Page MenuHomePhabricator

Adding phedenskog to perf-team
Closed, ResolvedPublicRequest

Description

https://wikitech.wikimedia.org/wiki/Production_shell_access#New_users

  1. Read, comprehend, and sign: https://phabricator.wikimedia.org/L3
  2. Have NDA signed and on-file with Legal.
  3. Public key SSH (Must be different from the Labs key for Wikitech/Gerrit)
  4. Approvals from at least one employee and/or relevant service/team lead.

Request details:

  • Username: phedenskog
  • Full name: Peter Hedenskog
  • Public key SSH: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxyWdrsYsbZuCFvBYGJAc/dhzp1Jfg0il+FFux+LB8F2iJ6jSA46LGT2JPPGumx72+ArGkr+xddgnzBfyutrkrRRTRI30yszFXJsm07GG9I8mAdj/6UXhWsNDBJy7xTvUYMD8TTbtXCT7dTdAg8BxpwKEvW04wZX2HIVDcwDBIMfxRvsvSS352FmfQ7OSytW9/82egMZlcbF6GDJytV6Sk8Zbh5EldtA5EH7pLexlSR8FFSi88h2NF+c6I8rHPpiorbB1jqA2b3krbMhe8vp13VS319L+b6VfsS4OgR5XUnFVHr3SiQ/eqtGwivOnXVFZBngpqzeat7AxPlDMl93l1 phedenskog@WMF1412
  • Reason: @Peter is a member of the Performance Team and should have access to the servers where our services run on (e.g. hafnium for webperf/navtiming, and tungsten for xhgui - Note: host names to change per T158837).

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Krinkle updated the task description. (Show Details)

I approve, naturally :-)

access to the servers where our services run on (e.g. hafnium for webperf/navtiming, and tungsten for xhgui - Note: host names to change per T158837).

Access is (should be) generally based on puppet role names, not host names. So in this case, this is:

  • access to hosts using xhgui::app (admin groups in hieradata/role/common/xhgui/app.yaml = perf-roots)
  • access to hosts using role::webperf (admin groups in hieradata/role/common/webperf.yaml = perf-roots, eventlogging-admins)

So we can summarize it as "membership in perf-roots" and access will move to wherever the role is applied which adds this group. We don't have to think about host names.

Dzahn renamed this task from Requesting access to perf-teams for phedenskog to Requesting access to perf-teams for phedenskog (add phedenskog to perf-roots).Nov 6 2017, 7:44 AM

Though... Also see T179317#3731710 "perf-roots grants full root access to nearly half the servers in production"

@Muehlenhoff

Access is (should be) generally based on puppet role names, not host names.

Yeah, we use roles (mainly webperf and xhgui for the purpose of this task). And access to these roles will be granted via the perf-team group once T179728 is resolved, which should happen before this task. This is a request for perf-team (per task title).

Krinkle triaged this task as High priority.Nov 6 2017, 8:54 PM
Krinkle added a project: Performance-Team.
Krinkle moved this task from Inbox, needs triage to Blocked (old) on the Performance-Team board.

@Krinkle Now that i saw the other ticket to create "perf-team" i understand better. Gotcha!

MoritzMuehlenhoff renamed this task from Requesting access to perf-teams for phedenskog (add phedenskog to perf-roots) to Adding phedenskog to perf-team.Nov 8 2017, 8:42 AM
MoritzMuehlenhoff claimed this task.

I've updated the title to reflect the recent creation of perf-team. I'll create a Gerrit patch, but this needs to be approved in next Monday's Ops meeting first.

Change 390244 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add shell user for phedenskog

https://gerrit.wikimedia.org/r/390244

Change 390245 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add phedenskog to perf-team group

https://gerrit.wikimedia.org/r/390245

Please note this was reviewed and approved in our operations team meeting today. I'll go ahead and rebase/merge @MoritzMuehlenhoff's patchsets.

Change 390244 merged by RobH:
[operations/puppet@production] Add shell user for phedenskog

https://gerrit.wikimedia.org/r/390244

Change 390245 merged by RobH:
[operations/puppet@production] Add phedenskog to perf-team group

https://gerrit.wikimedia.org/r/390245

RobH removed MoritzMuehlenhoff as the assignee of this task.
RobH removed a project: Patch-For-Review.
RobH added a subscriber: MoritzMuehlenhoff.

This is now live (after ops meeting approval). Since this affects a fair number of systems, manually kicking puppet for this seems excessive. All affected systems will call in within 30 minutes and get the updates.

If you have any issues logging in after 17:50 GMT, please feel free to re-open this task, or ping me in irc (nick RobH).