webservice doesn't need to write into $HOME/.kube, but direct use of kubectl to launch a deployment needs to be able to write some metadata into the directory.
After updating, $HOME/.kube should have perms something like:
$ ls -adl .kube drwxr-sr-x 3 tools.stashbot tools.stashbot 4096 Oct 25 2016 .kube
We could also make $HOME/.kube/config use the same chattr trick that we use for replica.my.cnf so that users can not accidentally delete the file.
Change 354839 had a related patch set uploaded (by BryanDavis; owner: Bryan Davis):
[operations/puppet@production] tools: have maintain-kubeusers chown $HOME/.kube
Change 354839 merged by Rush:
[operations/puppet@production] tools: have maintain-kubeusers chown $HOME/.kube
I'll clean up the permissions on the existing directories manually from labstore1005.eqiad.wmnet
Change 360779 had a related patch set uploaded (by BryanDavis; owner: Bryan Davis):
[operations/puppet@production] tools: fix chattr file path in maintain-kubeusers
Mentioned in SAL (#wikimedia-cloud) [2017-06-22T00:12:34Z] <bd808> Set ownership and permissions on $HOME/.kube for all tools (T165875)
Change 360779 merged by Madhuvishy:
[operations/puppet@production] tools: Fix maintain-kubeusers
I still need to do the cleanup for directories created before the script was fixed. I started on that and then stalled out on figuring out how to do the uid/gid mappings from a host that is not using LDAP in nsswitch. I started looking again today though and should have something soon.
$ ssh labstore1004.eqiad.wmnet $ sudo -s $ cd /exp/project/tools/project $ for d in $(find . -maxdepth 2 -name .kube -type d -user root); do u=$(ls -ld ${d%%/.kube}|awk '{print $4}') echo $d $u chown $u:$u $d chmod 0775 $d done ./nada/.kube 52816 ./validator/.kube 52596 ./prometheus/.kube root ./liangent/.kube 51115 ./samoabot/.kube 51104 ./test-lighttpd-precise/.kube 52520 ./webarchivebot/.kube 52813 ./jarbot/.kube 52831 ./liangent-misc/.kube 51465 ./phetools/.kube 52004 ./jarallah/.kube 52835 ./wikihistory/.kube 51512 ./afcbot/.kube 51049 ./sbot/.kube 51916 ./repo/.kube root ./ebraminio-dev/.kube 51315 ./himo/.kube 52807 ./wikiminiatlas/.kube 51499 ./davod/.kube 52785 ./lyan/.kube 53332 ./rotpunkt-bot/.kube 52770 ./yemen/.kube 52789 ./aaaaaa/.kube root ./crosswatch-monitoring/.kube 52537 ./farhangestan/.kube 52569 ./npp/.kube 52671 ./maurelio/.kube 53110 ./pathoschild-contrib/.kube 51337 ./spbot/.kube 51190 ./liangent-py/.kube 51118 ./liangent-toolserver/.kube 52123 ./framabot/.kube 53040 ./liangent-django/.kube 51588 ./passlicense/.kube 52784 ./edinbot/.kube 51430 ./zhwiki/.kube 51119 ./fn/.kube 52232 ./thedavetools/.kube 52924 $ (for d in $(find . -maxdepth 2 -name .kube -type d -user root); do u=$(ls -ld ${d%%/.kube}|awk '{print $4}'); echo $d $u; done)|sort ./aaaaaa/.kube root ./prometheus/.kube root ./repo/.kube root
The directories that are still owned by root are for disabled tools.