@Pchelolo, could you add a public SSH key to use for this? Per 1, it should not be the same as the one used for labs.

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSxkE+b4Jc+3FoCgYqZvQJZ8a0Hk2UhC2Qb1zi1CiThsE8oBPf6n1Mki58o/mHBrtfgAPutCFFylkLwuPDE5tDojENvNx3roMxEmpQhDTs3iKTfXF98IVdsrI8gmrpCQoy+fny3K/O89rmAza2WTK2ogB2rDBLRAC0hYz6pzuA38+4ybmYbqVn/SQSDyMsX0366xBsn3r6pEwyttZsLhO/5HDG1O5cUkrxwXr5XACIGGHZyG2ev2uLtZj/6py5skxvp2xLs1/m7qP1Sykvz8QungW7KfyzNCVKb07RxKlsUQEnAqnQY2fnB3VjKSe4FNUafQHkmFJ1MLr0zH31uMOF pchelko@Petrs-MBP.corp.wikimedia.org

@Pchelolo you also need to read and sign {L3}

@mobrovac read and signed.

Change 269368 had a related patch set uploaded (by Dzahn):
admin: add user ppchelko

https://gerrit.wikimedia.org/r/269368

Change 269369 had a related patch set uploaded (by Dzahn):
admin: add ppchelko to restbase-admins

https://gerrit.wikimedia.org/r/269369

Hm, actually, with restbase-admins you are not able to deploy, you can:

• log in,
• read logs
• start/stop/restart restbase and cassandra

For deployment, one needs to be in the restbase-roots group, so I'd say to go ahead and retitle this as @Pchelolo needing restbase-roots access.

or maybe an alternative is to amend the permissions the restbase-admins have with the deploy commands, so that all admins can deploy. would it be easy to list the needed command to be added to sudo privileges?

Re-titled to ask for restbase-roots access, per @mobrovac.

In T126283#2012043, @Dzahn wrote:

or maybe an alternative is to amend the permissions the restbase-admins have with the deploy commands, so that all admins can deploy. would it be easy to list the needed command to be added to sudo privileges?

That's a bit tricky and error-prone because the target repo is owned by root on the nodes, and we use ansible to deploy, which spawns its own local commands when performing the fetch and check-out phases.

Amended the Gerrit change to become "add to roots" as well.

Change 269368 merged by Cmjohnson:
admin: add user ppchelko

https://gerrit.wikimedia.org/r/269368

User added but adding to restbase-roots group will require an approval in ops meeting.

Change 269369 merged by Dzahn:
admin: add ppchelko to restbase-roots

https://gerrit.wikimedia.org/r/269369

Change 272513 had a related patch set uploaded (by Dzahn):
admin: add bast-only group for ppchelko

https://gerrit.wikimedia.org/r/272513

Change 272513 merged by Dzahn:
admin: add bast-only group for ppchelko

https://gerrit.wikimedia.org/r/272513

approved in meeting (https://office.wikimedia.org/wiki/Operations/Operations_Meeting_Notes/TechOps-2016-02-22#Access_Requests)

merged, followed-up with access to bastion hosts

[restbase1001:~] $ id ppchelko
uid=12460(ppchelko) gid=500(wikidev) groups=500(wikidev),744(restbase-roots)

[bast1001:~] $ id ppchelko
uid=12460(ppchelko) gid=500(wikidev) groups=500(wikidev),707(bastiononly)

etc.. the same on all restbase hosts as soon as puppet ran