PM
Dzahn triaged this task as High priority.
gerritbot added a comment.Dec 11 2018, 10:50 AM

Change 478776 merged by Alexandros Kosiaris:
[operations/puppet@production] admins: add to proton-admins: pmiazga, bsitzmann, mholloway, mbsantos, tgr

https://gerrit.wikimedia.org/r/478776

akosiaris closed this task as Resolved.Dec 11 2018, 11:12 AM

I 've slightly amended the patch to remove the now defunct sc-admins group and merged the patch per the SRE meeting's approval. Resolving this

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits