Every scap and sync-* operation on the WMF prod cluster is emitting soft failure warnings about "@Error: access denied to common from localhost (127.0.0.1)" from mw2187 and mw2080. The Trebuchet managed /srv/deployment/scap/scap git clones on these hosts are corrupted and only partially checked out.
@chasemp ran salt-call deploy.checkout 'scap/scap' on mw2080.codfw.wmnet and saw this failure description:
[16:31] < chasemp> Command u'/usr/bin/git checkout --force --quiet tags/scap/scap-sync-20150622-214637' failed with return code: 128 [16:31] < chasemp> [ERROR ] output: error: object file .git/objects/57/a4ca75e191a778f80d06bf1bc331d7db5d7f6a is empty [16:31] < chasemp> error: object file .git/objects/57/a4ca75e191a778f80d06bf1bc331d7db5d7f6a is empty [16:31] < chasemp> fatal: loose object 57a4ca75e191a778f80d06bf1bc331d7db5d7f6a (stored in .git/objects/57/a4ca75e191a778f80d06bf1bc331d7db5d7f6a) is corrupt [16:31] < chasemp> local:
When I updated scap via Trebuchet I logged fetch failures from mw1222, mw2086 and virt1000 followed by checkout failures from mw1104, mw1222, mw2009, mw2011, mw2021, mw2028, mw2031, mw2034, mw2069, mw2076, mw2080, mw2086, mw2095, mw2099, mw2120, mw2127, mw2131, mw2136, mw2170, mw2187, mw2189, mw2197 and virt1000.
The fix would be to either manually repair the git clones on these hosts or to remove /srv/deployment/scap/scap entirely and have Trebuchet re-clone the repo via salt-call deploy.fetch 'scap/scap' && salt-call deploy.checkout 'scap/scap'