Approved, thanks.

Having the ability to restart the api service is a sudo right, and thus we have to review this request in an operations meeting. Additionally, the following will be required from the user, all documented on https://wikitech.wikimedia.org/wiki/Requesting_shell_access. Many of these items have already been done, since this is simply expanding @schana's access.

• - preferred shell username
• - wikitech user name
• - email address to be tied to the shell account
• - Read, acknowledge, and sign the L3 document.
• - attach a dedicated public key (not the same key as labs or used elsewhere) for shell access.

Since @DarTar approved the access expansion, all this lacks is ops meeting approval. I'll list on our agenda today.

The group being requested is:

recommendation-admin:
    description: Group of recommendation-api admins
    gid: 794
    members: [gwicke, ppchelko, eevans, mobrovac]
    privileges: ['ALL = NOPASSWD: /usr/sbin/service recommendation_api *',
                 'ALL = (recommendation_api) NOPASSWD: ALL']

I put in the wrong group, @mobrovac confirmed in ops meeting this is actually requesting service deployer rights. No one in the meeting objected.

Right. @schana is the service owner and maintainer, so he needs to be able to both deploy the service and directly restart it on the SCB hosts. Hence, he needs to be part of both deploy-service and recommendation-admin groups.

Change 365658 had a related patch set uploaded (by RobH; owner: RobH):
[operations/puppet@production] adding nschaaf to deploy-service and recommendation-admin groups

https://gerrit.wikimedia.org/r/365658

Change 365658 merged by RobH:
[operations/puppet@production] adding nschaaf to two sudo groups

https://gerrit.wikimedia.org/r/365658