@akosiaris: Hey, @awight is joing Scoring platform team, do you think this needs to go through normal access requests period as Adam is already staff.

FWIW, I see that I have access to tin and can presumably deploy there. However, I don't have ssh access to the canary server scb1002 or any of the other workers. This might be the correct access level for my team, in which case I think we're finished here. Let me know!

In T168442#3370887, @Ladsgroup wrote:

@akosiaris: Hey, @awight is joing Scoring platform team, do you think this needs to go through normal access requests period as Adam is already staff.

Please note that being staff doesn't exempt anyone from any of the steps for access requests. So we'd have to confirm everything anyhow if this was a brand new request. Since he already has shell access, this is merely increasing the access. This included me auditing L3 (@awight has already signed it), and confirming they already exist in the admin module with an active user (he does.)

However, it still isn't clear if this request is needed for increased access levels to the scb1002 (and assorted cluster?)

@awight: Can you please provide details as to exactly what servers or data that you need access to, but do not currently have?

Sounds like I'll need shell on scb[1-2]* and also the ores-admin group, so I can do terrible things on production boxes.

Change 361593 had a related patch set uploaded (by Ladsgroup; owner: Amir Sarabadani):
[operations/puppet@production] Add awight to ores-admins

https://gerrit.wikimedia.org/r/361593

This is the only thing that needs to be done

My fault, I've been flapping this task like crazy... T168442#3380731

Thanks for taking a look!

In T168442#3380801, @RobH wrote:

Addition to the ores-admins is a sudo group, and thus will require review during the weekly operations meeting on Monday.

Let's get manager signoff while we wait.

:)
@Halfak, I believe that's for you.

Confirmed!

Change 361593 merged by Dzahn:
[operations/puppet@production] admins: Add awight to ores-admins

https://gerrit.wikimedia.org/r/361593

You have been added to the ores-admins group. This was approved in today's ops meeting.

This gives you access to "service b" nodes. Such as, for example:

Notice: /Stage[main]/Admin/Admin::Groupmembers[ores-admin]/Exec[ores-admin_ensure_members]/returns: executed successfully
Notice: Finished catalog run in 17.00 seconds
[scb1001:~] $ id awight
uid=4974(awight) gid=500(wikidev) groups=500(wikidev),782(ores-admin)

but also all these: node /^scb[12]00[123456]\.(eqiad|codfw)\.wmnet$/ {

I ran puppet on scp1001/2001 to confirm, the others will happen automatically within the next 30 min.

This is what you can run as root:

[scb2001:~] $ sudo cat /etc/sudoers.d/ores-admin 
# This file is managed by Puppet!

%ores-admin ALL = NOPASSWD: /usr/sbin/service uwsgi-ores *
%ores-admin ALL = NOPASSWD: /usr/sbin/service celery-ores-worker *

Thanks! Confirmed working.