Given that I already have shell access for most boxes and this is a pretty limited expansion of privileges, if it's possible to waive the requirement of waiting for three business days, I'd ask for that. I was planning the deploy for tomorrow and only now realized I don't have access to scb*.

I approve of the access request being fulfilled. I'm in support of expediting if possible.

CC @bearND and @Mholloway for visibility.

Access checklist:

• - user has existing shell name
• - user has signed L3 (as of 2017-09-14 @ 15:34 GMT it has not been signed.)
• - manager approval (@dr0ptp4kt granted.)
• - user provides exact usergroups for inclusion

[]- user has to await approval in ops meeting for sudo requests.

I see you requesting access to SCB (but not listing the access group) and access to

pdfrender-admin:
    description: Group of pdfrender admins
    gid: 790
    members: [gwicke, ppchelko, eevans, mobrovac]
    privileges: ['ALL = NOPASSWD: /usr/sbin/service pdfrender *',
                 'ALL = (pdfrender) NOPASSWD: ALL']

I think you want the sc admins group for admin on scb, but it grants root to the full cluster of sc[a|b}

sc-admins:

description: General service cluster admins - sc(a|b)
gid: 779
members: [eevans, gwicke, mobrovac, ppchelko]
privileges: ['ALL = NOPASSWD: /usr/bin/puppet agent *',
           'ALL = NOPASSWD: /usr/sbin/service changeprop *',
           'ALL = NOPASSWD: /usr/sbin/service citoid *',
           'ALL = NOPASSWD: /usr/sbin/service cpjobqueue *',
           'ALL = NOPASSWD: /usr/sbin/service cxserver *',
           'ALL = NOPASSWD: /usr/sbin/service graphoid *',
           'ALL = NOPASSWD: /usr/sbin/service mathoid *',
           'ALL = NOPASSWD: /usr/sbin/service mobileapps *',
           'ALL = NOPASSWD: /usr/sbin/service pdfrender *',
           'ALL = NOPASSWD: /usr/sbin/service recommendation_api *',
           'ALL = (recommendation_api) NOPASSWD: ALL',
           'ALL = NOPASSWD: /usr/sbin/service trendingedits *',
           'ALL = NOPASSWD: /usr/sbin/service zotero *',
           'ALL = NOPASSWD: /usr/bin/firejail --join=*']

As you can see, one of your two requests is sudo, and will require a operations meeting approval. As such, there isn't any process to expedite past this ops meeting review, without having the Ops director sign off (@mark).

@Tgr: Can you please detail what exact group you need for access to scb/confirm its sc-admins? Please also read, understand, and sign the L3. We require that for all requests, even existing users who have not yet signed it. Once we have the additional group, this still needs to wait for ops meeting on Monday.

I'm assigning this to you for your input on the above (additonal group name plus L3 signature. Please assign back to me when complete and I'll ensure this is listed on the ops meeting next Monday.

In T175882#3608038, @dr0ptp4kt wrote:

I approve of the access request being fulfilled. I'm in support of expediting if possible.

CC @bearND and @Mholloway for visibility.

We cannot expedite requests without @mark specifically overriding this process. In particular on granting a user sudo rights, sorry!

We cannot expedite requests without @mark specifically overriding this process. In particular on granting a user sudo rights, sorry!

Understood. Thanks, @RobH !

I chatted with @Tgr via IRC, and he is aware this will have to wait until Monday & he needs to sign the L3.

It seems that he only needs pdfrender-admin, not anything else. I'll link a patchset shortly.

Change 378060 had a related patch set uploaded (by RobH; owner: RobH):
[operations/puppet@production] add tgr to pdfrender-admin sudo group

https://gerrit.wikimedia.org/r/378060

Thanks, Rob!

I'm assigning this to you for your input on the above (additonal group name plus L3 signature. Please assign back to me when complete and I'll ensure this is listed on the ops meeting next Monday.

Just acknowledging that I saw this and am waiting for T175941: Reset Phabricator 2FA for Tgr.

I strongly support @Tgr's access request as well.

Noted that you've signed L3 and all that is needed id pfdrender-admin. I've prepared the patchset (linked in task description) and it is listed for discussion on our ops meeting today.

Change 378060 merged by RobH:
[operations/puppet@production] add tgr to pdfrender-admin sudo group

https://gerrit.wikimedia.org/r/378060