Page MenuHomePhabricator

Meta Swift container rights incorrect for thumbor user
Closed, ResolvedPublic

Description

Can't write to wikipedia-meta-local-thumb

Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]: 2019-02-22 10:39:59,713 8822 swiftclient:ERROR Object PUT failed: https://ms-fe.svc.eqiad.wmnet/v1/AUTH_mw/wikipedia-meta-local-thumb/7/7e/Vector_search_icon.svg/12px-Vector_search_icon.svg.png.webp 403 Forbidden  [first 60 chars of response] <html><h1>Forbidden</h1><p>Access was denied to this resourc
Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]: Traceback (most recent call last):
Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]:   File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 1647, in _retry
Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]:     service_token=self.service_token, **kwargs)
Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]:   File "/usr/lib/python2.7/dist-packages/swiftclient/client.py", line 1298, in put_object
Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]:     raise ClientException.from_response(resp, 'Object PUT failed', body)
Feb 22 10:39:59 thumbor1004 thumbor@8822[1101]: ClientException: Object PUT failed: https://ms-fe.svc.eqiad.wmnet/v1/AUTH_mw/wikipedia-meta-local-thumb/7/7e/Vector_search_icon.svg/12px-Vector_search_icon.svg.png.webp 403 Forbidden  [first 60 chars of response] <html><h1>Forbidden</h1><p>Access was denied to this resource

Event Timeline

This probably went unnotticed before because new thumbnails on meta must have been rare, until webp came around.

Indeed, thumbor didn't have write access in eqiad but it did in codfw for wikipedia-meta-local-thumb.

I've fixed the permissions now with swift post -w 'mw:media,mw:thumbor' -r 'mw:media,.r:*,mw:thumbor' wikipedia-meta-local-thumb although I wonder how that could have happened since setZoneAccess.php should have done the right thing for all containers, unless changed manually in eqiad only.

Will reopen if we run into this again, works for now.