Page MenuHomePhabricator

Set up user for automatic WDQS GUI builds
Closed, ResolvedPublic

Description

We need to set up user for WDQS GUI automated builds. Instructions from @hashar:

  • releng get the password added to Jenkins credential store and releng secret store
  • get a private mailling list for the LDAP user - wdqs-gui-build@lists.wikimedia.org (T189810)
  • set up the email above as the email for the user wdqsguibuilder in LDAP.

Event Timeline

Smalyshev triaged this task as Medium priority.Mar 15 2018, 6:36 PM
Smalyshev created this task.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 15 2018, 6:36 PM
Smalyshev moved this task from Backlog to Next on the User-Smalyshev board.Mar 16 2018, 5:02 PM
Smalyshev moved this task from Next to Waiting/Blocked on the User-Smalyshev board.
Smalyshev updated the task description. (Show Details)Apr 2 2018, 5:28 PM

I can add a password to the jenkins credential store but need to have that communicated to me in a secure way. Should we create a private phabricator task or ....exchange pgp keys?

@mmodell If you send me an email with your public key (smalyshev@wikimedia) I think this should work. Thanks!

mmodell updated the task description. (Show Details)Apr 19 2018, 7:11 PM
greg added a subscriber: greg.

RelEng related things here done, the rest are in Ops bailiwick (mailing list and ldap).

We already have the user in LDAP (wdqsguibuilder) though for now it uses my email address. But I think we could try running it with this address, to ensure the procedure works?

We already have the user in LDAP (wdqsguibuilder) though for now it uses my email address. But I think we could try running it with this address, to ensure the procedure works?

@Smalyshev Sure I don't see why not.

@mmodell We have https://gerrit.wikimedia.org/r/c/415769/ implementing the job. Needs review/+2.

https://gerrit.wikimedia.org/r/#/c/415769/3/jjb/wikidata.yaml creates the job with:

- ssh-agent-credentials:
    users:
        - 'wdqsguibuilder'

The job XML reflects that value properly:

<buildWrappers>
  <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
    <user>wdqsguibuilder</user>
  </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
</buildWrappers></project>

But in the GUI it fails to find that credential id and default to another one. The credential store list one has:

WDQSGUIBuilderLDAP Login for WDQS GUI Builder

I guess it is case sensitive.

The Jenkins Credential store has one for a username and password in LDAP. It should instead be a SSH user with a private key, then the job will be able to push the change for review to Gerrit over git/ssh.

So a key pair should be generated the public key added in Gerrit for the WDQSGUIBuilder. Then the private key added to the Jenkins credential store. I guess https://integration.wikimedia.org/ci/credentials/store/system/domain/_/credential/WDQSGUIBuilder/ can be deleted.

Ok I fixed the credentials (Added the private key and removed the ldap user/password) ... @Smalyshev you will need to add the coresponding public key to gerrit if you have not done so already. I re-ran the jenkins job and it failed with a seemingly unrelated error about missing grunt.

Smalyshev updated the task description. (Show Details)Apr 28 2018, 7:20 AM

Change 429540 had a related patch set uploaded (by Smalyshev; owner: Smalyshev):
[integration/config@master] Replace email with private list wdqs-gui-build@lists.wikimedia.org

https://gerrit.wikimedia.org/r/429540

Smalyshev updated the task description. (Show Details)Apr 28 2018, 7:22 AM
Dzahn added a subscriber: Dzahn.May 7 2018, 5:29 PM

Done! I edited the LDAP user (uid=wdqsguibuilder) and changed the email address field to wdqs-gui-build@lists.wikimedia.org.

Dzahn updated the task description. (Show Details)May 7 2018, 5:29 PM

@Smalyshev ticket resolved?

	homeDirectory: /home/wdqsguibuilder
	mail: wdqs-gui-build@lists.wikimedia.org
	uid: wdqsguibuilder

There's also https://gerrit.wikimedia.org/r/c/429540/ though it probably would also work without it.

Dzahn added a comment.May 7 2018, 5:35 PM

Ah, i see. +1ed, i will have to leave this for Hashar to merge though. Don't have +2 on that repo. Let's keep the ticket open until then.

mmodell added a comment.EditedMay 7 2018, 6:45 PM

ok I +2'd it. hashar is out this week.

Change 429540 merged by jenkins-bot:
[integration/config@master] Replace email with private list wdqs-gui-build@lists.wikimedia.org

https://gerrit.wikimedia.org/r/429540

Smalyshev closed this task as Resolved.May 7 2018, 6:54 PM
Smalyshev claimed this task.