Maniphest T194998

Create custom deployment-prep role that allows editing of Designate records only
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Krenair
	May 18 2018, 6:17 PM

Description

<Krenair> basically we want a server in deployment-prep to be able to edit designate zones in deployment-prep
<Krenair> which means we need a service user which has permissions to do so in openstack
<Krenair> but we can't just give it projectadmin rights and then distribute the credentials to servers, because non-projectadmin users can SSH into those servers and sudo etc.
<andrewbogott> Krenair: that's definitely a thing we can do.  Can you make a phab task (or find the existing one) and assign it to me?
<andrewbogott> It'll be a few weeks though because I'm mostly at conferences and on holiday

Details

	Subject	Repo	Branch	Lines +/-
	designate: support a new 'designatemanager' role	operations/puppet	production	+1 -1

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	Krenair	T182927 Get letsencrypt wildcard cert for *.beta.wmflabs.org domains
Resolved	Andrew	T184245 Create some mechanism for instances in projects to modify the project Designate records
Resolved	Andrew	T194998 Create custom deployment-prep role that allows editing of Designate records only

Event Timeline

Krenair triaged this task as Medium priority.May 18 2018, 6:17 PM

Krenair created this task.

Krenair mentioned this in T190781: Secure deployment-prep sudo access to prevent privilege escalation by dns-manager credentials.May 20 2018, 10:24 PM

I'm going to create a new role, 'designatemanager' and attach a patch here granting some DNS privs to that role. Then I think we should create a new user and give it 'observer' and 'designatemanager' on deployment-prep.

My only reservation here is that I'm unsure how to limit other inappropriate uses of the user account, e.g. in gerrit. I'm also not sure that I can easily add a user to keystone without having be a full-fledged developer account. I can ban or delete it from making wikitech edits but it still seems a bit complicated to have a user with public creds out in the world. Thoughts?

Change 438057 had a related patch set uploaded (by Andrew Bogott; owner: Andrew Bogott):
[operations/puppet@production] designate: support a new 'designatemanager' role

https://gerrit.wikimedia.org/r/438057

gerritbot added a project: Patch-For-Review.Jun 7 2018, 5:42 PM

In T194998#4265079, @Andrew wrote:

I'm going to create a new role, 'designatemanager' and attach a patch here granting some DNS privs to that role. Then I think we should create a new user and give it 'observer' and 'designatemanager' on deployment-prep.

My only reservation here is that I'm unsure how to limit other inappropriate uses of the user account, e.g. in gerrit. I'm also not sure that I can easily add a user to keystone without having be a full-fledged developer account. I can ban or delete it from making wikitech edits but it still seems a bit complicated to have a user with public creds out in the world. Thoughts?

I already made one called deployment-prep-dns-manager as a normal account, but I see your point about other services. These aren't exactly public credentials (though they're not under NDA requirements either), this isn't a full-blown novaobserver thing, but maybe we can use the same trick that was used there anyway.

I've issued deployment-prep-dns-manager the designateadmin role on deployment-prep.

I've changed deployment-prep-dns-manager's shell to /bin/false (and done the same for novaobserver while I'm at it.)

Let me know if this gets you what you need! Meanwhile, I'll see about closing wikitech and gerrit options for that user.

Change 438057 merged by Andrew Bogott:
[operations/puppet@production] designate: support a new 'designatemanager' role

https://gerrit.wikimedia.org/r/438057

andrew@labcontrol1001:~$ openstack role list
+----------------------------------+----------------+
| ID                               | Name           |
+----------------------------------+----------------+
| 1102f4ff63c3435793d0e4340bf4b04e | glanceadmin    |
| 2cd63d467f754404bf3746fe63ee0698 | admin          |
| 47a8370618ea42d49f7047774e75d262 | observer       |
| 4d8cad783d6342efa8414d7d36fbc034 | projectadmin   |
| 906f1588626d4d0993629ea3928b6fb4 | designateadmin |
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_       |
| f473273fac7146b3bdbf22e5d4504f95 | user           |
+----------------------------------+----------------+
andrew@labcontrol1001:~$ openstack role assignment list | grep deployment-prep-dns-manager
| 47a8370618ea42d49f7047774e75d262 | deployment-prep-dns-manager              |       | deployment-prep                  |        | False     |
| 906f1588626d4d0993629ea3928b6fb4 | deployment-prep-dns-manager              |       | deployment-prep                  |        | False     |

Krenair closed this task as Resolved.Jun 8 2018, 10:09 PM

Krenair assigned this task to Andrew.

Peachey88 updated the task description. (Show Details)Jun 8 2018, 11:34 PM

• Vvjjkkii renamed this task from Create custom deployment-prep role that allows editing of Designate records only to pqcaaaaaaa.Jul 1 2018, 1:09 AM

• Vvjjkkii reopened this task as Open.

• Vvjjkkii removed Andrew as the assignee of this task.

• Vvjjkkii raised the priority of this task from Medium to High.

• Vvjjkkii added projects: CheckUser, Connected-Open-Heritage-Batch-uploads (RAÄ-KMB_1_2017-02), Tamil-Sites, Gamepress, Hashtags, Jade, KartoEditor, Language-2018-Apr-June, New-Editor-Experiences, Mail, TCB-Team (now WMDE-TechWish).

• Vvjjkkii updated the task description. (Show Details)

• Vvjjkkii removed subscribers: gerritbot, Aklapper.

CommunityTechBot renamed this task from pqcaaaaaaa to Create custom deployment-prep role that allows editing of Designate records only.Jul 2 2018, 4:55 AM

CommunityTechBot closed this task as Resolved.

CommunityTechBot assigned this task to Andrew.

CommunityTechBot lowered the priority of this task from High to Medium.

CommunityTechBot updated the task description. (Show Details)