For Wikimedia Wikis, on the centralauth table lives the oathauth_users table which stores very sensitive data. I am proposing to add a note such as I did for fa9e5ecb11d6 to note it is deliberately excluded. For sure we don't want anyone to know who has or has not 2FA enabled, let alone the scratch codes...
Note: as you can see at https://quarry.wmflabs.org/query/34258 the table is not being displayed. I don't know if it is however being replicated but not displayed. We should check that too.
Change 496063 had a related patch set uploaded (by MarcoAurelio; owner: MarcoAurelio):
[operations/puppet@production] maintain-views: Note explicit exclusion of oathauth_users from replicas
As spoken via IRC, the table is filtered on replication, so it is not even replicated to the wikireplicas (https://gerrit.wikimedia.org/r/plugins/gitiles/operations/puppet/+/production/manifests/realm.pp#203)
Change 496063 had a related patch set uploaded (by MarcoAurelio; owner: MarcoAurelio):
[operations/puppet@production] maintain-views: Note explicit exclusion of oathauth_users from replicas
Change 496063 merged by Bstorm:
[operations/puppet@production] maintain-views: Note explicit exclusion of oathauth_users from replicas